fix: add Leo/Zara false positive exclusion; add cloneRepo unit tests

Reviewed-on: jiantw83/code-review#73

.gitea/ai-review/exclusions.json

@@ -0,0 +1,11 @@
+[
+  {
+    "role": "Rex",
+    "location": "app/git.js",
+    "suggestion": "請避免將敏感資料（如 GITEA_TOKEN）直接寫入環境變數"
+  },
+  {
+    "location": "app/git.js",
+    "suggestion": "GITEA_TOKEN 直接嵌入 URL 中"
+  }
+]

.gitea/ai-review/findings.json

@@ -1,79 +1,100 @@
 [
   {
     "level": "critical",
-    "role": "Rex",
-    "location": "app/config.js:7",
-    "suggestion": "請確保 EXCLUSIONS_PATH 的值不包含敏感資訊，並使用環境變數來管理敏感資料。",
+    "role": "Leo",
+    "location": "app/git.js:14",
+    "suggestion": "GITEA_TOKEN 直接嵌入 URL 中，可能導致憑證洩漏。建議使用環境變數或安全的憑證管理方式來處理敏感資訊。",
+    "is_new": true
+  },
+  {
+    "level": "critical",
+    "role": "Zara",
+    "location": "app/git.js:14",
+    "suggestion": "GITEA_TOKEN 直接嵌入 URL 中，可能導致憑證洩漏。建議使用環境變數或安全的憑證管理方式來處理敏感資訊。",
+    "is_new": true
+  },
+  {
+    "level": "critical",
+    "role": "Maya",
+    "location": "app/git.js:1",
+    "suggestion": "缺少對 cloneRepo 函數的單元測試，應該為其添加測試以確保其正確性。",
+    "is_new": true
+  },
+  {
+    "level": "critical",
+    "role": "Maya",
+    "location": "app/git.js:1",
+    "suggestion": "缺少對 commitAndPush 函數的單元測試，應該為其添加測試以確保其正確性。",
     "is_new": true
   },
   {
     "level": "warning",
+    "role": "Leo",
+    "location": "app/git.js:25",
+    "suggestion": "在使用 fs.existsSync 檢查目錄是否存在時，應考慮使用非同步方法以避免阻塞事件循環。",
+    "is_new": true
+  },
+  {
+    "level": "warning",
+    "role": "Leo",
+    "location": "app/git.js:29",
+    "suggestion": "在 git clone 時使用 --depth=1 可能會導致未來需要完整歷史紀錄時的性能問題，建議根據實際需求調整。",
+    "is_new": true
+  },
+  {
+    "level": "warning",
+    "role": "Maya",
+    "location": "app/findings.js:1",
+    "suggestion": "loadExclusions 函數中對於 JSON 格式的驗證不足，建議增加對於資料結構的檢查，以避免潛在的錯誤。",
+    "is_new": true
+  },
+  {
+    "level": "warning",
+    "role": "Maya",
+    "location": "app/findings.js:1",
+    "suggestion": "applyExclusions 函數中對於 findings 和 exclusions 參數的有效性檢查不足，建議增加檢查以提高程式的健壯性。",
+    "is_new": true
+  },
+  {
+    "level": "info",
+    "role": "Aria",
+    "location": "README.md",
+    "suggestion": "建議在 README 中增加對於新功能（如排除問題過濾）的詳細說明，以便未來的維護者能快速了解其功能.",
+    "is_new": true
+  },
+  {
+    "level": "info",
+    "role": "Rex",
+    "location": "app/findings.js:93",
+    "suggestion": "建議在 loadExclusions 函式中增加對於 JSON 格式的驗證，確保讀取的資料符合預期格式，避免潛在的錯誤。",
+    "is_new": true
+  },
+  {
+    "level": "info",
+    "role": "Rex",
+    "location": "app/findings.js:40",
+    "suggestion": "在 applyExclusions 函式中，建議增加對於 findings 和 exclusions 參數的有效性檢查，以提高程式的健壯性。",
+    "is_new": true
+  },
+  {
+    "level": "info",
+    "role": "Zara",
+    "location": "app/findings.js:93",
+    "suggestion": "建議在 loadExclusions 函式中增加對於 JSON 格式的驗證，確保讀取的資料符合預期格式，避免潛在的錯誤。",
+    "is_new": true
+  },
+  {
+    "level": "info",
     "role": "Zara",
     "location": "app/findings.js:40",
-    "suggestion": "在 applyExclusions 函數中，使用 filter 和 some 方法的組合可能會導致效能問題，特別是當 findings 和 exclusions 的數量很大時。考慮使用更有效的資料結構（如 HashSet）來加速查詢。",
-    "is_new": true
-  },
-  {
-    "level": "warning",
-    "role": "Rex",
-    "location": "app/findings.js:40",
-    "suggestion": "在讀取排除問題檔案時，建議加入對檔案內容的驗證，以防止不正確的格式導致潛在的錯誤或漏洞。",
-    "is_new": true
-  },
-  {
-    "level": "warning",
-    "role": "Aria",
-    "location": "README.md:4",
-    "suggestion": "建議將列表項目從數字改為符號，因為這樣可以更清晰地表示步驟，並避免數字錯位的問題。",
-    "is_new": true
-  },
-  {
-    "level": "info",
-    "role": "Leo",
-    "location": "app/findings.js:1",
-    "suggestion": "建議在檔案開頭添加檔案的功能描述，以提高可讀性。",
-    "is_new": true
-  },
-  {
-    "level": "info",
-    "role": "Leo",
-    "location": "app/findings.js:40",
-    "suggestion": "建議為 loadExclusions 函式添加詳細的文件說明，以便未來的開發者能更快理解其功能。",
-    "is_new": true
-  },
-  {
-    "level": "info",
-    "role": "Leo",
-    "location": "app/findings.js:93",
-    "suggestion": "建議為 deduplicateWithAI 函式添加詳細的文件說明，以便未來的開發者能更快理解其功能。",
-    "is_new": true
-  },
-  {
-    "level": "info",
-    "role": "Aria",
-    "location": "README.md:10",
-    "suggestion": "建議在每個步驟後添加簡短的描述，以提高可讀性和理解性。",
-    "is_new": true
-  },
-  {
-    "level": "info",
-    "role": "Aria",
-    "location": "app/config.js:7",
-    "suggestion": "建議在常數命名中使用全大寫字母和底線分隔，以提高可讀性。",
+    "suggestion": "在 applyExclusions 函式中，建議增加對於 findings 和 exclusions 參數的有效性檢查，以提高程式的健壯性。",
     "is_new": true
   },
   {
     "level": "info",
     "role": "Maya",
-    "location": "app/main.js:42",
-    "suggestion": "建議在每個步驟完成後的 log 中，增加更多上下文資訊，讓使用者更清楚每個步驟的結果。",
-    "is_new": true
-  },
-  {
-    "level": "info",
-    "role": "Maya",
-    "location": "app/main.js:50",
-    "suggestion": "建議在發佈 comment 失敗時，記錄具體的錯誤原因，以便後續調試。",
+    "location": "app/main.js:1",
+    "suggestion": "建議為主要流程中的每個步驟添加詳細的單元測試，以確保整體功能的正確性和穩定性。",
     "is_new": true
   }
 ]

TODO.md

@@ -15,14 +15,14 @@
 - 驗收：log 中能看到 deduplication/resolution confirmation 成功或失敗（如 402），降級時有「保留所有問題」等明確訊息。
 - 完成
 
-## 階段四：排除問題過濾
-- 目標：讀取排除問題檔案，過濾 PR 問題表格中不需要處理的問題。
-- 驗收：log 中能看到排除問題檔案讀取成功或不存在的訊息，以及過濾後 findings 數量變化。
+## 階段四：AI 排除問題過濾
+- 目標：讀取排除問題檔案（exclusions.json）進行規則過濾，並呼叫 AI 判斷剩餘問題是否為誤報或不適用，兩層過濾後產生最終問題清單。
+- 驗收：log 中能看到排除問題檔案讀取成功或不存在的訊息、規則過濾數量變化，以及「AI 誤報過濾: N -> M 筆」或降級訊息。
 - 完成
 
 ## 階段五：findings 寫入與 comment 發布
 - 目標：findings.jsonl 正確寫入，comment 發布順序正確（舊問題→非嚴重→嚴重），每步有 log。
-- 驗收：log 中能看到 findings 寫入、comment sync 的詳細訊息與順序。
+- 驗收：log 中能看到 findings.json 寫入、comment sync 的詳細訊息與順序。
 - 完成
 
