refactor: remove unused API keys and configurations from action and config files

Co-authored-by: Copilot <copilot@github.com>

.gitea/ai-review/exclusions.json

@@ -0,0 +1,11 @@
+[
+  {
+    "role": "Rex",
+    "location": "app/git.js",
+    "suggestion": "請避免將敏感資料（如 GITEA_TOKEN）直接寫入環境變數"
+  },
+  {
+    "location": "app/git.js",
+    "suggestion": "GITEA_TOKEN 直接嵌入 URL 中"
+  }
+]

.gitea/ai-review/findings.json

@@ -0,0 +1,58 @@
+[
+  {
+    "level": "critical",
+    "role": "Rex",
+    "location": ".gitea/workflows/review.yaml:41-44",
+    "suggestion": "工作流程 `AI Code Review` 被授予了 `contents: write`, `pull-requests: write`, `issues: write` 等廣泛權限。特別是 `contents: write` 權限，若工作流程所使用的 Action (`code-review`) 存在漏洞，可能導致程式碼庫被惡意修改，構成嚴重的安全風險。建議遵循最小權限原則，審查並僅授予工作流程執行所需的最少權限。例如，若僅需讀取程式碼和發布評論，則 `contents: read` 和 `pull-requests: write` 可能已足夠，而 `issues: write` 則可能完全不需要。",
+    "is_new": true
+  },
+  {
+    "level": "critical",
+    "role": "Rex",
+    "location": "README.md",
+    "suggestion": "`README.md` 中的 Gitea Actions 工作流程範例（特別是 OpenRouter 和 Google Gemini 部分）建議使用者配置 `contents: write`, `pull-requests: write`, `issues: write` 等廣泛權限。這會引導使用者建立具有過高權限的工作流程，若所使用的 Action 存在漏洞，可能導致程式碼庫被惡意修改。建議更新所有範例，遵循最小權限原則，僅建議授予工作流程執行所需的最少權限，例如 `contents: read` 和 `pull-requests: write`。",
+    "is_new": true
+  },
+  {
+    "level": "critical",
+    "role": "Maya",
+    "location": "app/config.test.js",
+    "suggestion": "在 `app/config.js` 中，`amazonq`, `kilo`, `roo`, `cline`, `continue`, `kade` 等 LLM 供應商的模型環境變數已從 `OPENAI_MODEL` 變更為各自專屬的 `PROVIDER_MODEL` (例如 `AMAZONQ_MODEL`)。然而，`app/config.test.js` 中僅針對 `amazonq` 進行了部分測試，而 `kilo`, `roo`, `cline`, `continue`, `kade` 這些供應商完全沒有任何測試案例。這導致這些供應商的配置邏輯（包括新的模型環境變數和預設值）完全未經驗證。請為這些未測試的供應商新增完整的單元測試，確保它們的 API 金鑰、基礎 URL 和模型配置都能正確解析，並驗證當對應的環境變數未設定時，能正確使用預設模型。",
+    "is_new": true
+  },
+  {
+    "level": "warning",
+    "role": "Leo",
+    "location": "README.md:50",
+    "suggestion": "在 `2. OpenRouter` 的範例中，`with:` 區塊使用 `OPENAI_API_KEY` 參數來傳遞 `OPENROUTER_API_KEY` secret。雖然這可能是 `code-review` action 的設計，但 `OPENAI_API_KEY` 這個名稱可能會讓使用者誤解為只能用於 OpenAI。建議考慮在 `code-review` action 中提供更通用的 API key 參數（例如 `API_KEY` 或 `PROVIDER_API_KEY`），或針對 OpenRouter 提供專屬的參數（例如 `OPENROUTER_API_KEY`），以提高清晰度並減少使用者設定時的困惑。如果 action 無法修改，目前的說明已盡力澄清，但仍是一個潛在的混淆點。",
+    "is_new": false
+  },
+  {
+    "level": "warning",
+    "role": "Zara",
+    "location": "app/config.js:15",
+    "suggestion": "將預設的 Gemini 模型從 `gemini-1.5-flash` 更新為 `gemini-2.5-flash`，這可能影響應用程式與 LLM 互動的效能和成本。建議在部署前，對 `gemini-2.5-flash` 模型進行詳細的效能基準測試，評估其在回應時間、處理速度、準確性及成本效益方面的表現，確保其符合應用程式的特定需求，並避免潛在的效能退化或不必要的成本增加。",
+    "is_new": false
+  },
+  {
+    "level": "warning",
+    "role": "Maya",
+    "location": "app/config.js:15",
+    "suggestion": "預設的 `GEMINI_MODEL` 已從 `gemini-1.5-flash` 變更為 `gemini-2.5-flash`。請確保有對應的單元測試來驗證當 `process.env.GEMINI_MODEL` 未設定時，`getLLMConfig` 函數能正確回傳新的預設模型 `gemini-2.5-flash`。",
+    "is_new": false
+  },
+  {
+    "level": "warning",
+    "role": "Leo",
+    "location": "app/config.js:15",
+    "suggestion": "目前 `checks` 陣列使用多個空格進行欄位對齊，這是一種脆弱的格式化方式，當配置項的內容長度改變時，容易導致對齊混亂，增加維護成本。建議將 `checks` 陣列中的每個 LLM 配置項重構為物件形式（例如 `{ provider: 'openai', apiKeyEnv: 'OPENAI_API_KEY', baseURL: '...', modelEnv: 'OPENAI_MODEL', defaultModel: '...' }`）。這樣可以提高程式碼的可讀性、可維護性及擴展性，並使新增或修改配置項更加清晰。",
+    "is_new": true
+  },
+  {
+    "level": "warning",
+    "role": "Maya",
+    "location": ".gitea/workflows/review.yaml",
+    "suggestion": "工作流程已從使用 OpenAI 轉換為 Gemini。雖然 `app/config.test.js` 增加了 `getLLMConfig` 的單元測試，但這僅驗證了配置的解析。為了確保 AI Code Review 功能在實際使用 Gemini 模型時能正常運作，建議在 CI/CD 中增加一個整合測試步驟。此測試應能驗證使用 Gemini 模型時，AI Code Review Action 是否能成功生成 PR 評論，例如檢查 PR 評論是否存在或其內容是否符合預期，以確保端到端的整合是成功的。",
+    "is_new": true
+  }
+]

.gitea/workflows/master.yaml

@@ -1,10 +1,11 @@
+name: CD
 on:
   push:
     branches:
     - master
 jobs:
   version:
-    name: "CD > 計算版本號"
+    name: 計算版本號
     runs-on: ubuntu
     outputs:
       version: ${{ steps.version.outputs.version }}
@@ -13,14 +14,14 @@ jobs:
       id: version
       uses: https://gitea.jsc.idv.tw/actions/calculate-version@${{ vars.ACTION_CALCULATE_VERSION }}
   release:
-    name: "CD > 發布專案"
+    name: 發布專案
     runs-on: ubuntu
     needs: version
     steps:
     - name: 發布專案
       uses: akkuman/gitea-release-action@${{ vars.ACTION_RELEASE_VERSION }}
       with:
-        tag_name: "v${{ needs.version.outputs.version }}"
+        tag_name: v${{ needs.version.outputs.version }}
     - name: 清理成品
       uses: https://gitea.jsc.idv.tw/actions/cleanup-release@${{ vars.ACTION_CLEANUP_RELEASE_VERSION }}
       with:

.gitea/workflows/review.yaml

@@ -0,0 +1,42 @@
+name: AI
+concurrency:
+  group: ${{ github.workflow }}-${{ github.head_ref }}
+  cancel-in-progress: true
+on:
+  pull_request:
+    branches-ignore:
+    - master
+    types: [opened, synchronize]
+jobs:
+  version:
+    name: 計算版本號
+    runs-on: ubuntu
+    outputs:
+      version: ${{ steps.version.outputs.version }}
+    steps:
+    - name: 計算版本號
+      id: version
+      uses: https://gitea.jsc.idv.tw/actions/calculate-version@${{ vars.ACTION_CALCULATE_VERSION }}
+      with:
+        IS_BETA: true
+    - name: 標註版本號
+      uses: akkuman/gitea-release-action@${{ vars.ACTION_RELEASE_VERSION }}
+      with:
+        name: code-review v${{ steps.version.outputs.version }}
+        tag_name: v${{ steps.version.outputs.version }}
+        target_commitish: ${{ github.head_ref }}
+  code-review:
+    name: 'Code Review'
+    runs-on: ubuntu
+    needs: [version]
+    steps:
+    - name: AI Code Review
+      uses: https://gitea.jsc.idv.tw/jiantw83/code-review@v${{ needs.version.outputs.version }}
+      with:
+        GEMINI_API_KEY: ${{ secrets.GEMINI_API_KEY }}
+        GEMINI_BASE_URL: https://generativelanguage.googleapis.com/v1beta
+        GEMINI_MODEL: ${{ vars.GEMINI_MODEL }}
+    permissions:
+      contents: write
+      pull-requests: write
+      issues: write

