feat: refactor commitAndPush to use GIT_ASKPASS for authentication and add tests

Reviewed-on: jiantw83/code-review#66

.gitea/ai-review/findings.json

@@ -1,7 +1,7 @@
 [
   {
     "level": "critical",
-    "role": "Rex",
+    "role": "Leo",
     "location": "app/git.js:11",
     "suggestion": "GITEA_TOKEN 直接嵌入 URL 中，可能導致憑證洩漏。建議使用環境變數或安全的憑證管理方式來處理敏感資訊。",
     "is_new": true
@@ -16,41 +16,27 @@
   {
     "level": "warning",
     "role": "Leo",
-    "location": "app/git.js:11",
-    "suggestion": "建議將 git 函式的實作細節封裝到一個獨立的模組中，以提高模組化和可重用性。",
-    "is_new": true
-  },
-  {
-    "level": "warning",
-    "role": "Leo",
-    "location": "app/git.js:41",
-    "suggestion": "建議在 try-catch 區塊中增加更詳細的錯誤處理，以便於未來的除錯和維護。",
-    "is_new": true
-  },
-  {
-    "level": "warning",
-    "role": "Zara",
     "location": "app/git.js:25",
     "suggestion": "在使用 fs.existsSync 檢查目錄是否存在時，應考慮使用非同步方法以避免阻塞事件循環。",
     "is_new": true
   },
   {
     "level": "warning",
-    "role": "Zara",
+    "role": "Leo",
     "location": "app/git.js:29",
     "suggestion": "在 git clone 時使用 --depth=1 可能會導致未來需要完整歷史紀錄時的性能問題，建議根據實際需求調整。",
     "is_new": true
   },
   {
     "level": "warning",
-    "role": "Rex",
+    "role": "Leo",
     "location": "app/git.js:11",
     "suggestion": "在使用 fs.copyFileSync 時，未檢查目標檔案是否存在，可能會覆蓋重要資料。建議在複製之前檢查檔案是否存在。",
     "is_new": true
   },
   {
     "level": "warning",
-    "role": "Maya",
+    "role": "Leo",
     "location": "app/git.js:11",
     "suggestion": "在 commitAndPush 函數中，對於 git 操作的錯誤處理不夠完善，應該添加更多的測試來驗證不同情況下的行為。",
     "is_new": true
@@ -58,57 +44,15 @@
   {
     "level": "info",
     "role": "Leo",
-    "location": "app/git.js:5",
-    "suggestion": "建議為函式添加 JSDoc 註解，以提高文件完整性和可讀性。",
+    "location": ".gitea/workflows/review.yaml:5",
+    "suggestion": "建議在 'branches-ignore' 前加上空行，以提高可讀性。",
     "is_new": true
   },
   {
     "level": "info",
     "role": "Leo",
-    "location": "app/git.js:10",
-    "suggestion": "建議將常數如 'repo' 提取為變數，以提高可讀性和可維護性。",
-    "is_new": true
-  },
-  {
-    "level": "info",
-    "role": "Zara",
     "location": "app/git.js:45",
     "suggestion": "考慮使用 async/await 來處理 fs.copyFileSync，以提高可讀性和錯誤處理能力。",
     "is_new": true
-  },
-  {
-    "level": "info",
-    "role": "Aria",
-    "location": "app/git.js:12",
-    "suggestion": "考慮將常量 GITEA_SERVER_URL、GITEA_REPOSITORY、GITEA_TOKEN、PR_HEAD_BRANCH 和 FINDINGS_PATH 的引入放在一起，以保持一致性。",
-    "is_new": true
-  },
-  {
-    "level": "info",
-    "role": "Aria",
-    "location": "app/git.js:41",
-    "suggestion": "在 console.log 的訊息中，考慮使用更具描述性的文字來提高可讀性。",
-    "is_new": true
-  },
-  {
-    "level": "info",
-    "role": "Aria",
-    "location": "app/git.js:43",
-    "suggestion": "考慮將錯誤處理的 console.log 訊息翻譯成英文，以保持一致性。",
-    "is_new": true
-  },
-  {
-    "level": "info",
-    "role": "Maya",
-    "location": "app/git.js:11",
-    "suggestion": "建議為 git 函數添加測試，以確保其在不同參數下的行為正確。",
-    "is_new": true
-  },
-  {
-    "level": "info",
-    "role": "Maya",
-    "location": "app/git.js:11",
-    "suggestion": "建議對 repoDir 的存在性檢查進行單元測試，以確保在不存在時能正確執行 clone 操作。",
-    "is_new": true
   }
 ]

