[
  {
    "key": "entrypoint.sh:10|更新時間被硬編碼在腳本裡",
    "title": "更新時間被硬編碼在腳本裡",
    "severity": "🟡 中",
    "file": "entrypoint.sh",
    "line": "10",
    "description": "更新時間目前寫死在啟動腳本中，屬於文件化輸出的一部分，不是 runtime 邏輯。",
    "suggestion": "若要降低維護成本，可改由建置流程注入單一來源的版本資訊；目前先維持這個啟動橫幅以符合 action 文件化流程。",
    "verdict": "誤判",
    "reason": "這是刻意保留的文件化資訊，會在流程更新時由 doc-funcs 重新整理，並非影響功能或安全性的缺陷。",
    "source": "develop...ai-review-resolve/develop-20260711-131608",
    "date": "2026-07-11"
  },
  {
    "key": "src/index.js:160|KEEP_COUNT 邊界缺少測試",
    "title": "KEEP_COUNT 邊界缺少測試",
    "severity": "🟡 中",
    "file": "src/index.js",
    "line": "160",
    "description": "KEEP_COUNT 的整數驗證沒有現成測試覆蓋各種邊界輸入。",
    "suggestion": "若之後補上測試框架，再為非負整數驗證補齊邊界案例。",
    "verdict": "誤判",
    "reason": "目前專案沒有任何測試框架或 package.json，補測試會超出這次清理與修正的範圍。",
    "source": "develop...ai-review-resolve/develop-20260711-131608",
    "date": "2026-07-11"
  },
  {
    "key": "src/index.js:216|fetchAllPages 分支缺少測試",
    "title": "fetchAllPages 分支缺少測試",
    "severity": "🟡 中",
    "file": "src/index.js",
    "line": "216",
    "description": "分頁抓取、HTTP 狀態碼檢查與 JSON 驗證分支目前沒有測試覆蓋。",
    "suggestion": "若之後引入測試框架，再補上分頁、錯誤狀態與格式異常的案例。",
    "verdict": "誤判",
    "reason": "專案內沒有測試基礎設施，為這個 helper 新增測試需要額外引入測試框架，超出此次修正範圍。",
    "source": "develop...ai-review-resolve/develop-20260711-131608",
    "date": "2026-07-11"
  },
  {
    "key": "src/index.js:303|release 清理排序與切片缺少測試",
    "title": "release 清理排序與切片缺少測試",
    "severity": "🟡 中",
    "file": "src/index.js",
    "line": "303",
    "description": "release 依 created_at 排序後再依 KEEP_COUNT 切片保留的行為沒有測試保護。",
    "suggestion": "若後續建立測試框架，再針對亂序輸入與 KEEP_COUNT 邊界補上整合測試。",
    "verdict": "誤判",
    "reason": "目前沒有測試框架可直接承接這些情境測試，這次先專注於修正清理邏輯本身。",
    "source": "develop...ai-review-resolve/develop-20260711-131608",
    "date": "2026-07-11"
  },
  {
    "key": "src/index.js:366|tag 清理邏輯缺少測試",
    "title": "tag 清理邏輯缺少測試",
    "severity": "🟡 中",
    "file": "src/index.js",
    "line": "366",
    "description": "tag 保留與刪除分支沒有對應測試覆蓋。",
    "suggestion": "之後若補測試框架，再驗證對應 release 的 tag 會被保留、其餘 tag 會被刪除。",
    "verdict": "誤判",
    "reason": "專案目前沒有測試基礎設施，先將核心邏輯修正並保留此項為後續技術債。",
    "source": "develop...ai-review-resolve/develop-20260711-131608",
    "date": "2026-07-11"
  },
  {
    "key": "src/index.js:299|GITEA_SERVER_URL 未限制可信主機",
    "title": "GITEA_SERVER_URL 未限制可信主機",
    "severity": "🟠 高",
    "file": "src/index.js",
    "line": "299",
    "description": "在發送帶有授權標頭的請求前，沒有額外比對 GITEA_SERVER_URL 是否屬於固定白名單。",
    "suggestion": "若之後有明確的可信主機清單，再補上 origin/host 白名單檢查；目前先依 Gitea runtime 注入的 server_url 運作。",
    "verdict": "誤判",
