From 1b7aeedfdb3c827360cc08e55e4c43a1f4b3dd04 Mon Sep 17 00:00:00 2001 From: Jeffery Date: Tue, 12 May 2026 07:09:20 +0000 Subject: [PATCH 01/17] feat: support multiple API keys for LLM providers, allowing automatic key rotation on failure --- .gitea/workflows/review.yaml | 2 +- README.md | 11 ++++++----- TODO.md | 5 +++++ app/config.js | 22 ++++++++++++++-------- app/config.test.js | 13 ++++++++++--- app/llm.js | 30 +++++++++++++++++++----------- 6 files changed, 55 insertions(+), 28 deletions(-) diff --git a/.gitea/workflows/review.yaml b/.gitea/workflows/review.yaml index b2ca93a..6fbcb0b 100644 --- a/.gitea/workflows/review.yaml +++ b/.gitea/workflows/review.yaml @@ -33,7 +33,7 @@ jobs: - name: AI Code Review uses: https://gitea.jsc.idv.tw/jiantw83/code-review@v${{ needs.version.outputs.version }} with: - GEMINI_API_KEY: ${{ secrets.GEMINI_API_KEY_1 }} + GEMINI_API_KEY: ${{ secrets.GEMINI_API_KEY }},${{ secrets.GEMINI_API_KEY_1 }},${{ secrets.GEMINI_API_KEY_2 }},${{ secrets.GEMINI_API_KEY_3 }},${{ secrets.GEMINI_API_KEY_4 }},${{ secrets.GEMINI_API_KEY_5 }},${{ secrets.GEMINI_API_KEY_6 }},${{ secrets.GEMINI_API_KEY_7 }},${{ secrets.GEMINI_API_KEY_8 }},${{ secrets.GEMINI_API_KEY_9 }} GEMINI_BASE_URL: https://generativelanguage.googleapis.com/v1beta GEMINI_MODEL: ${{ vars.GEMINI_MODEL }} permissions: diff --git a/README.md b/README.md index dd5d383..745001c 100644 --- a/README.md +++ b/README.md @@ -21,6 +21,7 @@ 3. Comment 加上些許 emoji 讓資訊有點活力 4. 盡量將應用程式放在 ./app，修改 entrypoint.sh 與 Dockerfile 讓程式可以正常運行 5. 將提示詞放到 ./app/prompts 內供程式讀取 +6. API Key 支援逗號分隔傳入多個，依序嘗試，失敗時自動換下一個，全部失敗則 exit 1 # 使用說明 @@ -42,7 +43,7 @@ jobs: - name: AI Code Review uses: https://gitea.jsc.idv.tw/jiantw83/code-review@${{ vars.ACTION_CODE_REVIEW_VERSION }} with: - OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }} + OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }} # 支援逗號分隔多個 Key OPENAI_BASE_URL: https://api.openai.com/v1 OPENAI_MODEL: ${{ vars.OPENAI_MODEL }} permissions: @@ -65,7 +66,7 @@ jobs: - name: AI Code Review uses: https://gitea.jsc.idv.tw/jiantw83/code-review@${{ vars.ACTION_CODE_REVIEW_VERSION }} with: - OPENAI_API_KEY: ${{ secrets.OPENROUTER_API_KEY }} # OpenRouter 使用 OpenAI 相容介面，以 OPENAI_API_KEY 傳入 + OPENAI_API_KEY: ${{ secrets.OPENROUTER_API_KEY }} # OpenRouter 使用 OpenAI 相容介面，以 OPENAI_API_KEY 傳入，支援逗號分隔多個 Key OPENAI_BASE_URL: https://openrouter.ai/api/v1 OPENAI_MODEL: ${{ vars.OPENROUTER_MODEL }} permissions: @@ -88,7 +89,7 @@ jobs: - name: AI Code Review uses: https://gitea.jsc.idv.tw/jiantw83/code-review@${{ vars.ACTION_CODE_REVIEW_VERSION }} with: - CLAUDE_API_KEY: ${{ secrets.CLAUDE_API_KEY }} + CLAUDE_API_KEY: ${{ secrets.CLAUDE_API_KEY }} # 支援逗號分隔多個 Key CLAUDE_BASE_URL: https://api.anthropic.com/v1 permissions: contents: write @@ -110,7 +111,7 @@ jobs: - name: AI Code Review uses: https://gitea.jsc.idv.tw/jiantw83/code-review@${{ vars.ACTION_CODE_REVIEW_VERSION }} with: - GEMINI_API_KEY: ${{ secrets.GEMINI_API_KEY }} + GEMINI_API_KEY: ${{ secrets.GEMINI_API_KEY }},${{ secrets.GEMINI_API_KEY_1 }},${{ secrets.GEMINI_API_KEY_2 }},${{ secrets.GEMINI_API_KEY_3 }},${{ secrets.GEMINI_API_KEY_4 }},${{ secrets.GEMINI_API_KEY_5 }},${{ secrets.GEMINI_API_KEY_6 }},${{ secrets.GEMINI_API_KEY_7 }},${{ secrets.GEMINI_API_KEY_8 }},${{ secrets.GEMINI_API_KEY_9 }} GEMINI_BASE_URL: https://generativelanguage.googleapis.com/v1beta GEMINI_MODEL: ${{ vars.GEMINI_MODEL }} permissions: @@ -133,7 +134,7 @@ jobs: - name: AI Code Review uses: https://gitea.jsc.idv.tw/jiantw83/code-review@${{ vars.ACTION_CODE_REVIEW_VERSION }} with: - AMAZONQ_API_KEY: ${{ secrets.AMAZONQ_API_KEY }} + AMAZONQ_API_KEY: ${{ secrets.AMAZONQ_API_KEY }} # 支援逗號分隔多個 Key AMAZONQ_BASE_URL: https://q.api.aws permissions: contents: write diff --git a/TODO.md b/TODO.md index 540a5c0..c605eac 100644 --- a/TODO.md +++ b/TODO.md @@ -35,6 +35,11 @@ - 驗收：log 中能看到「critical 問題存在，workflow 結束（exit 1）」等明確訊息，且 workflow 狀態為失敗。 - 完成 +## 階段八：API Key 輪替 +- 目標：所有平台的 API Key 支援逗號分隔傳入多個，依序嘗試，單一 Key 失敗時自動換下一個，全部失敗則 exit 1。 +- 驗收：log 中能看到「key[N/M] 失敗」等訊息，換 key 後繼續執行；傳入單一 Key 時行為與原本相同；全部 Key 失敗時 log「所有 API Key 均失敗，終止流程」且 workflow 狀態為失敗。 +- 完成 + --- 所有階段驗收通過。 diff --git a/app/config.js b/app/config.js index 3dc350e..c8212e3 100644 --- a/app/config.js +++ b/app/config.js @@ -8,16 +8,22 @@ export const PR_BASE_BRANCH = process.env.PR_BASE_BRANCH || ''; export const FINDINGS_PATH = '.gitea/ai-review/findings.json'; export const EXCLUSIONS_PATH = '.gitea/ai-review/exclusions.json'; +/** 將逗號分隔的 API key 字串拆成陣列 */ +function splitKeys(value) { + if (!value) return []; + return value.split(',').map(k => k.trim()).filter(Boolean); +} + export function getLLMConfig() { const checks = [ - ['openai', process.env.OPENAI_API_KEY, process.env.OPENAI_BASE_URL || 'https://api.openai.com/v1', process.env.OPENAI_MODEL || 'gpt-4o-mini'], - ['claude', process.env.CLAUDE_API_KEY, process.env.CLAUDE_BASE_URL || 'https://api.anthropic.com/v1', process.env.CLAUDE_MODEL || 'claude-3-haiku-20240307'], - ['gemini', process.env.GEMINI_API_KEY, process.env.GEMINI_BASE_URL || 'https://generativelanguage.googleapis.com/v1beta', process.env.GEMINI_MODEL || 'gemini-2.5-flash'], - ['ollama', 'ollama', process.env.OLLAMA_BASE_URL, process.env.OLLAMA_MODEL], - ['amazonq', process.env.AMAZONQ_API_KEY, process.env.AMAZONQ_BASE_URL || 'https://q.api.aws', process.env.AMAZONQ_MODEL || 'amazon-q'], + ['openai', splitKeys(process.env.OPENAI_API_KEY), process.env.OPENAI_BASE_URL || 'https://api.openai.com/v1', process.env.OPENAI_MODEL || 'gpt-4o-mini'], + ['claude', splitKeys(process.env.CLAUDE_API_KEY), process.env.CLAUDE_BASE_URL || 'https://api.anthropic.com/v1', process.env.CLAUDE_MODEL || 'claude-3-haiku-20240307'], + ['gemini', splitKeys(process.env.GEMINI_API_KEY), process.env.GEMINI_BASE_URL || 'https://generativelanguage.googleapis.com/v1beta', process.env.GEMINI_MODEL || 'gemini-2.5-flash'], + ['ollama', ['ollama'], process.env.OLLAMA_BASE_URL, process.env.OLLAMA_MODEL], + ['amazonq', splitKeys(process.env.AMAZONQ_API_KEY), process.env.AMAZONQ_BASE_URL || 'https://q.api.aws', process.env.AMAZONQ_MODEL || 'amazon-q'], ]; - for (const [provider, key, baseURL, model] of checks) { - if (key && baseURL) return { provider, apiKey: key, baseURL, model }; + for (const [provider, apiKeys, baseURL, model] of checks) { + if (apiKeys.length > 0 && baseURL) return { provider, apiKeys, baseURL, model }; } - return { provider: null, apiKey: null, baseURL: null, model: null }; + return { provider: null, apiKeys: [], baseURL: null, model: null }; } diff --git a/app/config.test.js b/app/config.test.js index b757cec..03cf9ac 100644 --- a/app/config.test.js +++ b/app/config.test.js @@ -26,14 +26,14 @@ describe('getLLMConfig', () => { it('returns null provider when no env vars set', () => { const cfg = getLLMConfig(); assert.equal(cfg.provider, null); - assert.equal(cfg.apiKey, null); + assert.deepEqual(cfg.apiKeys, []); }); it('detects openai with defaults', () => { process.env.OPENAI_API_KEY = 'sk-test'; const cfg = getLLMConfig(); assert.equal(cfg.provider, 'openai'); - assert.equal(cfg.apiKey, 'sk-test'); + assert.deepEqual(cfg.apiKeys, ['sk-test']); assert.equal(cfg.baseURL, 'https://api.openai.com/v1'); assert.equal(cfg.model, 'gpt-4o-mini'); }); @@ -48,7 +48,14 @@ describe('getLLMConfig', () => { assert.equal(cfg.model, 'gpt-4o'); }); - it('detects gemini with defaults', () => { + it('detects gemini with comma-separated keys, picks one', () => { + process.env.GEMINI_API_KEY = 'key1,key2,key3'; + const cfg = getLLMConfig(); + assert.equal(cfg.provider, 'gemini'); + assert.deepEqual(cfg.apiKeys, ['key1', 'key2', 'key3']); + }); + + it('detects gemini with single key (no comma)', () => { process.env.GEMINI_API_KEY = 'gemini-key'; const cfg = getLLMConfig(); assert.equal(cfg.provider, 'gemini'); diff --git a/app/llm.js b/app/llm.js index db7217b..dddce5f 100644 --- a/app/llm.js +++ b/app/llm.js @@ -5,23 +5,31 @@ import { getLLMConfig } from './config.js'; const httpsAgent = new https.Agent({ rejectUnauthorized: false }); export async function chat(systemPrompt, userContent) { - const { provider, apiKey, baseURL, model } = getLLMConfig(); + const { provider, apiKeys, baseURL, model } = getLLMConfig(); if (!provider) throw new Error('未設定任何 LLM API Key'); console.log(` [LLM] provider=${provider} model=${model}`); - const headers = { - 'Content-Type': 'application/json', - 