.gitea/workflows/review.yaml

@@ -1,4 +1,7 @@
 name: AI
+concurrency:
+  group: ${{ github.workflow }}-${{ github.head_ref }}
+  cancel-in-progress: true
 on:
   pull_request:
     branches-ignore:

app/git.js

@@ -1,7 +1,7 @@
 import { spawnSync } from 'child_process';
 import fs from 'fs';
 import path from 'path';
-import { GITEA_SERVER_URL, GITEA_REPOSITORY, GITEA_TOKEN, PR_HEAD_BRANCH, FINDINGS_PATH } from './config.js';
+import { GITEA_SERVER_URL, GITEA_REPOSITORY, PR_HEAD_BRANCH, FINDINGS_PATH } from './config.js';
 
 function git(args, cwd) {
   const result = spawnSync('git', args, { cwd, encoding: 'utf8' });
@@ -11,21 +11,36 @@ function git(args, cwd) {
 }
 
 export async function commitAndPush(workspace) {
-  const remoteUrl = GITEA_SERVER_URL.replace(/\/$/, '')
-    .replace('https://', `https://${GITEA_TOKEN}@`)
-    .replace('http://', `http://${GITEA_TOKEN}@`) + `/${GITEA_REPOSITORY}.git`;
+  const remoteUrl = GITEA_SERVER_URL.replace(/\/$/, '') + `/${GITEA_REPOSITORY}.git`;
 
   const repoDir = path.join(workspace, 'repo');
 
   try {
     if (!fs.existsSync(repoDir)) {
-      git(['clone', '--depth=1', '--branch', PR_HEAD_BRANCH, remoteUrl, repoDir], workspace);
+      // Use GIT_ASKPASS to provide token for authentication
+      gitWithToken(['clone', '--depth=1', '--branch', PR_HEAD_BRANCH, remoteUrl, repoDir], workspace);
     }
 
     git(['config', 'user.email', 'ai-review[bot]@gitea'], repoDir);
     git(['config', 'user.name', 'AI Review Bot'], repoDir);
     git(['fetch', 'origin', PR_HEAD_BRANCH], repoDir);
     git(['checkout', PR_HEAD_BRANCH], repoDir);
+// Helper to run git with GITEA_TOKEN via GIT_ASKPASS
+import { GITEA_TOKEN } from './config.js';
+function gitWithToken(args, cwd) {
+  const askPassScript = `#!/bin/sh\necho \"${GITEA_TOKEN}\"`;
+  const askPassPath = path.join(cwd, 'git-askpass.sh');
+  fs.writeFileSync(askPassPath, askPassScript, { mode: 0o700 });
+  const result = spawnSync('git', args, {
+    cwd,
+    encoding: 'utf8',
+    env: { ...process.env, GIT_ASKPASS: askPassPath },
+  });
+  fs.unlinkSync(askPassPath);
+  if (result.error) throw result.error;
+  if (result.status !== 0) throw new Error((result.stderr || result.stdout || '').trim());
+  return (result.stdout || '').trim();
+}
 
     // 將 findings.json 從 workspace 複製到 clone 的 repo
     const srcFindings = path.join(workspace, FINDINGS_PATH);

app/git.test.js

@@ -0,0 +1,30 @@
+import { commitAndPush } from './git.js';
+import fs from 'fs';
+import path from 'path';
+
+// Mock dependencies and environment
+jest.mock('fs');
+jest.mock('child_process', () => ({
+  spawnSync: jest.fn(() => ({ status: 0, stdout: '', stderr: '' }))
+}));
+
+describe('commitAndPush', () => {
+  const workspace = '/tmp/workspace';
+  const repoDir = path.join(workspace, 'repo');
+
+  beforeEach(() => {
+    jest.clearAllMocks();
+    fs.existsSync.mockReturnValue(false);
+    fs.writeFileSync.mockImplementation(() => {});
+    fs.unlinkSync.mockImplementation(() => {});
+  });
+
+  it('should clone repo and configure git', async () => {
+    await expect(commitAndPush(workspace)).resolves.not.toThrow();
+  });
+
+  it('should not clone if repo exists', async () => {
+    fs.existsSync.mockReturnValue(true);
+    await expect(commitAndPush(workspace)).resolves.not.toThrow();
+  });
+});