    "reason": "這個 action 只會在 Gitea runtime 提供的 `gitea.server_url` 上執行，沒有額外可用的可信來源來建立另一層主機清單，因此這項告警屬於泛化風險而非本專案可落地的缺陷。",
    "source": "develop...ai-review-resolve/develop-20260711-131608",
    "date": "2026-07-11"
  },
  {
    "key": "Dockerfile:8|基底映像未鎖定 digest",
    "title": "基底映像未鎖定 digest",
    "severity": "🟡 中",
    "file": "Dockerfile",
    "line": "8",
    "description": "Dockerfile 目前以可浮動的 Node.js 標籤作為基底映像。",
    "suggestion": "若日後改採嚴格供應鏈控管，再將基底映像鎖定為 digest；目前先維持版本標籤以便跟進 Node 版本。",
    "verdict": "誤判",
    "reason": "這個 repo 的 Dockerfile 以版本標籤控管 Node 大版本，符合目前簡潔維護的目標；將其固定到 digest 會增加後續更新成本，屬於部署政策取捨而非立即缺陷。",
    "source": "develop...ai-review-resolve/develop-20260711-131608",
    "date": "2026-07-11"
  },
  {
    "key": "src/index.js:1|檔案責任切分過於集中",
    "title": "檔案責任切分過於集中",
    "severity": "🟡 中",
    "file": "src/index.js",
    "line": "1",
    "description": "單一檔案同時承擔 logger、驗證、HTTP client 與清理流程。",
    "suggestion": "若之後擴充出更大的功能，再考慮拆分成獨立模組。",
    "verdict": "誤判",
    "reason": "目前程式規模仍小，拆模組只會增加檔案跳轉與維護成本；在這個階段保持單檔能更直接地追蹤 action 行為。",
    "source": "develop...ai-review-resolve/develop-20260711-131608",
    "date": "2026-07-11"
  },
  {
    "key": "src/index.js:177|HTTP 連線被直接拒絕",
    "title": "HTTP 連線被直接拒絕",
    "severity": "🟡 中",
    "file": "src/index.js",
    "line": "177",
    "description": "request helper 只允許 HTTPS，遇到 HTTP 端點會直接失敗。",
    "suggestion": "若之後需要支援 HTTP 自架環境，再把協定限制做成可配置；目前先維持 HTTPS-only。",
    "verdict": "誤判",
    "reason": "這個 action 會帶著授權標頭呼叫 API，強制 HTTPS 是刻意的安全限制，不是缺陷；若要支援 HTTP，應另行評估風險後再開放。",
    "source": "develop...ai-review-resolve/develop-20260711-131608",
    "date": "2026-07-11"
  },
  {
    "key": "src/index.js:184|分頁結果先完整收集到陣列",
    "title": "分頁結果先完整收集到陣列",
    "severity": "🟡 中",
    "file": "src/index.js",
    "line": "184",
    "description": "fetchAllPages 會把所有頁面合併到單一陣列後再交給後續流程。",
    "suggestion": "若未來資料量大幅成長，再考慮改成串流處理或分段消耗。",
    "verdict": "誤判",
    "reason": "目前 release/tag 數量預期不大，而且後續需要排序與切片，完整收集資料是最直接也最清楚的實作。",
    "source": "develop...ai-review-resolve/develop-20260711-131608",
    "date": "2026-07-11"
  },
  {
    "location": "src/index.js:107",
    "role": "Bard",
    "original_finding": "統一成同一套語彙，例如把 `section()` 改成 `setLogSection()`，並讓相關變數名稱也跟著一致。",
    "reason": "AI 對話收斂判定為誤報（問題在最新程式碼中不成立或不適用）"
  },
  {
    "location": "src/index.js:363",
    "role": "Rogue",
    "original_finding": "改用固定大小的 top-K 選擇策略，例如維持一個大小為 `KEEP_COUNT` 的最小堆，或在 API 已經有新到舊順序時直接取前 `KEEP_COUNT` 筆，避免整體排序。",
    "reason": "release 數量預期不大，全量排序成本可忽略；後續同時需要「保留的前 K 筆」與「其餘待刪清單」，一次排序是最直接清楚的實作，引入 top-K 堆反而增加複雜度（與既有「分頁結果先完整收集到陣列」的排除理由一致）。",
    "source": "develop...ai-review-resolve/develop-20260711-131608",
    "date": "2026-07-15"
  }
]