Dockerfile

@@ -1,10 +1,16 @@
-FROM alpine:latest
+FROM alpine
 
-# 安裝必要的工具
+RUN apk add --no-cache bash nodejs npm git \
-RUN apk add --no-cache --no-check-certificate bash
+    && node --version \
+    && npm --version \
+    && git --version
 
+WORKDIR /action
+
+COPY app/ /action/app/
 COPY entrypoint.sh /entrypoint.sh
 
-RUN chmod +x /entrypoint.sh
+RUN cd /action/app && npm install && \
+    chmod +x /entrypoint.sh
 
 ENTRYPOINT ["/entrypoint.sh"]

README.md

@@ -0,0 +1,164 @@
+# 簡介
+
+這是一個 AI Code Review Action。Gitea Workflow 可以使用此 Action 讓 AI 助理根據不同面向分析 Push Request 中變更的內容後，將問題分級 Commnet 到 Push Request 中。
+
+# 流程(新 Push Request、新 Commit (排除 AI 助理的 Commit) 觸發)
+
+1. 服務名稱、模型名稱、角色資訊(個性、符合個性的英文名稱、工作內容)，Comment 到 Push Request
+2. 每個角色個別分析 Git Diff 的內容產生新問題表格(問題等級、角色名稱、問題位置或行數、修改建議)
+3. 讀取所有未解決的舊問題(問題檔案 `.gitea/ai-review/findings.json` 存在於使用此 Action 的專案固定位置)加上新問題後，去除重複產生本次 Push Request 的問題表格(PR問題表格)覆蓋問題檔案
+4. 讀取排除問題檔案(`.gitea/ai-review/exclusions.json` 存在於使用此 Action 的專案固定位置)，用來過濾PR問題表格中不需要處理的問題
+5. 從PR問題表格中取出所有舊問題，依照等級排序後 Comment 到 Push Request
+6. 從PR問題表格中取出所有新問題，排除嚴重等級的問題後 Comment 到 Push Request
+7. 從PR問題表格中取出所有新問題，將每個嚴重等級的問題 Comment 到 Push Request
+8. Commit 問題檔案
+9. 如果PR問題表格中有嚴重問題，則不要讓 workflow 執行成功(exit 1)
+
+# 設計
+
+1. Gitea 的相關參數如果 inputs 沒有定義，則從 ${{ gitea.* }} 取得
+2. BASE_URL 如果 inputs 沒有定義，則使用預設值
+3. Comment 加上些許 emoji 讓資訊有點活力
+4. 盡量將應用程式放在 ./app，修改 entrypoint.sh 與 Dockerfile 讓程式可以正常運行
+5. 將提示詞放到 ./app/prompts 內供程式讀取
+
+# 使用說明
+
+1. 在 Gitea 專案中建立 `.gitea/workflows` 資料夾
+2. 在 `.gitea/workflows` 資料夾中建立 `ai-review.yaml'
+3. 在 `ai-review.yaml` 中填入以下內容(選擇一個使用)：
+
+### 1. OpenAI
+```yaml
+name: AI
+on:
+  pull_request:
+    types: [opened, synchronize]
+jobs:
+  code-review:
+    name: 'Code Review'
+    runs-on: ubuntu
+    steps:
+    - name: AI Code Review
+      uses: https://gitea.jsc.idv.tw/jiantw83/code-review@${{ vars.ACTION_CODE_REVIEW_VERSION }}
+      with:
+        OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
+        OPENAI_BASE_URL: https://api.openai.com/v1
+    permissions:
+      contents: write
+      pull-requests: write
+      issues: write
+```
+
+### 2. OpenRouter
+```yaml
+name: AI
+on:
+  pull_request:
+    types: [opened, synchronize]
+jobs:
+  code-review:
+    name: 'Code Review'
+    runs-on: ubuntu
+    steps:
+    - name: AI Code Review
+      uses: https://gitea.jsc.idv.tw/jiantw83/code-review@${{ vars.ACTION_CODE_REVIEW_VERSION }}
+      with:
+        OPENAI_API_KEY: ${{ secrets.OPENROUTER_API_KEY }}  # OpenRouter 使用 OpenAI 相容介面，以 OPENAI_API_KEY 傳入
+        OPENAI_BASE_URL: https://openrouter.ai/api/v1
+    permissions:
+      contents: write
+      pull-requests: write
+      issues: write
+```
+
+### 3. Anthropic Claude
+```yaml
+name: AI
+on:
+  pull_request:
+    types: [opened, synchronize]
+jobs:
+  code-review:
+    name: 'Code Review'
+    runs-on: ubuntu
+    steps:
+    - name: AI Code Review
+      uses: https://gitea.jsc.idv.tw/jiantw83/code-review@${{ vars.ACTION_CODE_REVIEW_VERSION }}
+      with:
+        CLAUDE_API_KEY: ${{ secrets.CLAUDE_API_KEY }}
+        CLAUDE_BASE_URL: https://api.anthropic.com/v1
+    permissions:
+      contents: write
+      pull-requests: write
+      issues: write
+```
+
+### 4. Google Gemini
+```yaml
+name: AI
+on:
+  pull_request:
+    types: [opened, synchronize]
+jobs:
+  code-review:
+    name: 'Code Review'
+    runs-on: ubuntu
+    steps:
+    - name: AI Code Review
+      uses: https://gitea.jsc.idv.tw/jiantw83/code-review@${{ vars.ACTION_CODE_REVIEW_VERSION }}
+      with:
+        GEMINI_API_KEY: ${{ secrets.GEMINI_API_KEY }}
+        GEMINI_BASE_URL: https://generativelanguage.googleapis.com/v1beta
+        GEMINI_MODEL: ${{ vars.GEMINI_MODEL }}
+    permissions:
+      contents: write
+      pull-requests: write
+      issues: write
+```
+
+### 5. Amazon Q
+```yaml
+name: AI
+on:
+  pull_request:
+    types: [opened, synchronize]
+jobs:
+  code-review:
+    name: 'Code Review'
+    runs-on: ubuntu
+    steps:
+    - name: AI Code Review
+      uses: https://gitea.jsc.idv.tw/jiantw83/code-review@${{ vars.ACTION_CODE_REVIEW_VERSION }}
+      with:
+        AMAZONQ_API_KEY: ${{ secrets.AMAZONQ_API_KEY }}
+        AMAZONQ_BASE_URL: https://q.api.aws
+    permissions:
+      contents: write
+      pull-requests: write
+      issues: write
+```
+
+### - Ollama
+
+```yaml
+name: AI
+on:
+  pull_request:
+    types: [opened, synchronize]
+jobs:
+  code-review:
+    name: 'Code Review'
+    runs-on: ubuntu
+    steps:
+    - name: AI Code Review
+        uses: https://gitea.jsc.idv.tw/jiantw83/code-review@${{ vars.ACTION_CODE_REVIEW_VERSION }}
+        with:
+          OLLAMA_BASE_URL: ${{ vars.OLLAMA_BASE_URL }}
+          OLLAMA_MODEL: ${{ vars.OLLAMA_MODEL }}
+    permissions:
+      contents: write
+      pull-requests: write
+
+      issues: write
+```

