feat: 階段四 - findings 寫入與 comment 依序發布（舊問題→非嚴重→嚴重）

app/main.js

@@ -2,6 +2,7 @@ import { GITEA_REPOSITORY, PR_NUMBER, PR_HEAD_BRANCH, PR_BASE_BRANCH, getLLMConf
 import { loadRoles, getRoleIntro } from './roles.js';
 import { getPRDiff, postComment } from './gitea.js';
 import { analyzeWithRole, loadOldFindings, mergeFindings, sortByLevel, deduplicateWithAI } from './findings.js';
+import { saveFindings, postOldFindingsComment, postNewNonCriticalComment, postNewCriticalComments } from './comments.js';
 
 const WORKSPACE = process.env.GITHUB_WORKSPACE || '/workspace';
 
@@ -74,8 +75,18 @@ async function main() {
   const sorted = sortByLevel(deduped);
   console.log(`  Step3b dedup findings total=${sorted.length} (critical=${sorted.filter(f=>f.level==='critical').length} warning=${sorted.filter(f=>f.level==='warning').length} info=${sorted.filter(f=>f.level==='info').length})`);
 
-  console.log('\n📝 Step4: Findings 寫入與 Comment 發布（待實作）');
-  console.log('  [stub] 寫入 findings.json，發布 comment...');
+  // Step4: 寫入 findings.json，依序發布 comment
+  console.log('\n📝 Step4: Findings 寫入與 Comment 發布');
+  saveFindings(WORKSPACE, sorted);
+
+  try {
+    await postOldFindingsComment(sorted);
+    await postNewNonCriticalComment(sorted);
+    await postNewCriticalComments(sorted);
+    console.log('  Step4 完成');
+  } catch (e) {
+    console.log(`  ⚠️  comment 發布失敗（繼續執行）: ${e.message}`);
+  }
 
   console.log('\n💾 Step5: 記憶區 Commit/Push（待實作）');
   console.log('  [stub] commit & push findings.json...');