refactor: improve comment formatting and streamline AI handling in findings processing

Reviewed-on: jiantw83/code-review#85

.gitea/ai-review/exclusions.json

@@ -93,5 +93,115 @@
     "role": "Rex",
     "location": ".gitea/workflows/review.yaml",
     "suggestion": "切換 LLM 服務提供商的維護建議屬過度謹慎，不是實際程式碼問題"
+  },
+  {
+    "role": "Leo",
+    "location": "app/llm.js",
+    "suggestion": "Authorization 標頭已有 provider !== 'ollama' 判斷，不會無條件加入，已正確處理"
+  },
+  {
+    "role": "Zara",
+    "location": "app/llm.js",
+    "suggestion": "timeout 已移除，每個 key 等待完整回應，避免浪費免費額度"
+  },
+  {
+    "role": "Rex",
+    "location": "app/llm.js",
+    "suggestion": "httpsAgent (rejectUnauthorized: false) 已移除，SSL/TLS 驗證已恢復正常"
+  },
+  {
+    "role": "Maya",
+    "location": "app/llm.js",
+    "suggestion": "llm.test.js 已存在並涵蓋 API Key 輪替的所有異常狀況，包含單 Key、多 Key 輪替、所有 Key 失敗等測試案例"
+  },
+  {
+    "role": "Zara",
+    "location": "app/comments.js",
+    "suggestion": "comments.js:24 的 saveFindings 函式為正常寫入邏輯，不涉及異常訊息格式或重複寫入問題"
+  },
+  {
+    "role": "Leo",
+    "location": ".gitea/workflows/review.yaml",
+    "suggestion": "Gitea Actions 不支援在 workflow 內合併 secrets 再拆解，多個 secret 逗號串接是唯一可行做法，非設計缺陷"
+  },
+  {
+    "role": "Maya",
+    "location": "app/llm.test.js",
+    "suggestion": "console.log/error 為診斷用途，不是業務邏輯，TODO.md 驗收標準為人工驗收描述，不需要在單元測試中斷言 console 輸出"
+  },
+  {
+    "role": "Maya",
+    "location": "app/llm.test.js",
+    "suggestion": "輪替邏輯對所有錯誤類型行為一致（catch 全部），401/429/timeout 觸發相同輪替流程，測試不同錯誤類型無額外驗證價值"
+  },
+  {
+    "role": "Aria",
+    "location": ".gitea/workflows/master.yaml",
+    "suggestion": "master.yaml 檔案結尾已有換行符號（0x0a），符合 POSIX 慣例，無需修改"
+  },
+  {
+    "role": "Leo",
+    "location": "app/llm.test.js",
+    "suggestion": "console.log/error 為診斷用途，不是業務邏輯，TODO.md 驗收標準為人工驗收描述，不需要在單元測試中斷言 console 輸出"
+  },
+  {
+    "role": "Leo",
+    "location": "app/llm.test.js",
+    "suggestion": "輪替邏輯對所有錯誤類型行為一致（catch 全部），401/429/timeout 觸發相同輪替流程，測試不同錯誤類型無額外驗證價值"
+  },
+  {
+    "role": "Rex",
+    "location": "app/package.json",
+    "suggestion": "審查 changelog 是人工作業，不是程式碼問題，不適合作為 code review 問題"
+  },
+  {
+    "role": "Aria",
+    "location": "app/llm.js",
+    "suggestion": "此 action 為 CLI 工具，process.exit(1) 是設計意圖讓 CI/CD workflow 失敗。改拋錯會被 chatJSON 的 catch 吞掉回傳 []，破壞現有行為"
+  },
+  {
+    "role": "Aria",
+    "location": "Dockerfile",
+    "suggestion": "Dockerfile 檔案結尾已有換行符號（0x0a），符合 POSIX 慣例"
+  },
+  {
+    "role": "Aria",
+    "location": "entrypoint.sh",
+    "suggestion": "entrypoint.sh 檔案結尾已有換行符號（0x0a），符合 POSIX 慣例"
+  },
+  {
+    "role": "Maya",
+    "location": "app/main.js",
+    "suggestion": "main.js 整合測試需要真實 Gitea API、LLM API、git 操作，不適合單元測試。各模組已有獨立單元測試覆蓋"
+  },
+  {
+    "role": "Maya",
+    "location": "app/comments.js",
+    "suggestion": "comments.js 的 buildTable 為簡單字串拼接，postComment 已透過 gitea.js mock 間接測試，補測試效益低"
+  },
+  {
+    "role": "Maya",
+    "location": "app/roles.js",
+    "suggestion": "roles.js 依賴容器內固定路徑 /action/app/prompts/roles，單元測試環境無法存取，且邏輯為簡單 YAML 讀取與字串拼接"
+  },
+  {
+    "role": "Leo",
+    "location": "app/gitea.js",
+    "suggestion": "gitea.js 的 SSL 驗證已改為由 GITEA_SKIP_TLS_VERIFY 環境變數控制，預設啟用驗證，非安全漏洞"
+  },
+  {
+    "role": "Zara",
+    "location": "Dockerfile",
+    "suggestion": "Dockerfile 已優化層次快取：先 COPY package.json 再 npm install，最後才 COPY 其餘檔案"
+  },
+  {
+    "role": "Aria",
+    "location": "app/package.json",
+    "suggestion": "test 腳本已改為 node --test *.test.js，在 app/ 目錄下執行可自動發現所有測試檔案"
+  },
+  {
+    "role": "Zara",
+    "location": "app/main.js",
+    "suggestion": "deduplicateWithAI 和 filterFalsePositivesWithAI 為循序依賴流程（去重後才能過濾），無法平行化"
   }
 ]

