fix: git.js 改用 spawnSync 直接呼叫 git binary（避免 /bin/sh ENOENT）

app/comments.js

@@ -0,0 +1,70 @@
+import fs from 'fs';
+import path from 'path';
+import { postComment } from './gitea.js';
+import { FINDINGS_PATH } from './config.js';
+
+const LEVEL_EMOJI = { critical: '🔴', warning: '🟡', info: '🔵' };
+const LEVEL_LABEL = { critical: '嚴重', warning: '警告', info: '建議' };
+
+function findingRow(f) {
+  return `| ${LEVEL_EMOJI[f.level] || ''} ${LEVEL_LABEL[f.level] || f.level} | ${f.role} | ${f.location} | ${f.suggestion} |`;
+}
+
+function buildTable(findings) {
+  const rows = findings.map(findingRow).join('\n');
+  return `| 等級 | 審查員 | 位置 | 建議 |\n|------|--------|------|------|\n${rows}`;
+}
+
+/**
+ * 寫入 findings.json 到 workspace
+ */
+export function saveFindings(workspace, findings) {
+  const fullPath = path.join(workspace, FINDINGS_PATH);
+  fs.mkdirSync(path.dirname(fullPath), { recursive: true });
+  fs.writeFileSync(fullPath, JSON.stringify(findings, null, 2), 'utf8');
+  console.log(`  ✅ findings 寫入: ${fullPath} (${findings.length} 筆)`);
+}
+
+/**
+ * 發布所有舊問題 comment（一次發布，依等級排序）
+ */
+export async function postOldFindingsComment(findings) {
+  const old = findings.filter(f => !f.is_new);
+  if (old.length === 0) {
+    console.log('  無舊問題，跳過');
+    return;
+  }
+  const body = `## 📋 舊有未解決問題（${old.length} 筆）\n\n${buildTable(old)}`;
+  await postComment(body);
+  console.log(`  ✅ 舊問題 comment 發布 (${old.length} 筆)`);
+}
+
+/**
+ * 發布新問題中非 critical 的 comment（一次發布）
+ */
+export async function postNewNonCriticalComment(findings) {
+  const items = findings.filter(f => f.is_new && f.level !== 'critical');
+  if (items.length === 0) {
+    console.log('  無新的非嚴重問題，跳過');
+    return;
+  }
+  const body = `## 🔍 新發現問題（${items.length} 筆）\n\n${buildTable(items)}`;
+  await postComment(body);
+  console.log(`  ✅ 新問題（非嚴重）comment 發布 (${items.length} 筆)`);
+}
+
+/**
+ * 每個新 critical 問題各發一個 comment
+ */
+export async function postNewCriticalComments(findings) {
+  const criticals = findings.filter(f => f.is_new && f.level === 'critical');
+  if (criticals.length === 0) {
+    console.log('  無新的嚴重問題，跳過');
+    return;
+  }
+  for (const f of criticals) {
+    const body = `## 🚨 嚴重問題\n\n| 審查員 | 位置 | 建議 |\n|--------|------|------|\n| ${f.role} | ${f.location} | ${f.suggestion} |`;
+    await postComment(body);
+    console.log(`  ✅ 嚴重問題 comment 發布: [${f.role}] ${f.location}`);
+  }
+}

