Skip to content

does modules-untouched download and upload automatcially#25

Merged
jwaisner merged 2 commits intomainfrom
auto-build
Jan 25, 2026
Merged

does modules-untouched download and upload automatcially#25
jwaisner merged 2 commits intomainfrom
auto-build

Conversation

@N6REJ
Copy link
Copy Markdown
Contributor

@N6REJ N6REJ commented Dec 16, 2025 •
edited by qodo-code-review bot
Loading

User description

This allows the user to only have to type "gradle release" and it will fetch the update, add it to modules-untouched and then does the build.

PR Type

Enhancement, Documentation

Description

  • Adds automated upstream workflow for version detection and release creation

  • Automatically downloads from nono303/memcached and creates GitHub releases

  • Implements smart polling to wait for modules-untouched updates

  • Documents prerequisites (GitHub CLI, GH_PAT, 7-Zip) and workflow examples

Diagram Walkthrough

flowchart LR
  A["gradle release<br/>-PbundleVersion=X.X.X"] --> B{"Version exists in<br/>modules-untouched?"}
  B -->|Yes| C["Normal build process"]
  B -->|No| D["Download from<br/>nono303/memcached"]
  D --> E["Extract version<br/>from memcached.exe"]
  E --> F["Create 7z archive"]
  F --> G["Create GitHub release<br/>with gh CLI"]
  G --> H["Poll modules-untouched<br/>every 10s max 5min"]
  H --> C
  C --> I["Package final release"]
Loading

File Walkthrough
Relevant files
Documentation
README.md
Document automated upstream workflow and version detection

.gradle-docs/README.md

  • Added "Automated Workflow" to feature list highlighting automatic
    upstream release creation
  • Added comprehensive "Automated Upstream Workflow" section with smart
    version detection logic
  • Documented 7-step workflow: version check, download, extract, archive,
    create release, wait for update, normal build
  • Added prerequisites table (GitHub CLI, GH_PAT, 7-Zip) with setup
    instructions
  • Included detailed example workflow output showing the complete
    automated process
  • Updated version management steps to include upstream release creation
    as first step
 +108/-6 
README.md
Add automated workflow features to README                               

README.md

  • Added two new key features highlighting automated upstream workflow
    capabilities
  • Emphasized smart version detection and automatic release creation for
    missing versions
  • Positioned new features prominently before existing features
 +2/-0     

@N6REJ
does modules-untouched download and upload automatcially so nothing i…
ae74811 
…s needed to be done except run gradle release
@N6REJ N6REJ added the enhancement ✨ Improve program label Dec 16, 2025
@qodo-code-review qodo-code-review bot changed the title does modules-untouched download and upload automatcially does modules-untouched download and upload automatcially Dec 16, 2025
@qodo-code-review
Copy link
Copy Markdown
Contributor

qodo-code-review bot commented Dec 16, 2025 •
edited
Loading

PR Compliance Guide 🔍

Below is a summary of compliance checks for this PR:

Security Compliance
🟢
No security concerns identified No security vulnerabilities detected by AI analysis. Human verification advised for critical code.
Ticket Compliance
⚪
🎫 No ticket provided
  • Create ticket/issue
Codebase Duplication Compliance
⚪
Codebase context is not defined

Follow the guide to enable codebase context checks.

Custom Compliance
🟢
Generic: Meaningful Naming and Self-Documenting Code

Objective: Ensure all identifiers clearly express their purpose and intent, making code
self-documenting

Status: Passed

Learn more about managing compliance generic rules or creating your own custom rules

⚪
Generic: Comprehensive Audit Trails

Objective: To create a detailed and reliable record of critical system actions for security analysis
and compliance.

Status:
No code visibility: This PR diff contains documentation-only changes, so whether critical actions are logged
with user/timestamp/outcome cannot be validated from the provided diff.