.gitea/ai-review/findings.json

@@ -1,58 +1,9 @@
 [
   {
-    "level": "critical",
+    "level": "info",
-    "role": "Leo",
-    "location": "app/llm.js:22",
-    "suggestion": "在 `chat` 函式中，`Authorization` 標頭是無條件地被加入到所有 LLM 請求中。這對於不需要 API Key 的服務（如 Ollama）是不必要的，且可能導致錯誤。建議在設定 `Authorization` 標頭之前，先判斷當前的 `provider` 是否需要 API Key，例如 `if (provider !== 'ollama' && apiKeys[i]) { headers['Authorization'] = `Bearer ${apiKeys[i]}`; }`，以提高程式碼的健壯性和正確性。",
-    "is_new": true
-  },
-  {
-    "level": "critical",
-    "role": "Zara",
-    "location": "app/llm.js:20",
-    "suggestion": "當啟用 API Key 輪替機制時，單一 API 請求的 `timeout` 設定為 120 秒過長。若有多個 Key 且每個 Key 都因逾時而失敗，可能導致整個流程耗時過久（例如 10 個 Key 可能耗時 20 分鐘）。建議將單次請求的逾時時間縮短（例如 10-30 秒），以加速 Key 的輪替，避免 CI/CD 流程長時間阻塞。",
-    "is_new": true
-  },
-  {
-    "level": "critical",
     "role": "Rex",
-    "location": "app/llm.js:6",
+    "location": "action.yaml",
-    "suggestion": "程式碼中 `https.Agent({ rejectUnauthorized: false })` 停用了 SSL/TLS 憑證驗證。這會使所有 HTTPS 連線容易受到中間人 (Man-in-the-Middle, MITM) 攻擊，攻擊者可以攔截並修改與 LLM 服務提供者的通訊，導致資料洩漏、未經授權的存取或 AI 回應被操縱。請移除 `const httpsAgent = new https.Agent({ rejectUnauthorized: false });` 這一行，並確保 `axios.post` 呼叫中不再使用 `httpsAgent` 選項。預設情況下，Node.js 和 Axios 會執行嚴格的 SSL 憑證驗證，這是確保通訊安全的最佳實踐。如果遇到憑證問題，應調查並解決底層的憑證信任鏈問題，而非禁用驗證。",
+    "suggestion": "此 Action 需要 `contents: write`、`pull-requests: write` 和 `issues: write` 權限。這些權限對於 Action 的正常運作是必要的（例如寫入 findings.json、發布評論），但屬於較廣泛的權限。建議在文件或使用說明中明確指出這些權限的需求及其潛在影響，確保使用者了解並接受。",
-    "is_new": true
-  },
-  {
-    "level": "critical",
-    "role": "Maya",
-    "location": "app/llm.js:10-31",
-    "suggestion": "`app/llm.js` 中實現的 API Key 輪替功能是本次改動的核心，但目前缺少對應的單元測試。請務必在 `app/llm.test.js` 中新增全面的測試案例，以驗證 `TODO.md` 中「階段八：API Key 輪替」的所有驗收標準：\n*   **單一 Key 成功**：傳入單一有效 Key 時，確保行為與原本相同。\n*   **多個 Key 輪替成功**：驗證當前 N-1 個 Key 失敗，第 N 個 Key 成功時，系統能依序嘗試並最終成功。\n*   **所有 Key 失敗**：驗證當所有傳入的 Key 都失敗時，系統能正確記錄每次失敗，並最終呼叫 `process.exit(1)` 終止流程（測試時需模擬 `process.exit` 以捕獲其調用）。\n*   **日誌訊息**：驗證在 Key 失敗時，能正確輸出「key[N/M] 失敗」的日誌；所有 Key 失敗時，能輸出「所有 API Key 均失敗，終止流程」。\n*   **錯誤處理**：模擬不同類型的 API 錯誤（例如 401 Unauthorized, 429 Too Many Requests, 網路超時等），確保 Key 輪替機制能穩健處理。",
-    "is_new": true
-  },
-  {
-    "level": "warning",
-    "role": "Zara",
-    "location": "app/comments.js:24",
-    "suggestion": "在 `saveFindings` 函數中，`fs.writeFileSync` 是一個同步操作。如果 `findings` 陣列可能非常大，或者此函數會被頻繁呼叫，同步寫入檔案可能會阻塞 Node.js 事件迴圈，導致應用程式響應變慢。建議改用 `fs.writeFile` (非同步) 以避免阻塞主執行緒，提升應用程式的響應能力。",
-    "is_new": false
-  },
-  {
-    "level": "warning",
-    "role": "Aria",
-    "location": ".gitea/workflows/master.yaml",
-    "suggestion": "檔案結尾應包含一個換行符號 (newline at EOF)，這是 POSIX 系統的慣例，有助於版本控制系統的正確處理。",
-    "is_new": false
-  },
-  {
-    "level": "warning",
-    "role": "Leo",
-    "location": ".gitea/workflows/review.yaml:36",
-    "suggestion": "GEMINI_API_KEY 的值過長，影響可讀性。雖然這是為了傳遞多個 Secret，但建議考慮是否有其他方式可以讓設定檔更簡潔，例如將多個 Secret 組合為一個，或在 Action 內部處理多個獨立的 Secret 變數（如果 Action 支援）。如果沒有其他方式，請考慮將其分行以提高可讀性（雖然 YAML 可能會將其視為單行）。",
-    "is_new": true
-  },
-  {
-    "level": "warning",
-    "role": "Maya",
-    "location": "app/llm.js",
-    "suggestion": "`chatJSON` 函數依賴於 `chat` 函數的 API Key 輪替邏輯。為確保在處理 JSON 格式回應時，API Key 輪替機制也能正常運作，建議在 `app/llm.test.js` 中為 `chatJSON` 函數新增至少一個測試案例，特別是針對 Key 輪替失敗或成功後的行為進行驗證。",
     "is_new": true
   }
 ]

.gitea/workflows/master.yaml

@@ -25,4 +25,4 @@ jobs:
     - name: 清理成品
       uses: https://gitea.jsc.idv.tw/actions/cleanup-release@${{ vars.ACTION_CLEANUP_RELEASE_VERSION }}
       with:
-        RUNNER_TOKEN: ${{ secrets.RUNNER_TOKEN }}
+        RUNNER_TOKEN: ${{ secrets.RUNNER_TOKEN }}

.gitea/workflows/review.yaml

@@ -26,16 +26,16 @@ jobs:
         tag_name: v${{ steps.version.outputs.version }}
         target_commitish: ${{ github.head_ref }}
   code-review:
-    name: 'Code Review'
+    name: Code Review
     runs-on: ubuntu
     needs: [version]
     steps:
     - name: AI Code Review
-      uses: https://gitea.jsc.idv.tw/jiantw83/code-review@v${{ needs.version.outputs.version }}
+      uses: https://gitea.jsc.idv.tw/actions/code-review@v${{ needs.version.outputs.version }}
       with:
-        OPENAI_API_KEY: ${{ secrets.OPENROUTER_API_KEY }}
+        GEMINI_API_KEY: ${{ secrets.GEMINI_API_KEY }},${{ secrets.GEMINI_API_KEY_1 }},${{ secrets.GEMINI_API_KEY_2 }},${{ secrets.GEMINI_API_KEY_3 }},${{ secrets.GEMINI_API_KEY_4 }},${{ secrets.GEMINI_API_KEY_5 }},${{ secrets.GEMINI_API_KEY_6 }},${{ secrets.GEMINI_API_KEY_7 }},${{ secrets.GEMINI_API_KEY_8 }},${{ secrets.GEMINI_API_KEY_9 }},${{ secrets.GEMINI_API_KEY_10 }},${{ secrets.GEMINI_API_KEY_11 }},${{ secrets.GEMINI_API_KEY_12 }},${{ secrets.GEMINI_API_KEY_13 }},${{ secrets.GEMINI_API_KEY_14 }},${{ secrets.GEMINI_API_KEY_15 }},${{ secrets.GEMINI_API_KEY_16 }},${{ secrets.GEMINI_API_KEY_17 }},${{ secrets.GEMINI_API_KEY_18 }},${{ secrets.GEMINI_API_KEY_19 }}
-        OPENAI_BASE_URL: https://openrouter.ai/api/v1
+        GEMINI_BASE_URL: https://generativelanguage.googleapis.com/v1beta
-        OPENAI_MODEL: ${{ vars.OPENROUTER_MODEL }}
+        GEMINI_MODEL: ${{ vars.GEMINI_MODEL }}
     permissions:
       contents: write
       pull-requests: write