TODO.md

@@ -0,0 +1,40 @@
+# 開發階段 TODO
+
+## 階段一：基本流程串接
+- 目標：確保 action 可以被觸發，pipeline 各步驟依序執行，log 出每個主要階段的進入與完成。
+- 驗收：log 中能看到每個階段（如「Step1: pipeline start」、「Step2: findings merge」等）明確訊息，且流程能走完（即使還沒產生 findings）。
+- 完成
+
+## 階段二：Findings 產生與合併
+- 目標：各角色（style/security/performance/maintainability/testing）能產生 findings，並正確合併新舊 findings。
+- 驗收：log 中能看到每個角色 findings 數量、合併後 findings 統計，並有「Step3: merged findings total=...」等訊息。
+- 完成
+
+## 階段三：AI 去重與角色確認
+- 目標：嘗試呼叫 LLM 進行 findings 去重與角色確認，API 額度不足時要有降級處理 log。
+- 驗收：log 中能看到 deduplication/resolution confirmation 成功或失敗（如 402），降級時有「保留所有問題」等明確訊息。
+- 完成
+
+## 階段四：AI 排除問題過濾
+- 目標：讀取排除問題檔案（`.gitea/ai-review/exclusions.json`）進行規則過濾，並呼叫 AI 判斷剩餘問題是否為誤報或不適用，兩層過濾後產生最終問題清單。
+- 驗收：log 中能看到排除問題檔案讀取成功或不存在的訊息、規則過濾數量變化，以及「AI 誤報過濾: N -> M 筆」或降級訊息。
+- 完成
+
+## 階段五：findings 寫入與 comment 發布
+- 目標：`.gitea/ai-review/findings.json` 正確寫入，comment 發布順序正確（舊問題→非嚴重→嚴重），每步有 log。
+- 驗收：log 中能看到 `.gitea/ai-review/findings.json` 寫入、comment sync 的詳細訊息與順序。
+- 完成
+
+## 階段六：記憶區 commit/push 與錯誤處理
+- 目標：記憶區能成功 commit/push，錯誤時有明確 log，流程結束有總結訊息。
+- 驗收：log 有「persisted findings」、「commit=...」、「push=...」等訊息，錯誤時有「Runner failed: ...」等明確錯誤說明。
+- 完成
+
+## 階段七：阻擋嚴重問題 PR（第 8 點）
+- 目標：如果 PR 問題表格中有嚴重（critical）問題，workflow 需直接 exit 1，不讓流程成功。
+- 驗收：log 中能看到「critical 問題存在，workflow 結束（exit 1）」等明確訊息，且 workflow 狀態為失敗。
+- 完成
+
+---
+
+所有階段驗收通過。

action.yaml

@@ -1,20 +1,101 @@
-name: 'Docker Action Template'
+name: 'AI Code Review'
-description: 'Docker Action 範本'
+description: 'AI 多角色 Code Review Action，自動分析 PR 並發布問題 Comment'
 author: 'Jeffery'
 inputs:
-  runner_token:
+  # Gitea 相關（可從 gitea context 自動取得）
-    description: 'Gitea Runner Token'
+  GITEA_TOKEN:
-    required: true
+    description: 'Gitea API Token'
-  text:
+    required: false
-    description: '輸入的文字'
+  GITEA_SERVER_URL:
-    default: "Hello, World!"
+    description: 'Gitea Server URL'
-outputs:
+    required: false
-  text:
+  GITEA_REPOSITORY:
-    description: '輸出的文字'
+    description: 'Gitea Repository (owner/repo)'
+    required: false
+  PR_NUMBER:
+    description: 'Pull Request Number'
+    required: false
+  PR_HEAD_BRANCH:
+    description: 'PR 來源分支'
+    required: false
+  PR_BASE_BRANCH:
+    description: 'PR 目標分支'
+    required: false
+
+  # OpenAI-compatible
+  OPENAI_API_KEY:
+    description: 'OpenAI / OpenRouter API Key'
+    required: false
+  OPENAI_BASE_URL:
+    description: 'OpenAI-compatible Base URL'
+    required: false
+    default: 'https://openrouter.ai/api/v1'
+  OPENAI_MODEL:
+    description: 'OpenAI-compatible Model Name'
+    required: false
+
+  # Anthropic Claude
+  CLAUDE_API_KEY:
+    description: 'Anthropic Claude API Key'
+    required: false
+  CLAUDE_BASE_URL:
+    description: 'Claude Base URL'
+    required: false
+  CLAUDE_MODEL:
+    description: 'Claude Model Name'
+    required: false
+
+  # Google Gemini
+  GEMINI_API_KEY:
+    description: 'Google Gemini API Key'
+    required: false
+  GEMINI_BASE_URL:
+    description: 'Gemini Base URL'
+    required: false
+  GEMINI_MODEL:
+    description: 'Gemini Model Name'
+    required: false
+
+  # Ollama
+  OLLAMA_BASE_URL:
+    description: 'Ollama Base URL'
+    required: false
+  OLLAMA_MODEL:
+    description: 'Ollama Model Name'
+    required: false
+
+  # Amazon Q
+  AMAZONQ_API_KEY:
+    description: 'Amazon Q API Key'
+    required: false
+  AMAZONQ_BASE_URL:
+    description: 'Amazon Q Base URL'
+    required: false
+
+
+
 runs:
   using: 'docker'
   image: 'Dockerfile'
   env:
-    GITEA_SERVER_URL: ${{ gitea.server_url }}
+    # Gitea context（優先用 inputs，否則從 gitea context 取）
-    GITEA_REPOSITORY: ${{ gitea.repository }}
+    GITEA_TOKEN: ${{ inputs.GITEA_TOKEN || secrets.GITEA_TOKEN }}
-    RUNNER_TOKEN: ${{ inputs.runner_token || secrets.GITEA_TOKEN || secrets.RUNNER_TOKEN }}
+    GITEA_SERVER_URL: ${{ inputs.GITEA_SERVER_URL || gitea.server_url }}
+    GITEA_REPOSITORY: ${{ inputs.GITEA_REPOSITORY || gitea.repository }}
+    PR_NUMBER: ${{ inputs.PR_NUMBER || gitea.event.pull_request.number }}
+    PR_HEAD_BRANCH: ${{ inputs.PR_HEAD_BRANCH || gitea.event.pull_request.head.ref }}
+    PR_BASE_BRANCH: ${{ inputs.PR_BASE_BRANCH || gitea.event.pull_request.base.ref }}
+    # LLM
+    OPENAI_API_KEY: ${{ inputs.OPENAI_API_KEY }}
+    OPENAI_BASE_URL: ${{ inputs.OPENAI_BASE_URL }}
+    OPENAI_MODEL: ${{ inputs.OPENAI_MODEL }}
+    CLAUDE_API_KEY: ${{ inputs.CLAUDE_API_KEY }}
+    CLAUDE_BASE_URL: ${{ inputs.CLAUDE_BASE_URL }}
+    CLAUDE_MODEL: ${{ inputs.CLAUDE_MODEL }}
+    GEMINI_API_KEY: ${{ inputs.GEMINI_API_KEY }}
+    GEMINI_BASE_URL: ${{ inputs.GEMINI_BASE_URL }}
+    GEMINI_MODEL: ${{ inputs.GEMINI_MODEL }}
+    OLLAMA_BASE_URL: ${{ inputs.OLLAMA_BASE_URL }}
+    OLLAMA_MODEL: ${{ inputs.OLLAMA_MODEL }}
+    AMAZONQ_API_KEY: ${{ inputs.AMAZONQ_API_KEY }}
+    AMAZONQ_BASE_URL: ${{ inputs.AMAZONQ_BASE_URL }}

app/comments.js

@@ -0,0 +1,70 @@
+import fs from 'fs';
+import path from 'path';
+import { postComment } from './gitea.js';
+import { FINDINGS_PATH } from './config.js';
+
+const LEVEL_EMOJI = { critical: '🔴', warning: '🟡', info: '🔵' };
+const LEVEL_LABEL = { critical: '嚴重', warning: '警告', info: '建議' };
+
+function findingRow(f) {
+  return `| ${LEVEL_EMOJI[f.level] || ''} ${LEVEL_LABEL[f.level] || f.level} | ${f.role} | ${f.location} | ${f.suggestion} |`;
+}
+
+function buildTable(findings) {
+  const rows = findings.map(findingRow).join('\n');
+  return `| 等級 | 審查員 | 位置 | 建議 |\n|------|--------|------|------|\n${rows}`;
+}
+
+/**
+ * 寫入 findings.json 到 workspace
+ */
+export function saveFindings(workspace, findings) {
+  const fullPath = path.join(workspace, FINDINGS_PATH);
+  fs.mkdirSync(path.dirname(fullPath), { recursive: true });
+  fs.writeFileSync(fullPath, JSON.stringify(findings, null, 2), 'utf8');
+  console.log(`  ✅ findings 寫入: ${fullPath} (${findings.length} 筆)`);
+}
+
+/**
+ * 發布所有舊問題 comment（一次發布，依等級排序）
+ */
+export async function postOldFindingsComment(findings) {
+  const old = findings.filter(f => !f.is_new);
+  if (old.length === 0) {
+    console.log('  無舊問題，跳過');
+    return;
+  }
+  const body = `## 📋 舊有未解決問題（${old.length} 筆）\n\n${buildTable(old)}`;
+  await postComment(body);
+  console.log(`  ✅ 舊問題 comment 發布 (${old.length} 筆)`);
+}
+
+/**
+ * 發布新問題中非 critical 的 comment（一次發布）
+ */
+export async function postNewNonCriticalComment(findings) {
+  const items = findings.filter(f => f.is_new && f.level !== 'critical');
+  if (items.length === 0) {
+    console.log('  無新的非嚴重問題，跳過');
+    return;
+  }
+  const body = `## 🔍 新發現問題（${items.length} 筆）\n\n${buildTable(items)}`;
+  await postComment(body);
+  console.log(`  ✅ 新問題（非嚴重）comment 發布 (${items.length} 筆)`);
+}
+
+/**
+ * 每個新 critical 問題各發一個 comment
+ */
+export async function postNewCriticalComments(findings) {
+  const criticals = findings.filter(f => f.is_new && f.level === 'critical');
+  if (criticals.length === 0) {
+    console.log('  無新的嚴重問題，跳過');
+    return;
+  }
+  for (const f of criticals) {
+    const body = `## 🚨 嚴重問題\n\n| 審查員 | 位置 | 建議 |\n|--------|------|------|\n| ${f.role} | ${f.location} | ${f.suggestion} |`;
+    await postComment(body);
+    console.log(`  ✅ 嚴重問題 comment 發布: [${f.role}] ${f.location}`);
+  }
+}

