155 lines
8.6 KiB
JSON
155 lines
8.6 KiB
JSON
[
|
|
{
|
|
"key": "entrypoint.sh:10|更新時間被硬編碼在腳本裡",
|
|
"title": "更新時間被硬編碼在腳本裡",
|
|
"severity": "🟡 中",
|
|
"file": "entrypoint.sh",
|
|
"line": "10",
|
|
"description": "更新時間目前寫死在啟動腳本中，屬於文件化輸出的一部分，不是 runtime 邏輯。",
|
|
"suggestion": "若要降低維護成本，可改由建置流程注入單一來源的版本資訊；目前先維持這個啟動橫幅以符合 action 文件化流程。",
|
|
"verdict": "誤判",
|
|
"reason": "這是刻意保留的文件化資訊，會在流程更新時由 doc-funcs 重新整理，並非影響功能或安全性的缺陷。",
|
|
"source": "develop...ai-review-resolve/develop-20260711-131608",
|
|
"date": "2026-07-11"
|
|
},
|
|
{
|
|
"key": "src/index.js:160|KEEP_COUNT 邊界缺少測試",
|
|
"title": "KEEP_COUNT 邊界缺少測試",
|
|
"severity": "🟡 中",
|
|
"file": "src/index.js",
|
|
"line": "160",
|
|
"description": "KEEP_COUNT 的整數驗證沒有現成測試覆蓋各種邊界輸入。",
|
|
"suggestion": "若之後補上測試框架，再為非負整數驗證補齊邊界案例。",
|
|
"verdict": "誤判",
|
|
"reason": "目前專案沒有任何測試框架或 package.json，補測試會超出這次清理與修正的範圍。",
|
|
"source": "develop...ai-review-resolve/develop-20260711-131608",
|
|
"date": "2026-07-11"
|
|
},
|
|
{
|
|
"key": "src/index.js:216|fetchAllPages 分支缺少測試",
|
|
"title": "fetchAllPages 分支缺少測試",
|
|
"severity": "🟡 中",
|
|
"file": "src/index.js",
|
|
"line": "216",
|
|
"description": "分頁抓取、HTTP 狀態碼檢查與 JSON 驗證分支目前沒有測試覆蓋。",
|
|
"suggestion": "若之後引入測試框架，再補上分頁、錯誤狀態與格式異常的案例。",
|
|
"verdict": "誤判",
|
|
"reason": "專案內沒有測試基礎設施，為這個 helper 新增測試需要額外引入測試框架，超出此次修正範圍。",
|
|
"source": "develop...ai-review-resolve/develop-20260711-131608",
|
|
"date": "2026-07-11"
|
|
},
|
|
{
|
|
"key": "src/index.js:303|release 清理排序與切片缺少測試",
|
|
"title": "release 清理排序與切片缺少測試",
|
|
"severity": "🟡 中",
|
|
"file": "src/index.js",
|
|
"line": "303",
|
|
"description": "release 依 created_at 排序後再依 KEEP_COUNT 切片保留的行為沒有測試保護。",
|
|
"suggestion": "若後續建立測試框架，再針對亂序輸入與 KEEP_COUNT 邊界補上整合測試。",
|
|
"verdict": "誤判",
|
|
"reason": "目前沒有測試框架可直接承接這些情境測試，這次先專注於修正清理邏輯本身。",
|
|
"source": "develop...ai-review-resolve/develop-20260711-131608",
|
|
"date": "2026-07-11"
|
|
},
|
|
{
|
|
"key": "src/index.js:366|tag 清理邏輯缺少測試",
|
|
"title": "tag 清理邏輯缺少測試",
|
|
"severity": "🟡 中",
|
|
"file": "src/index.js",
|
|
"line": "366",
|
|
"description": "tag 保留與刪除分支沒有對應測試覆蓋。",
|
|
"suggestion": "之後若補測試框架，再驗證對應 release 的 tag 會被保留、其餘 tag 會被刪除。",
|
|
"verdict": "誤判",
|
|
"reason": "專案目前沒有測試基礎設施，先將核心邏輯修正並保留此項為後續技術債。",
|
|
"source": "develop...ai-review-resolve/develop-20260711-131608",
|
|
"date": "2026-07-11"
|
|
},
|
|
{
|
|
"key": "src/index.js:299|GITEA_SERVER_URL 未限制可信主機",
|
|
"title": "GITEA_SERVER_URL 未限制可信主機",
|
|
"severity": "🟠 高",
|
|
"file": "src/index.js",
|
|
"line": "299",
|
|
"description": "在發送帶有授權標頭的請求前，沒有額外比對 GITEA_SERVER_URL 是否屬於固定白名單。",
|
|
"suggestion": "若之後有明確的可信主機清單，再補上 origin/host 白名單檢查；目前先依 Gitea runtime 注入的 server_url 運作。",
|
|
"verdict": "誤判",
|
|
"reason": "這個 action 只會在 Gitea runtime 提供的 `gitea.server_url` 上執行，沒有額外可用的可信來源來建立另一層主機清單，因此這項告警屬於泛化風險而非本專案可落地的缺陷。",
|
|
"source": "develop...ai-review-resolve/develop-20260711-131608",
|
|
"date": "2026-07-11"
|
|