Dockerfile

@@ -1,4 +1,4 @@
-FROM alpine
+FROM alpine:3.20
 
 RUN apk add --no-cache bash nodejs npm git \
     && node --version \
@@ -7,10 +7,11 @@ RUN apk add --no-cache bash nodejs npm git \
 
 WORKDIR /action
 
+COPY app/package.json /action/app/
+RUN cd /action/app && npm install
+
 COPY app/ /action/app/
 COPY entrypoint.sh /entrypoint.sh
-
+RUN chmod +x /entrypoint.sh
-RUN cd /action/app && npm install && \
-    chmod +x /entrypoint.sh
 
 ENTRYPOINT ["/entrypoint.sh"]

README.md

@@ -21,7 +21,8 @@
 3. Comment 加上些許 emoji 讓資訊有點活力
 4. 盡量將應用程式放在 ./app，修改 entrypoint.sh 與 Dockerfile 讓程式可以正常運行
 5. 將提示詞放到 ./app/prompts 內供程式讀取
-6. API Key 支援逗號分隔傳入多個，依序嘗試，失敗時自動換下一個，全部失敗則 exit 1
+6. API Key 支援逗號分隔傳入多個，隨機順序各嘗試一次，全部失敗則 exit 1
+7. 讀取 Git Diff 時排除 `.gitea/` 資料夾內的所有檔案，避免 AI 分析 workflow 設定等非業務程式碼
 
 # 使用說明
 
@@ -32,16 +33,21 @@
 ### 1. OpenAI
 ```yaml
 name: AI
+concurrency:
+  group: ${{ github.workflow }}-${{ github.head_ref }}
+  cancel-in-progress: true
 on:
   pull_request:
+    branches-ignore:
+    - master
     types: [opened, synchronize]
 jobs:
   code-review:
-    name: 'Code Review'
+    name: Code Review
     runs-on: ubuntu
     steps:
     - name: AI Code Review
-      uses: https://gitea.jsc.idv.tw/jiantw83/code-review@${{ vars.ACTION_CODE_REVIEW_VERSION }}
+      uses: https://gitea.jsc.idv.tw/actions/code-review@${{ vars.ACTION_CODE_REVIEW_VERSION }}
       with:
         OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}  # 支援逗號分隔多個 Key
         OPENAI_BASE_URL: https://api.openai.com/v1
@@ -55,18 +61,23 @@ jobs:
 ### 2. OpenRouter
 ```yaml
 name: AI
+concurrency:
+  group: ${{ github.workflow }}-${{ github.head_ref }}
+  cancel-in-progress: true
 on:
   pull_request:
+    branches-ignore:
+    - master
     types: [opened, synchronize]
 jobs:
   code-review:
-    name: 'Code Review'
+    name: Code Review
     runs-on: ubuntu
     steps:
     - name: AI Code Review
-      uses: https://gitea.jsc.idv.tw/jiantw83/code-review@${{ vars.ACTION_CODE_REVIEW_VERSION }}
+      uses: https://gitea.jsc.idv.tw/actions/code-review@${{ vars.ACTION_CODE_REVIEW_VERSION }}
       with:
-        OPENAI_API_KEY: ${{ secrets.OPENROUTER_API_KEY }}  # OpenRouter 使用 OpenAI 相容介面，以 OPENAI_API_KEY 傳入，支援逗號分隔多個 Key
+        OPENAI_API_KEY: ${{ secrets.OPENROUTER_API_KEY }},${{ secrets.OPENROUTER_API_KEY_1 }}
         OPENAI_BASE_URL: https://openrouter.ai/api/v1
         OPENAI_MODEL: ${{ vars.OPENROUTER_MODEL }}
     permissions:
@@ -78,16 +89,21 @@ jobs:
 ### 3. Anthropic Claude
 ```yaml
 name: AI
+concurrency:
+  group: ${{ github.workflow }}-${{ github.head_ref }}
+  cancel-in-progress: true
 on:
   pull_request:
+    branches-ignore:
+    - master
     types: [opened, synchronize]
 jobs:
   code-review:
-    name: 'Code Review'
+    name: Code Review
     runs-on: ubuntu
     steps:
     - name: AI Code Review
-      uses: https://gitea.jsc.idv.tw/jiantw83/code-review@${{ vars.ACTION_CODE_REVIEW_VERSION }}
+      uses: https://gitea.jsc.idv.tw/actions/code-review@${{ vars.ACTION_CODE_REVIEW_VERSION }}
       with:
         CLAUDE_API_KEY: ${{ secrets.CLAUDE_API_KEY }}  # 支援逗號分隔多個 Key
         CLAUDE_BASE_URL: https://api.anthropic.com/v1
@@ -100,18 +116,23 @@ jobs:
 ### 4. Google Gemini
 ```yaml
 name: AI
+concurrency:
+  group: ${{ github.workflow }}-${{ github.head_ref }}
+  cancel-in-progress: true
 on:
   pull_request:
+    branches-ignore:
+    - master
     types: [opened, synchronize]
 jobs:
   code-review:
-    name: 'Code Review'
+    name: Code Review
     runs-on: ubuntu
     steps:
     - name: AI Code Review
-      uses: https://gitea.jsc.idv.tw/jiantw83/code-review@${{ vars.ACTION_CODE_REVIEW_VERSION }}
+      uses: https://gitea.jsc.idv.tw/actions/code-review@${{ vars.ACTION_CODE_REVIEW_VERSION }}
       with:
-        GEMINI_API_KEY: ${{ secrets.GEMINI_API_KEY }},${{ secrets.GEMINI_API_KEY_1 }},${{ secrets.GEMINI_API_KEY_2 }},${{ secrets.GEMINI_API_KEY_3 }},${{ secrets.GEMINI_API_KEY_4 }},${{ secrets.GEMINI_API_KEY_5 }},${{ secrets.GEMINI_API_KEY_6 }},${{ secrets.GEMINI_API_KEY_7 }},${{ secrets.GEMINI_API_KEY_8 }},${{ secrets.GEMINI_API_KEY_9 }}
+        GEMINI_API_KEY: ${{ secrets.GEMINI_API_KEY }},${{ secrets.GEMINI_API_KEY_1 }},${{ secrets.GEMINI_API_KEY_2 }},${{ secrets.GEMINI_API_KEY_3 }},${{ secrets.GEMINI_API_KEY_4 }},${{ secrets.GEMINI_API_KEY_5 }},${{ secrets.GEMINI_API_KEY_6 }},${{ secrets.GEMINI_API_KEY_7 }},${{ secrets.GEMINI_API_KEY_8 }},${{ secrets.GEMINI_API_KEY_9 }},${{ secrets.GEMINI_API_KEY_10 }},${{ secrets.GEMINI_API_KEY_11 }},${{ secrets.GEMINI_API_KEY_12 }},${{ secrets.GEMINI_API_KEY_13 }},${{ secrets.GEMINI_API_KEY_14 }},${{ secrets.GEMINI_API_KEY_15 }},${{ secrets.GEMINI_API_KEY_16 }},${{ secrets.GEMINI_API_KEY_17 }},${{ secrets.GEMINI_API_KEY_18 }},${{ secrets.GEMINI_API_KEY_19 }}
         GEMINI_BASE_URL: https://generativelanguage.googleapis.com/v1beta
         GEMINI_MODEL: ${{ vars.GEMINI_MODEL }}
     permissions:
@@ -123,16 +144,21 @@ jobs:
 ### 5. Amazon Q
 ```yaml
 name: AI
+concurrency:
+  group: ${{ github.workflow }}-${{ github.head_ref }}
+  cancel-in-progress: true
 on:
   pull_request:
+    branches-ignore:
+    - master
     types: [opened, synchronize]
 jobs:
   code-review:
-    name: 'Code Review'
+    name: Code Review
     runs-on: ubuntu
     steps:
     - name: AI Code Review
-      uses: https://gitea.jsc.idv.tw/jiantw83/code-review@${{ vars.ACTION_CODE_REVIEW_VERSION }}
+      uses: https://gitea.jsc.idv.tw/actions/code-review@${{ vars.ACTION_CODE_REVIEW_VERSION }}
       with:
         AMAZONQ_API_KEY: ${{ secrets.AMAZONQ_API_KEY }}  # 支援逗號分隔多個 Key
         AMAZONQ_BASE_URL: https://q.api.aws
@@ -146,22 +172,26 @@ jobs:
 