Referred Code 
### Automated Upstream Workflow

The build system includes an **intelligent automated workflow** that handles upstream releases:

#### Smart Version Detection

When you run `gradle release -PbundleVersion=1.6.39`, the build automatically:

1. **Checks modules-untouched** - Does version 1.6.39 exist?
   - ✅ **YES** → Skip to step 6 (normal build process)
   - ❌ **NO** → Continue to step 2 (create upstream release)

2. **Downloads from nono303** - Clones nono303/memcached repository and extracts `libevent-2.1/x64` folder

3. **Extracts version** - Uses PowerShell to get version from `memcached.exe` file properties

4. **Creates 7z archive** - Creates `memcached-{version}-win64.7z` with all binaries

5. **Creates GitHub release**:
   - Tag: `memcached-{bundle.release}` (e.g., `memcached-2025.8.20`)
   - Title: `Memcache {VERSION}` (e.g., `Memcache 1.6.39`)


 ... (clipped 12 lines)

Learn more about managing compliance generic rules or creating your own custom rules

Generic: Robust Error Handling and Edge Case Management

Objective: Ensure comprehensive error handling that provides meaningful context and graceful
degradation

Status:
No code visibility: The diff documents new automation (download/release creation/polling) but does not include
implementation code to verify failures, retries, timeouts, and actionable error messages
are handled robustly.

Referred Code 
### Automated Upstream Workflow

The build system includes an **intelligent automated workflow** that handles upstream releases:

#### Smart Version Detection

When you run `gradle release -PbundleVersion=1.6.39`, the build automatically:

1. **Checks modules-untouched** - Does version 1.6.39 exist?
   - ✅ **YES** → Skip to step 6 (normal build process)
   - ❌ **NO** → Continue to step 2 (create upstream release)

2. **Downloads from nono303** - Clones nono303/memcached repository and extracts `libevent-2.1/x64` folder

3. **Extracts version** - Uses PowerShell to get version from `memcached.exe` file properties

4. **Creates 7z archive** - Creates `memcached-{version}-win64.7z` with all binaries

5. **Creates GitHub release**:
   - Tag: `memcached-{bundle.release}` (e.g., `memcached-2025.8.20`)
   - Title: `Memcache {VERSION}` (e.g., `Memcache 1.6.39`)


 ... (clipped 78 lines)

Learn more about managing compliance generic rules or creating your own custom rules

Generic: Secure Error Handling

Objective: To prevent the leakage of sensitive system information through error messages while
providing sufficient detail for internal debugging.

Status:
User-facing errors: The PR describes automated GitHub/PowerShell/archiving steps but provides no code diff to
confirm that user-facing failures avoid leaking internal details while retaining secure
internal diagnostics.

Referred Code 
### Automated Upstream Workflow

The build system includes an **intelligent automated workflow** that handles upstream releases:

#### Smart Version Detection

When you run `gradle release -PbundleVersion=1.6.39`, the build automatically:

1. **Checks modules-untouched** - Does version 1.6.39 exist?
   - ✅ **YES** → Skip to step 6 (normal build process)
   - ❌ **NO** → Continue to step 2 (create upstream release)

2. **Downloads from nono303** - Clones nono303/memcached repository and extracts `libevent-2.1/x64` folder

3. **Extracts version** - Uses PowerShell to get version from `memcached.exe` file properties

4. **Creates 7z archive** - Creates `memcached-{version}-win64.7z` with all binaries

5. **Creates GitHub release**:
   - Tag: `memcached-{bundle.release}` (e.g., `memcached-2025.8.20`)
   - Title: `Memcache {VERSION}` (e.g., `Memcache 1.6.39`)


 ... (clipped 78 lines)

Learn more about managing compliance generic rules or creating your own custom rules

Generic: Secure Logging Practices

Objective: To ensure logs are useful for debugging and auditing without exposing sensitive
information like PII, PHI, or cardholder data.