app/config.js

@@ -0,0 +1,23 @@
+export const GITEA_TOKEN = process.env.GITEA_TOKEN || '';
+export const GITEA_SERVER_URL = process.env.GITEA_SERVER_URL || 'https://gitea.com';
+export const GITEA_REPOSITORY = process.env.GITEA_REPOSITORY || '';
+export const PR_NUMBER = process.env.PR_NUMBER || '';
+export const PR_HEAD_BRANCH = process.env.PR_HEAD_BRANCH || '';
+export const PR_BASE_BRANCH = process.env.PR_BASE_BRANCH || '';
+
+export const FINDINGS_PATH = '.gitea/ai-review/findings.json';
+export const EXCLUSIONS_PATH = '.gitea/ai-review/exclusions.json';
+
+export function getLLMConfig() {
+  const checks = [
+    ['openai',   process.env.OPENAI_API_KEY,   process.env.OPENAI_BASE_URL || 'https://api.openai.com/v1',   process.env.OPENAI_MODEL || 'gpt-4o-mini'],
+    ['claude',   process.env.CLAUDE_API_KEY,   process.env.CLAUDE_BASE_URL || 'https://api.anthropic.com/v1', process.env.CLAUDE_MODEL || 'claude-3-haiku-20240307'],
+    ['gemini',   process.env.GEMINI_API_KEY,   process.env.GEMINI_BASE_URL || 'https://generativelanguage.googleapis.com/v1beta', process.env.GEMINI_MODEL || 'gemini-2.5-flash'],
+    ['ollama',   'ollama',                      process.env.OLLAMA_BASE_URL,  process.env.OLLAMA_MODEL],
+    ['amazonq',  process.env.AMAZONQ_API_KEY,  process.env.AMAZONQ_BASE_URL  || 'https://q.api.aws',              process.env.AMAZONQ_MODEL  || 'amazon-q'],
+  ];
+  for (const [provider, key, baseURL, model] of checks) {
+    if (key && baseURL) return { provider, apiKey: key, baseURL, model };
+  }
+  return { provider: null, apiKey: null, baseURL: null, model: null };
+}

app/config.test.js

@@ -0,0 +1,101 @@
+import { describe, it, beforeEach, afterEach } from 'node:test';
+import assert from 'node:assert/strict';
+import { getLLMConfig } from './config.js';
+
+const ENV_KEYS = [
+  'OPENAI_API_KEY', 'OPENAI_BASE_URL', 'OPENAI_MODEL',
+  'CLAUDE_API_KEY', 'CLAUDE_BASE_URL', 'CLAUDE_MODEL',
+  'GEMINI_API_KEY', 'GEMINI_BASE_URL', 'GEMINI_MODEL',
+  'OLLAMA_BASE_URL', 'OLLAMA_MODEL',
+  'AMAZONQ_API_KEY', 'AMAZONQ_BASE_URL', 'AMAZONQ_MODEL',
+];
+
+let saved = {};
+beforeEach(() => {
+  saved = {};
+  for (const k of ENV_KEYS) { saved[k] = process.env[k]; delete process.env[k]; }
+});
+afterEach(() => {
+  for (const k of ENV_KEYS) {
+    if (saved[k] === undefined) delete process.env[k];
+    else process.env[k] = saved[k];
+  }
+});
+
+describe('getLLMConfig', () => {
+  it('returns null provider when no env vars set', () => {
+    const cfg = getLLMConfig();
+    assert.equal(cfg.provider, null);
+    assert.equal(cfg.apiKey, null);
+  });
+
+  it('detects openai with defaults', () => {
+    process.env.OPENAI_API_KEY = 'sk-test';
+    const cfg = getLLMConfig();
+    assert.equal(cfg.provider, 'openai');
+    assert.equal(cfg.apiKey, 'sk-test');
+    assert.equal(cfg.baseURL, 'https://api.openai.com/v1');
+    assert.equal(cfg.model, 'gpt-4o-mini');
+  });
+
+  it('detects openai with custom base url and model', () => {
+    process.env.OPENAI_API_KEY = 'sk-test';
+    process.env.OPENAI_BASE_URL = 'https://openrouter.ai/api/v1';
+    process.env.OPENAI_MODEL = 'gpt-4o';
+    const cfg = getLLMConfig();
+    assert.equal(cfg.provider, 'openai');
+    assert.equal(cfg.baseURL, 'https://openrouter.ai/api/v1');
+    assert.equal(cfg.model, 'gpt-4o');
+  });
+
+  it('detects gemini with defaults', () => {
+    process.env.GEMINI_API_KEY = 'gemini-key';
+    const cfg = getLLMConfig();
+    assert.equal(cfg.provider, 'gemini');
+    assert.equal(cfg.model, 'gemini-2.5-flash');
+  });
+
+  it('detects gemini with custom model', () => {
+    process.env.GEMINI_API_KEY = 'gemini-key';
+    process.env.GEMINI_MODEL = 'gemini-2.0-flash';
+    const cfg = getLLMConfig();
+    assert.equal(cfg.model, 'gemini-2.0-flash');
+  });
+
+  it('detects claude with defaults', () => {
+    process.env.CLAUDE_API_KEY = 'claude-key';
+    const cfg = getLLMConfig();
+    assert.equal(cfg.provider, 'claude');
+    assert.equal(cfg.model, 'claude-3-haiku-20240307');
+  });
+
+  it('detects amazonq with its own model env', () => {
+    process.env.AMAZONQ_API_KEY = 'aq-key';
+    process.env.AMAZONQ_MODEL = 'my-amazon-model';
+    const cfg = getLLMConfig();
+    assert.equal(cfg.provider, 'amazonq');
+    assert.equal(cfg.model, 'my-amazon-model');
+  });
+
+  it('openai takes priority over gemini when both set', () => {
+    process.env.OPENAI_API_KEY = 'sk-test';
+    process.env.GEMINI_API_KEY = 'gemini-key';
+    const cfg = getLLMConfig();
+    assert.equal(cfg.provider, 'openai');
+  });
+
+  it('empty string api key is treated as not set', () => {
+    process.env.OPENAI_API_KEY = '';
+    process.env.GEMINI_API_KEY = 'gemini-key';
+    const cfg = getLLMConfig();
+    assert.equal(cfg.provider, 'gemini');
+  });
+
+  it('detects ollama without api key', () => {
+    process.env.OLLAMA_BASE_URL = 'http://localhost:11434';
+    process.env.OLLAMA_MODEL = 'llama3';
+    const cfg = getLLMConfig();
+    assert.equal(cfg.provider, 'ollama');
+    assert.equal(cfg.model, 'llama3');
+  });
+});

