diff --git a/app/git.js b/app/git.js
index 7634ffb..ed80d20 100644
--- a/app/git.js
+++ b/app/git.js
@@ -1,8 +1,11 @@
-import { execSync } from 'child_process';
+import { spawnSync } from 'child_process';
 import { GITEA_SERVER_URL, GITEA_REPOSITORY, GITEA_TOKEN, PR_HEAD_BRANCH, FINDINGS_PATH } from './config.js';
 
-function exec(cmd, cwd) {
-  return execSync(cmd, { cwd, stdio: 'pipe' }).toString().trim();
+function git(args, cwd) {
+  const result = spawnSync('git', args, { cwd, encoding: 'utf8' });
+  if (result.error) throw result.error;
+  if (result.status !== 0) throw new Error(result.stderr || result.stdout);
+  return (result.stdout || '').trim();
 }
 
 /**
@@ -10,33 +13,24 @@ function exec(cmd, cwd) {
  */
 export function commitAndPush(workspace) {
   const repoDir = `${workspace}/${GITEA_REPOSITORY}`;
-  const remoteUrl = `${GITEA_SERVER_URL.replace(/\/$/, '')}/${GITEA_REPOSITORY}.git`
-    .replace('https://', `https://${GITEA_TOKEN}@`);
+  const remoteUrl = GITEA_SERVER_URL.replace(/\/$/, '').replace('https://', `https://${GITEA_TOKEN}@`) + `/${GITEA_REPOSITORY}.git`;
 
   try {
-    // 設定 git 身份
-    exec('git config user.email "ai-review[bot]@gitea"', repoDir);
-    exec('git config user.name "AI Review Bot"', repoDir);
+    git(['config', 'user.email', 'ai-review[bot]@gitea'], repoDir);
+    git(['config', 'user.name', 'AI Review Bot'], repoDir);
+    git(['fetch', 'origin', PR_HEAD_BRANCH], repoDir);
+    git(['checkout', PR_HEAD_BRANCH], repoDir);
+    git(['add', FINDINGS_PATH], repoDir);
 
-    // 切換到來源分支
-    exec(`git fetch origin ${PR_HEAD_BRANCH}`, repoDir);
-    exec(`git checkout ${PR_HEAD_BRANCH}`, repoDir);
-
-    // 確認 findings.json 存在
-    exec(`git add ${FINDINGS_PATH}`, repoDir);
-
-    // 檢查是否有變更
-    const status = exec('git status --porcelain', repoDir);
+    const status = git(['status', '--porcelain'], repoDir);
     if (!status) {
       console.log('  findings.json 無變更，跳過 commit');
       return;
     }
 
-    const commitMsg = 'chore: update ai-review findings [skip ci]';
-    const commitHash = exec(`git commit -m "${commitMsg}"`, repoDir)
-      .match(/\[.+ ([a-f0-9]+)\]/)?.[1] || 'unknown';
-
-    exec(`git push ${remoteUrl} ${PR_HEAD_BRANCH}`, repoDir);
+    const out = git(['commit', '-m', 'chore: update ai-review findings [skip ci]'], repoDir);
+    const commitHash = out.match(/\[.+ ([a-f0-9]+)\]/)?.[1] || 'unknown';
+    git(['push', remoteUrl, PR_HEAD_BRANCH], repoDir);
     console.log(`  ✅ persisted findings  commit=${commitHash}  push=${PR_HEAD_BRANCH}`);
   } catch (e) {
     console.log(`  ⚠️  Runner failed: commit/push 失敗: ${e.message}`);