Skip to content

lexe#50

Merged
ntheile merged 7 commits into
masterfrom
lexe
Jul 21, 2026
Merged

lexe#50
ntheile merged 7 commits into
masterfrom
lexe

Conversation

@ntheile

@ntheile ntheile commented Jul 17, 2026

Copy link
Copy Markdown
Contributor

Summary by CodeRabbit

  • New Features
    • Added Lexe backend support: node info, BOLT11/12 invoice/offer creation & payment, invoice lookup, transaction listing, decoding, and invoice payment-status event polling.
    • Added a React Native Lexe package for iOS/Android with TypeScript APIs plus a runnable example app.
    • Added configurable Lexe node setup with selectable network and optional local state storage.
  • Documentation
    • Updated README and React Native binding docs with setup, usage, contribution, and licensing guidance.
  • Chores
    • Added native build/packaging verification plus Git LFS safety hooks and CI workflow for artifact creation/publishing.

@coderabbitai

coderabbitai Bot commented Jul 17, 2026

Copy link
Copy Markdown

Review Change Stack

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

  • @coderabbitai resume to resume automatic reviews.
  • @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

  • ▶️ Resume reviews
  • 🔍 Trigger review
📝 Walkthrough

Walkthrough

Adds a Lexe Lightning backend with invoice, offer, payment, lookup, transaction, and event APIs. Exposes it through UniFFI and a React Native package with Android/iOS bindings, an example app, native artifact tooling, CI packaging, and publishing configuration.

Changes

Lexe integration

Layer / File(s) Summary
Lexe wallet backend
crates/lni/lexe/*, crates/lni/lib.rs, crates/lni/types.rs
Adds Lexe wallet initialization, payment and invoice operations, transaction filtering, timeout reconciliation, event polling, permissions, tests, and LightningNode factory wiring.
UniFFI data and API bridge
bindings/react-native-lexe/rust/*
Defines FFI records, errors, callbacks, conversions, and async LexeNode methods over the LNI backend.
React Native package and native module
bindings/react-native-lexe/{src,cpp,ios,android}/*, package.json, LniLexe.podspec
Adds package exports, one-time Rust/UniFFI initialization, Android and iOS TurboModule bridges, and native build configuration.
React Native example application
bindings/react-native-lexe/example/*
Adds Android and iOS project configuration, startup code, resources, build wrappers, and a minimal example screen.
Build and release automation
.github/workflows/build-react-native-lexe.yml, bindings/react-native-lexe/scripts/*, Cargo.toml
Registers the Rust binding crate, verifies native artifacts, validates generated output, builds release tarballs, and publishes matching package versions.
Repository and package support
.githooks/*, .gitignore, bindings/react-native-lexe/{README.md,CONTRIBUTING.md,CODE_OF_CONDUCT.md,LICENSE,.gitignore}
Adds Git LFS hooks, artifact inclusion rules, package documentation, licensing, and contribution guidance.

Estimated code review effort: 5 (Critical) | ~120 minutes

Possibly related PRs

🚥 Pre-merge checks | ✅ 3 | ❌ 2

❌ Failed checks (1 warning, 1 inconclusive)

Check name Status Explanation Resolution
Docstring Coverage ⚠️ Warning Docstring coverage is 15.91% which is insufficient. The required threshold is 80.00%. Write docstrings for the functions missing them to satisfy the coverage threshold.
Title check ❓ Inconclusive The title is related to the change but too vague to convey the main update. Use a concise, specific title such as "Add Lexe React Native bindings" or similar.
✅ Passed checks (3 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch lexe

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 83f81bd130

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment thread crates/lni/lexe/api.rs
Comment thread crates/lni/lexe/lib.rs

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 5

🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@crates/lni/lexe/api.rs`:
- Around line 256-276: Bound the caller-controlled limit in matching_payments
and the surrounding API parameter validation to the public API’s maximum page
size, rejecting params.limit values above that maximum. Avoid
Vec::with_capacity(limit) based on the untrusted request; use a bounded capacity
or no preallocation while preserving pagination and result limits.
- Around line 402-408: Update the timeout handling in the payment flow around
wallet.pay_invoice to reconcile the remote payment state using the invoice
payment hash before returning. If reconciliation cannot determine whether
payment completed, return an explicit indeterminate result that requires lookup
before retrying instead of the generic NetworkError; preserve the existing
successful payment path.
- Around line 519-543: Update on_invoice_events to reject requests where both
params.payment_hash and params.search are empty, using the same selector
validation behavior as lookup_invoice before entering the polling loop. Preserve
the existing callback.failure(None) response and avoid calling matching_payments
without at least one event selector.
- Around line 99-104: Update the routing-options validation condition to reject
only enabled unsupported options, allowing optional boolean fields set to
Some(false) while continuing to reject Some(true). Preserve the existing
handling for max_parts and hop public keys, and adjust the is_amp and
allow_self_payment checks in the surrounding validation logic.

In `@crates/lni/lexe/lib.rs`:
- Around line 306-307: Remove the payment preimage output from the affected
diagnostic paths, including the println! and corresponding dbg! calls around
payment handling. Ensure the locations also covered at the referenced lines do
not log payment.preimage, while retaining only non-sensitive payment identifiers
if diagnostics are still required.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 0aa055ad-db06-4084-a514-2233e5cb96f8

📥 Commits

Reviewing files that changed from the base of the PR and between 84943f4 and 83f81bd.

📒 Files selected for processing (6)
  • crates/lni/Cargo.toml
  • crates/lni/lexe/api.rs
  • crates/lni/lexe/lib.rs
  • crates/lni/lib.rs
  • crates/lni/types.rs
  • readme.md

Comment thread crates/lni/lexe/api.rs
Comment thread crates/lni/lexe/api.rs Outdated
Comment thread crates/lni/lexe/api.rs Outdated
Comment thread crates/lni/lexe/api.rs
Comment thread crates/lni/lexe/lib.rs
@socket-security

socket-security Bot commented Jul 20, 2026

Copy link
Copy Markdown

@socket-security

socket-security Bot commented Jul 20, 2026

Copy link
Copy Markdown

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action Severity Alert  (click "▶" to expand/collapse)
Warn High
Obfuscated code: cargo lexe-common is 90.0% likely obfuscated

Confidence: 0.90

Location: Package overview

From: ?cargo/lexe-common@0.1.16

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore cargo/lexe-common@0.1.16. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
Obfuscated code: cargo lexe-tls is 90.0% likely obfuscated

Confidence: 0.90

Location: Package overview

From: ?cargo/lexe-tls@0.1.16

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore cargo/lexe-tls@0.1.16. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
Obfuscated code: cargo tokio is 90.0% likely obfuscated

Confidence: 0.90

Location: Package overview

From: bindings/lni_nodejs/Cargo.tomlcargo/tokio@1.49.0

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore cargo/tokio@1.49.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
Obfuscated code: cargo writeable is 90.0% likely obfuscated

Confidence: 0.90

Location: Package overview

From: ?cargo/reqwest@0.12.28cargo/writeable@0.6.2

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore cargo/writeable@0.6.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
Obfuscated code: npm @react-native/debugger-frontend is 90.0% likely obfuscated

Confidence: 0.90

Location: Package overview

From: ?npm/react-native@0.85.0npm/@react-native/debugger-frontend@0.85.0

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@react-native/debugger-frontend@0.85.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
Obfuscated code: npm @react-native/debugger-frontend is 90.0% likely obfuscated

Confidence: 0.90

Location: Package overview

From: ?npm/react-native@0.85.0npm/@react-native/debugger-frontend@0.85.0

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@react-native/debugger-frontend@0.85.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 2

🧹 Nitpick comments (1)
bindings/react-native-lexe/scripts/fix-ubrn-cmake.mjs (1)

15-19: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Resolve UNIFFI_BINDGEN_PATH from package.json

path.resolve(require.resolve('uniffi-bindgen-react-native'), '../../../..') depends on the entry file’s directory depth, so a different main/exports layout can point UNIFFI_BINDGEN_PATH at the wrong ancestor. Use require.resolve('uniffi-bindgen-react-native/package.json') and take its directory instead.

