Merge pull request '分組保留 KEEP_COUNT 與移除 RUNNER_TOKEN' (#5) from develop into master

Reviewed-on: #5

.gitea/ai-review/exclusions.json

@@ -150,5 +150,21 @@
     "reason": "已有等價防護：回應摘要先經 sanitizeLogText 去除控制字元（無法注入換行／ANSI 偽造 log），再截斷至 200 字；請求對象是參數檢查階段驗證過的 HTTPS Gitea 端點，非任意外部來源。保留截斷後的錯誤摘要對排查 API 失敗（如 403 權限訊息）必要，移除反而增加維運成本。",
     "source": "develop...master",
     "date": "2026-07-15"
+  },
+  {
+    "location": "action.yml:40",
+    "role": "Maya",
+    "original_finding": "補一個整合測試或 action 介面測試，驗證執行時確實會把 `gitea.token` 帶進 `process.env.GITEA_TOKEN`，且不再依賴舊的 `RUNNER_TOKEN` 輸入。",
+    "reason": "專案目前沒有任何測試框架或 package.json，為 action 介面契約補整合測試需要先建立測試基礎設施，超出本次修正範圍（與既有多筆測試覆蓋類排除一致）；此契約已由 CI 實際執行驗證（自動 token 成功清理 release/tag）。",
+    "source": "develop...ai-review-resolve/develop-20260715-133726",
+    "date": "2026-07-15"
+  },
+  {
+    "location": "src/index.js:426",
+    "role": "Maya",
+    "original_finding": "補一個有 token 的案例，驗證 log 只會出現 `[redacted]`，而實際送出的 header 會是 `token ${GITEA_TOKEN}`，同時不要把明文 token 暴露到輸出中。",
+    "reason": "專案目前沒有測試基礎設施，補授權分支的測試屬後續技術債（與既有多筆測試覆蓋類排除一致）；遮蔽輸出為固定字面值 [redacted]，不經任何插值，明文外洩風險已由程式結構排除。",
+    "source": "develop...ai-review-resolve/develop-20260715-133726",
+    "date": "2026-07-15"
   }
 ]

action.yml

@@ -1,5 +1,5 @@
 # 檔案用途：定義 CLEANUP OLD RELEASES 這個 Docker action 的輸入參數與執行環境
-# 更新日期：2026/07/11 21:02:25
+# 更新日期：2026/07/15 13:05:00
 
 # Action 名稱，會顯示在 action 市集與文件中
 name: 'CLEANUP OLD RELEASES'
@@ -12,14 +12,10 @@ author: 'Jeffery'
 
 # 定義可由使用者或呼叫端傳入的輸入參數
 inputs:
-  # RUNNER_TOKEN 用於授權呼叫 Gitea API；未提供時會改用 secrets
-  RUNNER_TOKEN:
-    # 參數說明，讓呼叫端知道這是 Runner Token
-    description: 'Gitea Runner Token'
-  # KEEP_COUNT 用於控制保留的 release 數量
+  # KEEP_COUNT 用於控制保留的 release 數量；正式版與預發行版（prerelease）分組各自保留這個數量
   KEEP_COUNT:
-    # 參數說明，這裡表示保留的版本數量
-    description: '保留的版本數量'
+    # 參數說明，這裡表示每組（正式版／預發行版）各自保留的版本數量
+    description: '保留的版本數量（正式版與預發行版各自保留）'
     # 預設保留 2 個版本，避免完全刪除歷史 release
     default: '2'
 