 ```yaml
 name: AI
+concurrency:
+  group: ${{ github.workflow }}-${{ github.head_ref }}
+  cancel-in-progress: true
 on:
   pull_request:
+    branches-ignore:
+    - master
     types: [opened, synchronize]
 jobs:
   code-review:
-    name: 'Code Review'
+    name: Code Review
     runs-on: ubuntu
     steps:
     - name: AI Code Review
-        uses: https://gitea.jsc.idv.tw/jiantw83/code-review@${{ vars.ACTION_CODE_REVIEW_VERSION }}
+        uses: https://gitea.jsc.idv.tw/actions/code-review@${{ vars.ACTION_CODE_REVIEW_VERSION }}
         with:
           OLLAMA_BASE_URL: https://ollama.jsc.idv.me/v1
           OLLAMA_MODEL: ${{ vars.OLLAMA_MODEL }}
     permissions:
       contents: write
       pull-requests: write
-
       issues: write
 ```

TODO.md

@@ -36,10 +36,15 @@
 - 完成
 
 ## 階段八：API Key 輪替
-- 目標：所有平台的 API Key 支援逗號分隔傳入多個，依序嘗試，單一 Key 失敗時自動換下一個，全部失敗則 exit 1。
+- 目標：所有平台的 API Key 支援逗號分隔傳入多個，隨機順序各嘗試一次，單一 Key 失敗時自動換下一個，全部失敗則 exit 1。
 - 驗收：log 中能看到「key[N/M] 失敗」等訊息，換 key 後繼續執行；傳入單一 Key 時行為與原本相同；全部 Key 失敗時 log「所有 API Key 均失敗，終止流程」且 workflow 狀態為失敗。
 - 完成
 
+## 階段九：Git Diff 排除 .gitea/ 資料夾
+- 目標：讀取 Git Diff 時排除 `.gitea/` 資料夾內的所有檔案，避免 AI 分析 workflow 設定等非業務程式碼。
+- 驗收：PR 中有 `.gitea/` 路徑的變更時，diff 內容不包含該路徑的區塊，AI 分析結果不含 `.gitea/` 相關問題。
+- 完成
+
 ---
 
 所有階段驗收通過。

action.yaml

@@ -12,6 +12,10 @@ inputs:
   GITEA_REPOSITORY:
     description: 'Gitea Repository (owner/repo)'
     required: false
+  GITEA_SKIP_TLS_VERIFY:
+    description: '跳過 Gitea SSL/TLS 憑證驗證（自簽憑證時使用）'
+    required: false
+    default: 'false'
   PR_NUMBER:
     description: 'Pull Request Number'
     required: false
@@ -80,6 +84,7 @@ runs:
     GITEA_TOKEN: ${{ inputs.GITEA_TOKEN || secrets.GITEA_TOKEN }}
     GITEA_SERVER_URL: ${{ inputs.GITEA_SERVER_URL || gitea.server_url }}
     GITEA_REPOSITORY: ${{ inputs.GITEA_REPOSITORY || gitea.repository }}
+    GITEA_SKIP_TLS_VERIFY: ${{ inputs.GITEA_SKIP_TLS_VERIFY }}
     PR_NUMBER: ${{ inputs.PR_NUMBER || gitea.event.pull_request.number }}
     PR_HEAD_BRANCH: ${{ inputs.PR_HEAD_BRANCH || gitea.event.pull_request.head.ref }}
     PR_BASE_BRANCH: ${{ inputs.PR_BASE_BRANCH || gitea.event.pull_request.base.ref }}

app/comments.js

@@ -63,7 +63,7 @@ export async function postNewCriticalComments(findings) {
     return;
   }
   for (const f of criticals) {
-    const body = `## 🚨 嚴重問題\n\n| 審查員 | 位置 | 建議 |\n|--------|------|------|\n| ${f.role} | ${f.location} | ${f.suggestion} |`;
+    const body = `## 🚨 嚴重問題\n\n${buildTable([f])}`;
     await postComment(body);
     console.log(`  ✅ 嚴重問題 comment 發布: [${f.role}] ${f.location}`);
   }

app/config.js

@@ -1,6 +1,7 @@
 export const GITEA_TOKEN = process.env.GITEA_TOKEN || '';
 export const GITEA_SERVER_URL = process.env.GITEA_SERVER_URL || 'https://gitea.com';
 export const GITEA_REPOSITORY = process.env.GITEA_REPOSITORY || '';
+export const GITEA_SKIP_TLS_VERIFY = process.env.GITEA_SKIP_TLS_VERIFY === 'true';
 export const PR_NUMBER = process.env.PR_NUMBER || '';
 export const PR_HEAD_BRANCH = process.env.PR_HEAD_BRANCH || '';
 export const PR_BASE_BRANCH = process.env.PR_BASE_BRANCH || '';

app/config.test.js

@@ -105,4 +105,11 @@ describe('getLLMConfig', () => {
     assert.equal(cfg.provider, 'ollama');
     assert.equal(cfg.model, 'llama3');
   });
+
+  it('comma-only api key is treated as not set', () => {
+    process.env.OPENAI_API_KEY = ',,,';
+    const cfg = getLLMConfig();
+    assert.equal(cfg.provider, null);
+    assert.deepEqual(cfg.apiKeys, []);
+  });
 });

app/findings.js

@@ -11,7 +11,6 @@ const LEVELS = ['critical', 'warning', 'info'];
 export async function analyzeWithRole(role, diff) {
   console.log(`  [${role.name}] 開始分析...`);
   const findings = await chatJSON(role.system_prompt, `以下是 Git Diff 內容：\n\n${diff}`);
-  // 確保每筆都有必要欄位，並標記為新問題
   const valid = findings.filter(f => f.level && f.role && f.location && f.suggestion)
     .map(f => ({ ...f, is_new: true }));
   console.log(`  [${role.name}] 找到 ${valid.length} 個問題`);
@@ -40,7 +39,6 @@ export function loadOldFindings(workspace) {
 
 /**
  * 合併新舊 findings，以 (role + location + suggestion前50字) 為 key 去除重複
- * 舊問題保留，新問題若與舊問題重複則捨棄
  */
 export function mergeFindings(oldFindings, newFindings) {
   const key = f => `${f.role}|${f.location}|${String(f.suggestion).slice(0, 50)}`;
@@ -63,8 +61,17 @@ export function sortByLevel(findings) {
 }
 
 /**
- * 呼叫 LLM 進行語意去重，回傳去重後的 findings
+ * AI 呼叫失敗時的統一降級處理
- * 失敗時降級回傳原始 findings
+ */
+function fallback(label, findings, e) {
+  const status = e.response?.status;
+  const reason = (status === 402 || status === 429) ? `${status} 額度/限流` : e.message;
+  console.log(`  ⚠️  ${label}失敗（${reason}），降級：保留所有問題`);
+  return findings;
+}
+
+/**
+ * 呼叫 LLM 進行語意去重，失敗時降級回傳原始 findings
  */
 export async function deduplicateWithAI(findings) {
   if (findings.length === 0) return findings;
@@ -74,29 +81,20 @@ export async function deduplicateWithAI(findings) {
