[MOSIP-42820] prechecks enabled and severbaseurl to be dynamic

[Ivanmeneges]

Summary by CodeRabbit

• New Features

  • Added automated security analysis (CodeQL) to pull request workflows
  • Android builds now support custom server URL configuration via workflow input

• Chores

  • Enhanced CI/CD workflow organization with improved build job structure
  • Reorganized and streamlined automated testing pipeline

_{✏️ Tip: You can customize this high-level summary in your review settings.}

[coderabbitai]

Warning

Rate limit exceeded

@Ivanmeneges has exceeded the limit for the number of commits or files that can be reviewed per hour. Please wait 17 minutes and 31 seconds before requesting another review.

⌛ How to resolve this issue?

After the wait time has elapsed, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout.

Please see our FAQ for further information.

📥 Commits

Reviewing files that changed from the base of the PR and between 3835ead and f1a067a.

📒 Files selected for processing (2)

• .github/workflows/build-android.yml (2 hunks)
• .github/workflows/push_trigger.yml (2 hunks)

Walkthrough

Two GitHub Actions workflows are enhanced to improve build automation and security scanning. The Android build workflow adds dynamic server URL configuration capability with conditional replacement. The push trigger workflow introduces pull request triggers, CodeQL security analysis, and a dedicated Android build check job, while reorganizing existing SonarCloud analysis logic.

Changes

Cohort / File(s)	Summary
Android Build Workflow .github/workflows/build-android.yml	Adds serverBaseURL input parameter to workflow_dispatch trigger; introduces checkout step and conditional step to replace hardcoded API endpoint (api-internal.sandbox.xyz.net) with provided server URL in android/build.gradle* files when manually triggered
CI/CD Pipeline Expansion .github/workflows/push_trigger.yml	Adds pull_request trigger; introduces new CodeQL security analysis job with init, build, and analyze steps; adds Android Build Check job (build) with Java 17 setup and APK debug build, dependent on dco and codeql jobs; renames existing build to Sonarbuild, downgrades checkout from v3 to v2, changes JDK to version 11, and maintains SonarCloud analysis steps

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~25 minutes

• Job dependencies: Verify that the new job dependency chain in push_trigger.yml (dco → codeql → build) is correctly specified and won't cause workflow deadlocks or unexpected cancellations
• Conditional execution logic: Confirm the conditional step in build-android.yml correctly targets all relevant gradle files and handles edge cases
• Version downgrades: Validate that checkout@v2 and JDK 11 in the Sonarbuild job maintain compatibility with existing SonarCloud analysis
• CodeQL configuration: Ensure CodeQL initialization and build steps align with Java project requirements

Poem

🐰 A rabbit hops through workflows bright,
With security scans and builds so tight,
CodeQL guards while APKs compile,
Dynamic URLs? The Sonarbuild style!
CI/CD dreams come true tonight! ✨

Pre-merge checks and finishing touches

✅ Passed checks (3 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately references the ticket (MOSIP-42820) and summarizes the main changes: enabling prechecks and making serverbaseurl dynamic across workflow files.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 2

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)

.github/workflows/push_trigger.yml (1)

69-91: Inconsistent serverBaseURL input name across workflows.

Line 78 in the build-android job uses ${{ github.event.inputs.defaultServerBaseURL }}, but the build-android.yml workflow defines the input as serverBaseURL (not defaultServerBaseURL). This mismatch will result in an empty string and the URL replacement will not work correctly.

Align the input names. Either:

1. Rename the input in build-android.yml to defaultServerBaseURL, or
2. Update the reference here to serverBaseURL.

Apply the recommended fix:

       - name: Updating serverBaseURL.
         run: |
-          find . -type f -name "*build.gradle" -print0 | xargs -0 sed -i "s/api-internal.sandbox.xyz.net/${{ github.event.inputs.defaultServerBaseURL }}/g"
+          find . -type f -name "*build.gradle" -print0 | xargs -0 sed -i "s/api-internal.sandbox.xyz.net/${{ github.event.inputs.serverBaseURL }}/g"

🧹 Nitpick comments (1)

.github/workflows/push_trigger.yml (1)

93-124: Deprecated actions/setup-java@v1 in Sonarbuild job.

The Sonarbuild job (line 101) uses actions/setup-java@v1, which is deprecated and no longer maintained. This may cause compatibility issues or security concerns in the future.

Upgrade to actions/setup-java@v3 or @v4:

       - name: Set up JDK 11
-        uses: actions/setup-java@v1
+        uses: actions/setup-java@v3
         with:
           java-version: 11

Note: When upgrading, ensure the action still supports java-version parameter (v3+ may require a distribution parameter).

📜 Review details

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between 8f46caa and 3835ead.

📒 Files selected for processing (2)

• .github/workflows/build-android.yml (2 hunks)
• .github/workflows/push_trigger.yml (2 hunks)

🧰 Additional context used

🪛 actionlint (1.7.8)

.github/workflows/build-android.yml

5-5: unknown Webhook event "inputs". see https://docs.github.com/en/actions/reference/workflows-and-actions/events-that-trigger-workflows#webhook-events for list of all Webhook event names

(events)

---

6-6: unexpected key "serverBaseURL" for "inputs" section. expected one of "branches", "branches-ignore", "paths", "paths-ignore", "tags", "tags-ignore", "types", "workflows"

(syntax-check)

---

23-23: key "steps" is duplicated in "build" job. previously defined at line:20,col:5

(syntax-check)

.github/workflows/push_trigger.yml

44-44: could not parse as YAML: did not find expected key

(syntax-check)

🪛 YAMLlint (1.37.1)

.github/workflows/build-android.yml

[error] 23-23: duplication of key "steps" in mapping

(key-duplicates)

.github/workflows/push_trigger.yml

[error] 45-45: syntax error: expected , but found ''

(syntax)

🔇 Additional comments (3)

.github/workflows/build-android.yml (1)

27-31: Verify the URL replacement logic and consider edge cases.

The sed command replaces the hardcoded URL across all build.gradle* files. Ensure this correctly handles:

• Files that don't contain the placeholder URL (no harm, but adds noise)
• Special characters in the input URL (the # delimiter helps, but test with complex URLs)
• Files in subdirectories (the find command should catch these)

Test the sed command locally with sample URLs containing special characters (e.g., https://api.example.com:8443/path?query=value) to confirm it works as expected. If needed, consider escaping the URL input or using a more robust replacement approach.

.github/workflows/push_trigger.yml (2)

23-44: YAML syntax error in CodeQL job definition.

Static analysis tools report syntax errors around the CodeQL and build job boundary (lines 44–45). This is likely due to incorrect indentation or missing/duplicate keys.

Verify the YAML indentation around the CodeQL job closing (line 43–44) and build job opening (line 45) is correct. Ensure each job is properly closed before the next job begins. Run yamllint .github/workflows/push_trigger.yml locally to confirm the file is valid YAML.

---

52-56: Upgrade Java setup action in Android Build Check job.

The build job uses actions/setup-java@v3, which is good. However, ensure consistency with the Sonarbuild job, which should also be upgraded from the deprecated @v1.