Migrate Danger to Danger Swift and drop the Gemfile - #1903
Merged
Conversation
The Danger workflow was deleted in e57a91b (Sept 2023), so Danger has not run on any PR since. The Ruby Dangerfile had also gone stale: it pointed swiftlint.binary_path at a SwiftLint artifactbundle that was removed along with the SPM plugins in 6bb47d5. The only remaining effect of the Gemfile was recurring Dependabot bumps for a toolchain nobody ran. Port the Dangerfile to Swift and restore the workflow: - All five checks carry over: draft PR, [WIP] title, empty description, missing CHANGELOG entry, and >1000 lines of code. - Danger Swift has no git.lines_of_code, so the PR size check sums the additions and deletions reported by the GitHub API instead. - SwiftLint is embedded in Danger Swift itself, so linting is restored without adding anything to Package.swift. The library manifest stays clean for consumers. - The runner installs danger-swift and swiftlint via Homebrew. Neither is preinstalled on the arm64 images, only on the Intel ones. - Checkout stays shallow. On GitHub, Danger builds its whole git DSL from the API rather than from local history. Also bump the LICENSE copyright range, which was two years stale.
Homebrew 6 refuses to load formulae from untrusted third party taps. Naming danger-swift on the install line auto-trusts only that formula, not the danger-js dependency it pulls from the same tap.
The Homebrew tap ships danger-js as a pkg bundle with an embedded Node whose undici cannot read the GitHub API response stream, failing every fetch with 'TypeError: terminated'. Install danger-js from npm so it runs on the runner's Node, and point danger-swift at it explicitly to avoid clashing with the binary the tap installs as a dependency.
Danger sets a commit status alongside its comment, which needs the statuses scope. Without it the run logs 'Could not add a commit status' and relies on the exit code alone.
The Danger job installs danger-js with npm, which drops node_modules and package-lock.json into the working directory. Both are ephemeral on CI but show up as untracked when running Danger locally.
martinpucik
marked this pull request as ready for review
August 2, 2026 09:49
martinpucik
enabled auto-merge
August 2, 2026 09:49
martinpucik
disabled auto-merge
August 2, 2026 09:50
The default pull_request activity types are opened, synchronize and reopened, so marking a Pull Request ready for review did not trigger Danger. Its draft warning stayed on the comment until the next push.
martinpucik
enabled auto-merge
August 2, 2026 09:54
Kaspik
approved these changes
Aug 2, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What does this implement/fix? Explain your changes.
Danger has not actually run on any PR since
.github/workflows/danger.ymlwas deleted in e57a91b (Sept 2023). The RubyDangerfilehad gone stale alongside it — it pointedswiftlint.binary_pathat a SwiftLint artifactbundle that disappeared with the SPM plugins in 6bb47d5. The Gemfile's only remaining effect was recurring Dependabot bumps for a toolchain nobody ran.This ports the Dangerfile to Swift and restores the workflow.
All five checks carry over:
github.pr_json["mergeable_state"] == "draft"pullRequest.draft == truegithub.pr_title.include? "[WIP]"pullRequest.title.contains("[WIP]")github.pr_body.length < 5(pullRequest.body ?? "").count < 5git.modified_files.include?("CHANGELOG.md")danger.git.modifiedFiles.contains(...)git.lines_of_code > 1000(additions ?? 0) + (deletions ?? 0)Danger Swift has no
lines_of_code, so PR size sums the additions/deletions reported by the API — the same number Ruby computed.Package.swiftis deliberately untouched. SwiftLint ships embedded in Danger Swift, so linting is restored without adding any dependency that MessageKit consumers would have to resolve.Notes on the workflow:
brew install danger/tap/danger-swift swiftlint— neither is preinstalled on the arm64 runner images, only on the Intel ones.permissions: pull-requests: writeso Danger can post its report.Also bumps the LICENSE copyright range, which was two years stale.
Does this close any currently open issues?
No.
Any other comments?
Opened as a draft on purpose — it doubles as a live test of the new job, since the draft state should produce a
PR is marked as Draftwarning without failing the run.Where has this been tested?
Locally, ahead of this PR:
Dangerfile.swiftcompiles against Danger 3.22.1 (built in a scratch SPM package, since it is not part ofPackage.swift)..swiftlint.ymlparses and lints the wholeSourcestree clean on SwiftLint 0.65.0 — the exact version Homebrew installs — so this should not bury the next PR in pre-existing violations.The end-to-end
danger-swift cirun can only be verified by this PR itself.🤖 Generated with Claude Code