 保留等級較高的版本，優先保留 critical > warning > info。
 只回傳去重後的 JSON 陣列，不要有其他文字。`;
 
-  const userContent = `以下是問題清單，請去除語意重複的項目：\n\n${JSON.stringify(findings, null, 2)}`;
-
   try {
-    const result = await chatJSON(systemPrompt, userContent);
+    const result = await chatJSON(systemPrompt, `以下是問題清單，請去除語意重複的項目：\n\n${JSON.stringify(findings, null, 2)}`);
     if (Array.isArray(result) && result.length > 0) {
       console.log(`  AI 去重: ${findings.length} -> ${result.length} 筆`);
       return result;
     }
     throw new Error('AI 回傳空陣列');
   } catch (e) {
-    const status = e.response?.status;
+    return fallback('AI 去重', findings, e);
-    if (status === 402 || status === 429) {
-      console.log(`  ⚠️  AI 去重失敗（${status} 額度/限流），降級：保留所有問題`);
-    } else {
-      console.log(`  ⚠️  AI 去重失敗（${e.message}），降級：保留所有問題`);
-    }
-    return findings;
   }
 }
 
 /**
  * 讀取排除問題檔案（從 workspace 的 EXCLUSIONS_PATH）
- * 格式：[{ role, location, suggestion }]，欄位可部分省略，省略表示萬用
  */
 export function loadExclusions(workspace) {
   const fullPath = path.join(workspace, EXCLUSIONS_PATH);
@@ -125,17 +123,14 @@ export function applyExclusions(findings, exclusions) {
   const filtered = findings.filter(f => !exclusions.some(ex => {
     const fPath = String(f.location).split(':')[0];
     const exPath = ex.location ? String(ex.location).split(':')[0] : null;
-    return (!exPath || fPath === exPath) &&
+    return (!exPath || fPath === exPath) && (!ex.role || ex.role === f.role);
-           (!ex.role || ex.role === f.role);
   }));
   console.log(`  排除過濾: ${before} -> ${filtered.length} 筆（排除 ${before - filtered.length} 筆）`);
   return filtered;
 }
 
 /**
- * 呼叫 AI 判斷哪些問題是誤報或不需處理，回傳需保留的 findings
+ * 呼叫 AI 判斷哪些問題是誤報或不需處理，失敗時降級回傳原始 findings
- * exclusions 為已知誤報清單，供 AI 參考判斷
- * 失敗時降級回傳原始 findings
  */
 export async function filterFalsePositivesWithAI(findings, exclusions = []) {
   if (findings.length === 0) return findings;
@@ -152,22 +147,14 @@ export async function filterFalsePositivesWithAI(findings, exclusions = []) {
 3. 與已知誤報清單語意相近的問題（檔案路徑相同且建議內容相似）
 只回傳需要保留的問題 JSON 陣列，不要有其他文字。${exclusionHint}`;
 
-  const userContent = `請判斷以下問題清單，移除誤報或不需處理的問題：\n\n${JSON.stringify(findings, null, 2)}`;
-
   try {
-    const result = await chatJSON(systemPrompt, userContent);
+    const result = await chatJSON(systemPrompt, `請判斷以下問題清單，移除誤報或不需處理的問題：\n\n${JSON.stringify(findings, null, 2)}`);
     if (Array.isArray(result) && result.length > 0) {
       console.log(`  AI 誤報過濾: ${findings.length} -> ${result.length} 筆`);
       return result;
     }
     throw new Error('AI 回傳空陣列或非陣列');
   } catch (e) {
-    const status = e.response?.status;
+    return fallback('AI 誤報過濾', findings, e);
-    if (status === 402 || status === 429) {
-      console.log(`  ⚠️  AI 誤報過濾失敗（${status} 額度/限流），降級：保留所有問題`);
-    } else {
-      console.log(`  ⚠️  AI 誤報過濾失敗（${e.message}），降級：保留所有問題`);
-    }
-    return findings;
   }
 }

app/git.js

@@ -14,20 +14,26 @@ function makeRunner(spawn) {
   };
 }
 
+function withAskpass(workspace, fn) {
+  const askpassScript = path.join(workspace, '.git-askpass.sh');
+  fs.writeFileSync(askpassScript, '#!/bin/sh\necho "$GIT_TOKEN"\n', { mode: 0o700 });
+  const credEnv = { ...process.env, GIT_ASKPASS: askpassScript, GIT_USERNAME: 'x-token', GIT_TOKEN: GITEA_TOKEN };
+  try {
+    return fn(credEnv);
+  } finally {
+    try { fs.unlinkSync(askpassScript); } catch {}
+  }
+}
+
 /**
  * Clone PR head branch to workspace/repo (idempotent)
  */
 export function cloneRepo(workspace, _spawnSync = spawnSync) {
   const run = makeRunner(_spawnSync);
-  const baseUrl = GITEA_SERVER_URL.replace(/\/$/, '');
+  const remoteUrl = `${GITEA_SERVER_URL.replace(/\/$/, '')}/${GITEA_REPOSITORY}.git`;
-  const remoteUrl = `${baseUrl}/${GITEA_REPOSITORY}.git`;
   const repoDir = path.join(workspace, 'repo');
 
-  const askpassScript = path.join(workspace, '.git-askpass.sh');
+  return withAskpass(workspace, credEnv => {
-  fs.writeFileSync(askpassScript, '#!/bin/sh\necho "$GIT_TOKEN"\n', { mode: 0o700 });
-  const credEnv = { ...process.env, GIT_ASKPASS: askpassScript, GIT_USERNAME: 'x-token', GIT_TOKEN: GITEA_TOKEN };
-
-  try {
     if (!fs.existsSync(repoDir)) {
       run(['clone', '--depth=1', '--branch', PR_HEAD_BRANCH, remoteUrl, repoDir], workspace, credEnv);
       console.log(`  ✅ repo cloned to ${repoDir}`);
@@ -36,57 +42,40 @@ export function cloneRepo(workspace, _spawnSync = spawnSync) {
       run(['checkout', PR_HEAD_BRANCH], repoDir);
       console.log(`  ✅ repo already exists, fetched latest`);
     }
-  } finally {
+    return repoDir;
-    try { fs.unlinkSync(askpassScript); } catch {}
+  });
-  }
-  return repoDir;
 }
 
 export async function commitAndPush(workspace, _spawnSync = spawnSync) {
   const run = makeRunner(_spawnSync);
-
+  const remoteUrl = `${GITEA_SERVER_URL.replace(/\/$/, '')}/${GITEA_REPOSITORY}.git`;