'Authorization': `Bearer ${apiKey}`, - }; + const headers = { 'Content-Type': 'application/json' }; if (provider === 'claude') headers['anthropic-version'] = '2023-06-01'; - const resp = await axios.post( - `${baseURL.replace(/\/$/, '')}/chat/completions`, - { model, messages: [{ role: 'system', content: systemPrompt }, { role: 'user', content: userContent }], temperature: 0.2 }, - { headers, timeout: 120000, httpsAgent } - ); - return resp.data.choices[0].message.content; + let lastError; + for (let i = 0; i < apiKeys.length; i++) { + headers['Authorization'] = `Bearer ${apiKeys[i]}`; + try { + const resp = await axios.post( + `${baseURL.replace(/\/$/, '')}/chat/completions`, + { model, messages: [{ role: 'system', content: systemPrompt }, { role: 'user', content: userContent }], temperature: 0.2 }, + { headers, timeout: 120000, httpsAgent } + ); + return resp.data.choices[0].message.content; + } catch (e) { + lastError = e; + console.log(` [LLM] key[${i + 1}/${apiKeys.length}] 失敗: ${e.message}`); + } + } + console.error(' [LLM] 所有 API Key 均失敗，終止流程'); + process.exit(1); } export async function chatJSON(systemPrompt, userContent) { From 328d6b2100e1c288b341fc50c8861b2d1b6c8f50 Mon Sep 17 00:00:00 2001 From: AI Review Bot Date: Tue, 12 May 2026 07:18:00 +0000 Subject: [PATCH 02/17] chore: update ai-review findings [skip ci] --- .gitea/ai-review/findings.json | 55 +++++++++++++++++++++++----------- 1 file changed, 38 insertions(+), 17 deletions(-) diff --git a/.gitea/ai-review/findings.json b/.gitea/ai-review/findings.json index bbf0185..856ea5a 100644 --- a/.gitea/ai-review/findings.json +++ b/.gitea/ai-review/findings.json @@ -1,4 +1,32 @@ [ + { + "level": "critical", + "role": "Leo", + "location": "app/llm.js:22", + "suggestion": "在 `chat` 函式中，`Authorization` 標頭是無條件地被加入到所有 LLM 請求中。這對於不需要 API Key 的服務（如 Ollama）是不必要的，且可能導致錯誤。建議在設定 `Authorization` 標頭之前，先判斷當前的 `provider` 是否需要 API Key，例如 `if (provider !== 'ollama' && apiKeys[i]) { headers['Authorization'] = `Bearer ${apiKeys[i]}`; }`，以提高程式碼的健壯性和正確性。", + "is_new": true + }, + { + "level": "critical", + "role": "Zara", + "location": "app/llm.js:20", + "suggestion": "當啟用 API Key 輪替機制時，單一 API 請求的 `timeout` 設定為 120 秒過長。若有多個 Key 且每個 Key 都因逾時而失敗，可能導致整個流程耗時過久（例如 10 個 Key 可能耗時 20 分鐘）。建議將單次請求的逾時時間縮短（例如 10-30 秒），以加速 Key 的輪替，避免 CI/CD 流程長時間阻塞。", + "is_new": true + }, + { + "level": "critical", + "role": "Rex", + "location": "app/llm.js:6", + "suggestion": "程式碼中 `https.Agent({ rejectUnauthorized: false })` 停用了 SSL/TLS 憑證驗證。這會使所有 HTTPS 連線容易受到中間人 (Man-in-the-Middle, MITM) 攻擊，攻擊者可以攔截並修改與 LLM 服務提供者的通訊，導致資料洩漏、未經授權的存取或 AI 回應被操縱。請移除 `const httpsAgent = new https.Agent({ rejectUnauthorized: false });` 這一行，並確保 `axios.post` 呼叫中不再使用 `httpsAgent` 選項。預設情況下，Node.js 和 Axios 會執行嚴格的 SSL 憑證驗證，這是確保通訊安全的最佳實踐。如果遇到憑證問題，應調查並解決底層的憑證信任鏈問題，而非禁用驗證。", + "is_new": true + }, + { + "level": "critical", + "role": "Maya", + "location": "app/llm.js:10-31", + "suggestion": "`app/llm.js` 中實現的 API Key 輪替功能是本次改動的核心，但目前缺少對應的單元測試。請務必在 `app/llm.test.js` 中新增全面的測試案例，以驗證 `TODO.md` 中「階段八：API Key 輪替」的所有驗收標準：\n* **單一 Key 成功**：傳入單一有效 Key 時，確保行為與原本相同。\n* **多個 Key 輪替成功**：驗證當前 N-1 個 Key 失敗，第 N 個 Key 成功時，系統能依序嘗試並最終成功。\n* **所有 Key 失敗**：驗證當所有傳入的 Key 都失敗時，系統能正確記錄每次失敗，並最終呼叫 `process.exit(1)` 終止流程（測試時需模擬 `process.exit` 以捕獲其調用）。\n* **日誌訊息**：驗證在 Key 失敗時，能正確輸出「key[N/M] 失敗」的日誌；所有 Key 失敗時，能輸出「所有 API Key 均失敗，終止流程」。\n* **錯誤處理**：模擬不同類型的 API 錯誤（例如 401 Unauthorized, 429 Too Many Requests, 網路超時等），確保 Key 輪替機制能穩健處理。", + "is_new": true + }, { "level": "warning", "role": "Zara", @@ -11,27 +39,20 @@ "role": "Aria", "location": ".gitea/workflows/master.yaml", "suggestion": "檔案結尾應包含一個換行符號 (newline at EOF)，這是 POSIX 系統的慣例，有助於版本控制系統的正確處理。", + "is_new": false + }, + { + "level": "warning", + "role": "Leo", + "location": ".gitea/workflows/review.yaml:36", + "suggestion": "GEMINI_API_KEY 的值過長，影響可讀性。雖然這是為了傳遞多個 Secret，但建議考慮是否有其他方式可以讓設定檔更簡潔，例如將多個 Secret 組合為一個，或在 Action 內部處理多個獨立的 Secret 變數（如果 Action 支援）。如果沒有其他方式，請考慮將其分行以提高可讀性（雖然 YAML 可能會將其視為單行）。", "is_new": true }, { "level": "warning", - "role": "Aria", - "location": "Dockerfile", - "suggestion": "檔案結尾應包含一個換行符號 (newline at EOF)，這是 POSIX 系統的慣例，有助於版本控制系統的正確處理。", - "is_new": true - }, - { - "level": "warning", - "role": "Aria", - "location": "TODO.md", - "suggestion": "檔案結尾應包含一個換行符號 (newline at EOF)，這是 POSIX 系統的慣例，有助於版本控制系統的正確處理。", - "is_new": true - }, - { - "level": "warning", - "role": "Aria", - "location": "entrypoint.sh", - "suggestion": "檔案結尾應包含一個換行符號 (newline at EOF)，這是 POSIX 系統的慣例，有助於版本控制系統的正確處理。", + "role": "Maya", + "location": "app/llm.js", + "suggestion": "`chatJSON` 函數依賴於 `chat` 函數的 API Key 輪替邏輯。為確保在處理 JSON 格式回應時，API Key 輪替機制也能正常運作，建議在 `app/llm.test.js` 中為 `chatJSON` 函數新增至少一個測試案例，特別是針對 Key 輪替失敗或成功後的行為進行驗證。", "is_new": true } ] From 2ced37f54f8ffc108674923c6c190f9a441fa22e Mon Sep 17 00:00:00 2001 From: Jeffery Date: Tue, 12 May 2026 07:38:38 +0000 Subject: [PATCH 03/17] feat: refactor LLM API handling, add tests for key rotation and update package files --- .gitignore | 1 + app/llm.js | 7 +- app/llm.test.js | 128 ++++++++++++ app/package-lock.json | 468 ++++++++++++++++++++++++++++++++++++++++++ app/package.json | 2 +- 5 files changed, 600 insertions(+), 6 deletions(-) create mode 100644 .gitignore create mode 100644 app/llm.test.js create mode 100644 app/package-lock.json diff --git a/.gitignore b/.gitignore new file mode 100644 index 0000000..84376b6 --- /dev/null +++ b/.gitignore @@ -0,0 +1 @@ +app/node_modules/ diff --git a/app/llm.js b/app/llm.js index dddce5f..e2c2db1 100644 --- a/app/llm.js +++ b/app/llm.js @@ -1,9 +1,6 @@ import axios from 'axios'; -import https from 'https'; import { getLLMConfig } from './config.js'; -const httpsAgent = new https.Agent({ rejectUnauthorized: false }); - export async function chat(systemPrompt, userContent) { const { provider, apiKeys, baseURL, model } = getLLMConfig(); if (!provider) throw new Error('未設定任何 LLM API Key'); @@ -15,12 +12,12 @@ export async function chat(systemPrompt, userContent) { let lastError; for (let i = 0; i < apiKeys.length; i++) { - headers['Authorization'] = `Bearer ${apiKeys[i]}`; + if (provider !== 'ollama') headers['Authorization'] = `Bearer ${apiKeys[i]}`; try { const resp = await axios.post( `${baseURL.replace(/\/$/, '')}/chat/completions`, { model, messages: [{ role: 'system', content: systemPrompt }, { role: 'user', content: userContent }], temperature: 0.2 }, - { headers, timeout: 120000, httpsAgent } + { headers, timeout: 30000 } ); return resp.data.choices[0].message.content; } catch (e) { diff --git a/app/llm.test.js b/app/llm.test.js new file mode 100644 index 0000000..74f41f6 --- /dev/null +++ b/app/llm.test.js @@ -0,0 +1,128 @@ +import { describe, it, beforeEach, afterEach, mock } from 'node:test'; +import assert from 'node:assert/strict'; + +// Mock axios before importing llm.js +import axios from 'axios'; + +const ENV_KEYS = [ + 'OPENAI_API_KEY', 'OPENAI_BASE_URL', 'OPENAI_MODEL', + 'GEMINI_API_KEY', 'GEMINI_BASE_URL', 'GEMINI_MODEL', + 'CLAUDE_API_KEY', 'CLAUDE_BASE_URL', 'CLAUDE_MODEL', + 'OLLAMA_BASE_URL', 'OLLAMA_MODEL', + 'AMAZONQ_API_KEY', 'AMAZONQ_BASE_URL', 'AMAZONQ_MODEL', +]; + +let saved = {}; +beforeEach(() => { + saved = {}; + for (const k of ENV_KEYS) { saved[k] = process.env[k]; delete process.env[k]; } +}); +afterEach(() => { + for (const k of ENV_KEYS) { + if (saved[k] === undefined) delete process.env[k]; + else process.env[k] = saved[k]; + } + mock.restoreAll(); +}); + +function mockAxiosPost(responses) { + let call = 0; + mock.method(axios, 'post', async () => { + const r = responses[call++] ?? responses[responses.length - 1]; + if (r instanceof Error) throw r; + return r; + }); +} + +function makeOkResponse(content = 'ok') { + return { data: { choices: [{ message: { content } }] } }; +} + +describe('chat - key rotation', async () => { + const { chat } = await import('./llm.js'); + + it('succeeds on first key', async () => { + process.env.OPENAI_API_KEY = 'key1'; + mockAxiosPost([makeOkResponse('hello')]); + const result = await chat('sys', 'user'); + assert.equal(result, 'hello'); + }); + + it('rotates to second key when first fails', async () => { + process.env.OPENAI_API_KEY = 'key1,key2'; + mockAxiosPost([new Error('rate limit'), makeOkResponse('from key2')]); + const result = await chat('sys', 'user'); + assert.equal(result, 'from key2'); + }); + + it('rotates through all keys and succeeds on last', async () => { + process.env.OPENAI_API_KEY = 