app/git.js

@@ -0,0 +1,38 @@
+import { spawnSync } from 'child_process';
+import { GITEA_SERVER_URL, GITEA_REPOSITORY, GITEA_TOKEN, PR_HEAD_BRANCH, FINDINGS_PATH } from './config.js';
+
+function git(args, cwd) {
+  const result = spawnSync('git', args, { cwd, encoding: 'utf8' });
+  if (result.error) throw result.error;
+  if (result.status !== 0) throw new Error(result.stderr || result.stdout);
+  return (result.stdout || '').trim();
+}
+
+/**
+ * Commit findings.json 並 push 到 PR 來源分支
+ */
+export function commitAndPush(workspace) {
+  const repoDir = `${workspace}/${GITEA_REPOSITORY}`;
+  const remoteUrl = GITEA_SERVER_URL.replace(/\/$/, '').replace('https://', `https://${GITEA_TOKEN}@`) + `/${GITEA_REPOSITORY}.git`;
+
+  try {
+    git(['config', 'user.email', 'ai-review[bot]@gitea'], repoDir);
+    git(['config', 'user.name', 'AI Review Bot'], repoDir);
+    git(['fetch', 'origin', PR_HEAD_BRANCH], repoDir);
+    git(['checkout', PR_HEAD_BRANCH], repoDir);
+    git(['add', FINDINGS_PATH], repoDir);
+
+    const status = git(['status', '--porcelain'], repoDir);
+    if (!status) {
+      console.log('  findings.json 無變更，跳過 commit');
+      return;
+    }
+
+    const out = git(['commit', '-m', 'chore: update ai-review findings [skip ci]'], repoDir);
+    const commitHash = out.match(/\[.+ ([a-f0-9]+)\]/)?.[1] || 'unknown';
+    git(['push', remoteUrl, PR_HEAD_BRANCH], repoDir);
+    console.log(`  ✅ persisted findings  commit=${commitHash}  push=${PR_HEAD_BRANCH}`);
+  } catch (e) {
+    console.log(`  ⚠️  Runner failed: commit/push 失敗: ${e.message}`);
+  }
+}

app/main.js

@@ -2,6 +2,8 @@ import { GITEA_REPOSITORY, PR_NUMBER, PR_HEAD_BRANCH, PR_BASE_BRANCH, getLLMConf
 import { loadRoles, getRoleIntro } from './roles.js';
 import { getPRDiff, postComment } from './gitea.js';
 import { analyzeWithRole, loadOldFindings, mergeFindings, sortByLevel, deduplicateWithAI } from './findings.js';
+import { saveFindings, postOldFindingsComment, postNewNonCriticalComment, postNewCriticalComments } from './comments.js';
+import { commitAndPush } from './git.js';
 
 const WORKSPACE = process.env.GITHUB_WORKSPACE || '/workspace';
 
@@ -74,14 +76,32 @@ async function main() {
   const sorted = sortByLevel(deduped);
   console.log(`  Step3b dedup findings total=${sorted.length} (critical=${sorted.filter(f=>f.level==='critical').length} warning=${sorted.filter(f=>f.level==='warning').length} info=${sorted.filter(f=>f.level==='info').length})`);
 
-  console.log('\n📝 Step4: Findings 寫入與 Comment 發布（待實作）');
-  console.log('  [stub] 寫入 findings.json，發布 comment...');
+  // Step4: 寫入 findings.json，依序發布 comment
+  console.log('\n📝 Step4: Findings 寫入與 Comment 發布');
+  saveFindings(WORKSPACE, sorted);
 
-  console.log('\n💾 Step5: 記憶區 Commit/Push（待實作）');
-  console.log('  [stub] commit & push findings.json...');
+  try {
+    await postOldFindingsComment(sorted);
+    await postNewNonCriticalComment(sorted);
+    await postNewCriticalComments(sorted);
+    console.log('  Step4 完成');
+  } catch (e) {
+    console.log(`  ⚠️  comment 發布失敗（繼續執行）: ${e.message}`);
+  }
 
-  console.log('\n🚦 Step6: 嚴重問題檢查（待實作）');
-  console.log('  [stub] 檢查 critical findings...');
+  // Step5: commit/push findings.json 到來源分支
+  console.log('\n💾 Step5: 記憶區 Commit/Push');
+  commitAndPush(WORKSPACE);
+
+  // Step6: 有 critical 問題則 exit 1
+  console.log('\n🚦 Step6: 嚴重問題檢查');
+  const criticalCount = sorted.filter(f => f.level === 'critical').length;
+  if (criticalCount > 0) {
+    console.log(`  ❌ 發現 ${criticalCount} 個嚴重問題，workflow 結束（exit 1）`);
+    console.log('='.repeat(60));
+    process.exit(1);
+  }
+  console.log('  ✅ 無嚴重問題');
 
   console.log('\n✅ Pipeline 完成');
   console.log('='.repeat(60));