-  const baseUrl = GITEA_SERVER_URL.replace(/\/$/, '');
-  const remoteUrl = `${baseUrl}/${GITEA_REPOSITORY}.git`;
-  const repoDir = path.join(workspace, 'repo');
-
-  // Write a temporary askpass script that reads the token from an env var,
-  // so the token value never appears in the script file itself
-  const askpassScript = path.join(workspace, '.git-askpass.sh');
-  fs.writeFileSync(askpassScript, '#!/bin/sh\necho "$GIT_TOKEN"\n', { mode: 0o700 });
-
-  const credEnv = { ...process.env, GIT_ASKPASS: askpassScript, GIT_USERNAME: 'x-token', GIT_TOKEN: GITEA_TOKEN };
 
   try {
-    if (!fs.existsSync(repoDir)) {
+    const repoDir = cloneRepo(workspace, _spawnSync);
-      run(['clone', '--depth=1', '--branch', PR_HEAD_BRANCH, remoteUrl, repoDir], workspace, credEnv);
-    }
 
-    run(['config', 'user.email', 'ai-review[bot]@gitea'], repoDir);
+    await withAskpass(workspace, async credEnv => {
-    run(['config', 'user.name', 'AI Review Bot'], repoDir);
+      run(['config', 'user.email', 'ai-review[bot]@gitea'], repoDir);
-    run(['fetch', 'origin', PR_HEAD_BRANCH], repoDir, credEnv);
+      run(['config', 'user.name', 'AI Review Bot'], repoDir);
-    run(['checkout', PR_HEAD_BRANCH], repoDir);
 
-    // 將 findings.json 從 workspace 複製到 clone 的 repo
+      const srcFindings = path.join(workspace, FINDINGS_PATH);
-    const srcFindings = path.join(workspace, FINDINGS_PATH);
+      const destFindings = path.join(repoDir, FINDINGS_PATH);
-    const destFindings = path.join(repoDir, FINDINGS_PATH);
+      fs.mkdirSync(path.dirname(destFindings), { recursive: true });
-    fs.mkdirSync(path.dirname(destFindings), { recursive: true });
+      fs.copyFileSync(srcFindings, destFindings);
-    fs.copyFileSync(srcFindings, destFindings);
 
-    run(['add', FINDINGS_PATH], repoDir);
+      run(['add', FINDINGS_PATH], repoDir);
 
-    const status = run(['status', '--porcelain'], repoDir);
+      const status = run(['status', '--porcelain'], repoDir);
-    if (!status) {
+      if (!status) {
-      console.log('  findings.json 無變更，跳過 commit');
+        console.log('  findings.json 無變更，跳過 commit');
-      return;
+        return;
-    }
+      }
 
-    const out = run(['commit', '-m', 'chore: update ai-review findings [skip ci]'], repoDir);
+      const out = run(['commit', '-m', 'chore: update ai-review findings [skip ci]'], repoDir);
-    const commitHash = out.match(/\[.+ ([a-f0-9]+)\]/)?.[1] || 'unknown';
+      const commitHash = out.match(/\[.+ ([a-f0-9]+)\]/)?.[1] || 'unknown';
-    run(['push', remoteUrl, PR_HEAD_BRANCH], repoDir, credEnv);
+      run(['push', remoteUrl, PR_HEAD_BRANCH], repoDir, credEnv);
-    console.log(`  ✅ persisted findings  commit=${commitHash}  push=${PR_HEAD_BRANCH}`);
+      console.log(`  ✅ persisted findings  commit=${commitHash}  push=${PR_HEAD_BRANCH}`);
+    });
   } catch (e) {
     console.log(`  ⚠️  Runner failed: commit/push 失敗: ${e.message}`);
-  } finally {
-    try { fs.unlinkSync(askpassScript); } catch {}
   }
 }

app/gitea.js

@@ -1,14 +1,20 @@
 import axios from 'axios';
 import https from 'https';
-import { GITEA_TOKEN, GITEA_SERVER_URL, GITEA_REPOSITORY, PR_NUMBER } from './config.js';
+import { GITEA_TOKEN, GITEA_SERVER_URL, GITEA_REPOSITORY, GITEA_SKIP_TLS_VERIFY, PR_NUMBER } from './config.js';
 
-const httpsAgent = new https.Agent({ rejectUnauthorized: false });
+const httpsAgent = GITEA_SKIP_TLS_VERIFY ? new https.Agent({ rejectUnauthorized: false }) : undefined;
 const headers = () => ({ Authorization: `token ${GITEA_TOKEN}`, 'Content-Type': 'application/json' });
 const api = (path) => `${GITEA_SERVER_URL.replace(/\/$/, '')}/api/v1${path}`;
 
 export async function getPRDiff() {
   const resp = await axios.get(api(`/repos/${GITEA_REPOSITORY}/pulls/${PR_NUMBER}.diff`), { headers: headers(), timeout: 60000, httpsAgent });
-  return resp.data;
+  return filterDiff(resp.data, ['.gitea/']);
+}
+
+function filterDiff(diff, excludePrefixes) {
+  return diff.split(/(?=^diff --git )/m)
+    .filter(block => !excludePrefixes.some(p => block.startsWith(`diff --git a/${p}`)))
+    .join('');
 }
 
 export async function postComment(body) {

app/gitea.test.js

@@ -0,0 +1,64 @@
+import { describe, it, afterEach, mock } from 'node:test';
+import assert from 'node:assert/strict';
+import axios from 'axios';
+
+// gitea.js reads env vars at module load time (ESM cache), so we test
+// the actual values baked in at import time and verify behavior via axios mocks.
+
+afterEach(() => mock.restoreAll());
+
+describe('gitea', async () => {
+  const { getPRDiff, postComment } = await import('./gitea.js');
+
+  it('getPRDiff calls Gitea diff API with Authorization header', async () => {
+    let capturedUrl, capturedOpts;
+    mock.method(axios, 'get', async (url, opts) => {
+      capturedUrl = url;
+      capturedOpts = opts;
+      return { data: 'diff content' };
+    });