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@bindings/react-native-lexe/scripts/fix-ubrn-cmake.mjs` around lines 15 - 19,
Update the exportedResolver command to resolve
uniffi-bindgen-react-native/package.json and derive UNIFFI_BINDGEN_PATH from
that package file’s directory, replacing the current ancestor traversal from the
package entry path. Preserve the existing CMake output variable and whitespace
behavior.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.gitignore:
- Around line 133-136: Remove the broad `!bindings/react-native-lexe/android/**`
and `!bindings/react-native-lexe/example/android/**` rules, keeping only
directory-level un-ignore entries so nested generated artifacts remain ignored;
add narrowly scoped un-ignore patterns only for specific required file types if
needed.
- Line 137: Update the debug.keystore entry in .gitignore to use the negation
prefix, ensuring bindings/react-native-lexe/example/android/app/debug.keystore
is tracked instead of ignored.

---

Nitpick comments:
In `@bindings/react-native-lexe/scripts/fix-ubrn-cmake.mjs`:
- Around line 15-19: Update the exportedResolver command to resolve
uniffi-bindgen-react-native/package.json and derive UNIFFI_BINDGEN_PATH from
that package file’s directory, replacing the current ancestor traversal from the
package entry path. Preserve the existing CMake output variable and whitespace
behavior.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 37608bbe-b3ac-4d22-957d-9bea509a8f75

📥 Commits

Reviewing files that changed from the base of the PR and between 83f81bd and 7e5df68.