Status:
Token handling docs: The documentation introduces use of GH_PAT for gh authentication but the diff does not
include the underlying logging implementation to verify tokens/secrets are never logged or
emitted in build output.

Referred Code 
#### Prerequisites for Upstream Workflow

| Requirement       | Purpose                                          |
|-------------------|--------------------------------------------------|
| **GitHub CLI**    | Creating releases (`gh release create`)          |
| **GH_PAT**        | GitHub Personal Access Token (environment var)   |
| **7-Zip**         | Creating 7z archives                             |

Set up GitHub authentication:
```bash
# Set environment variable
$env:GH_PAT = 'your_github_personal_access_token'

# Or authenticate with gh CLI
gh auth login

</details>

> Learn more about managing compliance <a href='https://qodo-merge-docs.qodo.ai/tools/compliance/#configuration-options'>generic rules</a> or creating your own <a href='https://qodo-merge-docs.qodo.ai/tools/compliance/#custom-compliance'>custom rules</a>
</details></td></tr>
<tr><td><details>
<summary><strong>Generic: Security-First Input Validation and Data Handling</strong></summary><br>

**Objective:** Ensure all data inputs are validated, sanitized, and handled securely to prevent <br>vulnerabilities<br>

**Status:** <br><a href='https://github.com/Bearsampp/module-memcached/pull/25/files#diff-964df91d9863f52c526c4793242b7b3fa5087dd9a6eb692d6c947080c719f921R295-R326'><strong>External inputs</strong></a>: The PR documents downloading from an external repository and creating GitHub releases, but <br>no implementation code is shown to validate/sanitize inputs (e.g., versions, paths, <br>subprocess args) or to enforce secure handling of credentials.<br>
<details open><summary>Referred Code</summary>

```markdown
### Automated Upstream Workflow

The build system includes an **intelligent automated workflow** that handles upstream releases:

#### Smart Version Detection

When you run `gradle release -PbundleVersion=1.6.39`, the build automatically:

1. **Checks modules-untouched** - Does version 1.6.39 exist?
   - ✅ **YES** → Skip to step 6 (normal build process)
   - ❌ **NO** → Continue to step 2 (create upstream release)

2. **Downloads from nono303** - Clones nono303/memcached repository and extracts `libevent-2.1/x64` folder

3. **Extracts version** - Uses PowerShell to get version from `memcached.exe` file properties

4. **Creates 7z archive** - Creates `memcached-{version}-win64.7z` with all binaries

5. **Creates GitHub release**:
   - Tag: `memcached-{bundle.release}` (e.g., `memcached-2025.8.20`)
   - Title: `Memcache {VERSION}` (e.g., `Memcache 1.6.39`)


 ... (clipped 11 lines)

Learn more about managing compliance generic rules or creating your own custom rules

  • Update
Compliance status legend 🟢 - Fully Compliant
🟡 - Partial Compliant
🔴 - Not Compliant
⚪ - Requires Further Human Verification
🏷️ - Compliance label

@qodo-code-review
Copy link
Copy Markdown
Contributor

qodo-code-review bot commented Dec 16, 2025

PR Code Suggestions ✨

Explore these optional code suggestions:

CategorySuggestion                                                                                                                                    Impact
High-level
Decouple build and dependency release processes

The suggestion recommends decoupling this module's build process from the
release process of its upstream dependency, modules-untouched. Instead of the
build creating and publishing missing dependencies, it should fail, and a
separate, dedicated workflow should be used for dependency releases.

Examples:

.gradle-docs/README.md [295-327] 
### Automated Upstream Workflow

The build system includes an **intelligent automated workflow** that handles upstream releases:

#### Smart Version Detection

When you run `gradle release -PbundleVersion=1.6.39`, the build automatically:

1. **Checks modules-untouched** - Does version 1.6.39 exist?
   - ✅ **YES** → Skip to step 6 (normal build process)

 ... (clipped 23 lines)

Solution Walkthrough:

Before:

// In gradle 'release' task
function build_with_auto_release(version) {
  if (!dependency_exists_in_repo("modules-untouched", version)) {
    print("Dependency missing, creating upstream release...");
    clone_dependency_source();
    package_dependency_binaries();
    create_github_release_for_dependency("modules-untouched");
    poll_repo_until_dependency_appears("modules-untouched");
  }
  
  print("Continuing with normal build...");
  download_dependency("modules-untouched", version);
  // ... rest of the build process
}

After:

// In a separate, dedicated workflow for the dependency
function release_new_dependency_version() {
  clone_dependency_source();
  package_dependency_binaries();
  create_github_release_for_dependency("modules-untouched");
}

// In this project's gradle 'release' task
function build_release(version) {
  if (!dependency_exists_in_repo("modules-untouched", version)) {
    fail_build("Dependency " + version + " not found. Please release it first.");
  }
  
  print("Starting build...");
  download_dependency("modules-untouched", version);
  // ... rest of the build process
}
Suggestion importance[1-10]: 9

__

Why: This suggestion correctly identifies a critical design flaw, where the build process is tightly coupled with the release of an upstream dependency, making the build system fragile, complex, and stateful.

High
Security
Recommend more secure authentication method

Update the authentication instructions to recommend gh auth login as the
primary, more secure method, and present the use of the GH_PAT environment
variable as a less-secure alternative for CI/CD environments.

.gradle-docs/README.md [336-343]

 Set up GitHub authentication:
 ```bash
-# Set environment variable
+# Recommended: Authenticate with the GitHub CLI.
+# This is more secure as it stores the token in your system's keychain.
+gh auth login
+
+# Alternative: Use an environment variable (less secure).
+# Useful for non-interactive environments like CI/CD.
+# WARNING: Exposing tokens in environment variables can be a security risk.
 $env:GH_PAT = 'your_github_personal_access_token'
-
-# Or authenticate with gh CLI
-gh auth login


- [ ] **Apply / Chat** <!-- /improve --apply_suggestion=1 -->


<details><summary>Suggestion importance[1-10]: 8</summary>

__

Why: This suggestion provides important security advice by recommending the more secure `gh auth login` method over storing a PAT in an environment variable, correctly explaining the risks and appropriate use cases for each.


</details></details></td><td align=center>Medium

</td></tr><tr><td rowspan=2>General</td>
<td>



<details><summary>Clarify Windows-only workflow limitation</summary>

___

**Add a note to the "Automated Upstream Workflow" section to clarify that the <br>automated release creation process is currently only supported on Windows.**

[.gradle-docs/README.md [295-297]](https://github.com/Bearsampp/module-memcached/pull/25/files#diff-964df91d9863f52c526c4793242b7b3fa5087dd9a6eb692d6c947080c719f921R295-R297)

```diff
 ### Automated Upstream Workflow
+
+> **Note:** This automated upstream release creation process is currently only supported on **Windows**.
 
 The build system includes an **intelligent automated workflow** that handles upstream releases:
  • Apply / Chat
Suggestion importance[1-10]: 7

__

Why: The suggestion correctly identifies that the new workflow is Windows-specific due to using PowerShell on a .exe file, which contradicts the general claim of cross-platform support. Adding this clarification is crucial for accuracy and preventing user confusion.

Medium
Document build failure on timeout

Update the documentation for the polling step to clarify that the build will
fail if the 5-minute timeout is reached and provide context for why this might
happen.

.gradle-docs/README.md [320]

-6. **Waits for update** - Polls modules-untouched every 10 seconds (max 5 minutes) until version appears
+6. **Waits for update** - Polls modules-untouched every 10 seconds (up to a 5-minute maximum) until the new version appears. If the version does not appear within 5 minutes, the build will fail. This may indicate a delay in the upstream automation that publishes to `modules-untouched`.
  • Apply / Chat
Suggestion importance[1-10]: 6

__

Why: The suggestion correctly points out missing information about the timeout behavior, which is important for troubleshooting. Clarifying that the build fails improves the documentation's completeness and usability.