'k1,k2,k3'; + mockAxiosPost([new Error('fail'), new Error('fail'), makeOkResponse('from k3')]); + const result = await chat('sys', 'user'); + assert.equal(result, 'from k3'); + }); + + it('calls process.exit(1) when all keys fail', async () => { + process.env.OPENAI_API_KEY = 'k1,k2'; + mockAxiosPost([new Error('fail'), new Error('fail')]); + const exitMock = mock.method(process, 'exit', () => { throw new Error('exit:1'); }); + await assert.rejects(() => chat('sys', 'user'), /exit:1/); + assert.equal(exitMock.mock.calls[0].arguments[0], 1); + }); + + it('does not set Authorization header for ollama', async () => { + process.env.OLLAMA_BASE_URL = 'http://localhost:11434/v1'; + process.env.OLLAMA_MODEL = 'llama3'; + let capturedHeaders; + mock.method(axios, 'post', async (_url, _body, opts) => { + capturedHeaders = opts.headers; + return makeOkResponse('ollama response'); + }); + await chat('sys', 'user'); + assert.equal(capturedHeaders['Authorization'], undefined); + }); + + it('sets Authorization header for openai', async () => { + process.env.OPENAI_API_KEY = 'sk-test'; + let capturedHeaders; + mock.method(axios, 'post', async (_url, _body, opts) => { + capturedHeaders = opts.headers; + return makeOkResponse(); + }); + await chat('sys', 'user'); + assert.equal(capturedHeaders['Authorization'], 'Bearer sk-test'); + }); + + it('uses 30s timeout', async () => { + process.env.OPENAI_API_KEY = 'sk-test'; + let capturedOpts; + mock.method(axios, 'post', async (_url, _body, opts) => { + capturedOpts = opts; + return makeOkResponse(); + }); + await chat('sys', 'user'); + assert.equal(capturedOpts.timeout, 30000); + }); + + it('does not pass httpsAgent to axios', async () => { + process.env.OPENAI_API_KEY = 'sk-test'; + let capturedOpts; + mock.method(axios, 'post', async (_url, _body, opts) => { + capturedOpts = opts; + return makeOkResponse(); + }); + await chat('sys', 'user'); + assert.equal(capturedOpts.httpsAgent, undefined); + }); + + it('sets anthropic-version header for claude', async () => { + process.env.CLAUDE_API_KEY = 'claude-key'; + let capturedHeaders; + mock.method(axios, 'post', async (_url, _body, opts) => { + capturedHeaders = opts.headers; + return makeOkResponse(); + }); + await chat('sys', 'user'); + assert.equal(capturedHeaders['anthropic-version'], '2023-06-01'); + }); +}); diff --git a/app/package-lock.json b/app/package-lock.json new file mode 100644 index 0000000..6aaee51 --- /dev/null +++ b/app/package-lock.json @@ -0,0 +1,468 @@ +{ + "name": "ai-code-review", + "version": "1.0.0", + "lockfileVersion": 3, + "requires": true, + "packages": { + "": { + "name": "ai-code-review", + "version": "1.0.0", + "dependencies": { + "axios": "^1.6.7", + "js-yaml": "^4.1.0", + "openai": "^4.28.0" + } + }, + "node_modules/@types/node": { + "version": "18.19.130", + "resolved": "https://registry.npmjs.org/@types/node/-/node-18.19.130.tgz", + "integrity": "sha512-GRaXQx6jGfL8sKfaIDD6OupbIHBr9jv7Jnaml9tB7l4v068PAOXqfcujMMo5PhbIs6ggR1XODELqahT2R8v0fg==", + "dependencies": { + "undici-types": "~5.26.4" + } + }, + "node_modules/@types/node-fetch": { + "version": "2.6.13", + "resolved": "https://registry.npmjs.org/@types/node-fetch/-/node-fetch-2.6.13.tgz", + "integrity": "sha512-QGpRVpzSaUs30JBSGPjOg4Uveu384erbHBoT1zeONvyCfwQxIkUshLAOqN/k9EjGviPRmWTTe6aH2qySWKTVSw==", + "dependencies": { + "@types/node": "*", + "form-data": "^4.0.4" + } + }, + "node_modules/abort-controller": { + "version": "3.0.0", + "resolved": "https://registry.npmjs.org/abort-controller/-/abort-controller-3.0.0.tgz", + "integrity": "sha512-h8lQ8tacZYnR3vNQTgibj+tODHI5/+l06Au2Pcriv/Gmet0eaj4TwWH41sO9wnHDiQsEj19q0drzdWdeAHtweg==", + "dependencies": { + "event-target-shim": "^5.0.0" + }, + "engines": { + "node": ">=6.5" + } + }, + "node_modules/agentkeepalive": { + "version": "4.6.0", + "resolved": "https://registry.npmjs.org/agentkeepalive/-/agentkeepalive-4.6.0.tgz", + "integrity": "sha512-kja8j7PjmncONqaTsB8fQ+wE2mSU2DJ9D4XKoJ5PFWIdRMa6SLSN1ff4mOr4jCbfRSsxR4keIiySJU0N9T5hIQ==", + "dependencies": { + "humanize-ms": "^1.2.1" + }, + "engines": { + "node": ">= 8.0.0" + } + }, + "node_modules/argparse": { + "version": "2.0.1", + "resolved": "https://registry.npmjs.org/argparse/-/argparse-2.0.1.tgz", + "integrity": "sha512-8+9WqebbFzpX9OR+Wa6O29asIogeRMzcGtAINdpMHHyAg10f05aSFVBbcEqGf/PXw1EjAZ+q2/bEBg3DvurK3Q==" + }, + "node_modules/asynckit": { + "version": "0.4.0", + "resolved": "https://registry.npmjs.org/asynckit/-/asynckit-0.4.0.tgz", + "integrity": "sha512-Oei9OH4tRh0YqU3GxhX79dM/mwVgvbZJaSNaRk+bshkj0S5cfHcgYakreBjrHwatXKbz+IoIdYLxrKim2MjW0Q==" + }, + "node_modules/axios": { + "version": "1.16.0", + "resolved": "https://registry.npmjs.org/axios/-/axios-1.16.0.tgz", + "integrity": "sha512-6hp5CwvTPlN2A31g5dxnwAX0orzM7pmCRDLnZSX772mv8WDqICwFjowHuPs04Mc8deIld1+ejhtaMn5vp6b+1w==", + "dependencies": { + "follow-redirects": "^1.16.0", + "form-data": "^4.0.5", + "proxy-from-env": "^2.1.0" + } + }, + "node_modules/call-bind-apply-helpers": { + "version": "1.0.2", + "resolved": "https://registry.npmjs.org/call-bind-apply-helpers/-/call-bind-apply-helpers-1.0.2.tgz", + "integrity": "sha512-Sp1ablJ0ivDkSzjcaJdxEunN5/XvksFJ2sMBFfq6x0ryhQV/2b/KwFe21cMpmHtPOSij8K99/wSfoEuTObmuMQ==", + "dependencies": { + "es-errors": "^1.3.0", + "function-bind": "^1.1.2" + }, + "engines": { + "node": ">= 0.4" + } + }, + "node_modules/combined-stream": { + "version": "1.0.8", + "resolved": "https://registry.npmjs.org/combined-stream/-/combined-stream-1.0.8.tgz", + "integrity": "sha512-FQN4MRfuJeHf7cBbBMJFXhKSDq+2kAArBlmRBvcvFE5BB1HZKXtSFASDhdlz9zOYwxh8lDdnvmMOe/+5cdoEdg==", + "dependencies": { + "delayed-stream": "~1.0.0" + }, + "engines": { + "node": ">= 0.8" + } + }, + "node_modules/delayed-stream": { + "version": "1.0.0", + "resolved": "https://registry.npmjs.org/delayed-stream/-/delayed-stream-1.0.0.tgz", + "integrity": "sha512-ZySD7Nf91aLB0RxL4KGrKHBXl7Eds1DAmEdcoVawXnLD7SDhpNgtuII2aAkg7a7QS41jxPSZ17p4VdGnMHk3MQ==", + "engines": { + "node": ">=0.4.0" + } + }, + "node_modules/dunder-proto": { + "version": "1.0.1", + "resolved": "https://registry.npmjs.org/dunder-proto/-/dunder-proto-1.0.1.tgz", + "integrity": "sha512-KIN/nDJBQRcXw0MLVhZE9iQHmG68qAVIBg9CqmUYjmQIhgij9U5MFvrqkUL5FbtyyzZuOeOt0zdeRe4UY7ct+A==", + "dependencies": { + "call-bind-apply-helpers": "^1.0.1", + "es-errors": "^1.3.0", + "gopd": "^1.2.0" + }, + "engines": { + "node": ">= 0.4" + } + }, + "node_modules/es-define-property": { + "version": "1.0.1", + "resolved": "https://registry.npmjs.org/es-define-property/-/es-define-property-1.0.1.tgz", + "integrity": "sha512-e3nRfgfUZ4rNGL232gUgX06QNyyez04KdjFrF+LTRoOXmrOgFKDg4BCdsjW8EnT69eqdYGmRpJwiPVYNrCaW3g==", + "engines": { + "node": ">= 0.4" + } + }, + "node_modules/es-errors": { + "version": "1.3.0", + "resolved": "https://registry.npmjs.org/es-errors/-/es-errors-1.3.0.tgz", + "integrity": "sha512-Zf5H2Kxt2xjTvbJvP2ZWLEICxA6j+hAmMzIlypy4xcBg1vKVnx89Wy0GbS+kf5cwCVFFzdCFh2XSCFNULS6csw==", + "engines": { + "node": ">= 0.4" + } + }, + "node_modules/es-object-atoms": { + "version": "1.1.1", + "resolved": "https://registry.npmjs.org/es-object-atoms/-/es-object-atoms-1.1.1.tgz", + "integrity": "sha512-FGgH2h8zKNim9ljj7dankFPcICIK9Cp5bm+c2gQSYePhpaG5+esrLODihIorn+Pe6FGJzWhXQotPv73jTaldXA==", + "dependencies": { + "es-errors": "^1.3.0" + }, + "engines": { + "node": ">= 0.4" + } + }, + "node_modules/es-set-tostringtag": { + "version": "2.1.0", + "resolved": "https://registry.npmjs.org/es-set-tostringtag/-/es-set-tostringtag-2.1.0.tgz", + "integrity": "sha512-j6vWzfrGVfyXxge+O0x5sh6cvxAog0a/4Rdd2K36zCMV5eJ+/+tOAngRO8cODMNWbVRdVlmGZQL2YS3yR8bIUA==", + "dependencies": { + "es-errors": "^1.3.0", + "get-intrinsic": "^1.2.6", + "has-tostringtag": "^1.0.2", + "hasown": "^2.0.2" + }, + "engines": { + "node": ">= 0.4" + } + }, + "node_modules/event-target-shim": { + "version": "5.0.1", + "resolved": "https://registry.npmjs.org/event-target-shim/-/event-target-shim-5.0.1.tgz", + "integrity": "sha512-i/2XbnSz/uxRCU6+NdVJgKWDTM427+MqYbkQzD321DuCQJUqOuJKIA0IM2+W2xtYHdKOmZ4dR6fExsd4SXL+WQ==", + "engines": { + "node": ">=6" + } + }, + "node_modules/follow-redirects": { + "version": "1.16.0", + "resolved": "https://registry.npmjs.org/follow-redirects/-/follow-redirects-1.16.0.tgz", + "integrity": "sha512-y5rN/uOsadFT/JfYwhxRS5R7Qce+g3zG97+JrtFZlC9klX/W5hD7iiLzScI4nZqUS7DNUdhPgw4xI8W2LuXlUw==", + "funding": [ + { + "type": "individual", + "url": "https://github.com/sponsors/RubenVerborgh" + } + ], + "engines": { + "node": ">=4.0" + }, + "peerDependenciesMeta": { + "debug": { + "optional": true + } + } + }, + "node_modules/form-data": { + "version": "4.0.5", + "resolved": "https://registry.npmjs.org/form-data/-/form-data-4.0.5.tgz", + "integrity": "sha512-8RipRLol37bNs2bhoV67fiTEvdTrbMUYcFTiy3+wuuOnUog2QBHCZWXDRijWQfAkhBj2Uf5UnVaiWwA5vdd82w==", + "dependencies": { + "asynckit": "^0.4.0", + "combined-stream": "^1.0.8", + "es-set-tostringtag": "^2.1.0", + "hasown": "^2.0.2", + "mime-types": "^2.1.12" + }, + "engines": { + "node": ">= 6" + } + }, + "node_modules/form-data-encoder": { + "version": "1.7.2", + "resolved": "https://registry.npmjs.org/form-data-encoder/-/form-data-encoder-1.7.2.tgz", + "integrity": "sha512-qfqtYan3rxrnCk1VYaA4H+Ms9xdpPqvLZa6xmMgFvhO32x7/3J/ExcTd6qpxM0vH2GdMI+poehyBZvqfMTto8A==" + }, + "node_modules/formdata-node": { + "version": "4.4.1", + "resolved": "https://registry.npmjs.org/formdata-node/-/formdata-node-4.4.1.tgz", + "integrity": "sha512-0iirZp3uVDjVGt9p49aTaqjk84TrglENEDuqfdlZQ1roC9CWlPk6Avf8EEnZNcAqPonwkG35x4n3ww/1THYAeQ==", + "dependencies": { + "node-domexception": "1.0.0", + "web-streams-polyfill": "4.0.0-beta.3" + }, + "engines": { + "node": ">= 12.20" + } + }, + "node_modules/function-bind": { + "version": "1.1.2", + "resolved": "https://registry.npmjs.org/function-bind/-/function-bind-1.1.2.tgz", + "integrity": "sha512-7XHNxH7qX9xG5mIwxkhumTox/MIRNcOgDrxWsMt2pAr23WHp6MrRlN7FBSFpCpr+oVO0F744iUgR82nJMfG2SA==", + "funding": { + "url": "https://github.com/sponsors/ljharb" + } + }, + "node_modules/get-intrinsic": { + "version": "1.3.0", + "resolved": "https://registry.npmjs.org/get-intrinsic/-/get-intrinsic-1.3.0.tgz", + "integrity": "sha512-9fSjSaos/fRIVIp+xSJlE6lfwhES7LNtKaCBIamHsjr2na1BiABJPo0mOjjz8GJDURarmCPGqaiVg5mfjb98CQ==", + "dependencies": { + "call-bind-apply-helpers": "^1.0.2", + "es-define-property": "^1.0.1", + "es-errors": "^1.3.0", + "es-object-atoms": "^1.1.1", + "function-bind": "^1.1.2", + "get-proto": "^1.0.1", + "gopd": "^1.2.0", + "has-symbols": "^1.1.0", + "hasown": "^2.0.2", + "math-intrinsics": "^1.1.0" + }, + "engines": { + "node": ">= 0.4" + }, + "funding": { + "url": "https://github.com/sponsors/ljharb" + } + }, + "node_modules/get-proto": { + "version": "1.0.1", + "resolved": "https://registry.npmjs.org/get-proto/-/get-proto-1.0.1.tgz", + "integrity": "sha512-sTSfBjoXBp89JvIKIefqw7U2CCebsc74kiY6awiGogKtoSGbgjYE/G/+l9sF3MWFPNc9IcoOC4ODfKHfxFmp0g==", + "dependencies": { + "dunder-proto": "^1.0.1", + "es-object-atoms": "^1.0.0" + }, + "engines": { + "node": ">= 0.4" + } + }, + "node_modules/gopd": { + "version": "1.2.0", + "resolved": "https://registry.npmjs.org/gopd/-/gopd-1.2.0.tgz", + "integrity": "sha512-ZUKRh6/kUFoAiTAtTYPZJ3hw9wNxx+BIBOijnlG9PnrJsCcSjs1wyyD6vJpaYtgnzDrKYRSqf3OO6Rfa93xsRg==", + "engines": { + "node": ">= 0.4" + }, + "funding": { + "url": "https://github.com/sponsors/ljharb" + } + }, + "node_modules/has-symbols": { + "version": "1.1.0", + "resolved": "https://registry.npmjs.org/has-symbols/-/has-symbols-1.1.0.tgz", + "integrity": "sha512-1cDNdwJ2Jaohmb3sg4OmKaMBwuC48sYni5HUw2DvsC8LjGTLK9h+eb1X6RyuOHe4hT0ULCW68iomhjUoKUqlPQ==", + "engines": { + "node": ">= 0.4" + }, + "funding": { + "url": "https://github.com/sponsors/ljharb" + } + }, + "node_modules/has-tostringtag": { + "version": "1.0.2", + "resolved": "https://registry.npmjs.org/has-tostringtag/-/has-tostringtag-1.0.2.tgz", + "integrity": "sha512-NqADB8VjPFLM2V0VvHUewwwsw0ZWBaIdgo+ieHtK3hasLz4qeCRjYcqfB6AQrBggRKppKF8L52/VqdVsO47Dlw==", + "dependencies": { + "has-symbols": "^1.0.3" + }, + "engines": { + "node": ">= 0.4" + }, + "funding": { + "url": "https://github.com/sponsors/ljharb" + } + }, + "node_modules/hasown": { + "version": "2.0.3", + "resolved": "https://registry.npmjs.org/hasown/-/hasown-2.0.3.tgz", + "integrity": "sha512-ej4AhfhfL2Q2zpMmLo7U1Uv9+PyhIZpgQLGT1F9miIGmiCJIoCgSmczFdrc97mWT4kVY72KA+WnnhJ5pghSvSg==", + "dependencies": { + "function-bind": "^1.1.2" + }, + "engines": { + "node": ">= 0.4" + } + }, + "node_modules/humanize-ms": { + "version": "1.2.1", + "resolved": "https://registry.npmjs.org/humanize-ms/-/humanize-ms-1.2.1.tgz", + "integrity": "sha512-Fl70vYtsAFb/C06PTS9dZBo7ihau+Tu/DNCk/OyHhea07S+aeMWpFFkUaXRa8fI+ScZbEI8dfSxwY7gxZ9SAVQ==", + "dependencies": { + "ms": "^2.0.0" + } + }, + "node_modules/js-yaml": { + "version": "4.1.1", + "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.1.1.tgz", + "integrity": "sha512-qQKT4zQxXl8lLwBtHMWwaTcGfFOZviOJet3Oy/xmGk2gZH677CJM9EvtfdSkgWcATZhj/55JZ0rmy3myCT5lsA==", + "dependencies": { + "argparse": "^2.0.1" + }, + "bin": { + "js-yaml": "bin/js-yaml.js" + } + }, + "node_modules/math-intrinsics": { + "version": "1.1.0", + "resolved": "https://registry.npmjs.org/math-intrinsics/-/math-intrinsics-1.1.0.tgz", + "integrity": "sha512-/IXtbwEk5HTPyEwyKX6hGkYXxM9nbj64B+ilVJnC/R6B0pH5G4V3b0pVbL7DBj4tkhBAppbQUlf6F6Xl9LHu1g==", + "engines": { + "node": ">= 0.4" + } + }, + "node_modules/mime-db": { + "version": "1.52.0", + "resolved": "https://registry.npmjs.org/mime-db/-/mime-db-1.52.0.tgz", + "integrity": "sha512-sPU4uV7dYlvtWJxwwxHD0PuihVNiE7TyAbQ5SWxDCB9mUYvOgroQOwYQQOKPJ8CIbE+1ETVlOoK1UC2nU3gYvg==", + "engines": { + "node": ">= 0.6" + } + }, + "node_modules/mime-types": { + "version": "2.1.35", + "resolved": "https://registry.npmjs.org/mime-types/-/mime-types-2.1.35.tgz", + "integrity": "sha512-ZDY+bPm5zTTF+YpCrAU9nK0UgICYPT0QtT1NZWFv4s++TNkcgVaT0g6+4R2uI4MjQjzysHB1zxuWL50hzaeXiw==", + "dependencies": { + "mime-db": "1.52.0" + }, + "engines": { + "node": ">= 0.6" + } + }, + "node_modules/ms": { + "version": "2.1.3", + "resolved": "https://registry.npmjs.org/ms/-/ms-2.1.3.tgz", + "integrity": "sha512-6FlzubTLZG3J2a/NVCAleEhjzq5oxgHyaCU9yYXvcLsvoVaHJq/s5xXI6/XXP6tz7R9xAOtHnSO/tXtF3WRTlA==" + }, + "node_modules/node-domexception": { + "version": "1.0.0", + "resolved": "https://registry.npmjs.org/node-domexception/-/node-domexception-1.0.0.tgz", + "integrity": "sha512-/jKZoMpw0F8GRwl4/eLROPA3cfcXtLApP0QzLmUT/HuPCZWyB7IY9ZrMeKw2O/nFIqPQB3PVM9aYm0F312AXDQ==", + "deprecated": "Use your platform's native DOMException instead", + "funding": [ + { + "type": "github", + "url": "https://github.com/sponsors/jimmywarting" + }, + { + "type": "github", + "url": "https://paypal.me/jimmywarting" + } + ], + "engines": { + "node": ">=10.5.0" + } + }, + "node_modules/node-fetch": { + "version": "2.7.0", + "resolved": "https://registry.npmjs.org/node-fetch/-/node-fetch-2.7.0.tgz", + "integrity": "sha512-c4FRfUm/dbcWZ7U+1Wq0AwCyFL+3nt2bEw05wfxSz+DWpWsitgmSgYmy2dQdWyKC1694ELPqMs/YzUSNozLt8A==", + "dependencies": { + "whatwg-url": "^5.0.0" + }, + "engines": { + "node": "4.x || >=6.0.0" + }, + "peerDependencies": { + "encoding": "^0.1.0" + }, + "peerDependenciesMeta": { + "encoding": { + "optional": true + } + } + }, + "node_modules/openai": { + "version": "4.104.0", + "resolved": "https://registry.npmjs.org/openai/-/openai-4.104.0.tgz", + "integrity": "sha512-p99EFNsA/yX6UhVO93f5kJsDRLAg+CTA2RBqdHK4RtK8u5IJw32Hyb2dTGKbnnFmnuoBv5r7Z2CURI9sGZpSuA==", + "dependencies": { + "@types/node": "^18.11.18", + "@types/node-fetch": "^2.6.4", + "abort-controller": "^3.0.0", + "agentkeepalive": "^4.2.1", + "form-data-encoder": "1.7.2", + "formdata-node": "^4.3.2", + "node-fetch": "^2.6.7" + }, + "bin": { + "openai": "bin/cli" + }, + "peerDependencies": { + "ws": "^8.18.0", + "zod": "^3.23.8" + }, + "peerDependenciesMeta": { + "ws": { + "optional": true + }, + "zod": { + "optional": true + } + } + }, + "node_modules/proxy-from-env": { + "version": "2.1.0", + "resolved": "https://registry.npmjs.org/proxy-from-env/-/proxy-from-env-2.1.0.tgz", + "integrity": "sha512-cJ+oHTW1VAEa8cJslgmUZrc+sjRKgAKl3Zyse6+PV38hZe/V6Z14TbCuXcan9F9ghlz4QrFr2c92TNF82UkYHA==", + "engines": { + "node": ">=10" + } + }, + "node_modules/tr46": { + "version": "0.0.3", + "resolved": "https://registry.npmjs.org/tr46/-/tr46-0.0.3.tgz", + "integrity": "sha512-N3WMsuqV66lT30CrXNbEjx4GEwlow3v6rr4mCcv6prnfwhS01rkgyFdjPNBYd9br7LpXV1+Emh01fHnq2Gdgrw==" + }, + "node_modules/undici-types": { + "version": "5.26.5", + "resolved": "https://registry.npmjs.org/undici-types/-/undici-types-5.26.5.tgz", + "integrity": "sha512-JlCMO+ehdEIKqlFxk6IfVoAUVmgz7cU7zD/h9XZ0qzeosSHmUJVOzSQvvYSYWXkFXC+IfLKSIffhv0sVZup6pA==" + }, + "node_modules/web-streams-polyfill": { + "version": "4.0.0-beta.3", + "resolved": "https://registry.npmjs.org/web-streams-polyfill/-/web-streams-polyfill-4.0.0-beta.3.tgz", + "integrity": "sha512-QW95TCTaHmsYfHDybGMwO5IJIM93I/6vTRk+daHTWFPhwh+C8Cg7j7XyKrwrj8Ib6vYXe0ocYNrmzY4xAAN6ug==", + "engines": { + "node": ">= 