⛔ Files ignored due to path filters (23)
  • bindings/react-native-lexe/.yarn/releases/yarn-4.11.0.cjs is excluded by !**/.yarn/**
  • bindings/react-native-lexe/android/src/main/jniLibs/arm64-v8a/libreact_native_lexe.so is excluded by !**/*.so
  • bindings/react-native-lexe/android/src/main/jniLibs/armeabi-v7a/libreact_native_lexe.so is excluded by !**/*.so
  • bindings/react-native-lexe/android/src/main/jniLibs/x86/libreact_native_lexe.so is excluded by !**/*.so
  • bindings/react-native-lexe/android/src/main/jniLibs/x86_64/libreact_native_lexe.so is excluded by !**/*.so
  • bindings/react-native-lexe/cpp/generated/react_native_lexe.cpp is excluded by !**/generated/**
  • bindings/react-native-lexe/cpp/generated/react_native_lexe.hpp is excluded by !**/generated/**
  • bindings/react-native-lexe/example/android/app/src/main/res/mipmap-hdpi/ic_launcher.png is excluded by !**/*.png
  • bindings/react-native-lexe/example/android/app/src/main/res/mipmap-hdpi/ic_launcher_round.png is excluded by !**/*.png
  • bindings/react-native-lexe/example/android/app/src/main/res/mipmap-mdpi/ic_launcher.png is excluded by !**/*.png
  • bindings/react-native-lexe/example/android/app/src/main/res/mipmap-mdpi/ic_launcher_round.png is excluded by !**/*.png
  • bindings/react-native-lexe/example/android/app/src/main/res/mipmap-xhdpi/ic_launcher.png is excluded by !**/*.png
  • bindings/react-native-lexe/example/android/app/src/main/res/mipmap-xhdpi/ic_launcher_round.png is excluded by !**/*.png
  • bindings/react-native-lexe/example/android/app/src/main/res/mipmap-xxhdpi/ic_launcher.png is excluded by !**/*.png
  • bindings/react-native-lexe/example/android/app/src/main/res/mipmap-xxhdpi/ic_launcher_round.png is excluded by !**/*.png
  • bindings/react-native-lexe/example/android/app/src/main/res/mipmap-xxxhdpi/ic_launcher.png is excluded by !**/*.png
  • bindings/react-native-lexe/example/android/app/src/main/res/mipmap-xxxhdpi/ic_launcher_round.png is excluded by !**/*.png
  • bindings/react-native-lexe/example/android/gradle/wrapper/gradle-wrapper.jar is excluded by !**/*.jar
  • bindings/react-native-lexe/example/ios/Podfile.lock is excluded by !**/*.lock
  • bindings/react-native-lexe/example/ios/ReactNativeLexeExample.xcworkspace/contents.xcworkspacedata is excluded by !**/*.xcworkspace/contents.xcworkspacedata
  • bindings/react-native-lexe/src/generated/react_native_lexe-ffi.ts is excluded by !**/generated/**
  • bindings/react-native-lexe/src/generated/react_native_lexe.ts is excluded by !**/generated/**
  • bindings/react-native-lexe/yarn.lock is excluded by !**/yarn.lock, !**/*.lock
📒 Files selected for processing (79)
  • .githooks/post-checkout
  • .githooks/post-commit
  • .githooks/post-merge
  • .githooks/pre-push
  • .gitignore
  • Cargo.toml
  • bindings/react-native-lexe/.editorconfig
  • bindings/react-native-lexe/.gitattributes
  • bindings/react-native-lexe/.gitignore
  • bindings/react-native-lexe/.nvmrc
  • bindings/react-native-lexe/.watchmanconfig
  • bindings/react-native-lexe/.yarnrc.yml
  • bindings/react-native-lexe/CODE_OF_CONDUCT.md
  • bindings/react-native-lexe/CONTRIBUTING.md
  • bindings/react-native-lexe/LICENSE
  • bindings/react-native-lexe/LniLexe.podspec
  • bindings/react-native-lexe/README.md
  • bindings/react-native-lexe/ReactNativeLexeFramework.xcframework/Info.plist
  • bindings/react-native-lexe/ReactNativeLexeFramework.xcframework/ios-arm64-simulator/libreact_native_lexe.a
  • bindings/react-native-lexe/ReactNativeLexeFramework.xcframework/ios-arm64/libreact_native_lexe.a
  • bindings/react-native-lexe/android/CMakeLists.txt
  • bindings/react-native-lexe/android/build.gradle
  • bindings/react-native-lexe/android/cpp-adapter.cpp
  • bindings/react-native-lexe/android/src/main/AndroidManifest.xml
  • bindings/react-native-lexe/android/src/main/java/com/reactnativelnilexe/LniLexeModule.kt
  • bindings/react-native-lexe/android/src/main/java/com/reactnativelnilexe/LniLexePackage.kt
  • bindings/react-native-lexe/babel.config.js
  • bindings/react-native-lexe/cpp/react-native-lni-lexe.cpp
  • bindings/react-native-lexe/cpp/react-native-lni-lexe.h
  • bindings/react-native-lexe/eslint.config.mjs
  • bindings/react-native-lexe/example/.bundle/config
  • bindings/react-native-lexe/example/.watchmanconfig
  • bindings/react-native-lexe/example/Gemfile
  • bindings/react-native-lexe/example/README.md
  • bindings/react-native-lexe/example/android/app/build.gradle
  • bindings/react-native-lexe/example/android/app/proguard-rules.pro
  • bindings/react-native-lexe/example/android/app/src/main/AndroidManifest.xml
  • bindings/react-native-lexe/example/android/app/src/main/java/com/reactnativelnilexe/example/MainActivity.kt
  • bindings/react-native-lexe/example/android/app/src/main/java/com/reactnativelnilexe/example/MainApplication.kt
  • bindings/react-native-lexe/example/android/app/src/main/res/drawable/rn_edit_text_material.xml
  • bindings/react-native-lexe/example/android/app/src/main/res/values/strings.xml
  • bindings/react-native-lexe/example/android/app/src/main/res/values/styles.xml
  • bindings/react-native-lexe/example/android/build.gradle
  • bindings/react-native-lexe/example/android/gradle.properties
  • bindings/react-native-lexe/example/android/gradle/wrapper/gradle-wrapper.properties
  • bindings/react-native-lexe/example/android/gradlew
  • bindings/react-native-lexe/example/android/gradlew.bat
  • bindings/react-native-lexe/example/android/settings.gradle
  • bindings/react-native-lexe/example/app.json
  • bindings/react-native-lexe/example/babel.config.js
  • bindings/react-native-lexe/example/index.js
  • bindings/react-native-lexe/example/ios/.xcode.env
  • bindings/react-native-lexe/example/ios/Podfile
  • bindings/react-native-lexe/example/ios/ReactNativeLexeExample.xcodeproj/project.pbxproj
  • bindings/react-native-lexe/example/ios/ReactNativeLexeExample.xcodeproj/xcshareddata/xcschemes/ReactNativeLexeExample.xcscheme
  • bindings/react-native-lexe/example/ios/ReactNativeLexeExample/AppDelegate.swift
  • bindings/react-native-lexe/example/ios/ReactNativeLexeExample/Images.xcassets/AppIcon.appiconset/Contents.json
  • bindings/react-native-lexe/example/ios/ReactNativeLexeExample/Images.xcassets/Contents.json
  • bindings/react-native-lexe/example/ios/ReactNativeLexeExample/Info.plist
  • bindings/react-native-lexe/example/ios/ReactNativeLexeExample/LaunchScreen.storyboard
  • bindings/react-native-lexe/example/ios/ReactNativeLexeExample/PrivacyInfo.xcprivacy
  • bindings/react-native-lexe/example/jest.config.js
  • bindings/react-native-lexe/example/metro.config.js
  • bindings/react-native-lexe/example/package.json
  • bindings/react-native-lexe/example/react-native.config.js
  • bindings/react-native-lexe/example/src/App.tsx
  • bindings/react-native-lexe/ios/LniLexe.h
  • bindings/react-native-lexe/ios/LniLexe.mm
  • bindings/react-native-lexe/package.json
  • bindings/react-native-lexe/react-native.config.js
  • bindings/react-native-lexe/rust/Cargo.toml
  • bindings/react-native-lexe/rust/src/lib.rs
  • bindings/react-native-lexe/scripts/fix-ubrn-cmake.mjs
  • bindings/react-native-lexe/src/NativeLniLexe.ts
  • bindings/react-native-lexe/src/index.tsx
  • bindings/react-native-lexe/tsconfig.build.json
  • bindings/react-native-lexe/tsconfig.json
  • bindings/react-native-lexe/turbo.json
  • bindings/react-native-lexe/ubrn.config.yaml