+    const result = await getPRDiff();
+    assert.equal(result, 'diff content');
+    assert.ok(capturedUrl.includes('/api/v1/repos/'));
+    assert.ok(capturedUrl.endsWith('.diff'));
+    assert.ok(capturedOpts.headers['Authorization'].startsWith('token '));
+    assert.equal(capturedOpts.headers['Content-Type'], 'application/json');
+  });
+
+  it('postComment calls Gitea issues comments API with body', async () => {
+    let capturedUrl, capturedBody, capturedOpts;
+    mock.method(axios, 'post', async (url, body, opts) => {
+      capturedUrl = url;
+      capturedBody = body;
+      capturedOpts = opts;
+      return { data: { id: 1 } };
+    });
+    const result = await postComment('hello world');
+    assert.deepEqual(result, { id: 1 });
+    assert.ok(capturedUrl.includes('/api/v1/repos/'));
+    assert.ok(capturedUrl.endsWith('/comments'));
+    assert.equal(capturedBody.body, 'hello world');
+    assert.ok(capturedOpts.headers['Authorization'].startsWith('token '));
+  });
+
+  it('does not set httpsAgent by default (GITEA_SKIP_TLS_VERIFY not true)', async () => {
+    let capturedOpts;
+    mock.method(axios, 'get', async (_url, opts) => {
+      capturedOpts = opts;
+      return { data: '' };
+    });
+    await getPRDiff();
+    // httpsAgent is undefined when GITEA_SKIP_TLS_VERIFY !== 'true'
+    assert.equal(capturedOpts.httpsAgent, undefined);
+  });
+
+  it('getPRDiff propagates axios errors', async () => {
+    mock.method(axios, 'get', async () => { throw new Error('network error'); });
+    await assert.rejects(() => getPRDiff(), /network error/);
+  });
+
+  it('postComment propagates axios errors', async () => {
+    mock.method(axios, 'post', async () => { throw new Error('api error'); });
+    await assert.rejects(() => postComment('test'), /api error/);
+  });
+});

app/llm.js

@@ -10,19 +10,18 @@ export async function chat(systemPrompt, userContent) {
   const headers = { 'Content-Type': 'application/json' };
   if (provider === 'claude') headers['anthropic-version'] = '2023-06-01';
 
-  let lastError;
+  const shuffled = [...apiKeys].sort(() => Math.random() - 0.5);
-  for (let i = 0; i < apiKeys.length; i++) {
+  for (let i = 0; i < shuffled.length; i++) {
-    if (provider !== 'ollama') headers['Authorization'] = `Bearer ${apiKeys[i]}`;
+    if (provider !== 'ollama') headers['Authorization'] = `Bearer ${shuffled[i]}`;
     try {
       const resp = await axios.post(
         `${baseURL.replace(/\/$/, '')}/chat/completions`,
         { model, messages: [{ role: 'system', content: systemPrompt }, { role: 'user', content: userContent }], temperature: 0.2 },
-        { headers, timeout: 30000 }
+        { headers }
       );
       return resp.data.choices[0].message.content;
     } catch (e) {
-      lastError = e;
+      console.log(`  [LLM] key[${i + 1}/${shuffled.length}] 失敗: ${e.message}`);
-      console.log(`  [LLM] key[${i + 1}/${apiKeys.length}] 失敗: ${e.message}`);
     }
   }
   console.error('  [LLM] 所有 API Key 均失敗，終止流程');
@@ -30,12 +29,11 @@ export async function chat(systemPrompt, userContent) {
 }
 
 export async function chatJSON(systemPrompt, userContent) {
+  const text = await chat(systemPrompt, userContent);
   try {
-    let text = await chat(systemPrompt, userContent);
+    return JSON.parse(text.trim().replace(/^```[^\n]*\n?/, '').replace(/```$/, '').trim());
-    text = text.trim().replace(/^```[^\n]*\n?/, '').replace(/```$/, '').trim();
-    return JSON.parse(text);
   } catch (e) {
-    console.log(`  [LLM] 解析失敗: ${e.message}`);
+    console.log(`  [LLM] JSON 解析失敗: ${e.message}`);
     return [];
   }
 }

app/llm.test.js

@@ -48,18 +48,18 @@ describe('chat - key rotation', async () => {
     assert.equal(result, 'hello');
   });
 
-  it('rotates to second key when first fails', async () => {
+  it('shuffles keys and tries each exactly once', async () => {
-    process.env.OPENAI_API_KEY = 'key1,key2';
+    process.env.OPENAI_API_KEY = 'key1,key2,key3';
-    mockAxiosPost([new Error('rate limit'), makeOkResponse('from key2')]);
+    const usedKeys = [];
-    const result = await chat('sys', 'user');
+    mock.method(axios, 'post', async (_url, _body, opts) => {
-    assert.equal(result, 'from key2');
+      usedKeys.push(opts.headers['Authorization'].replace('Bearer ', ''));
-  });
+      throw new Error('fail');
-
+    });
-  it('rotates through all keys and succeeds on last', async () => {
+    const exitMock = mock.method(process, 'exit', () => { throw new Error('exit:1'); });
-    process.env.OPENAI_API_KEY = 'k1,k2,k3';
+    await assert.rejects(() => chat('sys', 'user'), /exit:1/);
-    mockAxiosPost([new Error('fail'), new Error('fail'), makeOkResponse('from k3')]);
+    assert.equal(exitMock.mock.calls[0].arguments[0], 1);
-    const result = await chat('sys', 'user');
+    assert.equal(usedKeys.length, 3);
-    assert.equal(result, 'from k3');