app/findings.js

@@ -0,0 +1,166 @@
+import fs from 'fs';
+import path from 'path';
+import { chatJSON } from './llm.js';
+import { FINDINGS_PATH, EXCLUSIONS_PATH } from './config.js';
+
+const LEVELS = ['critical', 'warning', 'info'];
+
+/**
+ * 用單一角色分析 diff，回傳 findings 陣列
+ */
+export async function analyzeWithRole(role, diff) {
+  console.log(`  [${role.name}] 開始分析...`);
+  const findings = await chatJSON(role.system_prompt, `以下是 Git Diff 內容：\n\n${diff}`);
+  // 確保每筆都有必要欄位，並標記為新問題
+  const valid = findings.filter(f => f.level && f.role && f.location && f.suggestion)
+    .map(f => ({ ...f, is_new: true }));
+  console.log(`  [${role.name}] 找到 ${valid.length} 個問題`);
+  return valid;
+}
+
+/**
+ * 讀取舊 findings（從 workspace 的 FINDINGS_PATH）
+ */
+export function loadOldFindings(workspace) {
+  const fullPath = path.join(workspace, FINDINGS_PATH);
+  if (!fs.existsSync(fullPath)) {
+    console.log('  舊 findings 檔案不存在，視為空');
+    return [];
+  }
+  try {
+    const data = JSON.parse(fs.readFileSync(fullPath, 'utf8'));
+    const old = (Array.isArray(data) ? data : []).map(f => ({ ...f, is_new: false }));
+    console.log(`  讀取舊 findings: ${old.length} 筆`);
+    return old;
+  } catch (e) {
+    console.log(`  ⚠️  讀取舊 findings 失敗: ${e.message}，視為空`);
+    return [];
+  }
+}
+
+/**
+ * 合併新舊 findings，以 (role + location + suggestion前50字) 為 key 去除重複
+ * 舊問題保留，新問題若與舊問題重複則捨棄
+ */
+export function mergeFindings(oldFindings, newFindings) {
+  const key = f => `${f.role}|${f.location}|${String(f.suggestion).slice(0, 50)}`;
+  const seen = new Set(oldFindings.map(key));
+  const deduped = newFindings.filter(f => {
+    if (seen.has(key(f))) return false;
+    seen.add(key(f));
+    return true;
+  });
+  const merged = [...oldFindings, ...deduped];
+  console.log(`  合併結果: 舊=${oldFindings.length} 新(去重後)=${deduped.length} 總計=${merged.length}`);
+  return merged;
+}
+
+/**
+ * 依等級排序（critical > warning > info）
+ */
+export function sortByLevel(findings) {
+  return [...findings].sort((a, b) => LEVELS.indexOf(a.level) - LEVELS.indexOf(b.level));
+}
+
+/**
+ * 呼叫 LLM 進行語意去重，回傳去重後的 findings
+ * 失敗時降級回傳原始 findings
+ */
+export async function deduplicateWithAI(findings) {
+  if (findings.length === 0) return findings;
+
+  const systemPrompt = `你是一位程式碼審查問題去重專家。
+給你一份問題清單（JSON 陣列），請移除語意重複的問題（即使描述文字不同，但指的是同一個問題）。
+保留等級較高的版本，優先保留 critical > warning > info。
+只回傳去重後的 JSON 陣列，不要有其他文字。`;
+
+  const userContent = `以下是問題清單，請去除語意重複的項目：\n\n${JSON.stringify(findings, null, 2)}`;
+
+  try {
+    const result = await chatJSON(systemPrompt, userContent);
+    if (Array.isArray(result) && result.length > 0) {
+      console.log(`  AI 去重: ${findings.length} -> ${result.length} 筆`);
+      return result;
+    }
+    throw new Error('AI 回傳空陣列');
+  } catch (e) {
+    const status = e.response?.status;
+    if (status === 402 || status === 429) {
+      console.log(`  ⚠️  AI 去重失敗（${status} 額度/限流），降級：保留所有問題`);
+    } else {
+      console.log(`  ⚠️  AI 去重失敗（${e.message}），降級：保留所有問題`);
+    }
+    return findings;
+  }
+}
+
+/**
+ * 讀取排除問題檔案（從 workspace 的 EXCLUSIONS_PATH）
+ * 格式：[{ role, location, suggestion }]，欄位可部分省略，省略表示萬用
+ */
+export function loadExclusions(workspace) {
+  const fullPath = path.join(workspace, EXCLUSIONS_PATH);
+  if (!fs.existsSync(fullPath)) {
+    console.log('  排除問題檔案不存在，跳過過濾');
+    return [];
+  }
+  try {
+    const data = JSON.parse(fs.readFileSync(fullPath, 'utf8'));
+    const exclusions = Array.isArray(data) ? data : [];
+    console.log(`  讀取排除問題: ${exclusions.length} 筆`);
+    return exclusions;
+  } catch (e) {
+    console.log(`  ⚠️  讀取排除問題失敗: ${e.message}，跳過過濾`);
+    return [];
+  }
+}
+
+/**
+ * 套用排除規則，過濾掉符合排除條件的 findings
+ * 排除條件：role/location/suggestion 皆符合（省略的欄位視為萬用）
+ */
+export function applyExclusions(findings, exclusions) {
+  if (exclusions.length === 0) return findings;
+  const before = findings.length;
+  const filtered = findings.filter(f => !exclusions.some(ex =>
+    (!ex.role || ex.role === f.role) &&
+    (!ex.location || String(f.location).includes(ex.location)) &&
+    (!ex.suggestion || String(f.suggestion).includes(String(ex.suggestion).slice(0, 20)))
+  ));
+  console.log(`  排除過濾: ${before} -> ${filtered.length} 筆（排除 ${before - filtered.length} 筆）`);
+  return filtered;
+}
+
+/**
+ * 呼叫 AI 判斷哪些問題是誤報或不需處理，回傳需保留的 findings
+ * 失敗時降級回傳原始 findings
+ */
+export async function filterFalsePositivesWithAI(findings) {
+  if (findings.length === 0) return findings;
+
+  const systemPrompt = `你是一位資深程式碼審查專家，負責判斷審查問題是否為誤報或不需處理。
+給你一份問題清單（JSON 陣列），每筆包含 level、role、location、suggestion。
+請移除以下類型的問題：
+1. 誤報：問題描述與實際程式碼不符（例如：程式碼已正確使用環境變數或 secrets，卻被標記為硬編碼敏感資料）
+2. 不適用：問題在此專案情境下不需處理（例如：CI/CD action 本來就需要透過環境變數傳遞 token）
+只回傳需要保留的問題 JSON 陣列，不要有其他文字。`;
+
+  const userContent = `請判斷以下問題清單，移除誤報或不需處理的問題：\n\n${JSON.stringify(findings, null, 2)}`;
+
+  try {
+    const result = await chatJSON(systemPrompt, userContent);
+    if (Array.isArray(result)) {
+      console.log(`  AI 誤報過濾: ${findings.length} -> ${result.length} 筆`);
+      return result;
+    }
+    throw new Error('AI 回傳非陣列');
+  } catch (e) {
+    const status = e.response?.status;
+    if (status === 402 || status === 429) {
+      console.log(`  ⚠️  AI 誤報過濾失敗（${status} 額度/限流），降級：保留所有問題`);
+    } else {
+      console.log(`  ⚠️  AI 誤報過濾失敗（${e.message}），降級：保留所有問題`);
+    }
+    return findings;
+  }
+}