14" + } + }, + "node_modules/webidl-conversions": { + "version": "3.0.1", + "resolved": "https://registry.npmjs.org/webidl-conversions/-/webidl-conversions-3.0.1.tgz", + "integrity": "sha512-2JAn3z8AR6rjK8Sm8orRC0h/bcl/DqL7tRPdGZ4I1CjdF+EaMLmYxBHyXuKL849eucPFhvBoxMsflfOb8kxaeQ==" + }, + "node_modules/whatwg-url": { + "version": "5.0.0", + "resolved": "https://registry.npmjs.org/whatwg-url/-/whatwg-url-5.0.0.tgz", + "integrity": "sha512-saE57nupxk6v3HY35+jzBwYa0rKSy0XR8JSxZPwgLr7ys0IBzhGviA1/TUGJLmSVqs8pb9AnvICXEuOHLprYTw==", + "dependencies": { + "tr46": "~0.0.3", + "webidl-conversions": "^3.0.0" + } + } + } +} diff --git a/app/package.json b/app/package.json index 466e7c7..642c211 100644 --- a/app/package.json +++ b/app/package.json @@ -3,7 +3,7 @@ "version": "1.0.0", "type": "module", "scripts": { - "test": "node --test app/git.test.js" + "test": "node --test git.test.js config.test.js llm.test.js" }, "dependencies": { "axios": "^1.6.7", From 710b9a1bb57e82ebb1310262454163d9a8e730b3 Mon Sep 17 00:00:00 2001 From: Jeffery Date: Tue, 12 May 2026 07:47:28 +0000 Subject: [PATCH 04/17] feat: update AI Code Review workflow to use OpenAI API instead of Gemini API --- .gitea/workflows/review.yaml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/.gitea/workflows/review.yaml b/.gitea/workflows/review.yaml index 6fbcb0b..787e9e9 100644 --- a/.gitea/workflows/review.yaml +++ b/.gitea/workflows/review.yaml @@ -33,9 +33,9 @@ jobs: - name: AI Code Review uses: https://gitea.jsc.idv.tw/jiantw83/code-review@v${{ needs.version.outputs.version }} with: - GEMINI_API_KEY: ${{ secrets.GEMINI_API_KEY }},${{ secrets.GEMINI_API_KEY_1 }},${{ secrets.GEMINI_API_KEY_2 }},${{ secrets.GEMINI_API_KEY_3 }},${{ secrets.GEMINI_API_KEY_4 }},${{ secrets.GEMINI_API_KEY_5 }},${{ secrets.GEMINI_API_KEY_6 }},${{ secrets.GEMINI_API_KEY_7 }},${{ secrets.GEMINI_API_KEY_8 }},${{ secrets.GEMINI_API_KEY_9 }} - GEMINI_BASE_URL: https://generativelanguage.googleapis.com/v1beta - GEMINI_MODEL: ${{ vars.GEMINI_MODEL }} + OPENAI_API_KEY: ${{ secrets.OPENROUTER_API_KEY }} + OPENAI_BASE_URL: https://openrouter.ai/api/v1 + OPENAI_MODEL: ${{ vars.OPENROUTER_MODEL }} permissions: contents: write pull-requests: write From 4a631bc62ae27b6d0b1d87453dbafe4399c17942 Mon Sep 17 00:00:00 2001 From: Jeffery Date: Tue, 12 May 2026 08:04:44 +0000 Subject: [PATCH 05/17] feat: support multiple OpenAI API keys in AI Code Review workflow --- .gitea/workflows/review.yaml | 2 +- README.md | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/.gitea/workflows/review.yaml b/.gitea/workflows/review.yaml index 787e9e9..f341996 100644 --- a/.gitea/workflows/review.yaml +++ b/.gitea/workflows/review.yaml @@ -33,7 +33,7 @@ jobs: - name: AI Code Review uses: https://gitea.jsc.idv.tw/jiantw83/code-review@v${{ needs.version.outputs.version }} with: - OPENAI_API_KEY: ${{ secrets.OPENROUTER_API_KEY }} + OPENAI_API_KEY: ${{ secrets.OPENROUTER_API_KEY }},${{ secrets.OPENROUTER_API_KEY_1 }} OPENAI_BASE_URL: https://openrouter.ai/api/v1 OPENAI_MODEL: ${{ vars.OPENROUTER_MODEL }} permissions: diff --git a/README.md b/README.md index 745001c..2b2be5a 100644 --- a/README.md +++ b/README.md @@ -66,7 +66,7 @@ jobs: - name: AI Code Review uses: https://gitea.jsc.idv.tw/jiantw83/code-review@${{ vars.ACTION_CODE_REVIEW_VERSION }} with: - OPENAI_API_KEY: ${{ secrets.OPENROUTER_API_KEY }} # OpenRouter 使用 OpenAI 相容介面，以 OPENAI_API_KEY 傳入，支援逗號分隔多個 Key + OPENAI_API_KEY: ${{ secrets.OPENROUTER_API_KEY }},${{ secrets.OPENROUTER_API_KEY_1 }} OPENAI_BASE_URL: https://openrouter.ai/api/v1 OPENAI_MODEL: ${{ vars.OPENROUTER_MODEL }} permissions: From e28c6ea5a30db713683011b07a41418a0e14bd7c Mon Sep 17 00:00:00 2001 From: Jeffery Date: Tue, 12 May 2026 08:05:37 +0000 Subject: [PATCH 06/17] feat: update AI Code Review workflow to use Gemini API keys and configuration --- .gitea/workflows/review.yaml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/.gitea/workflows/review.yaml b/.gitea/workflows/review.yaml index f341996..6fbcb0b 100644 --- a/.gitea/workflows/review.yaml +++ b/.gitea/workflows/review.yaml @@ -33,9 +33,9 @@ jobs: - name: AI Code Review uses: https://gitea.jsc.idv.tw/jiantw83/code-review@v${{ needs.version.outputs.version }} with: - OPENAI_API_KEY: ${{ secrets.OPENROUTER_API_KEY }},${{ secrets.OPENROUTER_API_KEY_1 }} - OPENAI_BASE_URL: https://openrouter.ai/api/v1 - OPENAI_MODEL: ${{ vars.OPENROUTER_MODEL }} + GEMINI_API_KEY: ${{ secrets.GEMINI_API_KEY }},${{ secrets.GEMINI_API_KEY_1 }},${{ secrets.GEMINI_API_KEY_2 }},${{ secrets.GEMINI_API_KEY_3 }},${{ secrets.GEMINI_API_KEY_4 }},${{ secrets.GEMINI_API_KEY_5 }},${{ secrets.GEMINI_API_KEY_6 }},${{ secrets.GEMINI_API_KEY_7 }},${{ secrets.GEMINI_API_KEY_8 }},${{ secrets.GEMINI_API_KEY_9 }} + GEMINI_BASE_URL: https://generativelanguage.googleapis.com/v1beta + GEMINI_MODEL: ${{ vars.GEMINI_MODEL }} permissions: contents: write pull-requests: write From a6df5c4f431eecb9fd3202f1f52e0e4a3666f335 Mon Sep 17 00:00:00 2001 From: Jeffery Date: Tue, 12 May 2026 08:17:49 +0000 Subject: [PATCH 07/17] feat: refactor API key handling to shuffle keys and attempt each once --- README.md | 2 +- TODO.md | 2 +- app/llm.js | 9 +++++---- app/llm.test.js | 28 ++++++++++++++-------------- 4 files changed, 21 insertions(+), 20 deletions(-) diff --git a/README.md b/README.md index 2b2be5a..e3cd44a 100644 --- a/README.md +++ b/README.md @@ -21,7 +21,7 @@ 3. Comment 加上些許 emoji 讓資訊有點活力 4. 盡量將應用程式放在 ./app，修改 entrypoint.sh 與 Dockerfile 讓程式可以正常運行 5. 將提示詞放到 ./app/prompts 內供程式讀取 -6. API Key 支援逗號分隔傳入多個，依序嘗試，失敗時自動換下一個，全部失敗則 exit 1 +6. API Key 支援逗號分隔傳入多個，隨機順序各嘗試一次，全部失敗則 exit 1 # 使用說明 diff --git a/TODO.md b/TODO.md index c605eac..225c458 100644 --- a/TODO.md +++ b/TODO.md @@ -36,7 +36,7 @@ - 完成 ## 階段八：API Key 輪替 -- 目標：所有平台的 API Key 支援逗號分隔傳入多個，依序嘗試，單一 Key 失敗時自動換下一個，全部失敗則 exit 1。 +- 目標：所有平台的 API Key 支援逗號分隔傳入多個，隨機順序各嘗試一次，單一 Key 失敗時自動換下一個，全部失敗則 exit 1。 - 驗收：log 中能看到「key[N/M] 失敗」等訊息，換 key 後繼續執行；傳入單一 Key 時行為與原本相同；全部 Key 失敗時 log「所有 API Key 均失敗，終止流程」且 workflow 狀態為失敗。 - 完成 diff --git a/app/llm.js b/app/llm.js index e2c2db1..1b009e0 100644 --- a/app/llm.js +++ b/app/llm.js @@ -10,19 +10,20 @@ export async function chat(systemPrompt, userContent) { const headers = { 'Content-Type': 'application/json' }; if (provider === 'claude') headers['anthropic-version'] = '2023-06-01'; + const shuffled = [...apiKeys].sort(() => Math.random() - 0.5); let lastError; - for (let i = 0; i < apiKeys.length; i++) { - if (provider !== 'ollama') headers['Authorization'] = `Bearer ${apiKeys[i]}`; + for (let i = 0; i < shuffled.length; i++) { + if (provider !== 'ollama') headers['Authorization'] = `Bearer ${shuffled[i]}`; try { const resp = await axios.post( `${baseURL.replace(/\/$/, '')}/chat/completions`, { model, messages: [{ role: 'system', content: systemPrompt }, { role: 'user', content: userContent }], temperature: 0.2 }, - { headers, timeout: 30000 } + { headers } ); return resp.data.choices[0].message.content; } catch (e) { lastError = e; - console.log(` [LLM] key[${i + 1}/${apiKeys.length}] 失敗: ${e.message}`); + console.log(` [LLM] key[${i + 1}/${shuffled.length}] 失敗: ${e.message}`); } } console.error(' [LLM] 所有 API Key 均失敗，終止流程'); diff --git a/app/llm.test.js b/app/llm.test.js index 74f41f6..c94b893 100644 --- a/app/llm.test.js +++ b/app/llm.test.js @@ -48,18 +48,18 @@ describe('chat - key rotation', async () => { assert.equal(result, 'hello'); }); - it('rotates to second key when first fails', async () => { - process.env.OPENAI_API_KEY = 'key1,key2'; - mockAxiosPost([new Error('rate limit'), makeOkResponse('from key2')]); - const result = await chat('sys', 'user'); - assert.equal(result, 'from key2'); - }); - - it('rotates through all keys and succeeds on last', async () => { - process.env.OPENAI_API_KEY = 'k1,k2,k3'; - mockAxiosPost([new Error('fail'), new Error('fail'), makeOkResponse('from k3')]); - const result = await chat('sys', 'user'); - assert.equal(result, 'from k3'); + it('shuffles keys and tries each exactly once', async () => { + process.env.OPENAI_API_KEY = 'key1,key2,key3'; + const usedKeys = []; + mock.method(axios, 'post', async (_url, _body, opts) => { + usedKeys.push(opts.headers['Authorization'].replace('Bearer ', '')); + throw new Error('fail'); + }); + const exitMock = mock.method(process, 'exit', () => { throw new Error('exit:1'); }); + await assert.rejects(() => chat('sys', 'user'), /exit:1/); + assert.equal(exitMock.mock.calls[0].arguments[0], 1); + assert.equal(usedKeys.length, 3); + assert.deepEqual([...usedKeys].sort(), ['key1', 'key2', 'key3']); }); it('calls process.exit(1) when all keys fail', async () => { @@ -93,7 +93,7 @@ describe('chat - key rotation', async () => { assert.equal(capturedHeaders['Authorization'], 'Bearer sk-test'); }); - it('uses 30s timeout', async () => { + it('does not set timeout', async () => { process.env.OPENAI_API_KEY = 'sk-test'; let capturedOpts; mock.method(axios, 'post', async (_url, _body, opts) => { @@ -101,7 +101,7 @@ describe('chat - key rotation', async () => { return makeOkResponse(); }); await chat('sys', 'user'); - assert.equal(capturedOpts.timeout, 30000); + assert.equal(capturedOpts.timeout, undefined); }); it('does not pass httpsAgent to axios', async () => { From b3c868ceec03a79bc3e9cdb7055dc8828d01761f Mon Sep 17 00:00:00 2001 From: AI Review Bot Date: Tue, 12 May 2026 08:23:00 +0000 Subject: [PATCH 08/17] chore: update ai-review findings [skip ci] --- .gitea/ai-review/findings.json | 24 +++++++++++++++++++----- 1 file changed, 19 insertions(+), 5 deletions(-) diff --git a/.gitea/ai-review/findings.json b/.gitea/ai-review/findings.json index 856ea5a..dacae23 100644 --- a/.gitea/ai-review/findings.json +++ b/.gitea/ai-review/findings.json @@ -4,28 +4,28 @@ "role": "Leo", "location": "app/llm.js:22", "suggestion": "在 `chat` 函式中，`Authorization` 標頭是無條件地被加入到所有 LLM 請求中。這對於不需要 API Key 的服務（如 Ollama）是不必要的，且可能導致錯誤。建議在設定 `Authorization` 標頭之前，先判斷當前的 `provider` 是否需要 API Key，例如 `if (provider !== 'ollama' && apiKeys[i]) { headers['Authorization'] = `Bearer ${apiKeys[i]}`; }`，以提高程式碼的健壯性和正確性。", - "is_new": true + "is_new": false }, { "level": "critical", "role": "Zara", "location": "app/llm.js:20", "suggestion": "當啟用 API Key 輪替機制時，單一 API 請求的 `timeout` 設定為 120 秒過長。若有多個 Key 且每個 Key 都因逾時而失敗，可能導致整個流程耗時過久（例如 10 個 Key 可能耗時 20 分鐘）。建議將單次請求的逾時時間縮短（例如 10-30 秒），以加速 Key 的輪替，避免 CI/CD 流程長時間阻塞。", - "is_new": true + "is_new": false }, { "level": "critical", "role": "Rex", "location": "app/llm.js:6", "suggestion": "程式碼中 `https.Agent({ rejectUnauthorized: false })` 停用了 SSL/TLS 憑證驗證。這會使所有 HTTPS 連線容易受到中間人 (Man-in-the-Middle, MITM) 攻擊，攻擊者可以攔截並修改與 LLM 服務提供者的通訊，導致資料洩漏、未經授權的存取或 AI 回應被操縱。請移除 `const httpsAgent = new https.Agent({ rejectUnauthorized: false });` 這一行，並確保 `axios.post` 呼叫中不再使用 `httpsAgent` 選項。預設情況下，Node.js 和 Axios 會執行嚴格的 SSL 憑證驗證，這是確保通訊安全的最佳實踐。如果遇到憑證問題，應調查並解決底層的憑證信任鏈問題，而非禁用驗證。", - "is_new": true + "is_new": false }, { "level": "critical", "role": "Maya", "location": "app/llm.js:10-31", "suggestion": "`app/llm.js` 中實現的 API Key 輪替功能是本次改動的核心，但目前缺少對應的單元測試。請務必在 `app/llm.test.js` 中新增全面的測試案例，以驗證 `TODO.md` 中「階段八：API Key 輪替」的所有驗收標準：\n* **單一 Key 成功**：傳入單一有效 Key 時，確保行為與原本相同。\n* **多個 Key 輪替成功**：驗證當前 N-1 個 Key 失敗，第 N 個 Key 成功時，系統能依序嘗試並最終成功。\n* **所有 Key 失敗**：驗證當所有傳入的 Key 都失敗時，系統能正確記錄每次失敗，並最終呼叫 `process.exit(1)` 終止流程（測試時需模擬 `process.exit` 以捕獲其調用）。\n* **日誌訊息**：驗證在 Key 失敗時，能正確輸出「key[N/M] 失敗」的日誌；所有 Key 失敗時，能輸出「所有 API Key 均失敗，終止流程」。\n* **錯誤處理**：模擬不同類型的 API 錯誤（例如 401 Unauthorized, 429 Too Many Requests, 網路超時等），確保 Key 輪替機制能穩健處理。", - "is_new": true + "is_new": false }, { "level": "warning", @@ -46,13 +46,27 @@ "role": "Leo", "location": ".gitea/workflows/review.yaml:36", "suggestion": "GEMINI_API_KEY 的值過長，影響可讀性。雖然這是為了傳遞多個 Secret，但建議考慮是否有其他方式可以讓設定檔更簡潔，例如將多個 Secret 組合為一個，或在 Action 內部處理多個獨立的 Secret 變數（如果 Action 支援）。如果沒有其他方式，請考慮將其分行以提高可讀性（雖然 YAML 可能會將其視為單行）。", + "is_new": false + }, + { + "level": "warning", + "role": "Maya", + "location": "app/llm.test.js", + "suggestion": "在 `llm.test.js` 中，`TODO.md` 驗收標準明確要求驗證「key[N/M] 失敗」和「所有 API Key 均失敗，終止流程」的日誌訊息。目前的測試雖然驗證了 `process.exit(1)` 的調用，但並未對 `console.log` 和 `console.error` 的輸出進行模擬和斷言。建議使用 `mock.method(console, 'log', ...)` 和 `mock.method(console, 'error', ...)` 來捕獲並驗證這些重要的日誌訊息，確保系統在 API Key 輪替失敗時能提供清晰的診斷資訊。", + "is_new": true + }, + { + "level": "warning", + "role": "Maya", + "location": "app/llm.test.js", + "suggestion": "針對 API Key 輪替的錯誤處理，`TODO.md` 驗收標準中提到「模擬不同類型的 API 錯誤（例如 401 Unauthorized, 429 Too Many Requests, 網路超時等）」。目前的測試僅使用 `new Error('fail')` 進行通用錯誤模擬。建議擴展測試案例，模擬 `axios` 拋出帶有特定 HTTP 狀態碼（如 401, 429）的錯誤，以及模擬網路超時（例如 `axios.isAxiosError` 且 `e.code === 'ECONNABORTED'`），以確保 API Key 輪替機制在面對不同類型的 API 錯誤時都能穩健運作。", "is_new": true }, { "level": "warning", "role": "Maya", "location": "app/llm.js", - "suggestion": "`chatJSON` 函數依賴於 `chat` 函數的 API Key 輪替邏輯。為確保在處理 JSON 格式回應時，API Key 輪替機制也能正常運作，建議在 `app/llm.test.js` 中為 `chatJSON` 函數新增至少一個測試案例，特別是針對 Key 輪替失敗或成功後的行為進行驗證。", + "suggestion": "`app/llm.js` 中的 `chatJSON` 函數依賴於 `chat` 函數的 API Key 輪替邏輯。雖然 `chat` 函數已新增測試，但 `chatJSON` 函數本身並未有專屬的測試案例。建議在 `app/llm.test.js` 中新增針對 `chatJSON` 的測試，特別是驗證在 API Key 輪替成功和失敗時，`chatJSON` 能正確處理 JSON 格式的回應，並在所有 Key 失敗時也能正確終止流程。", "is_new": true } ] From bb18147cab91badf964fee2d0287675ec005626d Mon Sep 17 00:00:00 2001 From: Jeffery Date: Tue, 12 May 2026 08:26:58 +0000 Subject: [PATCH 09/17] feat: update exclusions.json with additional suggestions and refine master.yaml for cleaner token handling --- .gitea/ai-review/exclusions.json | 30 ++++++++++++++++++++++++++++++ .gitea/workflows/master.yaml | 2 +- 2 files changed, 31 insertions(+), 1 deletion(-) diff --git a/.gitea/ai-review/exclusions.json b/.gitea/ai-review/exclusions.json index e081e36..0bcf829 100644 --- a/.gitea/ai-review/exclusions.json +++ b/.gitea/ai-review/exclusions.json @@ -93,5 +93,35 @@ "role": "Rex", "location": ".gitea/workflows/review.yaml", "suggestion": "切換 LLM 服務提供商的維護建議屬過度謹慎，不是實際程式碼問題" + }, + { + "role": "Leo", + "location": "app/llm.js", + "suggestion": "Authorization 標頭已有 provider !== 'ollama' 判斷，不會無條件加入，已正確處理" + }, + { + "role": "Zara", + "location": "app/llm.js", + "suggestion": "timeout 已移除，每個 key 等待完整回應，避免浪費免費額度" + }, + { + "role": "Rex", + "location": "app/llm.js", + "suggestion": "httpsAgent (rejectUnauthorized: false) 已移除，SSL/TLS 驗證已恢復正常" + }, + { + "role": "Maya", + "location": "app/llm.js", + "suggestion": "llm.test.js 已存在並涵蓋 API Key 輪替的所有異常狀況，包含單 Key、多 Key 輪替、所有 Key 失敗等測試案例" + }, + { + "role": "Zara", + "location": "app/comments.js", + "suggestion": "comments.js:24 的 saveFindings 函式為正常寫入邏輯，不涉及異常訊息格式或重複寫入問題" + }, + { + "role": "Leo", + "location": ".gitea/workflows/review.yaml", + "suggestion": "Gitea Actions 不支援在 workflow 內合併 secrets 再拆解，多個 secret 逗號串接是唯一可行做法，非設計缺陷" } ] diff --git a/.gitea/workflows/master.yaml b/.gitea/workflows/master.yaml index b37b091..bfe2ef2 100644 --- a/.gitea/workflows/master.yaml +++ b/.gitea/workflows/master.yaml @@ -25,4 +25,4 @@ jobs: - name: 清理成品 uses: https://gitea.jsc.idv.tw/actions/cleanup-release@${{ vars.ACTION_CLEANUP_RELEASE_VERSION }} with: - RUNNER_TOKEN: ${{ secrets.RUNNER_TOKEN }} \ No newline at end of file + RUNNER_TOKEN: ${{ secrets.RUNNER_TOKEN }} From b149508dab37fcc18fc5b8a04ed33c43dd65cae3 Mon Sep 17 00:00:00 2001 From: Jeffery Date: Tue, 12 May 2026 08:28:37 +0000 Subject: [PATCH 10/17] feat: enhance exclusions.json with additional suggestions and add chatJSON tests for JSON response handling --- .gitea/ai-review/exclusions.json | 10 ++++++++++ app/llm.test.js | 25 +++++++++++++++++++++++++ 2 files changed, 35 insertions(+) diff --git a/.gitea/ai-review/exclusions.json b/.gitea/ai-review/exclusions.json index 0bcf829..d9360c8 100644 --- a/.gitea/ai-review/exclusions.json +++ b/.gitea/ai-review/exclusions.json @@ -123,5 +123,15 @@ "role": "Leo", "location": ".gitea/workflows/review.yaml", "suggestion": "Gitea Actions 不支援在 workflow 內合併 secrets 再拆解，多個 secret 逗號串接是唯一可行做法，非設計缺陷" + }, + { + "role": "Maya", + "location": "app/llm.test.js", + "suggestion": "console.log/error 為診斷用途，不是業務邏輯，TODO.md 驗收標準為人工驗收描述，不需要在單元測試中斷言 console 輸出" + }, + { + "role": "Maya", + "location": "app/llm.test.js", + "suggestion": "輪替邏輯對所有錯誤類型行為一致（catch 全部），401/429/timeout 觸發相同輪替流程，測試不同錯誤類型無額外驗證價值" } ] diff --git a/app/llm.test.js b/app/llm.test.js index c94b893..c4654ab 100644 --- a/app/llm.test.js +++ b/app/llm.test.js @@ -126,3 +126,28 @@ describe('chat - key rotation', async () => { assert.equal(capturedHeaders['anthropic-version'], '2023-06-01'); }); }); + +describe('chatJSON', async () => { + const { chatJSON } = await import('./llm.js'); + + it('parses plain JSON response', async () => { + process.env.OPENAI_API_KEY = 'sk-test'; + mockAxiosPost([makeOkResponse('[{"level":"critical"}]')]); + const result = await chatJSON('sys', 'user'); + assert.deepEqual(result, [{ level: 'critical' }]); + }); + + it('strips markdown code block before parsing', async () => { + process.env.OPENAI_API_KEY = 'sk-test'; + mockAxiosPost([makeOkResponse('```json\n[{"level":"info"}]\n```')]); + const result = await chatJSON('sys', 'user'); + assert.deepEqual(result, [{ level: 'info' }]); + }); + + it('returns [] when JSON is invalid', async () => { + process.env.OPENAI_API_KEY = 'sk-test'; + mockAxiosPost([makeOkResponse('not json')]); + const result = await chatJSON('sys', 'user'); + assert.deepEqual(result, []); + }); +}); From af195b9c3b6ad663a7e0dfcf3b637c139e173c01 Mon Sep 17 00:00:00 2001 From: AI Review Bot Date: Tue, 12 May 2026 08:36:23 +0000 Subject: [PATCH 11/17] chore: update ai-review findings [skip ci] --- .gitea/ai-review/findings.json | 55 ++-------------------------------- 1 file changed, 3 insertions(+), 52 deletions(-) diff --git a/.gitea/ai-review/findings.json b/.gitea/ai-review/findings.json index dacae23..3c3e056 100644 --- a/.gitea/ai-review/findings.json +++ b/.gitea/ai-review/findings.json @@ -1,39 +1,4 @@ [ - { - "level": "critical", - "role": "Leo", - "location": "app/llm.js:22", - "suggestion": "在 `chat` 函式中，`Authorization` 標頭是無條件地被加入到所有 LLM 請求中。這對於不需要 API Key 的服務（如 Ollama）是不必要的，且可能導致錯誤。建議在設定 `Authorization` 標頭之前，先判斷當前的 `provider` 是否需要 API Key，例如 `if (provider !== 'ollama' && apiKeys[i]) { headers['Authorization'] = `Bearer ${apiKeys[i]}`; }`，以提高程式碼的健壯性和正確性。", - "is_new": false - }, - { - "level": "critical", - "role": "Zara", - "location": "app/llm.js:20", - "suggestion": "當啟用 API Key 輪替機制時，單一 API 請求的 `timeout` 設定為 120 秒過長。若有多個 Key 且每個 Key 都因逾時而失敗，可能導致整個流程耗時過久（例如 10 個 Key 可能耗時 20 分鐘）。建議將單次請求的逾時時間縮短（例如 10-30 秒），以加速 Key 的輪替，避免 CI/CD 流程長時間阻塞。", - "is_new": false - }, - { - "level": "critical", - "role": "Rex", - "location": "app/llm.js:6", - "suggestion": "程式碼中 `https.Agent({ rejectUnauthorized: false })` 停用了 SSL/TLS 憑證驗證。這會使所有 HTTPS 連線容易受到中間人 (Man-in-the-Middle, MITM) 攻擊，攻擊者可以攔截並修改與 LLM 服務提供者的通訊，導致資料洩漏、未經授權的存取或 AI 回應被操縱。請移除 `const httpsAgent = new https.Agent({ rejectUnauthorized: false });` 這一行，並確保 `axios.post` 呼叫中不再使用 `httpsAgent` 選項。預設情況下，Node.js 和 Axios 會執行嚴格的 SSL 憑證驗證，這是確保通訊安全的最佳實踐。如果遇到憑證問題，應調查並解決底層的憑證信任鏈問題，而非禁用驗證。", - "is_new": false - }, - { - "level": "critical", - "role": "Maya", - "location": "app/llm.js:10-31", - "suggestion": "`app/llm.js` 中實現的 API Key 輪替功能是本次改動的核心，但目前缺少對應的單元測試。請務必在 `app/llm.test.js` 中新增全面的測試案例，以驗證 `TODO.md` 中「階段八：API Key 輪替」的所有驗收標準：\n* **單一 Key 成功**：傳入單一有效 Key 時，確保行為與原本相同。\n* **多個 Key 輪替成功**：驗證當前 N-1 個 Key 失敗，第 N 個 Key 成功時，系統能依序嘗試並最終成功。\n* **所有 Key 失敗**：驗證當所有傳入的 Key 都失敗時，系統能正確記錄每次失敗，並最終呼叫 `process.exit(1)` 終止流程（測試時需模擬 `process.exit` 以捕獲其調用）。\n* **日誌訊息**：驗證在 Key 失敗時，能正確輸出「key[N/M] 失敗」的日誌；所有 Key 失敗時，能輸出「所有 API Key 均失敗，終止流程」。\n* **錯誤處理**：模擬不同類型的 API 錯誤（例如 401 Unauthorized, 429 Too Many Requests, 網路超時等），確保 Key 輪替機制能穩健處理。", - "is_new": false - }, - { - "level": "warning", - "role": "Zara", - "location": "app/comments.js:24", - "suggestion": "在 `saveFindings` 函數中，`fs.writeFileSync` 是一個同步操作。如果 `findings` 陣列可能非常大，或者此函數會被頻繁呼叫，同步寫入檔案可能會阻塞 Node.js 事件迴圈，導致應用程式響應變慢。建議改用 `fs.writeFile` (非同步) 以避免阻塞主執行緒，提升應用程式的響應能力。", - "is_new": false - }, { "level": "warning", "role": "Aria", @@ -44,29 +9,15 @@ { "level": "warning", "role": "Leo", - "location": ".gitea/workflows/review.yaml:36", - "suggestion": "GEMINI_API_KEY 的值過長，影響可讀性。雖然這是為了傳遞多個 Secret，但建議考慮是否有其他方式可以讓設定檔更簡潔，例如將多個 Secret 組合為一個，或在 Action 內部處理多個獨立的 Secret 變數（如果 Action 支援）。如果沒有其他方式，請考慮將其分行以提高可讀性（雖然 YAML 可能會將其視為單行）。", - "is_new": false - }, - { - "level": "warning", - "role": "Maya", "location": "app/llm.test.js", - "suggestion": "在 `llm.test.js` 中，`TODO.md` 驗收標準明確要求驗證「key[N/M] 失敗」和「所有 API Key 均失敗，終止流程」的日誌訊息。目前的測試雖然驗證了 `process.exit(1)` 的調用，但並未對 `console.log` 和 `console.error` 的輸出進行模擬和斷言。建議使用 `mock.method(console, 'log', ...)` 和 `mock.method(console, 'error', ...)` 來捕獲並驗證這些重要的日誌訊息，確保系統在 API Key 輪替失敗時能提供清晰的診斷資訊。", + "suggestion": "根據 `TODO.md` 的驗收標準，API Key 輪替失敗時應輸出特定的日誌訊息。目前的單元測試雖然驗證了 `process.exit(1)` 的調用，但並未對 `console.log` 和 `console.error` 的輸出進行模擬和斷言。建議使用 `mock.method(console, 'log', ...)` 和 `mock.method(console, 'error', ...)` 來捕獲並驗證這些重要的日誌訊息，以確保系統在 API Key 輪替失敗時能提供清晰的診斷資訊，這對長期維護和問題排查至關重要。", "is_new": true }, { "level": "warning", - "role": "Maya", + "role": "Leo", "location": "app/llm.test.js", - "suggestion": "針對 API Key 輪替的錯誤處理，`TODO.md` 驗收標準中提到「模擬不同類型的 API 錯誤（例如 401 Unauthorized, 429 Too Many Requests, 網路超時等）」。目前的測試僅使用 `new Error('fail')` 進行通用錯誤模擬。建議擴展測試案例，模擬 `axios` 拋出帶有特定 HTTP 狀態碼（如 401, 429）的錯誤，以及模擬網路超時（例如 `axios.isAxiosError` 且 `e.code === 'ECONNABORTED'`），以確保 API Key 輪替機制在面對不同類型的 API 錯誤時都能穩健運作。", - "is_new": true - }, - { - "level": "warning", - "role": "Maya", - "location": "app/llm.js", - "suggestion": "`app/llm.js` 中的 `chatJSON` 函數依賴於 `chat` 函數的 API Key 輪替邏輯。雖然 `chat` 函數已新增測試，但 `chatJSON` 函數本身並未有專屬的測試案例。建議在 `app/llm.test.js` 中新增針對 `chatJSON` 的測試，特別是驗證在 API Key 輪替成功和失敗時，`chatJSON` 能正確處理 JSON 格式的回應，並在所有 Key 失敗時也能正確終止流程。", + "suggestion": "針對 API Key 輪替的錯誤處理，`TODO.md` 驗收標準中明確提到「模擬不同類型的 API 錯誤（例如 401 Unauthorized, 429 Too Many Requests, 網路超時等）」。目前的測試僅使用 `new Error('fail')` 進行通用錯誤模擬。建議擴展測試案例，模擬 `axios` 拋出帶有特定 HTTP 狀態碼（如 401, 429）的錯誤，以及模擬網路超時（例如 `axios.isAxiosError` 且 `e.code === 'ECONNABORTED'`），以確保 API Key 輪替機制在面對各種實際的 API 錯誤時都能穩健運作，這有助於提高程式碼的健壯性和可維護性。", "is_new": true } ] From 95929fdced28d202050d50122a2d93cc555fc774 Mon Sep 17 00:00:00 2001 From: Jeffery Date: Tue, 12 May 2026 08:41:23 +0000 Subject: [PATCH 12/17] feat: add suggestions for master.yaml and llm.test.js to improve code quality and testing practices --- .gitea/ai-review/exclusions.json | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/.gitea/ai-review/exclusions.json b/.gitea/ai-review/exclusions.json index d9360c8..27703d2 100644 --- a/.gitea/ai-review/exclusions.json +++ b/.gitea/ai-review/exclusions.json @@ -133,5 +133,20 @@ "role": "Maya", "location": "app/llm.test.js", "suggestion": "輪替邏輯對所有錯誤類型行為一致（catch 全部），401/429/timeout 觸發相同輪替流程，測試不同錯誤類型無額外驗證價值" + }, + { + "role": "Aria", + "location": ".gitea/workflows/master.yaml", + "suggestion": "master.yaml 檔案結尾已有換行符號（0x0a），符合 POSIX 慣例，無需修改" + }, + { + "role": "Leo", + "location": "app/llm.test.js", + "suggestion": "console.log/error 為診斷用途，不是業務邏輯，TODO.md 驗收標準為人工驗收描述，不需要在單元測試中斷言 console 輸出" + }, + { + "role": "Leo", + "location": "app/llm.test.js", + "suggestion": "輪替邏輯對所有錯誤類型行為一致（catch 全部），401/429/timeout 觸發相同輪替流程，測試不同錯誤類型無額外驗證價值" } ] From a296c594d3bcfb2a3fb400a2e81401730e75dc80 Mon Sep 17 00:00:00 2001 From: AI Review Bot Date: Tue, 12 May 2026 08:45:24 +0000 Subject: [PATCH 13/17] chore: update ai-review findings [skip ci] --- .gitea/ai-review/findings.json | 22 ++++------------------ 1 file changed, 4 insertions(+), 18 deletions(-) diff --git a/.gitea/ai-review/findings.json b/.gitea/ai-review/findings.json index 3c3e056..3e4cf15 100644 --- a/.gitea/ai-review/findings.json +++ b/.gitea/ai-review/findings.json @@ -1,23 +1,9 @@ [ { - "level": "warning", - "role": "Aria", - "location": ".gitea/workflows/master.yaml", - "suggestion": "檔案結尾應包含一個換行符號 (newline at EOF)，這是 POSIX 系統的慣例，有助於版本控制系統的正確處理。", - "is_new": false - }, - { - "level": "warning", - "role": "Leo", - "location": "app/llm.test.js", - "suggestion": "根據 `TODO.md` 的驗收標準，API Key 輪替失敗時應輸出特定的日誌訊息。目前的單元測試雖然驗證了 `process.exit(1)` 的調用，但並未對 `console.log` 和 `console.error` 的輸出進行模擬和斷言。建議使用 `mock.method(console, 'log', ...)` 和 `mock.method(console, 'error', ...)` 來捕獲並驗證這些重要的日誌訊息，以確保系統在 API Key 輪替失敗時能提供清晰的診斷資訊，這對長期維護和問題排查至關重要。", - "is_new": true - }, - { - "level": "warning", - "role": "Leo", - "location": "app/llm.test.js", - "suggestion": "針對 API Key 輪替的錯誤處理，`TODO.md` 驗收標準中明確提到「模擬不同類型的 API 錯誤（例如 401 Unauthorized, 429 Too Many Requests, 網路超時等）」。目前的測試僅使用 `new Error('fail')` 進行通用錯誤模擬。建議擴展測試案例，模擬 `axios` 拋出帶有特定 HTTP 狀態碼（如 401, 429）的錯誤，以及模擬網路超時（例如 `axios.isAxiosError` 且 `e.code === 'ECONNABORTED'`），以確保 API Key 輪替機制在面對各種實際的 API 錯誤時都能穩健運作，這有助於提高程式碼的健壯性和可維護性。", + "level": "info", + "role": "Maya", + "location": "app/config.test.js", + "suggestion": "在 `app/config.js` 中，`splitKeys` 函式會過濾掉空字串，這表示如果環境變數只包含逗號（例如 `OPENAI_API_KEY = ','` 或 `OPENAI_API_KEY = ' '`），`apiKeys` 陣列將會是空的。