feat: add config-sdk-version.json and SDK version guard [LIN-2149] - #38
feat: add config-sdk-version.json and SDK version guard [LIN-2149]#38ChetanBhosale wants to merge 5 commits into
Conversation
Record the full published version history (version, pushed_date, description) in config-sdk-version.json at the repo root, newest first, and enforce that the version declared in the package manifest is always its top entry. A PR that does not touch the SDK version is unaffected; one that bumps the version fails until a matching entry is added. Enforced by scripts/check-sdk-version.py, run in CI via the SDK version check workflow and locally via a pre-commit hook. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_011RipJmrW6btPTyoXRXhfLU
|
Warning Review limit reached
Next review available in: 7 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (3)
📝 WalkthroughWalkthroughAdds Flutter SDK version 4.0.3 metadata, a Python validator for manifest and mirror consistency, and a GitHub Actions workflow that runs validation on ChangesSDK Version Validation
Estimated code review effort: 3 (Moderate) | ~25 minutes Sequence Diagram(s)sequenceDiagram
participant GitHubActions
participant check_sdk_version_py
participant config_sdk_version_json
GitHubActions->>check_sdk_version_py: execute validator
check_sdk_version_py->>config_sdk_version_json: read SDK version configuration
check_sdk_version_py->>check_sdk_version_py: compare manifest and mirror versions
check_sdk_version_py-->>GitHubActions: return validation status
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🧹 Nitpick comments (1)
.github/workflows/sdk-version-check.yml (1)
17-24: 🔒 Security & Privacy | 🔵 Trivial | ⚡ Quick winUse least-privilege checkout credentials.
This job needs only repository reads and no authenticated Git operations after checkout. Set
permissions: contents: readand disable credential persistence.actions/checkout@v4persists credentials by default, while GitHub supports explicitly restrictingGITHUB_TOKENpermissions. (github.com)Suggested hardening
+permissions: + contents: read + jobs: sdk-version: @@ - - uses: actions/checkout@v4 + - uses: actions/checkout@v4 + with: + persist-credentials: false🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/sdk-version-check.yml around lines 17 - 24, Harden the sdk-version job by granting only contents read permission and configure actions/checkout@v4 with credential persistence disabled. Add the job-level permissions setting and update the checkout step’s with configuration; leave the setup-python step unchanged.Source: Linters/SAST tools
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/sdk-version-check.yml:
- Around line 11-12: Update the pull_request trigger in the SDK version check
workflow by removing the branches filter so the validator runs for pull requests
targeting every branch.
In `@scripts/check-sdk-version.py`:
- Around line 94-129: Strengthen the configuration validation before the
existing version checks: ensure the root config, version_source, and any mirror
values are objects of the expected shape, and ensure every sdk_versions entry is
an object with non-empty version, pushed_date, and description. Reject invalid
entries through the script’s existing fail/reporting path before calls such as
src.get, e.get, read_version, or ordering logic; retain the existing
latest-entry warnings only if they remain applicable after requiring these
fields.
---
Nitpick comments:
In @.github/workflows/sdk-version-check.yml:
- Around line 17-24: Harden the sdk-version job by granting only contents read
permission and configure actions/checkout@v4 with credential persistence
disabled. Add the job-level permissions setting and update the checkout step’s
with configuration; leave the setup-python step unchanged.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: f6027a34-3b69-4105-8358-6aa741535d8c
📒 Files selected for processing (3)
.github/workflows/sdk-version-check.ymlconfig-sdk-version.jsonscripts/check-sdk-version.py
| pull_request: | ||
| branches: [main] |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟠 Major | ⚡ Quick win
Run the validator for PRs targeting every branch.
branches: [main] limits this trigger to PRs whose base is main; PRs into any other branch bypass the validator. Remove the filter to meet the stated “every pull request” requirement. (docs.github.com)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/sdk-version-check.yml around lines 11 - 12, Update the
pull_request trigger in the SDK version check workflow by removing the branches
filter so the validator runs for pull requests targeting every branch.
| entries = cfg.get("sdk_versions") | ||
| if not isinstance(entries, list) or not entries: | ||
| print(f"{RED}{CONFIG} has no non-empty 'sdk_versions' array.{OFF}") | ||
| return 1 | ||
|
|
||
| src = cfg.get("version_source") or {} | ||
| manifest, kind = src.get("file"), src.get("type") | ||
| if not manifest or not kind: | ||
| print(f"{RED}{CONFIG} is missing the 'version_source' block.{OFF}") | ||
| print('Expected e.g. "version_source": {"file": "package.json", ' | ||
| '"type": "package_json"}') | ||
| return 1 | ||
|
|
||
| code_version = read_version(manifest, kind) | ||
| if code_version is None and not errors: | ||
| fail(f"Could not find a version declaration in {manifest!r}.") | ||
|
|
||
| # --- structural checks on the config ------------------------------------- | ||
| versions = [e.get("version") for e in entries] | ||
| if any(not v for v in versions): | ||
| fail(f"Every entry in {CONFIG} needs a non-empty 'version'.") | ||
|
|
||
| dupes = sorted({v for v in versions if v and versions.count(v) > 1}) | ||
| if dupes: | ||
| fail(f"{CONFIG} lists duplicate versions: {', '.join(dupes)}") | ||
|
|
||
| ordered = sorted([v for v in versions if v], key=vkey, reverse=True) | ||
| if [v for v in versions if v] != ordered: | ||
| fail(f"{CONFIG} must be ordered newest-first. Expected to start with " | ||
| f"{ordered[0]!r} but found {versions[0]!r}.") | ||
|
|
||
| top = entries[0] | ||
| if not top.get("pushed_date"): | ||
| warn(f"Latest entry {top.get('version')!r} has no 'pushed_date'.") | ||
| if not top.get("description"): | ||
| warn(f"Latest entry {top.get('version')!r} has no 'description'.") |
There was a problem hiding this comment.
🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win
Validate every history entry before dereferencing it.
An incomplete historical entry can pass because only the latest entry is checked for pushed_date and description; non-object entries (or a non-object version_source) instead crash at Lines 100, 112, or 125. Validate the root object, version_source, mirrors, and every sdk_versions object with non-empty version, pushed_date, and description before continuing.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@scripts/check-sdk-version.py` around lines 94 - 129, Strengthen the
configuration validation before the existing version checks: ensure the root
config, version_source, and any mirror values are objects of the expected shape,
and ensure every sdk_versions entry is an object with non-empty version,
pushed_date, and description. Reject invalid entries through the script’s
existing fail/reporting path before calls such as src.get, e.get, read_version,
or ordering logic; retain the existing latest-entry warnings only if they remain
applicable after requiring these fields.
…to chetan/lin-2149-sdk-version-guard
Merges the latest main and adds the new release as the top entry of sdk_versions, keeping the manifest version and the recorded history in step so the SDK version check passes. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_011RipJmrW6btPTyoXRXhfLU
Replaces the shared Python checker with tool/check_sdk_version.dart, run with the Dart SDK the plugin already depends on: dart run tool/check_sdk_version.dart Uses dart:io and dart:convert only, so it needs no pub dependencies. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_011RipJmrW6btPTyoXRXhfLU
548e2cc to
abca815
Compare
Adds a Build workflow that compiles the SDK with its own toolchain, kept separate from the SDK version check so a version mistake and a build break are reported independently. Every command was run locally before being wired up. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_011RipJmrW6btPTyoXRXhfLU
|
Closing for now — parking this work. The branch |
1 participant
What
Adds
config-sdk-version.jsonat the repo root — the full published version history as{version, pushed_date, description}, newest first — and a check that stops the SDK version being bumped without a matching entry.The rule
The version in
pubspec.yamlmust equalsdk_versions[0].version.config-sdk-version.json.How
scripts/check-sdk-version.py— stdlib-only, no dependencies. Also rejects duplicate versions, out-of-order arrays and malformed JSON..github/workflows/sdk-version-check.yml— runs it on every PR.The checker is driven by the
version_sourceblock insideconfig-sdk-version.json, so the same script is used across all nine SDK repos.Data provenance
versionanddescriptioncome from Postgrespublic."SDKVersion".pushed_datedoes not — all 206 rows there were bulk-inserted on 2026-07-24 11:47:43, socreated_atcarries no release-date signal. Dates come from the package registry publish date instead, falling back to CHANGELOG, git tag, then the commit that bumped the manifest. All entries are dated and verified monotonic against version order.Note
Adding "SDK version check" as a required status check in branch protection is what actually blocks a merge — CI alone only reports.
Linear: LIN-2149
🤖 Generated with Claude Code
https://claude.ai/code/session_011RipJmrW6btPTyoXRXhfLU
Summary by CodeRabbit
New Features
Chores
main, and manual triggers.