app/git.js

@@ -0,0 +1,92 @@
+import { spawnSync } from 'child_process';
+import fs from 'fs';
+import path from 'path';
+import { GITEA_SERVER_URL, GITEA_REPOSITORY, GITEA_TOKEN, PR_HEAD_BRANCH, FINDINGS_PATH } from './config.js';
+
+function makeRunner(spawn) {
+  return function run(args, cwd, env) {
+    const opts = { cwd, encoding: 'utf8' };
+    if (env) opts.env = env;
+    const result = spawn('git', args, opts);
+    if (result.error) throw result.error;
+    if (result.status !== 0) throw new Error((result.stderr || result.stdout || '').trim());
+    return (result.stdout || '').trim();
+  };
+}
+
+/**
+ * Clone PR head branch to workspace/repo (idempotent)
+ */
+export function cloneRepo(workspace, _spawnSync = spawnSync) {
+  const run = makeRunner(_spawnSync);
+  const baseUrl = GITEA_SERVER_URL.replace(/\/$/, '');
+  const remoteUrl = `${baseUrl}/${GITEA_REPOSITORY}.git`;
+  const repoDir = path.join(workspace, 'repo');
+
+  const askpassScript = path.join(workspace, '.git-askpass.sh');
+  fs.writeFileSync(askpassScript, '#!/bin/sh\necho "$GIT_TOKEN"\n', { mode: 0o700 });
+  const credEnv = { ...process.env, GIT_ASKPASS: askpassScript, GIT_USERNAME: 'x-token', GIT_TOKEN: GITEA_TOKEN };
+
+  try {
+    if (!fs.existsSync(repoDir)) {
+      run(['clone', '--depth=1', '--branch', PR_HEAD_BRANCH, remoteUrl, repoDir], workspace, credEnv);
+      console.log(`  ✅ repo cloned to ${repoDir}`);
+    } else {
+      run(['fetch', 'origin', PR_HEAD_BRANCH], repoDir, credEnv);
+      run(['checkout', PR_HEAD_BRANCH], repoDir);
+      console.log(`  ✅ repo already exists, fetched latest`);
+    }
+  } finally {
+    try { fs.unlinkSync(askpassScript); } catch {}
+  }
+  return repoDir;
+}
+
+export async function commitAndPush(workspace, _spawnSync = spawnSync) {
+  const run = makeRunner(_spawnSync);
+
+  const baseUrl = GITEA_SERVER_URL.replace(/\/$/, '');
+  const remoteUrl = `${baseUrl}/${GITEA_REPOSITORY}.git`;
+  const repoDir = path.join(workspace, 'repo');
+
+  // Write a temporary askpass script that reads the token from an env var,
+  // so the token value never appears in the script file itself
+  const askpassScript = path.join(workspace, '.git-askpass.sh');
+  fs.writeFileSync(askpassScript, '#!/bin/sh\necho "$GIT_TOKEN"\n', { mode: 0o700 });
+
+  const credEnv = { ...process.env, GIT_ASKPASS: askpassScript, GIT_USERNAME: 'x-token', GIT_TOKEN: GITEA_TOKEN };
+
+  try {
+    if (!fs.existsSync(repoDir)) {
+      run(['clone', '--depth=1', '--branch', PR_HEAD_BRANCH, remoteUrl, repoDir], workspace, credEnv);
+    }
+
+    run(['config', 'user.email', 'ai-review[bot]@gitea'], repoDir);
+    run(['config', 'user.name', 'AI Review Bot'], repoDir);
+    run(['fetch', 'origin', PR_HEAD_BRANCH], repoDir, credEnv);
+    run(['checkout', PR_HEAD_BRANCH], repoDir);
+
+    // 將 findings.json 從 workspace 複製到 clone 的 repo
+    const srcFindings = path.join(workspace, FINDINGS_PATH);
+    const destFindings = path.join(repoDir, FINDINGS_PATH);
+    fs.mkdirSync(path.dirname(destFindings), { recursive: true });
+    fs.copyFileSync(srcFindings, destFindings);
+
+    run(['add', FINDINGS_PATH], repoDir);
+
+    const status = run(['status', '--porcelain'], repoDir);
+    if (!status) {
+      console.log('  findings.json 無變更，跳過 commit');
+      return;
+    }
+
+    const out = run(['commit', '-m', 'chore: update ai-review findings [skip ci]'], repoDir);
+    const commitHash = out.match(/\[.+ ([a-f0-9]+)\]/)?.[1] || 'unknown';
+    run(['push', remoteUrl, PR_HEAD_BRANCH], repoDir, credEnv);
+    console.log(`  ✅ persisted findings  commit=${commitHash}  push=${PR_HEAD_BRANCH}`);
+  } catch (e) {
+    console.log(`  ⚠️  Runner failed: commit/push 失敗: ${e.message}`);
+  } finally {
+    try { fs.unlinkSync(askpassScript); } catch {}
+  }
+}

app/git.test.js

@@ -0,0 +1,149 @@
+import { describe, it, before, after, beforeEach } from 'node:test';
+import assert from 'node:assert/strict';
+import fs from 'fs';
+import os from 'os';
+import path from 'path';
+import { commitAndPush, cloneRepo } from './git.js';
+
+// --- helpers ---
+function makeTmpWorkspace() {
+  const ws = fs.mkdtempSync(path.join(os.tmpdir(), 'git-test-'));
+  // Pre-create repo dir so clone branch is skipped
+  fs.mkdirSync(path.join(ws, 'repo'), { recursive: true });
+  // Create a findings.json to copy
+  const findingsDir = path.join(ws, '.gitea/ai-review');
+  fs.mkdirSync(findingsDir, { recursive: true });
+  fs.writeFileSync(path.join(findingsDir, 'findings.json'), '[]');
+  return ws;
+}
+
+// Default stub: all commands succeed, status returns changes
+function makeSpawn(overrides = {}) {
+  const calls = [];
+  const spawn = (cmd, args, opts) => {
+    const key = args[0];
+    calls.push({ cmd, args, opts });
+    if (overrides[key]) return overrides[key](args, opts);
+    if (key === 'status') return { status: 0, stdout: 'M .gitea/ai-review/findings.json', stderr: '', error: null };
+    if (key === 'commit') return { status: 0, stdout: '[feature-branch abc1234] chore', stderr: '', error: null };
+    return { status: 0, stdout: '', stderr: '', error: null };
+  };
+  spawn.calls = calls;
+  return spawn;
+}
+
+describe('commitAndPush', () => {
+  let workspace;
+
+  before(() => { workspace = makeTmpWorkspace(); });
+  after(() => { fs.rmSync(workspace, { recursive: true, force: true }); });
+  beforeEach(() => {
+    // Remove leftover askpass scripts between tests
+    for (const f of fs.readdirSync(workspace)) {
+      if (f.endsWith('.git-askpass.sh')) fs.unlinkSync(path.join(workspace, f));
+    }
+  });
+
+  it('does not embed token in any git command argument', async () => {
+    const spawn = makeSpawn();
+    await commitAndPush(workspace, spawn);
+
+    for (const { args } of spawn.calls) {
+      assert.ok(!args.join(' ').includes('test-token'), `Token leaked in git args: ${args.join(' ')}`);
+    }
+  });
+
+  it('uses GIT_ASKPASS env for network operations (fetch, push, clone)', async () => {
+    const spawn = makeSpawn();
+    await commitAndPush(workspace, spawn);
+
+    const networkOps = ['fetch', 'push', 'clone'];
+    const networkCalls = spawn.calls.filter(c => networkOps.includes(c.args[0]));
+    assert.ok(networkCalls.length > 0, 'expected at least one network git call');
+
+    for (const { args, opts } of networkCalls) {
+      assert.ok(opts?.env?.GIT_ASKPASS, `GIT_ASKPASS missing for git ${args[0]}`);
+    }
+  });
+
+  it('cleans up askpass script after successful run', async () => {
+    await commitAndPush(workspace, makeSpawn());
+    const leftover = fs.readdirSync(workspace).filter(f => f.endsWith('.git-askpass.sh'));
+    assert.equal(leftover.length, 0, 'askpass script was not cleaned up');
+  });
+
+  it('cleans up askpass script even when git fails', async () => {
+    const failSpawn = () => ({ status: 1, stdout: '', stderr: 'fatal: error', error: null });
+    await commitAndPush(workspace, failSpawn);
+    const leftover = fs.readdirSync(workspace).filter(f => f.endsWith('.git-askpass.sh'));
+    assert.equal(leftover.length, 0, 'askpass script was not cleaned up after failure');
+  });
+
+  it('skips commit when status shows no changes', async () => {
+    const spawn = makeSpawn({ status: () => ({ status: 0, stdout: '', stderr: '', error: null }) });
+    await commitAndPush(workspace, spawn);
+    const commitCalled = spawn.calls.some(c => c.args[0] === 'commit');
+    assert.equal(commitCalled, false, 'commit should not run when there are no changes');
+  });
+
+  it('does not throw when git command fails', async () => {
+    const failSpawn = () => ({ status: 1, stdout: '', stderr: 'fatal: error', error: null });
+    await assert.doesNotReject(() => commitAndPush(workspace, failSpawn));
+  });
+});
+
+describe('cloneRepo', () => {
+  let workspace;
+
+  before(() => { workspace = fs.mkdtempSync(path.join(os.tmpdir(), 'clone-test-')); });
+  after(() => { fs.rmSync(workspace, { recursive: true, force: true }); });
+
+  it('clones repo when repoDir does not exist', () => {
+    const spawn = makeSpawn();
+    cloneRepo(workspace, spawn);
+    const cloneCalled = spawn.calls.some(c => c.args[0] === 'clone');
+    assert.ok(cloneCalled, 'expected git clone to be called');
+  });
+
+  it('fetches and checks out when repoDir already exists', () => {
+    const repoDir = path.join(workspace, 'repo');
+    fs.mkdirSync(repoDir, { recursive: true });
+    const spawn = makeSpawn();
+    cloneRepo(workspace, spawn);
+    const cloneCalled = spawn.calls.some(c => c.args[0] === 'clone');
+    const fetchCalled = spawn.calls.some(c => c.args[0] === 'fetch');
+    assert.ok(!cloneCalled, 'clone should not run when repoDir exists');
+    assert.ok(fetchCalled, 'fetch should run when repoDir exists');
+  });
+
+  it('does not embed token in any git command argument', () => {
+    const spawn = makeSpawn();
+    cloneRepo(workspace, spawn);
+    for (const { args } of spawn.calls) {
+      assert.ok(!args.join(' ').includes('test-token'), `Token leaked in git args: ${args.join(' ')}`);
+    }
+  });
+
+  it('uses GIT_ASKPASS for network operations', () => {
+    const spawn = makeSpawn();
+    cloneRepo(workspace, spawn);
+    const networkCalls = spawn.calls.filter(c => ['clone', 'fetch'].includes(c.args[0]));
+    assert.ok(networkCalls.length > 0, 'expected at least one network git call');
+    for (const { args, opts } of networkCalls) {
+      assert.ok(opts?.env?.GIT_ASKPASS, `GIT_ASKPASS missing for git ${args[0]}`);
+    }
+  });
+
+  it('cleans up askpass script after run', () => {
+    const spawn = makeSpawn();
+    cloneRepo(workspace, spawn);
+    const leftover = fs.readdirSync(workspace).filter(f => f.endsWith('.git-askpass.sh'));
+    assert.equal(leftover.length, 0, 'askpass script was not cleaned up');
+  });
+
+  it('returns repoDir path', () => {
+    const spawn = makeSpawn();
+    const result = cloneRepo(workspace, spawn);
+    assert.equal(result, path.join(workspace, 'repo'));
+  });
+});