},
|
|
{
|
|
"key": "Dockerfile:8|基底映像未鎖定 digest",
|
|
"title": "基底映像未鎖定 digest",
|
|
"severity": "🟡 中",
|
|
"file": "Dockerfile",
|
|
"line": "8",
|
|
"description": "Dockerfile 目前以可浮動的 Node.js 標籤作為基底映像。",
|
|
"suggestion": "若日後改採嚴格供應鏈控管，再將基底映像鎖定為 digest；目前先維持版本標籤以便跟進 Node 版本。",
|
|
"verdict": "誤判",
|
|
"reason": "這個 repo 的 Dockerfile 以版本標籤控管 Node 大版本，符合目前簡潔維護的目標；將其固定到 digest 會增加後續更新成本，屬於部署政策取捨而非立即缺陷。",
|
|
"source": "develop...ai-review-resolve/develop-20260711-131608",
|
|
"date": "2026-07-11"
|
|
},
|
|
{
|
|
"key": "src/index.js:1|檔案責任切分過於集中",
|
|
"title": "檔案責任切分過於集中",
|
|
"severity": "🟡 中",
|
|
"file": "src/index.js",
|
|
"line": "1",
|
|
"description": "單一檔案同時承擔 logger、驗證、HTTP client 與清理流程。",
|
|
"suggestion": "若之後擴充出更大的功能，再考慮拆分成獨立模組。",
|
|
"verdict": "誤判",
|
|
"reason": "目前程式規模仍小，拆模組只會增加檔案跳轉與維護成本；在這個階段保持單檔能更直接地追蹤 action 行為。",
|
|
"source": "develop...ai-review-resolve/develop-20260711-131608",
|
|
"date": "2026-07-11"
|
|
},
|
|
{
|
|
"key": "src/index.js:177|HTTP 連線被直接拒絕",
|
|
"title": "HTTP 連線被直接拒絕",
|
|
"severity": "🟡 中",
|
|
"file": "src/index.js",
|
|
"line": "177",
|
|
"description": "request helper 只允許 HTTPS，遇到 HTTP 端點會直接失敗。",
|
|
"suggestion": "若之後需要支援 HTTP 自架環境，再把協定限制做成可配置；目前先維持 HTTPS-only。",
|
|
"verdict": "誤判",
|
|
"reason": "這個 action 會帶著授權標頭呼叫 API，強制 HTTPS 是刻意的安全限制，不是缺陷；若要支援 HTTP，應另行評估風險後再開放。",
|
|
"source": "develop...ai-review-resolve/develop-20260711-131608",
|
|
"date": "2026-07-11"
|
|
},
|
|
{
|
|
"key": "src/index.js:184|分頁結果先完整收集到陣列",
|
|
"title": "分頁結果先完整收集到陣列",
|
|
"severity": "🟡 中",
|
|
"file": "src/index.js",
|
|
"line": "184",
|
|
"description": "fetchAllPages 會把所有頁面合併到單一陣列後再交給後續流程。",
|
|
"suggestion": "若未來資料量大幅成長，再考慮改成串流處理或分段消耗。",
|
|
"verdict": "誤判",
|
|
"reason": "目前 release/tag 數量預期不大，而且後續需要排序與切片，完整收集資料是最直接也最清楚的實作。",
|
|
"source": "develop...ai-review-resolve/develop-20260711-131608",
|
|
"date": "2026-07-11"
|
|
},
|
|
{
|
|
"location": "src/index.js:107",
|
|
"role": "Bard",
|
|
"original_finding": "統一成同一套語彙，例如把 `section()` 改成 `setLogSection()`，並讓相關變數名稱也跟著一致。",
|
|
"reason": "AI 對話收斂判定為誤報（問題在最新程式碼中不成立或不適用）"
|
|
},
|
|
{
|
|
"location": "src/index.js:363",
|
|
"role": "Rogue",
|
|
"original_finding": "改用固定大小的 top-K 選擇策略，例如維持一個大小為 `KEEP_COUNT` 的最小堆，或在 API 已經有新到舊順序時直接取前 `KEEP_COUNT` 筆，避免整體排序。",
|
|
"reason": "release 數量預期不大，全量排序成本可忽略；後續同時需要「保留的前 K 筆」與「其餘待刪清單」，一次排序是最直接清楚的實作，引入 top-K 堆反而增加複雜度（與既有「分頁結果先完整收集到陣列」的排除理由一致）。",
|
|
"source": "develop...ai-review-resolve/develop-20260711-131608",
|
|
"date": "2026-07-15"
|
|
},
|
|
{
|
|
"location": "src/index.js:317",
|
|
"role": "Assassin",
|
|
"original_finding": "例外訊息只保留 HTTP 狀態碼與請求目標，不要預設帶回應 body；若真的需要除錯資訊，改成在受控的 debug 模式下才輸出，而且要先過濾敏感欄位並更短截斷。",
|
|
"reason": "已有等價防護：回應摘要先經 sanitizeLogText 去除控制字元（無法注入換行／ANSI 偽造 log），再截斷至 200 字；請求對象是參數檢查階段驗證過的 HTTPS Gitea 端點，非任意外部來源。保留截斷後的錯誤摘要對排查 API 失敗（如 403 權限訊息）必要，移除反而增加維運成本。",
|
|
"source": "develop...master",
|
|
"date": "2026-07-15"
|
|
}
|
|
]
|