@@ -35,7 +31,7 @@ runs:
     GITEA_SERVER_URL: ${{ gitea.server_url }}
     # GITEA_REPOSITORY 由 Gitea runtime 注入，供程式指定目標 repo
     GITEA_REPOSITORY: ${{ gitea.repository }}
-    # 優先使用傳入的 RUNNER_TOKEN，否則退回 Gitea token secrets
-    RUNNER_TOKEN: ${{ inputs.RUNNER_TOKEN || secrets.GITEA_TOKEN || secrets.RUNNER_TOKEN }}
+    # 使用 Gitea runtime 自動核發的 token，權限僅限當前 repo 且 job 結束即失效
+    GITEA_TOKEN: ${{ gitea.token }}
     # KEEP_COUNT 直接沿用輸入值，交由程式驗證
     KEEP_COUNT: ${{ inputs.KEEP_COUNT }}

src/index.js

@@ -395,12 +395,12 @@ function hasBatchFailure(results) {
 }
 
 /**
- * 執行 release 與 tag 清理流程。
+ * 執行 release 與 tag 清理流程；正式版與預發行版（prerelease）分組計算，各自保留最新 `KEEP_COUNT` 筆。
  */
 async function main() {
   const GITEA_SERVER_URL = normalizeEnvValue(process.env.GITEA_SERVER_URL);
   const GITEA_REPOSITORY = normalizeEnvValue(process.env.GITEA_REPOSITORY);
-  const RUNNER_TOKEN = normalizeEnvValue(process.env.RUNNER_TOKEN) ?? '';
+  const GITEA_TOKEN = normalizeEnvValue(process.env.GITEA_TOKEN) ?? '';
   const KEEP_COUNT = normalizeEnvValue(process.env.KEEP_COUNT) ?? '';
   const MAX_PAGES = normalizeEnvValue(process.env.MAX_PAGES) ?? '';
 
@@ -421,11 +421,11 @@ async function main() {
 
   const keepCount = Number(KEEP_COUNT);
   const authHeaders = {};
-  if (isEmptyOrNull(RUNNER_TOKEN)) {
-    warn('RUNNER_TOKEN is empty; release API calls will be anonymous');
+  if (isEmptyOrNull(GITEA_TOKEN)) {
+    warn('GITEA_TOKEN is empty; release API calls will be anonymous');
   } else {
-    info('RUNNER_TOKEN=[redacted]');
-    authHeaders.Authorization = `token ${RUNNER_TOKEN}`;
+    info('GITEA_TOKEN=[redacted]');
+    authHeaders.Authorization = `token ${GITEA_TOKEN}`;
   }
 
   const serverBase = new URL(GITEA_SERVER_URL);
@@ -454,16 +454,21 @@ async function main() {
     return 0;
   });
 
-  const releaseCount = releaseJson.length;
-  info(`RELEASE_COUNT=${releaseCount}`);
+  const stableReleases = releaseJson.filter((item) => !item?.prerelease);
+  const preReleases = releaseJson.filter((item) => item?.prerelease);
+
+  info(`RELEASE_COUNT=${releaseJson.length}`);
+  info(`STABLE_COUNT=${stableReleases.length}`);
+  info(`PRERELEASE_COUNT=${preReleases.length}`);
   info(`KEEP_COUNT=${KEEP_COUNT}`);
 
-  if (releaseCount <= keepCount) {
+  const releaseToKeep = [...stableReleases.slice(0, keepCount), ...preReleases.slice(0, keepCount)];
+  const releaseToDelete = [...stableReleases.slice(keepCount), ...preReleases.slice(keepCount)];
+
+  if (releaseToDelete.length === 0) {
     info('沒有需要清理的舊版本成品');
   } else {
     section('刪除舊版本成品');
-
-    const releaseToDelete = releaseJson.slice(keepCount);
     const releaseResults = await processInBatches(releaseToDelete, DELETE_CONCURRENCY, async (releaseItem) => {
       const releaseId = releaseItem?.id;
       if (!Number.isSafeInteger(releaseId) || releaseId <= 0) {
@@ -496,8 +501,7 @@ async function main() {
   section('刪除未指定 release 的 tag');
 
   const releaseTags = new Set(
-    releaseJson
-      .slice(0, keepCount)
+    releaseToKeep
       .map((item) => item?.tag_name)
       .filter((tag) => !isEmptyOrNull(tag)),
   );