app/gitea.js

@@ -0,0 +1,17 @@
+import axios from 'axios';
+import https from 'https';
+import { GITEA_TOKEN, GITEA_SERVER_URL, GITEA_REPOSITORY, PR_NUMBER } from './config.js';
+
+const httpsAgent = new https.Agent({ rejectUnauthorized: false });
+const headers = () => ({ Authorization: `token ${GITEA_TOKEN}`, 'Content-Type': 'application/json' });
+const api = (path) => `${GITEA_SERVER_URL.replace(/\/$/, '')}/api/v1${path}`;
+
+export async function getPRDiff() {
+  const resp = await axios.get(api(`/repos/${GITEA_REPOSITORY}/pulls/${PR_NUMBER}.diff`), { headers: headers(), timeout: 60000, httpsAgent });
+  return resp.data;
+}
+
+export async function postComment(body) {
+  const resp = await axios.post(api(`/repos/${GITEA_REPOSITORY}/issues/${PR_NUMBER}/comments`), { body }, { headers: headers(), timeout: 30000, httpsAgent });
+  return resp.data;
+}

app/llm.js

@@ -0,0 +1,36 @@
+import axios from 'axios';
+import https from 'https';
+import { getLLMConfig } from './config.js';
+
+const httpsAgent = new https.Agent({ rejectUnauthorized: false });
+
+export async function chat(systemPrompt, userContent) {
+  const { provider, apiKey, baseURL, model } = getLLMConfig();
+  if (!provider) throw new Error('未設定任何 LLM API Key');
+
+  console.log(`  [LLM] provider=${provider} model=${model}`);
+
+  const headers = {
+    'Content-Type': 'application/json',
+    'Authorization': `Bearer ${apiKey}`,
+  };
+  if (provider === 'claude') headers['anthropic-version'] = '2023-06-01';
+
+  const resp = await axios.post(
+    `${baseURL.replace(/\/$/, '')}/chat/completions`,
+    { model, messages: [{ role: 'system', content: systemPrompt }, { role: 'user', content: userContent }], temperature: 0.2 },
+    { headers, timeout: 120000, httpsAgent }
+  );
+  return resp.data.choices[0].message.content;
+}
+
+export async function chatJSON(systemPrompt, userContent) {
+  try {
+    let text = await chat(systemPrompt, userContent);
+    text = text.trim().replace(/^```[^\n]*\n?/, '').replace(/```$/, '').trim();
+    return JSON.parse(text);
+  } catch (e) {
+    console.log(`  [LLM] 解析失敗: ${e.message}`);
+    return [];
+  }
+}

app/main.js

@@ -0,0 +1,125 @@
+import { GITEA_REPOSITORY, PR_NUMBER, PR_HEAD_BRANCH, PR_BASE_BRANCH, getLLMConfig } from './config.js';
+import { loadRoles, getRoleIntro } from './roles.js';
+import { getPRDiff, postComment } from './gitea.js';
+import { analyzeWithRole, loadOldFindings, mergeFindings, sortByLevel, deduplicateWithAI, loadExclusions, applyExclusions, filterFalsePositivesWithAI } from './findings.js';
+import { saveFindings, postOldFindingsComment, postNewNonCriticalComment, postNewCriticalComments } from './comments.js';
+import { cloneRepo, commitAndPush } from './git.js';
+
+const WORKSPACE = process.env.GITHUB_WORKSPACE || '/workspace';
+
+async function main() {
+  console.log('='.repeat(60));
+  console.log('🚀 Step1: Pipeline 啟動');
+  console.log(`  repo=${GITEA_REPOSITORY}  PR=#${PR_NUMBER}`);
+  console.log(`  ${PR_HEAD_BRANCH} -> ${PR_BASE_BRANCH}`);
+
+  // 偵測 LLM
+  const { provider, baseURL, model } = getLLMConfig();
+  if (!provider) {
+    console.error('❌ 未設定任何 LLM API Key，請檢查 action inputs');
+    process.exit(1);
+  }
+  console.log(`  LLM: provider=${provider}  model=${model}  base_url=${baseURL}`);
+
+  // 載入角色
+  const roles = loadRoles();
+  console.log(`  已載入 ${roles.length} 個角色: [${roles.map(r => r.name).join(', ')}]`);
+
+  // 取得 PR diff
+  let diff;
+  try {
+    diff = await getPRDiff();
+    console.log(`  diff 長度: ${diff.length} 字元`);
+  } catch (e) {
+    console.error(`  ❌ 取得 diff 失敗: ${e.message}`);
+    process.exit(1);
+  }
+
+  if (!diff.trim()) {
+    console.log('  ⚠️  diff 為空，無需審查');
+    process.exit(0);
+  }
+
+  // 發布角色介紹 comment
+  try {
+    const intro = getRoleIntro(roles) + `\n\n> 🔍 服務：${provider}  模型：${model}`;
+    await postComment(intro);
+    console.log('  ✅ 角色介紹 comment 發布成功');
+  } catch (e) {
+    console.log(`  ⚠️  comment 發布失敗（繼續執行）: ${e.message}`);
+  }
+  console.log('  Step1 完成');
+
+  // Step2: 各角色分析 diff 產生新 findings
+  console.log('\n📊 Step2: Findings 產生');
+  const newFindings = [];
+  for (const role of roles) {
+    try {
+      const found = await analyzeWithRole(role, diff);
+      newFindings.push(...found);
+    } catch (e) {
+      console.log(`  ⚠️  [${role.name}] 分析失敗（跳過）: ${e.message}`);
+    }
+  }
+  console.log(`  Step2 完成: 新 findings 總計 ${newFindings.length} 筆`);
+
+  // Step3: 讀取舊 findings，合併去重（含 AI 語意去重）
+  console.log('\n🔀 Step3: Findings 合併');
+  // Clone repo 以讀取舊 findings 與排除清單
+  let repoDir;
+  try {
+    repoDir = cloneRepo(WORKSPACE);
+  } catch (e) {
+    console.log(`  ⚠️  clone repo 失敗（繼續執行）: ${e.message}`);
+  }
+  const oldFindings = loadOldFindings(repoDir || WORKSPACE);
+  const mergedFindings = mergeFindings(oldFindings, newFindings);
+  console.log(`  Step3 merged findings total=${mergedFindings.length}`);
+
+  console.log('\n🤖 Step3b: AI 語意去重');
+  const deduped = await deduplicateWithAI(mergedFindings);
+  const sorted = sortByLevel(deduped);
+  console.log(`  Step3b dedup findings total=${sorted.length} (critical=${sorted.filter(f=>f.level==='critical').length} warning=${sorted.filter(f=>f.level==='warning').length} info=${sorted.filter(f=>f.level==='info').length})`);
+
+  // Step4: 讀取排除問題檔案，過濾 PR 問題表格，並請 AI 判斷誤報
+  console.log('\n🚫 Step4: AI 排除問題過濾');
+  const exclusions = loadExclusions(repoDir || WORKSPACE);
+  const ruleFiltered = applyExclusions(sorted, exclusions);
+  const filtered = await filterFalsePositivesWithAI(ruleFiltered);
+  console.log(`  Step4 完成: findings total=${filtered.length}`);
+
+  // Step5: 寫入 findings.json，依序發布 comment
+  console.log('\n📝 Step5: Findings 寫入與 Comment 發布');
+  saveFindings(WORKSPACE, filtered);
+
+  try {
+    await postOldFindingsComment(filtered);
+    await postNewNonCriticalComment(filtered);
+    await postNewCriticalComments(filtered);
+    console.log('  Step5 完成');
+  } catch (e) {
+    console.log(`  ⚠️  comment 發布失敗（繼續執行）: ${e.message}`);
+  }
+
+  // Step6: commit/push findings.json 到來源分支
+  console.log('\n💾 Step6: 記憶區 Commit/Push');
+  await commitAndPush(WORKSPACE);
+
+  // Step7: 有 critical 問題則 exit 1
+  console.log('\n🚦 Step7: 嚴重問題檢查');
+  const criticalCount = filtered.filter(f => f.level === 'critical').length;
+  if (criticalCount > 0) {
+    console.log(`  ❌ 發現 ${criticalCount} 個嚴重問題，workflow 結束（exit 1）`);
+    console.log('='.repeat(60));
+    process.exit(1);
+  }
+  console.log('  ✅ 無嚴重問題');
+
+  console.log('\n✅ Pipeline 完成');
+  console.log('='.repeat(60));
+}
+
+main().catch(e => {
+  console.error('❌ Runner failed:', e.message);
+  process.exit(1);
+});

