fix: Remove hardcoded Gemini API key - #50
Conversation
Use String.fromEnvironment to read API key from dart-define flag instead of hardcoding. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
|
Note Other AI code review bot(s) detectedCodeRabbit has detected other AI code review bot(s) in this pull request and will avoid duplicating their findings in the review comments. This may lead to a less comprehensive review. 📝 WalkthroughWalkthroughAdds an OTOP static-checks workflow and supporting scripts/docs for repo auditing and OpenAPI enforcement; updates CI Flutter SDK pin; switches Gemini API key to environment-driven retrieval; adjusts platform plugin registrations and minor Android import. Changes
Sequence Diagram(s)sequenceDiagram
participant GH as GitHub Actions
participant Repo as Repository
participant Scripts as scripts/*.sh / .py
participant Linter as Spectral / swagger-cli
note over GH,Repo: otop-static-checks workflow triggers (push/PR)
GH->>Repo: checkout code
GH->>Scripts: run otop-uiid-audit.sh
Scripts-->>Repo: scans files -> writes otop.audit.uiids.md
GH->>Scripts: run otop-env-audit.sh
Scripts-->>Repo: ripgrep for hardcoded URLs -> writes otop.audit.env.md (exit 1 if critical)
GH->>Scripts: run otop-openapi-lint.sh
Scripts->>Repo: find OpenAPI spec
Scripts->>Linter: validate (swagger-cli) and lint (spectral with rules/spectral-otop.yml)
Linter-->>GH: pass/fail result
note over GH: workflow reports artifacts and may fail on hardcoded URLs or OpenAPI errors
Estimated code review effort🎯 4 (Complex) | ⏱️ ~45 minutes Poem
Pre-merge checks and finishing touches❌ Failed checks (1 warning)
✅ Passed checks (2 passed)
✨ Finishing touches
Comment |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| // API key from environment variable (dart-define) | ||
| static const String _apiKey = String.fromEnvironment('GEMINI_API_KEY', defaultValue: ''); |
There was a problem hiding this comment.
Because _apiKey now defaults to the empty string, _initModel() no longer catches a missing key (it only checks for 'YOUR_GEMINI_API_KEY'). In environments where --dart-define=GEMINI_API_KEY=... is not set (local dev, CI, or test runs), the service will still initialize the GenerativeModel with an empty key and then every request fails at runtime with API errors instead of the intended “API key not set” fallback. Consider treating an empty key as unset (e.g., check isEmpty) to keep the old safe behavior.
Useful? React with 👍 / 👎.
The project requires Dart SDK ^3.10.1, which is included in Flutter 3.38.5. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 0
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
.github/workflows/ci.yml (1)
35-35: Critical: Missing GEMINI_API_KEY dart-define flag in build commands.The API key is now sourced from
String.fromEnvironment('GEMINI_API_KEY'), but the build commands don't pass--dart-define=GEMINI_API_KEY=${{ secrets.GEMINI_API_KEY }}. This means every CI build will compile with an empty API key, causing all Gemini API requests to fail at runtime.🔎 Proposed fix
Add the secret to your repository and pass it during builds:
- name: Build APK - run: flutter build apk --release + run: flutter build apk --release --dart-define=GEMINI_API_KEY=${{ secrets.GEMINI_API_KEY }}Apply the same change to line 62 in the deploy job. You'll also need to add
GEMINI_API_KEYto your GitHub repository secrets.Also applies to: 62-62
♻️ Duplicate comments (1)
lib/services/gemini_service.dart (1)
7-8: Good security improvement, but address the guard issue.Moving from a hardcoded API key to
String.fromEnvironmentis the correct approach for secure key management. However, as noted in the previous review, the guard on line 19 only checks for the literal string'YOUR_GEMINI_API_KEY'and won't catch the empty-string default. Consider updating the guard to also check_apiKey.isEmptyso local dev and test environments fail gracefully with the intended warning message instead of cryptic API errors.🔎 Suggested guard enhancement
void _initModel() { - if (_apiKey == 'YOUR_GEMINI_API_KEY') { + if (_apiKey.isEmpty || _apiKey == 'YOUR_GEMINI_API_KEY') { debugPrint('⚠️ Gemini API Key nicht gesetzt! Hole einen kostenlosen Key von https://aistudio.google.com/apikey'); return; }
📜 Review details
Configuration used: defaults
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (2)
.github/workflows/ci.ymllib/services/gemini_service.dart
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (1)
- GitHub Check: build
🔇 Additional comments (1)
.github/workflows/ci.yml (1)
19-19: Flutter version 3.38.5 is a legitimate stable release (released December 12, 2025) and correctly bundled with Dart SDK 3.10.4, which satisfies the^3.10.1constraint. The version progression from early 2025 (3.24–3.27) to December 2025 (3.38.5) is expected given Flutter's typical release cadence.
Added import for R class to resolve 'Unresolved reference R' build error. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
R class is automatically available in the same package without import. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
namespace is com.alanko.ai, so R is in com.alanko.ai.R 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
There was a problem hiding this comment.
Actionable comments posted: 3
♻️ Duplicate comments (1)
scripts/otop-scan.sh (1)
88-92: Same heredoc pattern issue as lines 80-84.This has the same Shellcheck warning and readability concern as the health_hints_sample block above. Consider applying the same refactoring.
🧹 Nitpick comments (3)
scripts/otop-env-audit.sh (1)
12-12: Consider improving regex pattern readability.The URL detection pattern is quite complex and hard to maintain. Consider breaking it into separate patterns or adding comments explaining the regex components.
🔎 Suggested refactor for better maintainability
+# Pattern: http://localhost: OR https?://domain.tld +LOCALHOST_PATTERN="http://localhost:" +URL_PATTERN="https?://[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}" + echo "## Findings (first 200)" >> "$OUT" -rg -n "http://localhost:|https?://[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}" . -g'!**/node_modules/**' -g'!**/dist/**' -g'!**/build/**' -g'!**/.next/**' -g'!**/.venv/**' 2>/dev/null | head -n 200 >> "$OUT" || true +rg -n "$LOCALHOST_PATTERN|$URL_PATTERN" . \ + -g'!**/node_modules/**' \ + -g'!**/dist/**' \ + -g'!**/build/**' \ + -g'!**/.next/**' \ + -g'!**/.venv/**' \ + 2>/dev/null | head -n 200 >> "$OUT" || truescripts/otop-openapi-lint.sh (1)
16-17: Consider verifying the Spectral rules file exists before linting.If
rules/spectral-otop.ymlis missing, the error message from Spectral may be unclear.🔎 Proposed improvement
# Lint rules (operationId + tags required) +if [[ ! -f "rules/spectral-otop.yml" ]]; then + echo "Warning: rules/spectral-otop.yml not found. Skipping Spectral lint." + exit 0 +fi npx --yes @stoplight/spectral-cli lint -r rules/spectral-otop.yml "$SPEC".github/workflows/otop-static-checks.yml (1)
2-4: Consider scoping thepushtrigger to specific branches.Currently, this workflow runs on every push to any branch. For efficiency, you may want to limit it to
mainor feature branches.🔎 Example scope configuration
on: pull_request: - push: + push: + branches: + - main + - 'feature/**'
📜 Review details
Configuration used: defaults
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (22)
.github/workflows/otop-static-checks.ymlAGENTS.mdandroid/app/src/main/kotlin/com/alanko/ai/alanko_ai/AlankoWidgetProvider.ktdocs/otop-standard.mddocs/prompts/01_blueprint_from_openapi.txtdocs/prompts/02_v0_prompt.txtdocs/prompts/03_wiring_plan.txtdocs/prompts/04_checklist.txtdocs/retrofit-guide.mdlinux/flutter/generated_plugin_registrant.cclinux/flutter/generated_plugins.cmakemacos/Flutter/GeneratedPluginRegistrant.swiftotop.config.jsonrules/spectral-otop.ymlscripts/otop-add-operationid.pyscripts/otop-env-audit.shscripts/otop-install.shscripts/otop-openapi-lint.shscripts/otop-scan.shscripts/otop-uiid-audit.shwindows/flutter/generated_plugin_registrant.ccwindows/flutter/generated_plugins.cmake
✅ Files skipped from review due to trivial changes (1)
- docs/prompts/02_v0_prompt.txt
🚧 Files skipped from review as they are similar to previous changes (1)
- android/app/src/main/kotlin/com/alanko/ai/alanko_ai/AlankoWidgetProvider.kt
🧰 Additional context used
🪛 Biome (2.1.2)
otop.config.json
[error] 8-8: Expected an array, an object, or a literal but instead found '}'.
Expected an array, an object, or a literal here.
(parse)
[error] 11-11: Expected an array, an object, or a literal but instead found ','.
Expected an array, an object, or a literal here.
(parse)
🪛 LanguageTool
docs/prompts/03_wiring_plan.txt
[grammar] ~9-~9: Ensure spelling is correct
Context: ... - Jede Mutation invalidiert betroffene Lists (z.B. create invalidiert list). OUTPUT...
(QB_NEW_EN_ORTHOGRAPHY_ERROR_IDS_1)
AGENTS.md
[grammar] ~510-~510: Ergänze ein Satzzeichen
Context: ...er:** devshift-stack (dsactivi) ## OTOP Rules (MUST) - Add data-otop-id + `dat...
(QB_NEW_DE_OTHER_ERROR_IDS_MISSING_PUNCTUATION_OTOPDASHRULES)
[grammar] ~511-~511: Korrigiere die Fehler
Context: ...T) - Add data-otop-id + data-testid to every interactive UI component (Web). -...
(QB_NEW_DE_OTHER_ERROR_IDS_REPLACEMENT_MULTITOKEN)
[grammar] ~511-~511: Korrigiere die Fehler
Context: ...- Add data-otop-id + data-testid to every interactive UI component (Web). - React...
(QB_NEW_DE_OTHER_ERROR_IDS_REPLACEMENT_MULTITOKEN)
[grammar] ~511-~511: Korrigiere die Fehler
Context: ...data-otop-id + data-testid to every interactive UI component (Web). - React Native: add...
(QB_NEW_DE_OTHER_ERROR_IDS_REPLACEMENT_MULTITOKEN)
[grammar] ~511-~511: Korrigiere die Fehler
Context: ...d+data-testidto every interactive UI component (Web). - React Native: addtestID+...
(QB_NEW_DE_OTHER_ERROR_IDS_REPLACEMENT_MULTITOKEN)
[grammar] ~513-~513: Ergänze ein Satzzeichen
Context: ...abel="otop:"`. - Do not hardcode API URLs; use ENV/proxy. - Backend APIs must...
(QB_NEW_DE_OTHER_ERROR_IDS_MISSING_PUNCTUATION_APIDASHURLS)
[grammar] ~513-~513: Passe die Groß- und Kleinschreibung an
Context: ..."`. - Do not hardcode API URLs; use ENV/proxy. - Backend APIs must have OpenAPI with ...
(QB_NEW_DE_OTHER_ERROR_IDS_REPLACEMENT_ORTHOGRAPHY_LOWERCASE)
[grammar] ~514-~514: Passe das Symbol an
Context: ...dcode API URLs; use ENV/proxy. - Backend APIs must have OpenAPI with unique `oper...
(QB_NEW_DE_OTHER_ERROR_IDS_REPLACEMENT_OTHER)
[grammar] ~514-~514: Passe das Symbol an
Context: ...API URLs; use ENV/proxy. - Backend APIs must have OpenAPI with unique operationId + str...
(QB_NEW_DE_OTHER_ERROR_IDS_REPLACEMENT_OTHER)
[grammar] ~514-~514: Korrigiere die Fehler
Context: ...proxy. - Backend APIs must have OpenAPI with unique operationId + structured `tags...
(QB_NEW_DE_OTHER_ERROR_IDS_REPLACEMENT_MULTITOKEN)
[grammar] ~514-~514: Korrigiere die Fehler
Context: .... - Backend APIs must have OpenAPI with unique operationId + structured tags.
(QB_NEW_DE_OTHER_ERROR_IDS_REPLACEMENT_MULTITOKEN)
[grammar] ~514-~514: Korrigiere die Fehler
Context: ... have OpenAPI with unique operationId + structured tags.
(QB_NEW_DE_OTHER_ERROR_IDS_REPLACEMENT_MULTITOKEN)
[grammar] ~514-~514: Korrigiere die Fehler
Context: ...ave OpenAPI with unique operationId + structured tags.
(QB_NEW_DE_OTHER_ERROR_IDS_REPLACEMENT_MULTITOKEN)
[grammar] ~514-~514: Ergänze ein Wort
Context: ... with unique operationId + structured tags.
(QB_NEW_DE_OTHER_ERROR_IDS_MISSING_VERB)
docs/otop-standard.md
[grammar] ~1-~1: Ergänze ein Satzzeichen
Context: # OTOP Standard (Repo-weit) ## Ziel 1) **Backe...
(QB_NEW_DE_OTHER_ERROR_IDS_MISSING_PUNCTUATION_OTOPDASHSTANDARD)
[grammar] ~1-~1: Passe die Groß- und Kleinschreibung an
Context: # OTOP Standard (Repo-weit) ## Ziel 1) *Backend-Funktionen...
(QB_NEW_DE_OTHER_ERROR_IDS_REPLACEMENT_ORTHOGRAPHY_UPPERCASE)
[grammar] ~4-~4: Entferne ein Wort
Context: ...o-weit) ## Ziel 1) Backend-Funktionen sind eindeutig & stabil referenzierbar ...
(QB_NEW_DE_OTHER_ERROR_IDS_UNNECESSARY_NOUN)
[grammar] ~4-~4: Wähle ein passenderes Wort
Context: ...) Backend-Funktionen sind eindeutig & stabil referenzierbar (OpenAPI `operati...
(QB_NEW_DE_OTHER_ERROR_IDS_REPLACEMENT_CONJUNCTION)
[grammar] ~5-~5: Entferne ein Wort
Context: ...OpenAPI operationId). 2) UI-Elemente sind eindeutig & stabil referenzierbar ...
(QB_NEW_DE_OTHER_ERROR_IDS_UNNECESSARY_NOUN)
[grammar] ~5-~5: Wähle ein passenderes Wort
Context: ...Id). 2) **UI-Elemente** sind eindeutig & stabil referenzierbar (data-otop-id` /...
(QB_NEW_DE_OTHER_ERROR_IDS_REPLACEMENT_CONJUNCTION)
[grammar] ~6-~6: Korrigiere das Wort
Context: ...-id/data-testid`). 3) Verbindung Frontend↔Backend ist robust (keine hardc...
(QB_NEW_DE_OTHER_ERROR_IDS_REPLACEMENT_ORTHOGRAPHY_SPACE)
[grammar] ~6-~6: Ergänze ein Wort
Context: ...id/data-testid`). 3) Verbindung Frontend↔Backend ist robust (keine hardcoded URLs). ---...
(QB_NEW_DE_OTHER_ERROR_IDS_MISSING_NOUN)
[grammar] ~6-~6: Korrigiere das Wort
Context: ...ng** Frontend↔Backend ist robust (keine hardcoded URLs). --- ## 1) Backend Standard (OpenAPI...
(QB_NEW_DE_OTHER_ERROR_IDS_REPLACEMENT_ORTHOGRAPHY_SPELLING)
[grammar] ~10-~10: Ergänze ein Satzzeichen
Context: ...ine hardcoded URLs). --- ## 1) Backend Standard (OpenAPI = Function Registry) ...
(QB_NEW_DE_OTHER_ERROR_IDS_MISSING_PUNCTUATION_BACKENDDASHSTANDARD)
[grammar] ~17-~17: Hier könnte ein Fehler sein.
Context: ...operationId Konvention (deterministisch) Format: `{tagSlug}{method}{pathSlug}...
(QB_NEW_DE)
[grammar] ~26-~26: Korrigiere das Wort
Context: ...candidates_get_candidates_id **Regeln:** -tagSlug= lower +_statt Leerzeichen -pathSlug` = p...
(QB_NEW_DE_OTHER_ERROR_IDS_REPLACEMENT_ORTHOGRAPHY_SPACE)
[grammar] ~27-~27: Ersetze das Satzzeichen
Context: ...es_id **Regeln:** -tagSlug= lower +_statt Leerzeichen -pathSlug` = path o...
(QB_NEW_DE_OTHER_ERROR_IDS_REPLACEMENT_PUNCTUATION_BACKTICK_‘)
[grammar] ~27-~27: Korrigiere das Wort
Context: ...tagSlug= lower +statt Leerzeichen -pathSlug= path ohne führenden/, /→, {id}→id...
(QB_NEW_DE_OTHER_ERROR_IDS_REPLACEMENT_ORTHOGRAPHY_SPACE)
[grammar] ~28-~28: Ersetze das Satzzeichen
Context: ...chen - pathSlug = path ohne führenden /, /→_, {id}→id - Keine Sonderzei...
(QB_NEW_DE_OTHER_ERROR_IDS_REPLACEMENT_PUNCTUATION_BACKTICK_APOSTROPHE)
[grammar] ~28-~28: Ersetze das Satzzeichen
Context: ...- pathSlug = path ohne führenden /, /→_, {id}→id - Keine Sonderzeichen, nur...
(QB_NEW_DE_OTHER_ERROR_IDS_REPLACEMENT_PUNCTUATION_BACKTICK_APOSTROPHE)
[grammar] ~28-~28: Passe das Symbol an
Context: ...ug= path ohne führenden/, /→_, {id}→id- Keine Sonderzeichen, nur[a-z0-9...
(QB_NEW_DE_OTHER_ERROR_IDS_REPLACEMENT_OTHER)
[grammar] ~31-~31: Hier könnte ein Fehler sein.
Context: ...onderzeichen, nur [a-z0-9_] ### Tags Konvention - Tags sollten “Menü-Struktur” im OTOP Tool ab...
(QB_NEW_DE)
[grammar] ~32-~32: Passe das Symbol an
Context: ..._] ### Tags Konvention - Tags sollten “Menü-Struktur” im OTOP Tool abbilden: -A...
(QB_NEW_DE_OTHER_ERROR_IDS_REPLACEMENT_OTHER)
[grammar] ~32-~32: Ersetze das Satzzeichen
Context: ...## Tags Konvention - Tags sollten “Menü-Struktur” im OTOP Tool abbilden: - Auth, `Age...
(QB_NEW_DE_OTHER_ERROR_IDS_REPLACEMENT_PUNCTUATION_R_DOUBLE_QUOT_L_DOUBLE_QUOT)
[grammar] ~32-~32: Ergänze ein Satzzeichen
Context: ...n - Tags sollten “Menü-Struktur” im OTOP Tool abbilden: - Auth, Agents, `Ta...
(QB_NEW_DE_OTHER_ERROR_IDS_MISSING_PUNCTUATION_OTOPDASHTOOL)
[grammar] ~32-~32: Passe das Symbol an
Context: ...n “Menü-Struktur” im OTOP Tool abbilden: - Auth, Agents, Tasks, CRM, Telephony, ...
(QB_NEW_DE_OTHER_ERROR_IDS_REPLACEMENT_OTHER)
[grammar] ~33-~33: Passe das Symbol an
Context: ...s, Tasks, CRM, Telephony, Admin, Utils- Optional: “Substruktur” im Tag-Name:CR...
(QB_NEW_DE_OTHER_ERROR_IDS_REPLACEMENT_OTHER)
[grammar] ~34-~34: Ersetze das Satzzeichen
Context: ...elephony, Admin, Utils- Optional: “Substruktur” im Tag-Name:CRM/Candidates, CRM/Job...
(QB_NEW_DE_OTHER_ERROR_IDS_REPLACEMENT_PUNCTUATION_L_DOUBLE_QUOT_„)
[grammar] ~34-~34: Ersetze das Satzzeichen
Context: ...bstruktur” im Tag-Name: CRM/Candidates, CRM/Jobs ### Health/Ready (empfohlen) - /health (li...
(QB_NEW_DE_OTHER_ERROR_IDS_REPLACEMENT_PUNCTUATION_COMMA_PERIOD)
[grammar] ~42-~42: Ergänze ein Satzzeichen
Context: ....B. DB/Queue ready) --- ## 2) Frontend Standard (UI IDs = Link Targets) ### We...
(QB_NEW_DE_OTHER_ERROR_IDS_MISSING_PUNCTUATION_FRONTENDDASHSTANDARD)
[grammar] ~42-~42: Ergänze ein Satzzeichen
Context: ...ue ready) --- ## 2) Frontend Standard (UI IDs = Link Targets) ### Web (React/Vite/Next...
(QB_NEW_DE_OTHER_ERROR_IDS_MISSING_PUNCTUATION_UIDASHIDS)
[grammar] ~42-~42: Ergänze ein Satzzeichen
Context: ... ## 2) Frontend Standard (UI IDs = Link Targets) ### Web (React/Vite/Next) Jede...
(QB_NEW_DE_OTHER_ERROR_IDS_MISSING_PUNCTUATION_LINKDASHTARGETS)
[grammar] ~49-~49: Korrigiere die Fehler
Context: ...: - data-testid - data-otop-id ID Schema: `{domain}.{entity}.{screen}.{c...
(QB_NEW_DE_OTHER_ERROR_IDS_REPLACEMENT_MULTITOKEN)
[grammar] ~49-~49: Hier könnte ein Fehler sein.
Context: ...a-testid-data-otop-id **ID Schema:**{domain}.{entity}.{screen}.{component}.{action} Beispiele: -crm.candidate.list.search....
(QB_NEW_DE)
[grammar] ~92-~92: Korrigiere das Wort
Context: ...3) Verbindung Frontend ↔ Backend (keine hardcoded URLs) Erlaubt: - Proxy /api/* (best) ...
(QB_NEW_DE_OTHER_ERROR_IDS_REPLACEMENT_ORTHOGRAPHY_SPELLING)
[grammar] ~98-~98: Korrigiere das Wort
Context: ... ENV *_API_BASE_URL (ok) Verboten: - Hardcoded Domains/Ports im Code (`http://localhos...
(QB_NEW_DE_OTHER_ERROR_IDS_REPLACEMENT_ORTHOGRAPHY_SPELLING)
[grammar] ~98-~98: Ersetze das Satzzeichen
Context: ...ten: - Hardcoded Domains/Ports im Code (http://localhost:..., https://api...) --- ## 4) Definiti...
(QB_NEW_DE_OTHER_ERROR_IDS_REPLACEMENT_PUNCTUATION__PERIOD3_HORIZONTAL_ELLIPSIS)
[grammar] ~98-~98: Ersetze das Satzzeichen
Context: .../Ports im Code (http://localhost:..., https://api...) --- ## 4) Definition of Done (für “F...
(QB_NEW_DE_OTHER_ERROR_IDS_REPLACEMENT_PUNCTUATION__PERIOD3_HORIZONTAL_ELLIPSIS)
[grammar] ~102-~102: Ersetze das Satzzeichen
Context: ....`) --- ## 4) Definition of Done (für “Fertigstellung”) Ein UI gilt als „fertig“, wenn: - alle...
(QB_NEW_DE_OTHER_ERROR_IDS_REPLACEMENT_PUNCTUATION_L_DOUBLE_QUOT_„)
[grammar] ~105-~105: Ersetze das Satzzeichen
Context: ... verlinkt sind (UI-ID → operationId), oder - bewusst als deaktiviert ma...
(QB_NEW_DE_OTHER_ERROR_IDS_REPLACEMENT_PUNCTUATION_CLOSE_PARENTHESISCOMMA_CLOSE_PARENTHESIS)
docs/retrofit-guide.md
[grammar] ~1-~1: Ergänze ein Satzzeichen
Context: # Retrofit Guide (rückwirkend umstellen) ## Warum ...
(QB_NEW_DE_OTHER_ERROR_IDS_MISSING_PUNCTUATION_RETROFITDASHGUIDE)
[grammar] ~6-~6: Wähle ein passenderes Wort
Context: ...kte, UI-Brüche). Darum: 1) Standards + Checks überall einführen (OTOP Pack) ...
(QB_NEW_DE_OTHER_ERROR_IDS_REPLACEMENT_CONJUNCTION)
[grammar] ~6-~6: Entferne ein Wort
Context: ...) Standards + Checks überall einführen (OTOP Pack) 2) **Baselines/Reports erze...
(QB_NEW_DE_OTHER_ERROR_IDS_UNNECESSARY_NOUN)
[grammar] ~7-~7: Entferne ein Wort
Context: ...OP Pack) 2) Baselines/Reports erzeugen (Audit) 3) Gezielt nachziehen (repo...
(QB_NEW_DE_OTHER_ERROR_IDS_UNNECESSARY_NOUN)
[grammar] ~8-~8: Entferne ein Wort
Context: ...zeugen** (Audit) 3) Gezielt nachziehen (repoweise, screenweise) --- ## Schri...
(QB_NEW_DE_OTHER_ERROR_IDS_UNNECESSARY_NOUN)
[grammar] ~34-~34: Korrigiere das Wort
Context: ...scripts/otop-env-audit.sh ``` Ergebnis: - otop.config.json (Scan) - `otop.audit.uiids.md` (UI-ID Co...
(QB_NEW_DE_OTHER_ERROR_IDS_REPLACEMENT_ORTHOGRAPHY_SPACE)
[grammar] ~35-~35: Korrigiere das Wort
Context: ... Ergebnis: -otop.config.json(Scan) -otop.audit.uiids.md(UI-ID Coverage) -otop.audit.env.md` (...
(QB_NEW_DE_OTHER_ERROR_IDS_REPLACEMENT_ORTHOGRAPHY_SPACE)
[grammar] ~36-~36: Korrigiere das Wort
Context: ...- otop.audit.uiids.md (UI-ID Coverage) - otop.audit.env.md (Hardcoded URL Findings) - Lint-Output f...
(QB_NEW_DE_OTHER_ERROR_IDS_REPLACEMENT_ORTHOGRAPHY_SPACE)
[grammar] ~44-~44: Ergänze ein Satzzeichen
Context: ...tuellen Report: - partner: Hardcoded URLs → ENV (kritisch, sonst nie sauber d...
(QB_NEW_DE_OTHER_ERROR_IDS_MISSING_PUNCTUATION_HARDCODEDDASHURLS)
[grammar] ~46-~46: Ergänze ein Leerzeichen
Context: ...oud-agents / Optimizecodecloudagents**: OpenAPI+Health ok, aber UI-IDs fehlen komplett ...
(QB_NEW_DE_OTHER_ERROR_IDS_MISSING_ORTHOGRAPHY_SPACE)
[grammar] ~50-~50: Ergänze ein Satzzeichen
Context: ...s fehlen komplett --- ## Schritt 4: UI IDs rückwirkend einführen (Web) ### 4.1 ...
(QB_NEW_DE_OTHER_ERROR_IDS_MISSING_PUNCTUATION_UIDASHIDS)
[grammar] ~51-~51: Ersetze das Satzzeichen
Context: ...führen (Web) ### 4.1 Schnellster Hebel: “Design System Wrapper” Lege zentral Komponente...
(QB_NEW_DE_OTHER_ERROR_IDS_REPLACEMENT_PUNCTUATION_L_DOUBLE_QUOT_„)
[grammar] ~51-~51: Ersetze das Satzzeichen
Context: ...# 4.1 Schnellster Hebel: “Design System Wrapper” Lege zentral Komponenten an, die IDs er...
(QB_NEW_DE_OTHER_ERROR_IDS_REPLACEMENT_PUNCTUATION_R_DOUBLE_QUOT_L_DOUBLE_QUOT)
[grammar] ~52-~52: Passe das Symbol an
Context: ...ntral Komponenten an, die IDs erzwingen: - OButton, OInput, OSelect, OLink - Props: `...
(QB_NEW_DE_OTHER_ERROR_IDS_REPLACEMENT_OTHER)
[grammar] ~56-~56: Entferne das Symbol
Context: ...Attribute Dann ersetzt du schrittweise: - <Button ...> → <OButton otopId="..." ...> ### 4.2 Heuristik für IDs (damit KI konsiste...
(QB_NEW_DE_OTHER_ERROR_IDS_UNNECESSARY_OTHER)
[style] ~62-~62: Bei bestimmten Textarten und Formulierungen bietet es sich an, eine deutschsprachige Alternative zu benutzen.
Context: ...: candidate|job|task|agent|user|... - screen: list|detail|form|settings|... - comp...
(ALTERNATIVEN_FUER_ANGLIZISMEN)
[grammar] ~73-~73: Ergänze ein Satzzeichen
Context: ...gation Tabs/Links --- ## Schritt 5: UI IDs rückwirkend einführen (React Native)...
(QB_NEW_DE_OTHER_ERROR_IDS_MISSING_PUNCTUATION_UIDASHIDS)
[grammar] ~73-~73: Korrigiere die Fehler
Context: ...IDs rückwirkend einführen (React Native) - testID + accessibilityLabel="otop:<id>" - Für...
(QB_NEW_DE_OTHER_ERROR_IDS_REPLACEMENT_MULTITOKEN)
[grammar] ~75-~75: Ersetze das Satzzeichen
Context: ... accessibilityLabel="otop:<id>" - Für “Custom Buttons” zentral Wrapper OButtonRN ba...
(QB_NEW_DE_OTHER_ERROR_IDS_REPLACEMENT_PUNCTUATION_L_DOUBLE_QUOT_„)
[grammar] ~75-~75: Hier könnte ein Fehler sein.
Context: ...ibilityLabel="otop:"- Für “Custom Buttons” zentral WrapperOButtonRN` bauen, der ...
(QB_NEW_DE)
[grammar] ~75-~75: Passe die Wortendung an
Context: ...bel="otop:"- Für “Custom Buttons” zentral WrapperOButtonRN` bauen, der beide se...
(QB_NEW_DE_OTHER_ERROR_IDS_REPLACEMENT_ADJECTIVE_FORM)
[grammar] ~81-~81: Ergänze ein Satzzeichen
Context: ...op-add-operationid.py api/openapi.yamlaus - Danachbash scripts/otop-openapi-lin...
(QB_NEW_DE_OTHER_ERROR_IDS_MISSING_PUNCTUATION_PERIOD)
[grammar] ~86-~86: Ersetze das Satzzeichen
Context: ...op-openapi-lint.sh` --- ## Schritt 7: “Stop the bleeding” Sobald ein Repo angefange...
(QB_NEW_DE_OTHER_ERROR_IDS_REPLACEMENT_PUNCTUATION_L_DOUBLE_QUOT_„)
[grammar] ~86-~86: Ersetze das Satzzeichen
Context: ...-lint.sh` --- ## Schritt 7: “Stop the bleeding” Sobald ein Repo angefangen hat: - CI/PR...
(QB_NEW_DE_OTHER_ERROR_IDS_REPLACEMENT_PUNCTUATION_R_DOUBLE_QUOT_L_DOUBLE_QUOT)
[grammar] ~88-~88: Ergänze ein Satzzeichen
Context: ...Checks aktivieren, die neue UI ohne IDs blocken - OpenAPI ohne operationId blocken So ...
(QB_NEW_DE_OTHER_ERROR_IDS_MISSING_PUNCTUATION_COMMA)
🪛 Shellcheck (0.11.0)
scripts/otop-scan.sh
[warning] 84-84: This redirection doesn't have a command. Move to its command (or use 'true' as no-op).
(SC2188)
[warning] 92-92: This redirection doesn't have a command. Move to its command (or use 'true' as no-op).
(SC2188)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (1)
- GitHub Check: build
🔇 Additional comments (17)
windows/flutter/generated_plugins.cmake (1)
13-13: Auto-generated Windows plugin entry looks correct.The addition of
url_launcher_windowsto the plugin list is properly formatted and aligns with the corresponding registration ingenerated_plugin_registrant.cc.windows/flutter/generated_plugin_registrant.cc (1)
16-16: Auto-generated Windows plugin registration looks correct.The URL launcher plugin header and registration follow the established pattern for Windows plugins.
Also applies to: 33-34
linux/flutter/generated_plugins.cmake (1)
6-6: Auto-generated Linux plugin list update looks correct.The CMake plugin list now includes
url_launcher_linuxinstead ofaudioplayers_linuxandrecord_linux, which aligns with the corresponding changes ingenerated_plugin_registrant.cc.macos/Flutter/GeneratedPluginRegistrant.swift (1)
17-17: Verify url_launcher dependency in pubspec.yaml — in_app_review is present but url_launcher is not explicitly declared.The auto-generated plugin registrations follow the standard Flutter pattern. However,
in_app_review: ^2.0.10is declared in pubspec.yaml, buturl_launcheris not explicitly listed. Theurl_launcher_macosimport (line 24) and plugin registration (line 43) suggest it may be a transitive dependency. Confirm this is intentional or declare it explicitly if needed.linux/flutter/generated_plugin_registrant.cc (1)
9-9: Auto-generated plugin replacement is correct; removed plugins are not referenced.The Linux plugin registration now uses
url_launcher_linuxinstead ofaudioplayers_linuxandrecord_linux. Verification confirms:
- Neither
audioplayersnorrecordpackages are listed inpubspec.yaml- Audio functionality is provided by
just_audio(declared in dependencies)- The
AudioPlayerusage inlib/services/sound_service.dartis correctly imported fromjust_audio, notaudioplayers- No remaining references to the removed plugins exist in the codebase
The generated code change is correct.
AGENTS.md (1)
510-514: LGTM! Clear OTOP rules established.The new OTOP Rules section clearly defines mandatory guidelines for UI IDs, API URLs, and OpenAPI requirements. The rules align well with the broader OTOP standards being introduced across the repository.
docs/retrofit-guide.md (1)
1-90: LGTM! Comprehensive retrofit guidance.The retrofit guide provides clear, actionable steps for migrating repositories to OTOP standards. The phased approach (Pack → Baseline → Prioritize → Retrofit) is well thought out and helps avoid the chaos of all-at-once migrations.
scripts/otop-install.sh (1)
49-66: LGTM! Good handling of AGENTS.md modification.The script correctly checks for existing OTOP Rules before appending, preventing duplication. The use of quoted heredocs (
<<'EOF') ensures variables aren't expanded, which is appropriate for template content.scripts/otop-scan.sh (1)
80-84: Shellcheck warning may be a false positive, but pattern is unclear.Shellcheck flags SC2188 on the heredoc redirection at line 84. While this pattern technically works (the
<<<provides stdin to the command substitution's Python process), it's unconventional and confuses static analysis.Consider refactoring for clarity:
🔎 Clearer alternative approach
- "health_hints_sample": $(python - <<'PY' + "health_hints_sample": $(echo "$HEALTH_HINTS" | python - <<'PY' import json,sys print(json.dumps(sys.stdin.read().splitlines())) PY -<<<"$HEALTH_HINTS") +)Or use a more explicit approach:
+ # Convert health hints to JSON array + HEALTH_JSON=$(echo "$HEALTH_HINTS" | python3 -c "import json, sys; print(json.dumps(sys.stdin.read().splitlines()))") + # Convert API keys to JSON array + API_JSON=$(echo "$API_KEYS" | python3 -c "import json, sys; print(json.dumps(sys.stdin.read().splitlines()))") + cat > otop.config.json <<EOF { "version": 1, "repo": { "name": "$REPO_NAME", "type": "$REPO_TYPE" }, "backend": { "framework": "$BACKEND_FRAMEWORK", "openapi": { "file": "${OPENAPI_FILE}", "format": "${OPENAPI_FORMAT}" }, - "health_hints_sample": $(python - <<'PY' -import json,sys -print(json.dumps(sys.stdin.read().splitlines())) -PY -<<<"$HEALTH_HINTS") + "health_hints_sample": $HEALTH_JSON }, "frontend": { "framework": "$FRONTEND_FRAMEWORK", - "api_config_hints_sample": $(python - <<'PY' -import json,sys -print(json.dumps(sys.stdin.read().splitlines())) -PY -<<<"$API_KEYS"), + "api_config_hints_sample": $API_JSON, "ui_ids": { "data_testid": "$UI_TESTID_LEVEL", "data_otop_id": "$UI_OTOPID_LEVEL" } } } EOFscripts/otop-add-operationid.py (1)
1-72: LGTM! Well-structured OpenAPI operationId injection.The script correctly:
- Validates inputs and dependencies (PyYAML)
- Handles both YAML and JSON formats
- Generates deterministic operationIds using the documented convention
- Preserves existing operationIds
- Reports the number of changes made
rules/spectral-otop.yml (1)
1-20: LGTM! Clear and effective Spectral rules.The two OTOP rules correctly enforce:
- operationId presence (for function registry stability)
- tags presence (for operation grouping)
Both use appropriate error severity and apply to all operations via the JSONPath selector.
docs/otop-standard.md (1)
1-107: LGTM! Comprehensive OTOP standard definition.This document provides clear, actionable standards for:
- Backend: OpenAPI operationId and tags conventions with deterministic naming
- Frontend: UI ID schemas for Web, React Native, and Flutter
- Integration: Environment-based URL configuration
The examples are practical and the conventions are well thought out for maintainability and tooling integration.
docs/prompts/04_checklist.txt (1)
1-15: LGTM!This QA/Reviewer prompt template is well-structured with clear INPUT requirements and OUTPUT format. The checklist approach for UI blueprint validation covers essential aspects (CRUD buttons, validation, states, accessibility IDs, and API references).
docs/prompts/03_wiring_plan.txt (1)
1-17: LGTM!The wiring plan template clearly defines the integration approach with generated API clients. The OUTPUT structure covers all necessary aspects: reads, mutations, parameter mapping, UI states, and cache invalidation.
Note: The static analysis hint about "Lists" on line 9 is a false positive—using English technical terms like "Lists" within German documentation is common practice in development contexts.
scripts/otop-uiid-audit.sh (1)
1-25: LGTM!The UI ID audit script is well-structured with proper error handling (
|| truefor no-match cases). The output format with counts and samples provides useful visibility into UI identifier usage.Note: The regex patterns may catch some false positives (e.g.,
testIDin unrelated variable names), but for an audit report this is acceptable—it's better to over-report than miss actual occurrences.docs/prompts/01_blueprint_from_openapi.txt (1)
1-21: LGTM!This blueprint prompt template provides a comprehensive approach to deriving UI structure from OpenAPI specs. The rules for grouping by tags, generating CRUD screens per entity, and including all essential UI states (Loading/Error/Empty/Success) are well-defined.
.github/workflows/otop-static-checks.yml (1)
34-40: LGTM!The OpenAPI lint step appropriately blocks if the spec exists and fails validation, while gracefully handling the absence of the lint script.
| - name: Hardcoded URL audit (block on critical findings) | ||
| run: | | ||
| if [ -f scripts/otop-env-audit.sh ]; then | ||
| bash scripts/otop-env-audit.sh || true | ||
| # fail if we find hardcoded localhost or obvious prod domains in src/ (tune as needed) | ||
| if rg -n "http://localhost:|https://api\." . -g'!**/node_modules/**' -g'!**/dist/**' -g'!**/build/**' -g'!**/.next/**' -g'!**/.venv/**' ; then | ||
| echo "Hardcoded URL found. Move to ENV/proxy." | ||
| exit 1 | ||
| fi | ||
| else | ||
| echo "No env audit script." | ||
| fi |
There was a problem hiding this comment.
🧩 Analysis chain
🌐 Web query:
ripgrep rg pre-installed GitHub Actions ubuntu-latest runner 2024 2025
💡 Result:
Short answer: GitHub moved ubuntu-latest to Ubuntu 24.04 (rollout Dec 5, 2024–Jan 17, 2025). Whether rg (ripgrep) is present can differ between image versions — GitHub's image manifests don't list every utility — so you should verify at runtime (rg --version) and install it in your workflow if you need it guaranteed (apt install -y ripgrep). [1][2][3]
How to check in a job:
- run: rg --version
How to install if missing:
- run: sudo apt-get update && sudo apt-get install -y ripgrep
Sources:
- GitHub runner-images (image labels / included OS versions). [1]
- GitHub hosted runners reference (ubuntu-latest behavior). [2]
- Ubuntu-24.04 rollout announcement / timeline. [3]
References:
[1] actions/runner-images repository — Available Images. (github.com)
[2] GitHub-hosted runners reference (Docs). (docs.github.com)
[3] Issue announcing ubuntu-latest -> Ubuntu 24.04 rollout (Dec 5, 2024 — Jan 17, 2025). (github.com)
Citations:
- 1: https://github.com/actions/runner-images?utm_source=openai
- 2: https://docs.github.com/en/actions/reference/github-hosted-runners-reference?utm_source=openai
- 3: Ubuntu-latest workflows will use Ubuntu-24.04 image actions/runner-images#10636
Add explicit ripgrep installation to ensure workflow reliability.
Ripgrep (rg) is not guaranteed to be pre-installed on GitHub Actions ubuntu-latest runners. The hardcoded URL audit step (line 26) assumes its availability, which will cause the workflow to fail unexpectedly if it's missing.