Comment thread .gitignore Outdated
Comment thread .gitignore
!bindings/react-native-lexe/android/**
!bindings/react-native-lexe/example/android/
!bindings/react-native-lexe/example/android/**
bindings/react-native-lexe/example/android/app/debug.keystore

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win

Missing ! prefix to track the debug keystore.

This line explicitly ignores the debug.keystore. In React Native projects, the debug keystore is typically committed to version control so that anyone cloning the repository can build the Android example app out-of-the-box without missing keystore errors or signing mismatches.

Given the context, it appears the ! prefix was accidentally omitted.

♻️ Proposed fix
-bindings/react-native-lexe/example/android/app/debug.keystore
+!bindings/react-native-lexe/example/android/app/debug.keystore
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
bindings/react-native-lexe/example/android/app/debug.keystore
!bindings/react-native-lexe/example/android/app/debug.keystore
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.gitignore at line 137, Update the debug.keystore entry in .gitignore to use
the negation prefix, ensuring
bindings/react-native-lexe/example/android/app/debug.keystore is tracked instead
of ignored.

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 2

🧹 Nitpick comments (3)
.github/workflows/build-react-native-lexe.yml (3)

134-143: 🔒 Security & Privacy | 🔵 Trivial | ⚡ Quick win

Manual publish dispatch has no branch/environment gate.

workflow_dispatch.inputs.publish can trigger the publish job from any branch a user can dispatch the workflow on, with no environment protection rule requiring review before the npm-publish secret is used. Consider gating the publish job with a protected GitHub Environment (with required reviewers) so a manual publish can't happen from an untested branch.

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/build-react-native-lexe.yml around lines 134 - 143, Gate
the publish job’s manual-dispatch path with a protected GitHub Environment that
requires reviewers before npm-publish credentials are available. Update the
publish job configuration identified by publish so it references the
repository’s designated protected environment, while preserving the existing
tag-or-input condition and build dependency.

114-123: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low value

Duplicate native-artifact path lists across CI and the verification script.

The set of iOS/Android artifact paths is maintained independently in two places; adding or removing a platform/ABI requires updating both, risking drift.

  • .github/workflows/build-react-native-lexe.yml#L114-L123: derive this for artifact in ... list from a single shared manifest (or reuse verify-native-artifacts.mjs's list, e.g. by having this step invoke a small script that emits the paths) instead of hardcoding it separately.
  • bindings/react-native-lexe/scripts/verify-native-artifacts.mjs#L10-L39: keep this as the canonical source of the artifact list and have the CI step consume it.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/build-react-native-lexe.yml around lines 114 - 123, Use
bindings/react-native-lexe/scripts/verify-native-artifacts.mjs as the canonical
source for native artifact paths, and update its artifact-list export or output
mechanism as needed. In .github/workflows/build-react-native-lexe.yml lines
114-123, replace the duplicated hardcoded for-list with a step that consumes the
canonical list, ensuring additions or removals only require changing
verify-native-artifacts.mjs.

159-169: 🔒 Security & Privacy | 🔵 Trivial | ⚡ Quick win

Use npm trusted publishing here instead of NPM_TOKEN. This job already runs on ubuntu-latest, so it can publish via OIDC: add permissions: id-token: write, remove NODE_AUTH_TOKEN, and configure the package as a GitHub Actions trusted publisher on npm.

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/build-react-native-lexe.yml around lines 159 - 169, Update
the “Publish to npm” workflow step to use npm trusted publishing via GitHub
Actions OIDC: add job-level id-token: write permission, remove the
NODE_AUTH_TOKEN environment variable and its validation, and retain the package
discovery and public npm publish commands. Ensure the corresponding package
trusted publisher is configured on npm.

Source: Linters/SAST tools

🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/build-react-native-lexe.yml:
- Line 44: Update the actions/checkout step in the build workflow to set
persist-credentials to false, while preserving the existing pinned checkout
action and subsequent job behavior.

In `@bindings/react-native-lexe/README.md`:
- Around line 28-48: Make the working-directory transition explicit in the local
installation instructions: after the build commands in the react-native-lexe
setup sequence, show returning to the consuming app directory before running npm
install, or replace the relative package path with a clearly defined
absolute/placeholder checkout path. Ensure the install path is not resolved from
bindings/react-native-lexe.

---

Nitpick comments:
In @.github/workflows/build-react-native-lexe.yml:
- Around line 134-143: Gate the publish job’s manual-dispatch path with a
protected GitHub Environment that requires reviewers before npm-publish
credentials are available. Update the publish job configuration identified by
publish so it references the repository’s designated protected environment,
while preserving the existing tag-or-input condition and build dependency.
- Around line 114-123: Use
bindings/react-native-lexe/scripts/verify-native-artifacts.mjs as the canonical
source for native artifact paths, and update its artifact-list export or output
mechanism as needed. In .github/workflows/build-react-native-lexe.yml lines
114-123, replace the duplicated hardcoded for-list with a step that consumes the
canonical list, ensuring additions or removals only require changing
verify-native-artifacts.mjs.
- Around line 159-169: Update the “Publish to npm” workflow step to use npm
trusted publishing via GitHub Actions OIDC: add job-level id-token: write
permission, remove the NODE_AUTH_TOKEN environment variable and its validation,
and retain the package discovery and public npm publish commands. Ensure the
corresponding package trusted publisher is configured on npm.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: e71e0067-ca59-4cb4-8800-c4bfea97b8f3

📥 Commits

Reviewing files that changed from the base of the PR and between 7e5df68 and e3d5660.

📒 Files selected for processing (9)
  • .github/workflows/build-react-native-lexe.yml
  • .gitignore
  • bindings/react-native-lexe/.gitattributes
  • bindings/react-native-lexe/.gitignore
  • bindings/react-native-lexe/README.md
  • bindings/react-native-lexe/package.json
  • bindings/react-native-lexe/scripts/verify-native-artifacts.mjs
  • bindings/react-native-lexe/ubrn.config.yaml
  • crates/lni/lexe/api.rs
💤 Files with no reviewable changes (1)
  • bindings/react-native-lexe/.gitattributes
🚧 Files skipped from review as they are similar to previous changes (4)
  • bindings/react-native-lexe/ubrn.config.yaml
  • .gitignore
  • bindings/react-native-lexe/package.json
  • crates/lni/lexe/api.rs

Comment thread .github/workflows/build-react-native-lexe.yml Outdated
Comment thread bindings/react-native-lexe/README.md

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🧹 Nitpick comments (1)
bindings/react-native-lexe/scripts/verify-native-identity.mjs (1)

12-28: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low value

Fold read into requireText to avoid redundant failure logs.

Currently, if a file is missing, read pushes a failure and returns an empty string. The script then proceeds to check the empty string for every required text snippet, logging a redundant missing "text" error for each one. Folding the read logic directly into requireText allows returning early to keep CI logs clean.

♻️ Proposed refactor
-function read(relativePath) {
-  const absolutePath = path.join(packageDirectory, relativePath);
-  if (!existsSync(absolutePath)) {
-    failures.push(`${relativePath}: missing`);
-    return '';
-  }
-  return readFileSync(absolutePath, 'utf8');
-}
-
 function requireText(relativePath, requiredText) {
-  const contents = read(relativePath);
+  const absolutePath = path.join(packageDirectory, relativePath);
+  if (!existsSync(absolutePath)) {
+    failures.push(`${relativePath}: missing`);
+    return;
+  }
+  const contents = readFileSync(absolutePath, 'utf8');
   for (const text of requiredText) {
     if (!contents.includes(text)) {
       failures.push(`${relativePath}: missing ${JSON.stringify(text)}`);
     }
   }
 }
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@bindings/react-native-lexe/scripts/verify-native-identity.mjs` around lines
12 - 28, Fold the file-reading logic from read into requireText: construct and
check the absolute path there, record the missing-file failure, and return
immediately when the file is absent. Then validate requiredText only for
successfully read files, and remove the now-unused read function.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In `@bindings/react-native-lexe/scripts/verify-native-identity.mjs`:
- Around line 12-28: Fold the file-reading logic from read into requireText:
construct and check the absolute path there, record the missing-file failure,
and return immediately when the file is absent. Then validate requiredText only
for successfully read files, and remove the now-unused read function.

ℹ️ Review info
⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 600233ff-73fe-4c08-a8c2-6cfed46ca041

📥 Commits

Reviewing files that changed from the base of the PR and between 0613984 and 0e626b3.

⛔ Files ignored due to path filters (1)
  • bindings/react-native-lexe/yarn.lock is excluded by !**/yarn.lock, !**/*.lock
📒 Files selected for processing (8)
  • .github/workflows/build-react-native-lexe.yml
  • bindings/react-native-lexe/README.md
  • bindings/react-native-lexe/example/src/App.tsx
  • bindings/react-native-lexe/package.json
  • bindings/react-native-lexe/scripts/fix-ubrn-cmake.mjs
  • bindings/react-native-lexe/scripts/verify-native-identity.mjs
  • bindings/react-native-lexe/tsconfig.json
  • bindings/react-native-lexe/ubrn.config.yaml
🚧 Files skipped from review as they are similar to previous changes (6)
  • bindings/react-native-lexe/example/src/App.tsx
  • bindings/react-native-lexe/tsconfig.json
  • bindings/react-native-lexe/ubrn.config.yaml
  • bindings/react-native-lexe/README.md
  • .github/workflows/build-react-native-lexe.yml
  • bindings/react-native-lexe/package.json

@ntheile
ntheile merged commit 65ce1c1 into master Jul 21, 2026
3 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant