Create ant.yml

[Premiermoney]

No description provided.

[qodo-code-review]

Review Summary by Qodo

Add Java CI workflow with Ant build automation

✨ Enhancement

Walkthroughs

Description

• Add GitHub Actions workflow for Java CI/CD pipeline
• Configure automated builds using Ant on master branch
• Set up JDK 11 with Temurin distribution for builds
• Trigger workflow on push and pull request events

Diagram

flowchart LR
  A["GitHub Events<br/>push/pull_request"] -- "trigger" --> B["Java CI Workflow"]
  B -- "checkout code" --> C["actions/checkout@v4"]
  B -- "setup JDK 11" --> D["actions/setup-java@v4"]
  D -- "build with Ant" --> E["ant -noinput -buildfile build.xml"]
  E -- "build result" --> F["CI Status"]

Loading

File Changes

1. .github/workflows/ant.yml ⚙️ Configuration changes +25/-0

GitHub Actions Java CI workflow with Ant

• Create new GitHub Actions workflow file for Java CI/CD
• Configure workflow to trigger on push and pull requests to master branch
• Set up JDK 11 with Temurin distribution
• Execute Ant build with build.xml configuration file

.github/workflows/ant.yml

---

[qodo-code-review]

Code Review by Qodo

🐞 Bugs (3) 📘 Rule violations (0)

1. Wrong build tool used 🐞 Bug ≡ Correctness

Description

The workflow runs ant -buildfile build.xml, but this repo is configured as an Android/Gradle
project and provides a Gradle wrapper, so the build job will fail when it cannot run the intended
build. Update the workflow to use ./gradlew with the appropriate Gradle task(s).

Code

.github/workflows/ant.yml[R24-25]

Evidence

The workflow explicitly runs Ant with build.xml, while the repository is configured with Gradle
Android plugins and includes the Gradle wrapper script, indicating Ant is not the correct build
entrypoint.

.github/workflows/ant.yml[17-25]
build.gradle[1-5]
app/build.gradle[1-29]
gradlew[1-23]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

### Issue description
The new GitHub Actions workflow uses Ant (`ant -buildfile build.xml`) even though the repository is configured for Gradle/Android builds. This will break CI because the workflow is calling the wrong build system.

### Issue Context
This repository contains Gradle build scripts and the Gradle wrapper, indicating Gradle is the supported build entrypoint.

### Fix
- Replace the Ant step with Gradle wrapper invocation, e.g. `./gradlew build` (or the project-appropriate task such as `assembleDebug` / `test`).
- Ensure the workflow uses `chmod +x ./gradlew` if needed.

### Fix Focus Areas
- .github/workflows/ant.yml[17-25]

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

2. Missing token permissions 🐞 Bug ⛨ Security

Description

The workflow does not declare a permissions: block, so GITHUB_TOKEN privileges default to the
repository setting and may grant unnecessary write access to this CI job. This increases impact if
the workflow is abused or compromised.

Code

.github/workflows/ant.yml[R4-16]

Evidence

The workflow file defines triggers and a build job but contains no permissions: key anywhere,
meaning permissions are not explicitly constrained.

.github/workflows/ant.yml[4-25]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

### Issue description
The workflow lacks an explicit `permissions:` declaration, so the job token permissions will be inherited from repo defaults and may be broader than required.

### Issue Context
This workflow only checks out code and runs a build; it typically needs read-only access to repository contents.

### Fix
Add a minimal permissions block at the workflow or job level, for example:
```yml
permissions:
 contents: read
```

### Fix Focus Areas
- .github/workflows/ant.yml[4-18]

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

3. Unpinned GitHub actions 🐞 Bug ⛨ Security

Description

The workflow uses mutable tags (actions/checkout@v4, actions/setup-java@v4) instead of pinning
to immutable commit SHAs, which weakens supply-chain integrity. Pinning actions to SHAs makes builds
reproducible and reduces risk from tag retargeting.

Code

.github/workflows/ant.yml[R18-23]

Evidence

The workflow uses tag-based references for actions rather than commit SHAs.

.github/workflows/ant.yml[18-23]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

### Issue description
The workflow references GitHub Actions by version tags, which are mutable. This creates unnecessary supply-chain risk.

### Issue Context
Pinning to a full commit SHA ensures the workflow always runs the exact action revision that was reviewed.

### Fix
Update action usages to commit SHAs, e.g.:
```yml
- uses: actions/checkout@<full_sha>
- uses: actions/setup-java@<full_sha>
```
(Use the commit SHA for the desired release from each action's repository.)

### Fix Focus Areas
- .github/workflows/ant.yml[18-23]

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

[qodo-code-review]

1. Wrong build tool used 🐞 Bug ≡ Correctness

The workflow runs ant -buildfile build.xml, but this repo is configured as an Android/Gradle
project and provides a Gradle wrapper, so the build job will fail when it cannot run the intended
build. Update the workflow to use ./gradlew with the appropriate Gradle task(s).

Agent Prompt

### Issue description
The new GitHub Actions workflow uses Ant (`ant -buildfile build.xml`) even though the repository is configured for Gradle/Android builds. This will break CI because the workflow is calling the wrong build system.

### Issue Context
This repository contains Gradle build scripts and the Gradle wrapper, indicating Gradle is the supported build entrypoint.

### Fix
- Replace the Ant step with Gradle wrapper invocation, e.g. `./gradlew build` (or the project-appropriate task such as `assembleDebug` / `test`).
- Ensure the workflow uses `chmod +x ./gradlew` if needed.

### Fix Focus Areas
- .github/workflows/ant.yml[17-25]

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools