Open
Conversation
Agent-Logs-Url: https://github.com/bitly/bitlyapi.js/sessions/4f2688c3-6cea-4781-8692-1b956c6ad2c0 Co-authored-by: jehiah <45028+jehiah@users.noreply.github.com>
jehiah
approved these changes
May 1, 2026
📝 WalkthroughWalkthroughUpdates the OpenAPI Generator CLI version in a build script from Changes
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~2 minutes 🚥 Pre-merge checks | ✅ 4✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Review rate limit: 9/10 reviews remaining, refill in 6 minutes. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (2)
scripts/openapi-generator-cli.sh (2)
6-16:⚠️ Potential issue | 🟠 Major | 🏗️ Heavy liftAdd checksum verification before executing the downloaded JAR.
Right now the script downloads a remote artifact and immediately executes it (
exec java -jar ...), with no integrity check. Even though the version is pinned, this is still a supply-chain risk (e.g., malicious/accidental tampering upstream). Store an expected SHA256 in the script (or fetch from a trusted source) and fail if the downloaded jar doesn’t match.🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@scripts/openapi-generator-cli.sh` around lines 6 - 16, Add SHA256 checksum verification for the downloaded OpenAPI Generator JAR: define an expected checksum variable (e.g., EXPECTED_SHA256) alongside VERSION/SOURCE/FILENAME, compute the actual checksum of $VENDOR_DIR/$FILENAME using a portable tool (sha256sum or shasum -a 256), compare actual vs EXPECTED_SHA256, and if they differ print an error, remove the downloaded file and exit non‑zero; only proceed to exec java -jar ... after the checksum validation succeeds. Reference symbols: VERSION, SOURCE, FILENAME, VENDOR_DIR, and the final exec java -jar invocation to ensure the check happens before execution.
8-16:⚠️ Potential issue | 🟡 Minor | ⚡ Quick winQuote shell variables to harden against path/filename edge cases.
Several expansions are unquoted (
$SOURCE,$VENDOR_DIR,$FILENAME), including:
- Line 9:
basename $SOURCE- Line 10:
mkdir -p $VENDOR_DIR- Line 12:
[ ! -f $VENDOR_DIR/$FILENAME ]- Line 14:
wget $SOURCE -O $VENDOR_DIR/$FILENAME- Line 16:
exec java -jar $VENDOR_DIR/$FILENAME "$@"This can cause failures if any path contains whitespace or special characters.
🛠️ Proposed hardening diff
-VERSION=7.21.0 -SOURCE=https://repo1.maven.org/maven2/org/openapitools/openapi-generator-cli/${VERSION}/openapi-generator-cli-${VERSION}.jar -FILENAME=$(basename $SOURCE) -mkdir -p $VENDOR_DIR +VERSION=7.21.0 +SOURCE="https://repo1.maven.org/maven2/org/openapitools/openapi-generator-cli/${VERSION}/openapi-generator-cli-${VERSION}.jar" +FILENAME="$(basename "$SOURCE")" +mkdir -p "$VENDOR_DIR" set -e -if [ ! -f $VENDOR_DIR/$FILENAME ]; then +if [ ! -f "$VENDOR_DIR/$FILENAME" ]; then echo "Downloading OpenAPI Generator CLI version $VERSION" - wget $SOURCE -O $VENDOR_DIR/$FILENAME + wget "$SOURCE" -O "$VENDOR_DIR/$FILENAME" fi -exec java -jar $VENDOR_DIR/$FILENAME "$@" +exec java -jar "$VENDOR_DIR/$FILENAME" "$@"🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@scripts/openapi-generator-cli.sh` around lines 8 - 16, The script uses unquoted variable expansions which break on paths with spaces or special chars; update usages to quote expansions: assign FILENAME with basename "$SOURCE", call mkdir -p "$VENDOR_DIR", test file existence with [ ! -f "$VENDOR_DIR/$FILENAME" ], pass wget "$SOURCE" -O "$VENDOR_DIR/$FILENAME", and run the jar with exec java -jar "$VENDOR_DIR/$FILENAME" "$@"; keep the same variable names (SOURCE, VENDOR_DIR, FILENAME) and commands (basename, wget, exec) so the change is a straightforward quoting hardening.
🧹 Nitpick comments (1)
scripts/openapi-generator-cli.sh (1)
11-15: ⚡ Quick winMake the download more reliable (timeouts/retries) and tighten error handling.
The script uses
set -e(Line 11) but:
- earlier commands (readlink/dirname) run before
set -ewgethas no explicit timeout/retry, which can make CI flaky on transient network issuesConsider switching to
set -euo pipefailnear the top and addingwgetoptions like--tries,--timeout, and--retry-connrefused.🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@scripts/openapi-generator-cli.sh` around lines 11 - 15, Move the shell strictness to the top and harden the download: replace the top-level "set -e" with "set -euo pipefail" as the first executable line (so it applies to earlier readlink/dirname calls), ensure variables like VENDOR_DIR, FILENAME, SOURCE, VERSION are quoted when referenced, and replace the simple wget call in the download block with a wget invocation that specifies retries and timeouts (e.g. use --tries, --timeout, --retry-connrefused and optionally --waitretry) so the download is more resilient; keep the conditional (if [ ! -f "$VENDOR_DIR/$FILENAME" ]) and fail-fast behavior, and ensure any wget failure is surfaced (no silent redirects or swallowing of exit codes).
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Outside diff comments:
In `@scripts/openapi-generator-cli.sh`:
- Around line 6-16: Add SHA256 checksum verification for the downloaded OpenAPI
Generator JAR: define an expected checksum variable (e.g., EXPECTED_SHA256)
alongside VERSION/SOURCE/FILENAME, compute the actual checksum of
$VENDOR_DIR/$FILENAME using a portable tool (sha256sum or shasum -a 256),
compare actual vs EXPECTED_SHA256, and if they differ print an error, remove the
downloaded file and exit non‑zero; only proceed to exec java -jar ... after the
checksum validation succeeds. Reference symbols: VERSION, SOURCE, FILENAME,
VENDOR_DIR, and the final exec java -jar invocation to ensure the check happens
before execution.
- Around line 8-16: The script uses unquoted variable expansions which break on
paths with spaces or special chars; update usages to quote expansions: assign
FILENAME with basename "$SOURCE", call mkdir -p "$VENDOR_DIR", test file
existence with [ ! -f "$VENDOR_DIR/$FILENAME" ], pass wget "$SOURCE" -O
"$VENDOR_DIR/$FILENAME", and run the jar with exec java -jar
"$VENDOR_DIR/$FILENAME" "$@"; keep the same variable names (SOURCE, VENDOR_DIR,
FILENAME) and commands (basename, wget, exec) so the change is a straightforward
quoting hardening.
---
Nitpick comments:
In `@scripts/openapi-generator-cli.sh`:
- Around line 11-15: Move the shell strictness to the top and harden the
download: replace the top-level "set -e" with "set -euo pipefail" as the first
executable line (so it applies to earlier readlink/dirname calls), ensure
variables like VENDOR_DIR, FILENAME, SOURCE, VERSION are quoted when referenced,
and replace the simple wget call in the download block with a wget invocation
that specifies retries and timeouts (e.g. use --tries, --timeout,
--retry-connrefused and optionally --waitretry) so the download is more
resilient; keep the conditional (if [ ! -f "$VENDOR_DIR/$FILENAME" ]) and
fail-fast behavior, and ensure any wget failure is surfaced (no silent redirects
or swallowing of exit codes).
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro Plus
Run ID: 413648db-d2e8-46d0-b55d-973e9ae1ff8e
📒 Files selected for processing (1)
scripts/openapi-generator-cli.sh
📜 Review details
🔇 Additional comments (1)
scripts/openapi-generator-cli.sh (1)
7-8: Maven artifact URL for version 7.21.0 is valid and reachable.The artifact
openapi-generator-cli-7.21.0.jarathttps://repo1.maven.org/maven2/org/openapitools/openapi-generator-cli/7.21.0/openapi-generator-cli-7.21.0.jarreturns HTTP 200 and is available. The VERSION and SOURCE variables at lines 7-8 are correctly configured.
jakeheft
approved these changes
May 1, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Updates the OpenAPI Generator CLI version from
7.16.0to7.21.0inscripts/openapi-generator-cli.sh. Client regeneration to be run separately viascripts/update_client.shonce this is merged.