Low
  • More

@qodo-code-review
Copy link
Copy Markdown
Contributor

qodo-code-review bot commented Dec 17, 2025

PR Reviewer Guide 🔍

Here are some key observations to aid the review process:

⏱️ Estimated effort to review: 2 🔵🔵⚪⚪⚪
🧪 No relevant tests
🔒 Security concerns

Sensitive information exposure:
The documentation includes an example that assigns GH_PAT to a literal token string ($env:GH_PAT = 'your_github_personal_access_token'). While it appears to be a placeholder, it may encourage users to paste real tokens into terminal history or scripts. Consider explicitly labeling it as a placeholder, recommending gh auth login as the default, and advising least-privilege token scopes and avoiding storing tokens in files or logs.

⚡ Recommended focus areas for review

Token Handling

The docs instruct setting GH_PAT and show an example value assignment; double-check the wording clearly states this is a placeholder, recommends least-privilege scopes, and discourages persisting the token in shells/history or any repo-tracked files.

 
#### Prerequisites for Upstream Workflow

| Requirement       | Purpose                                          |
|-------------------|--------------------------------------------------|
| **GitHub CLI**    | Creating releases (`gh release create`)          |
| **GH_PAT**        | GitHub Personal Access Token (environment var)   |
| **7-Zip**         | Creating 7z archives                             |

Set up GitHub authentication:
```bash
# Set environment variable
$env:GH_PAT = 'your_github_personal_access_token'

# Or authenticate with gh CLI
gh auth login

</details>

<details><summary><a href='https://github.com/Bearsampp/module-memcached/pull/25/files#diff-964df91d9863f52c526c4793242b7b3fa5087dd9a6eb692d6c947080c719f921R313-R316'><strong>Terminology</strong></a>

The release title uses “Memcache” while the project and binaries are “Memcached”; consider aligning naming to avoid confusion in release titles and documentation.
</summary>

```markdown
5. **Creates GitHub release**:
   - Tag: `memcached-{bundle.release}` (e.g., `memcached-2025.8.20`)
   - Title: `Memcache {VERSION}` (e.g., `Memcache 1.6.39`)
   - Description: `Memcached {VERSION} automated build`
Workflow Clarity

The automated workflow description includes specific repo/branch/subfolder details and polling behavior; verify these are accurate and stable, and consider noting failure modes (e.g., if modules-untouched isn’t updated within 5 minutes) and what the user should do next.

 
2. **Downloads from nono303** - Clones nono303/memcached repository and extracts `libevent-2.1/x64` folder

3. **Extracts version** - Uses PowerShell to get version from `memcached.exe` file properties

4. **Creates 7z archive** - Creates `memcached-{version}-win64.7z` with all binaries

5. **Creates GitHub release**:
   - Tag: `memcached-{bundle.release}` (e.g., `memcached-2025.8.20`)
   - Title: `Memcache {VERSION}` (e.g., `Memcache 1.6.39`)
   - Description: `Memcached {VERSION} automated build`
   - Asset: The 7z file
   - Uses GitHub CLI (`gh`) with `GH_PAT` environment variable

6. **Waits for update** - Polls modules-untouched every 10 seconds (max 5 minutes) until version appears

7. **Normal build process**:
   - Downloads binaries from modules-untouched
   - Overlays configuration from `bin/memcached{version}/`
   - Packages final release

@qodo-code-review
Copy link
Copy Markdown
Contributor

qodo-code-review bot commented Dec 17, 2025

PR Code Suggestions ✨

No code suggestions found for the PR.

@jwaisner jwaisner merged commit fc97409 into main Jan 25, 2026
2 checks passed
@jwaisner jwaisner deleted the auto-build branch January 25, 2026 21:23
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

enhancement ✨ Improve program

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@N6REJ @jwaisner