+    assert.deepEqual([...usedKeys].sort(), ['key1', 'key2', 'key3']);
   });
 
   it('calls process.exit(1) when all keys fail', async () => {
@@ -93,7 +93,7 @@ describe('chat - key rotation', async () => {
     assert.equal(capturedHeaders['Authorization'], 'Bearer sk-test');
   });
 
-  it('uses 30s timeout', async () => {
+  it('does not set timeout', async () => {
     process.env.OPENAI_API_KEY = 'sk-test';
     let capturedOpts;
     mock.method(axios, 'post', async (_url, _body, opts) => {
@@ -101,7 +101,7 @@ describe('chat - key rotation', async () => {
       return makeOkResponse();
     });
     await chat('sys', 'user');
-    assert.equal(capturedOpts.timeout, 30000);
+    assert.equal(capturedOpts.timeout, undefined);
   });
 
   it('does not pass httpsAgent to axios', async () => {
@@ -126,3 +126,28 @@ describe('chat - key rotation', async () => {
     assert.equal(capturedHeaders['anthropic-version'], '2023-06-01');
   });
 });
+
+describe('chatJSON', async () => {
+  const { chatJSON } = await import('./llm.js');
+
+  it('parses plain JSON response', async () => {
+    process.env.OPENAI_API_KEY = 'sk-test';
+    mockAxiosPost([makeOkResponse('[{"level":"critical"}]')]);
+    const result = await chatJSON('sys', 'user');
+    assert.deepEqual(result, [{ level: 'critical' }]);
+  });
+
+  it('strips markdown code block before parsing', async () => {
+    process.env.OPENAI_API_KEY = 'sk-test';
+    mockAxiosPost([makeOkResponse('```json\n[{"level":"info"}]\n```')]);
+    const result = await chatJSON('sys', 'user');
+    assert.deepEqual(result, [{ level: 'info' }]);
+  });
+
+  it('returns [] when JSON is invalid', async () => {
+    process.env.OPENAI_API_KEY = 'sk-test';
+    mockAxiosPost([makeOkResponse('not json')]);
+    const result = await chatJSON('sys', 'user');
+    assert.deepEqual(result, []);
+  });
+});

app/main.js

@@ -13,7 +13,6 @@ async function main() {
   console.log(`  repo=${GITEA_REPOSITORY}  PR=#${PR_NUMBER}`);
   console.log(`  ${PR_HEAD_BRANCH} -> ${PR_BASE_BRANCH}`);
 
-  // 偵測 LLM
   const { provider, baseURL, model } = getLLMConfig();
   if (!provider) {
     console.error('❌ 未設定任何 LLM API Key，請檢查 action inputs');
@@ -21,11 +20,9 @@ async function main() {
   }
   console.log(`  LLM: provider=${provider}  model=${model}  base_url=${baseURL}`);
 
-  // 載入角色
   const roles = loadRoles();
   console.log(`  已載入 ${roles.length} 個角色: [${roles.map(r => r.name).join(', ')}]`);
 
-  // 取得 PR diff
   let diff;
   try {
     diff = await getPRDiff();
@@ -40,7 +37,6 @@ async function main() {
     process.exit(0);
   }
 
-  // 發布角色介紹 comment
   try {
     const intro = getRoleIntro(roles) + `\n\n> 🔍 服務：${provider}  模型：${model}`;
     await postComment(intro);
@@ -48,24 +44,22 @@ async function main() {
   } catch (e) {
     console.log(`  ⚠️  comment 發布失敗（繼續執行）: ${e.message}`);
   }
-  console.log('  Step1 完成');
 
   // Step2: 各角色分析 diff 產生新 findings
   console.log('\n📊 Step2: Findings 產生');
+  const results = await Promise.allSettled(roles.map(role => analyzeWithRole(role, diff)));
   const newFindings = [];
-  for (const role of roles) {
+  for (let i = 0; i < results.length; i++) {
-    try {
+    if (results[i].status === 'fulfilled') {
-      const found = await analyzeWithRole(role, diff);
+      newFindings.push(...results[i].value);
-      newFindings.push(...found);
+    } else {
-    } catch (e) {
+      console.log(`  ⚠️  [${roles[i].name}] 分析失敗（跳過）: ${results[i].reason?.message}`);
-      console.log(`  ⚠️  [${role.name}] 分析失敗（跳過）: ${e.message}`);
     }
   }
   console.log(`  Step2 完成: 新 findings 總計 ${newFindings.length} 筆`);
 
   // Step3: 讀取舊 findings，合併去重（含 AI 語意去重）
   console.log('\n🔀 Step3: Findings 合併');
-  // Clone repo 以讀取舊 findings 與排除清單
   let repoDir;
   try {
     repoDir = cloneRepo(WORKSPACE);
@@ -91,7 +85,6 @@ async function main() {
   // Step5: 寫入 findings.json，依序發布 comment
   console.log('\n📝 Step5: Findings 寫入與 Comment 發布');
   saveFindings(WORKSPACE, filtered);
-
   try {
     await postOldFindingsComment(filtered);
     await postNewNonCriticalComment(filtered);
@@ -114,7 +107,6 @@ async function main() {
     process.exit(1);
   }
   console.log('  ✅ 無嚴重問題');
-
   console.log('\n✅ Pipeline 完成');
   console.log('='.repeat(60));
 }

app/package.json

@@ -3,7 +3,7 @@
   "version": "1.0.0",
   "type": "module",
   "scripts": {
-    "test": "node --test git.test.js config.test.js llm.test.js"
+    "test": "node --test *.test.js"
   },
   "dependencies": {
     "axios": "^1.6.7",

app/roles.js

@@ -1,8 +1,9 @@
 import fs from 'fs';
 import path from 'path';
+import { fileURLToPath } from 'url';
 import yaml from 'js-yaml';
 
-const ROLES_DIR = '/action/app/prompts/roles';
+const ROLES_DIR = path.join(fileURLToPath(import.meta.url), '..', 'prompts', 'roles');
 
 export function loadRoles() {
   return fs.readdirSync(ROLES_DIR)