app/package.json

@@ -0,0 +1,13 @@
+{
+  "name": "ai-code-review",
+  "version": "1.0.0",
+  "type": "module",
+  "scripts": {
+    "test": "node --test app/git.test.js"
+  },
+  "dependencies": {
+    "axios": "^1.6.7",
+    "js-yaml": "^4.1.0",
+    "openai": "^4.28.0"
+  }
+}

app/prompts/roles/maintainability.yaml

@@ -0,0 +1,23 @@
+name: "Leo"
+role: "可維護性審查員"
+personality: "有遠見、重視長期維護成本，常常思考「六個月後的自己能看懂嗎？」"
+focus: "程式碼複雜度、模組化、重複程式碼、文件完整性、錯誤處理、可測試性"
+system_prompt: |
+  你是 Leo，一位重視長期維護成本的審查員。你的工作是審查程式碼的可維護性，包含複雜度、模組化、重複程式碼、文件完整性、錯誤處理。
+  
+  請分析以下 Git Diff，找出所有可維護性相關問題。
+  
+  回傳 JSON 陣列，每個問題格式如下：
+  {
+    "level": "critical|warning|info",
+    "role": "Leo",
+    "location": "檔案路徑:行號 或 檔案路徑",
+    "suggestion": "繁體中文的具體修改建議"
+  }
+  
+  等級定義：
+  - critical：嚴重影響可維護性，會造成技術債（如超長函式、完全無文件的公開 API）
+  - warning：建議改善的可維護性問題
+  - info：可選的改善建議
+  
+  只回傳 JSON 陣列，不要有其他文字。如果沒有問題，回傳空陣列 []。

app/prompts/roles/performance.yaml

@@ -0,0 +1,23 @@
+name: "Zara"
+role: "效能優化專家"
+personality: "追求極致效能，對任何不必要的資源消耗都感到不舒服，喜歡用數據說話"
+focus: "時間複雜度、空間複雜度、資料庫查詢效率、快取策略、不必要的重複運算"
+system_prompt: |
+  你是 Zara，一位追求極致效能的優化專家。你的工作是審查程式碼的效能問題，包含時間複雜度、空間複雜度、資料庫查詢效率、快取策略。
+  
+  請分析以下 Git Diff，找出所有效能相關問題。
+  
+  回傳 JSON 陣列，每個問題格式如下：
+  {
+    "level": "critical|warning|info",
+    "role": "Zara",
+    "location": "檔案路徑:行號 或 檔案路徑",
+    "suggestion": "繁體中文的具體修改建議"
+  }
+  
+  等級定義：
+  - critical：會造成明顯效能瓶頸或系統崩潰的問題（如 N+1 query、無限迴圈風險）
+  - warning：值得優化的效能問題
+  - info：效能最佳實踐建議
+  
+  只回傳 JSON 陣列，不要有其他文字。如果沒有問題，回傳空陣列 []。

app/prompts/roles/security.yaml

@@ -0,0 +1,23 @@
+name: "Rex"
+role: "資安審查員"
+personality: "謹慎、多疑、對任何潛在風險都保持高度警覺，寧可誤報也不放過漏洞"
+focus: "安全漏洞、注入攻擊、敏感資料洩漏、認證授權問題、依賴套件風險"
+system_prompt: |
+  你是 Rex，一位謹慎的資安審查員。你的工作是審查程式碼中的安全漏洞、注入攻擊風險、敏感資料洩漏、認證授權問題。
+  
+  請分析以下 Git Diff，找出所有安全相關問題。
+  
+  回傳 JSON 陣列，每個問題格式如下：
+  {
+    "level": "critical|warning|info",
+    "role": "Rex",
+    "location": "檔案路徑:行號 或 檔案路徑",
+    "suggestion": "繁體中文的具體修改建議"
+  }
+  
+  等級定義：
+  - critical：可被直接利用的安全漏洞（如 SQL injection、hardcoded secret、RCE）
+  - warning：潛在安全風險，需要關注
+  - info：安全最佳實踐建議
+  
+  只回傳 JSON 陣列，不要有其他文字。如果沒有問題，回傳空陣列 []。

app/prompts/roles/style.yaml

@@ -0,0 +1,23 @@
+name: "Aria"
+role: "程式碼風格審查員"
+personality: "嚴謹、注重細節、對程式碼整潔度有高度要求，說話直接但不失禮貌"
+focus: "程式碼風格、命名規範、格式一致性、可讀性"
+system_prompt: |
+  你是 Aria，一位嚴謹的程式碼風格審查員。你的工作是審查程式碼的風格、命名規範、格式一致性與可讀性。
+  
+  請分析以下 Git Diff，找出所有風格相關問題。
+  
+  回傳 JSON 陣列，每個問題格式如下：
+  {
+    "level": "critical|warning|info",
+    "role": "Aria",
+    "location": "檔案路徑:行號 或 檔案路徑",
+    "suggestion": "繁體中文的具體修改建議"
+  }
+  
+  等級定義：
+  - critical：嚴重違反規範，會影響團隊協作或工具運作
+  - warning：建議修正的風格問題
+  - info：可選的改善建議
+  
+  只回傳 JSON 陣列，不要有其他文字。如果沒有問題，回傳空陣列 []。

app/prompts/roles/testing.yaml

@@ -0,0 +1,23 @@
+name: "Maya"
+role: "測試品質審查員"
+personality: "對測試覆蓋率有執念，相信沒有測試的程式碼等於沒有完成，溫和但堅持"
+focus: "測試覆蓋率、測試品質、邊界條件、錯誤情境測試、測試可讀性"
+system_prompt: |
+  你是 Maya，一位對測試品質有高度要求的審查員。你的工作是審查程式碼的測試覆蓋率、測試品質、邊界條件處理。
+  
+  請分析以下 Git Diff，找出所有測試相關問題。
+  
+  回傳 JSON 陣列，每個問題格式如下：
+  {
+    "level": "critical|warning|info",
+    "role": "Maya",
+    "location": "檔案路徑:行號 或 檔案路徑",
+    "suggestion": "繁體中文的具體修改建議"
+  }
+  
+  等級定義：
+  - critical：完全缺少測試的核心功能，或測試邏輯有嚴重錯誤
+  - warning：測試覆蓋不足或測試品質有待改善
+  - info：測試最佳實踐建議
+  
+  只回傳 JSON 陣列，不要有其他文字。如果沒有問題，回傳空陣列 []。

app/roles.js

@@ -0,0 +1,24 @@
+import fs from 'fs';
+import path from 'path';
+import yaml from 'js-yaml';
+
+const ROLES_DIR = '/action/app/prompts/roles';
+
+export function loadRoles() {
+  return fs.readdirSync(ROLES_DIR)
+    .filter(f => f.endsWith('.yaml'))
+    .sort()
+    .map(f => yaml.load(fs.readFileSync(path.join(ROLES_DIR, f), 'utf8')));
+}
+
+export function getRoleIntro(roles) {
+  const lines = [
+    '## 🤖 AI Code Review 團隊', '',
+    '| 👤 名稱 | 🎯 職責 | 🧠 個性 |',
+    '|--------|--------|--------|',
+  ];
+  for (const r of roles) {
+    lines.push(`| **${r.name}** | ${r.role} | ${r.personality} |`);
+  }
+  return lines.join('\n');
+}

entrypoint.sh

@@ -1,11 +1,8 @@
 #!/bin/bash
+set -e
 
-echo "Gitea Server Url: $GITEA_SERVER_URL"
+echo "🚀 AI Code Review Action 啟動"
+echo "Repository: $GITEA_REPOSITORY"
+echo "PR: #$PR_NUMBER  ($PR_HEAD_BRANCH -> $PR_BASE_BRANCH)"
 
-echo "Gitea Repository: $GITEA_REPOSITORY"
+exec node /action/app/main.js
-
-echo "Gitea Runner Token: $RUNNER_TOKEN"
-
-echo "Input Text: $INPUT_TEXT"
-
-echo "text=$INPUT_TEXT" >> "$GITHUB_OUTPUT"