雖然目前的 `getLLMConfig` 邏輯能正確處理空的 `apiKeys` 陣列，並最終導致 `provider` 為 `null`，但建議在 `app/config.test.js` 中增加一個明確的測試案例，以驗證這種邊界條件下 `getLLMConfig` 的行為是否符合預期，確保其在無效或空字串輸入時的穩定性。", "is_new": true } ] From b6aa37201ad11d773a11a4ca42fcc82188ead119 Mon Sep 17 00:00:00 2001 From: Jeffery Date: Tue, 12 May 2026 09:01:54 +0000 Subject: [PATCH 14/17] feat: add test for handling comma-only API key in getLLMConfig --- app/config.test.js | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/app/config.test.js b/app/config.test.js index 03cf9ac..c648520 100644 --- a/app/config.test.js +++ b/app/config.test.js @@ -105,4 +105,11 @@ describe('getLLMConfig', () => { assert.equal(cfg.provider, 'ollama'); assert.equal(cfg.model, 'llama3'); }); + + it('comma-only api key is treated as not set', () => { + process.env.OPENAI_API_KEY = ',,,'; + const cfg = getLLMConfig(); + assert.equal(cfg.provider, null); + assert.deepEqual(cfg.apiKeys, []); + }); }); From 3fa5504e9ae0b3c5d4eeea9a0659617ea5ccf2e3 Mon Sep 17 00:00:00 2001 From: AI Review Bot Date: Tue, 12 May 2026 09:13:49 +0000 Subject: [PATCH 15/17] chore: update ai-review findings [skip ci] --- .gitea/ai-review/findings.json | 20 +++++++++++++++++--- 1 file changed, 17 insertions(+), 3 deletions(-) diff --git a/.gitea/ai-review/findings.json b/.gitea/ai-review/findings.json index 3e4cf15..80c1dad 100644 --- a/.gitea/ai-review/findings.json +++ b/.gitea/ai-review/findings.json @@ -1,9 +1,23 @@ [ + { + "level": "critical", + "role": "Aria", + "location": "app/llm.js:39", + "suggestion": "在 `chat` 函式中直接呼叫 `process.exit(1)` 會導致應用程式立即終止，降低了模組的重用性和測試彈性。建議改為拋出一個自訂錯誤（例如 `AllApiKeysFailedError`），讓呼叫端（例如應用程式的入口點）來決定如何處理此錯誤，例如在頂層捕獲後再呼叫 `process.exit(1)`。", + "is_new": true + }, + { + "level": "warning", + "role": "Aria", + "location": "app/llm.js:26", + "suggestion": "變數 `lastError` 在迴圈結束後並未使用。請考慮移除此變數，或在所有 API Key 均失敗時，將其包含在拋出的錯誤訊息中，以提供更詳細的失敗原因。", + "is_new": true + }, { "level": "info", - "role": "Maya", - "location": "app/config.test.js", - "suggestion": "在 `app/config.js` 中，`splitKeys` 函式會過濾掉空字串，這表示如果環境變數只包含逗號（例如 `OPENAI_API_KEY = ','` 或 `OPENAI_API_KEY = ' '`），`apiKeys` 陣列將會是空的。雖然目前的 `getLLMConfig` 邏輯能正確處理空的 `apiKeys` 陣列，並最終導致 `provider` 為 `null`，但建議在 `app/config.test.js` 中增加一個明確的測試案例，以驗證這種邊界條件下 `getLLMConfig` 的行為是否符合預期，確保其在無效或空字串輸入時的穩定性。", + "role": "Rex", + "location": "app/package.json", + "suggestion": "此次變更包含 `axios` 和 `openai` 等重要函式庫的版本更新，特別是 `openai` 從 `4.28.0` 升級到 `4.104.0`。建議審查這些函式庫的發行說明（changelog），以了解是否有任何安全修補、已知漏洞或行為變更，確保更新不會引入新的安全風險或不預期的行為。", "is_new": true } ] From 9650162a67268beb9872ec93187b0f8b2856877d Mon Sep 17 00:00:00 2001 From: Jeffery Date: Tue, 12 May 2026 09:21:32 +0000 Subject: [PATCH 16/17] feat: extend GEMINI_API_KEY support to include additional keys and update suggestions in exclusions.json --- .gitea/ai-review/exclusions.json | 10 ++++++++++ .gitea/workflows/review.yaml | 2 +- README.md | 2 +- app/llm.js | 2 -- 4 files changed, 12 insertions(+), 4 deletions(-) diff --git a/.gitea/ai-review/exclusions.json b/.gitea/ai-review/exclusions.json index 27703d2..8d3f313 100644 --- a/.gitea/ai-review/exclusions.json +++ b/.gitea/ai-review/exclusions.json @@ -148,5 +148,15 @@ "role": "Leo", "location": "app/llm.test.js", "suggestion": "輪替邏輯對所有錯誤類型行為一致（catch 全部），401/429/timeout 觸發相同輪替流程，測試不同錯誤類型無額外驗證價值" + }, + { + "role": "Rex", + "location": "app/package.json", + "suggestion": "審查 changelog 是人工作業，不是程式碼問題，不適合作為 code review 問題" + }, + { + "role": "Aria", + "location": "app/llm.js", + "suggestion": "此 action 為 CLI 工具，process.exit(1) 是設計意圖讓 CI/CD workflow 失敗。改拋錯會被 chatJSON 的 catch 吞掉回傳 []，破壞現有行為" } ] diff --git a/.gitea/workflows/review.yaml b/.gitea/workflows/review.yaml index 6fbcb0b..5c36cc4 100644 --- a/.gitea/workflows/review.yaml +++ b/.gitea/workflows/review.yaml @@ -33,7 +33,7 @@ jobs: - name: AI Code Review uses: https://gitea.jsc.idv.tw/jiantw83/code-review@v${{ needs.version.outputs.version }} with: - GEMINI_API_KEY: ${{ secrets.GEMINI_API_KEY }},${{ secrets.GEMINI_API_KEY_1 }},${{ secrets.GEMINI_API_KEY_2 }},${{ secrets.GEMINI_API_KEY_3 }},${{ secrets.GEMINI_API_KEY_4 }},${{ secrets.GEMINI_API_KEY_5 }},${{ secrets.GEMINI_API_KEY_6 }},${{ secrets.GEMINI_API_KEY_7 }},${{ secrets.GEMINI_API_KEY_8 }},${{ secrets.GEMINI_API_KEY_9 }} + GEMINI_API_KEY: ${{ secrets.GEMINI_API_KEY }},${{ secrets.GEMINI_API_KEY_1 }},${{ secrets.GEMINI_API_KEY_2 }},${{ secrets.GEMINI_API_KEY_3 }},${{ secrets.GEMINI_API_KEY_4 }},${{ secrets.GEMINI_API_KEY_5 }},${{ secrets.GEMINI_API_KEY_6 }},${{ secrets.GEMINI_API_KEY_7 }},${{ secrets.GEMINI_API_KEY_8 }},${{ secrets.GEMINI_API_KEY_9 }},${{ secrets.GEMINI_API_KEY_10 }},${{ secrets.GEMINI_API_KEY_11 }},${{ secrets.GEMINI_API_KEY_12 }},${{ secrets.GEMINI_API_KEY_13 }},${{ secrets.GEMINI_API_KEY_14 }},${{ secrets.GEMINI_API_KEY_15 }},${{ secrets.GEMINI_API_KEY_16 }},${{ secrets.GEMINI_API_KEY_17 }},${{ secrets.GEMINI_API_KEY_18 }},${{ secrets.GEMINI_API_KEY_19 }} GEMINI_BASE_URL: https://generativelanguage.googleapis.com/v1beta GEMINI_MODEL: ${{ vars.GEMINI_MODEL }} permissions: diff --git a/README.md b/README.md index e3cd44a..e1717ef 100644 --- a/README.md +++ b/README.md @@ -111,7 +111,7 @@ jobs: - name: AI Code Review uses: https://gitea.jsc.idv.tw/jiantw83/code-review@${{ vars.ACTION_CODE_REVIEW_VERSION }} with: - GEMINI_API_KEY: ${{ secrets.GEMINI_API_KEY }},${{ secrets.GEMINI_API_KEY_1 }},${{ secrets.GEMINI_API_KEY_2 }},${{ secrets.GEMINI_API_KEY_3 }},${{ secrets.GEMINI_API_KEY_4 }},${{ secrets.GEMINI_API_KEY_5 }},${{ secrets.GEMINI_API_KEY_6 }},${{ secrets.GEMINI_API_KEY_7 }},${{ secrets.GEMINI_API_KEY_8 }},${{ secrets.GEMINI_API_KEY_9 }} + GEMINI_API_KEY: ${{ secrets.GEMINI_API_KEY }},${{ secrets.GEMINI_API_KEY_1 }},${{ secrets.GEMINI_API_KEY_2 }},${{ secrets.GEMINI_API_KEY_3 }},${{ secrets.GEMINI_API_KEY_4 }},${{ secrets.GEMINI_API_KEY_5 }},${{ secrets.GEMINI_API_KEY_6 }},${{ secrets.GEMINI_API_KEY_7 }},${{ secrets.GEMINI_API_KEY_8 }},${{ secrets.GEMINI_API_KEY_9 }},${{ secrets.GEMINI_API_KEY_10 }},${{ secrets.GEMINI_API_KEY_11 }},${{ secrets.GEMINI_API_KEY_12 }},${{ secrets.GEMINI_API_KEY_13 }},${{ secrets.GEMINI_API_KEY_14 }},${{ secrets.GEMINI_API_KEY_15 }},${{ secrets.GEMINI_API_KEY_16 }},${{ secrets.GEMINI_API_KEY_17 }},${{ secrets.GEMINI_API_KEY_18 }},${{ secrets.GEMINI_API_KEY_19 }} GEMINI_BASE_URL: https://generativelanguage.googleapis.com/v1beta GEMINI_MODEL: ${{ vars.GEMINI_MODEL }} permissions: diff --git a/app/llm.js b/app/llm.js index 1b009e0..4bf932f 100644 --- a/app/llm.js +++ b/app/llm.js @@ -11,7 +11,6 @@ export async function chat(systemPrompt, userContent) { if (provider === 'claude') headers['anthropic-version'] = '2023-06-01'; const shuffled = [...apiKeys].sort(() => Math.random() - 0.5); - let lastError; for (let i = 0; i < shuffled.length; i++) { if (provider !== 'ollama') headers['Authorization'] = `Bearer ${shuffled[i]}`; try { @@ -22,7 +21,6 @@ export async function chat(systemPrompt, userContent) { ); return resp.data.choices[0].message.content; } catch (e) { - lastError = e; console.log(` [LLM] key[${i + 1}/${shuffled.length}] 失敗: ${e.message}`); } } From d9acf3b0b794dc2368c258ed3970e7c2a262655c Mon Sep 17 00:00:00 2001 From: AI Review Bot Date: Tue, 12 May 2026 09:25:14 +0000 Subject: [PATCH 17/17] chore: update ai-review findings [skip ci] --- .gitea/ai-review/findings.json | 18 ++---------------- 1 file changed, 2 insertions(+), 16 deletions(-) diff --git a/.gitea/ai-review/findings.json b/.gitea/ai-review/findings.json index 80c1dad..6a44d72 100644 --- a/.gitea/ai-review/findings.json +++ b/.gitea/ai-review/findings.json @@ -1,23 +1,9 @@ [ - { - "level": "critical", - "role": "Aria", - "location": "app/llm.js:39", - "suggestion": "在 `chat` 函式中直接呼叫 `process.exit(1)` 會導致應用程式立即終止，降低了模組的重用性和測試彈性。建議改為拋出一個自訂錯誤（例如 `AllApiKeysFailedError`），讓呼叫端（例如應用程式的入口點）來決定如何處理此錯誤，例如在頂層捕獲後再呼叫 `process.exit(1)`。", - "is_new": true - }, - { - "level": "warning", - "role": "Aria", - "location": "app/llm.js:26", - "suggestion": "變數 `lastError` 在迴圈結束後並未使用。請考慮移除此變數，或在所有 API Key 均失敗時，將其包含在拋出的錯誤訊息中，以提供更詳細的失敗原因。", - "is_new": true - }, { "level": "info", - "role": "Rex", + "role": "Leo", "location": "app/package.json", - "suggestion": "此次變更包含 `axios` 和 `openai` 等重要函式庫的版本更新，特別是 `openai` 從 `4.28.0` 升級到 `4.104.0`。建議審查這些函式庫的發行說明（changelog），以了解是否有任何安全修補、已知漏洞或行為變更，確保更新不會引入新的安全風險或不預期的行為。", + "suggestion": "在 `app/package.json` 中，`axios` 和 `openai` 等函式庫進行了版本更新，特別是 `openai` 從 `4.28.0` 升級到 `4.104.0`。為了確保長期維護的穩定性和安全性，建議審查這些函式庫的發行說明（changelog），以了解是否有任何重大變更、安全修補或已知漏洞，並確認這些更新不會引入不預期的行為或技術債。", "is_new": true } ]