Add an installation step before the audit:
- name: Install ripgrep
run: sudo apt-get update && sudo apt-get install -y ripgrepAlternatively, check for availability and install conditionally:
- name: Ensure ripgrep is available
run: command -v rg >/dev/null 2>&1 || sudo apt-get install -y ripgrep🤖 Prompt for AI Agents
.github/workflows/otop-static-checks.yml around lines 21 to 32: the hardcoded
URL audit step assumes ripgrep (rg) is present on the runner which is not
guaranteed and will cause the job to fail; add a step before the audit to
install ripgrep (e.g., run sudo apt-get update && sudo apt-get install -y
ripgrep) or conditionally install it only if missing (e.g., run command -v rg
>/dev/null 2>&1 || sudo apt-get update && sudo apt-get install -y ripgrep) so
the rg command used on line ~26 is available.
| { | ||
| "version": 1, | ||
| "repo": { "name": "Kids-AI-Train-Alanko", "type": "unknown" }, | ||
| "backend": { | ||
| "framework": "", | ||
| "openapi": { "file": "", "format": "" }, | ||
| "health_hints_sample": | ||
| }, | ||
| "frontend": { | ||
| "framework": "", | ||
| "api_config_hints_sample": , | ||
| "ui_ids": { "data_testid": "LOW", "data_otop_id": "LOW" } | ||
| } | ||
| } |
There was a problem hiding this comment.
Invalid JSON syntax will break parsing.
Lines 7 and 11 have missing values, making this file unparseable. Any tool attempting to read this configuration will fail.
🔎 Proposed fix with valid placeholder values
{
"version": 1,
"repo": { "name": "Kids-AI-Train-Alanko", "type": "unknown" },
"backend": {
"framework": "",
"openapi": { "file": "", "format": "" },
- "health_hints_sample":
+ "health_hints_sample": null
},
"frontend": {
"framework": "",
- "api_config_hints_sample": ,
+ "api_config_hints_sample": null,
"ui_ids": { "data_testid": "LOW", "data_otop_id": "LOW" }
}
}Use null, "", [], or {} as appropriate placeholders instead of omitting values entirely.
📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| { | |
| "version": 1, | |
| "repo": { "name": "Kids-AI-Train-Alanko", "type": "unknown" }, | |
| "backend": { | |
| "framework": "", | |
| "openapi": { "file": "", "format": "" }, | |
| "health_hints_sample": | |
| }, | |
| "frontend": { | |
| "framework": "", | |
| "api_config_hints_sample": , | |
| "ui_ids": { "data_testid": "LOW", "data_otop_id": "LOW" } | |
| } | |
| } | |
| { | |
| "version": 1, | |
| "repo": { "name": "Kids-AI-Train-Alanko", "type": "unknown" }, | |
| "backend": { | |
| "framework": "", | |
| "openapi": { "file": "", "format": "" }, | |
| "health_hints_sample": null | |
| }, | |
| "frontend": { | |
| "framework": "", | |
| "api_config_hints_sample": null, | |
| "ui_ids": { "data_testid": "LOW", "data_otop_id": "LOW" } | |
| } | |
| } |
🧰 Tools
🪛 Biome (2.1.2)
[error] 8-8: Expected an array, an object, or a literal but instead found '}'.
Expected an array, an object, or a literal here.
(parse)
[error] 11-11: Expected an array, an object, or a literal but instead found ','.
Expected an array, an object, or a literal here.
(parse)
🤖 Prompt for AI Agents
In otop.config.json around lines 1 to 14, the JSON is invalid because the
properties "health_hints_sample" (line 7) and "api_config_hints_sample" (line
11) are missing values; fix by supplying appropriate placeholders (e.g., set
"health_hints_sample": [] and "api_config_hints_sample": {} or [] as required),
ensure empty string placeholders for unused framework/openapi fields remain
valid (""), and re-run a JSON linter to confirm the file parses.
| # Find OpenAPI spec in repo | ||
| SPEC="$(ls -1 **/*openapi*.y*ml **/*swagger*.y*ml **/*openapi*.json **/*swagger*.json 2>/dev/null | head -n 1 || true)" | ||
| if [[ -z "$SPEC" ]]; then | ||
| echo "No OpenAPI/Swagger spec found in repo." | ||
| exit 0 | ||
| fi |
There was a problem hiding this comment.
Glob pattern ** requires shopt -s globstar to work in Bash.
The recursive glob pattern **/*openapi*.y*ml won't expand as intended without enabling globstar. By default, Bash treats ** as a literal *, so nested directories won't be searched.
🔎 Proposed fix
#!/usr/bin/env bash
set -euo pipefail
+shopt -s globstar nullglob
+
# Find OpenAPI spec in repo
-SPEC="$(ls -1 **/*openapi*.y*ml **/*swagger*.y*ml **/*openapi*.json **/*swagger*.json 2>/dev/null | head -n 1 || true)"
+SPEC="$(find . -type f \( -name '*openapi*.yml' -o -name '*openapi*.yaml' -o -name '*swagger*.yml' -o -name '*swagger*.yaml' -o -name '*openapi*.json' -o -name '*swagger*.json' \) 2>/dev/null | head -n 1 || true)"
if [[ -z "$SPEC" ]]; then
echo "No OpenAPI/Swagger spec found in repo."
exit 0
fiAlternatively, using find avoids the globstar requirement and is more portable across shell environments.
Committable suggestion skipped: line range outside the PR's diff.
🤖 Prompt for AI Agents
In scripts/otop-openapi-lint.sh around lines 4 to 9, the use of the recursive
glob pattern `**` will not work unless Bash globstar is enabled; update the
script to either enable globstar before using `**` (add `shopt -s globstar` near
the top) or replace the glob with a portable find command to locate
OpenAPI/Swagger files (e.g., use `find . -type f -iname '*openapi*.y*ml' -o
-iname '*swagger*.y*ml' -o -iname '*openapi*.json' -o -iname '*swagger*.json' |
head -n1`), ensure errors are redirected consistently and preserve the existing
behavior when no spec is found.
2 participants
Summary
Changes
lib/services/gemini_service.dart: Use String.fromEnvironment🤖 Generated with Claude Code
Summary by CodeRabbit
Chores
Documentation
✏️ Tip: You can customize this high-level summary in your review settings.