 ## 階段六：記憶區 commit/push 與錯誤處理

app/findings.js

@@ -124,9 +124,43 @@ export function applyExclusions(findings, exclusions) {
   const before = findings.length;
   const filtered = findings.filter(f => !exclusions.some(ex =>
     (!ex.role || ex.role === f.role) &&
-    (!ex.location || ex.location === f.location) &&
-    (!ex.suggestion || String(f.suggestion).startsWith(String(ex.suggestion).slice(0, 50)))
+    (!ex.location || String(f.location).includes(ex.location)) &&
+    (!ex.suggestion || String(f.suggestion).includes(String(ex.suggestion).slice(0, 20)))
   ));
   console.log(`  排除過濾: ${before} -> ${filtered.length} 筆（排除 ${before - filtered.length} 筆）`);
   return filtered;
 }
+
+/**
+ * 呼叫 AI 判斷哪些問題是誤報或不需處理，回傳需保留的 findings
+ * 失敗時降級回傳原始 findings
+ */
+export async function filterFalsePositivesWithAI(findings) {
+  if (findings.length === 0) return findings;
+
+  const systemPrompt = `你是一位資深程式碼審查專家，負責判斷審查問題是否為誤報或不需處理。
+給你一份問題清單（JSON 陣列），每筆包含 level、role、location、suggestion。
+請移除以下類型的問題：
+1. 誤報：問題描述與實際程式碼不符（例如：程式碼已正確使用環境變數或 secrets，卻被標記為硬編碼敏感資料）
+2. 不適用：問題在此專案情境下不需處理（例如：CI/CD action 本來就需要透過環境變數傳遞 token）
+只回傳需要保留的問題 JSON 陣列，不要有其他文字。`;
+
+  const userContent = `請判斷以下問題清單，移除誤報或不需處理的問題：\n\n${JSON.stringify(findings, null, 2)}`;
+
+  try {
+    const result = await chatJSON(systemPrompt, userContent);
+    if (Array.isArray(result)) {
+      console.log(`  AI 誤報過濾: ${findings.length} -> ${result.length} 筆`);
+      return result;
+    }
+    throw new Error('AI 回傳非陣列');
+  } catch (e) {
+    const status = e.response?.status;
+    if (status === 402 || status === 429) {
+      console.log(`  ⚠️  AI 誤報過濾失敗（${status} 額度/限流），降級：保留所有問題`);
+    } else {
+      console.log(`  ⚠️  AI 誤報過濾失敗（${e.message}），降級：保留所有問題`);
+    }
+    return findings;
+  }
+}

app/git.js

@@ -14,6 +14,34 @@ function makeRunner(spawn) {
   };
 }
 
+/**
+ * Clone PR head branch to workspace/repo (idempotent)
+ */
+export function cloneRepo(workspace, _spawnSync = spawnSync) {
+  const run = makeRunner(_spawnSync);
+  const baseUrl = GITEA_SERVER_URL.replace(/\/$/, '');
+  const remoteUrl = `${baseUrl}/${GITEA_REPOSITORY}.git`;
+  const repoDir = path.join(workspace, 'repo');
+
+  const askpassScript = path.join(workspace, '.git-askpass.sh');
+  fs.writeFileSync(askpassScript, '#!/bin/sh\necho "$GIT_TOKEN"\n', { mode: 0o700 });
+  const credEnv = { ...process.env, GIT_ASKPASS: askpassScript, GIT_USERNAME: 'x-token', GIT_TOKEN: GITEA_TOKEN };
+
+  try {
+    if (!fs.existsSync(repoDir)) {
+      run(['clone', '--depth=1', '--branch', PR_HEAD_BRANCH, remoteUrl, repoDir], workspace, credEnv);
+      console.log(`  ✅ repo cloned to ${repoDir}`);
+    } else {
+      run(['fetch', 'origin', PR_HEAD_BRANCH], repoDir, credEnv);
+      run(['checkout', PR_HEAD_BRANCH], repoDir);
+      console.log(`  ✅ repo already exists, fetched latest`);
+    }
+  } finally {
+    try { fs.unlinkSync(askpassScript); } catch {}
+  }
+  return repoDir;
+}
+
 export async function commitAndPush(workspace, _spawnSync = spawnSync) {
   const run = makeRunner(_spawnSync);
 

app/git.test.js

@@ -3,7 +3,7 @@ import assert from 'node:assert/strict';
 import fs from 'fs';
 import os from 'os';
 import path from 'path';
-import { commitAndPush } from './git.js';
+import { commitAndPush, cloneRepo } from './git.js';
 
 // --- helpers ---
 function makeTmpWorkspace() {
@@ -91,3 +91,59 @@ describe('commitAndPush', () => {
     await assert.doesNotReject(() => commitAndPush(workspace, failSpawn));
   });
 });
+
+describe('cloneRepo', () => {
+  let workspace;
+
+  before(() => { workspace = fs.mkdtempSync(path.join(os.tmpdir(), 'clone-test-')); });
+  after(() => { fs.rmSync(workspace, { recursive: true, force: true }); });
+
+  it('clones repo when repoDir does not exist', () => {
+    const spawn = makeSpawn();
+    cloneRepo(workspace, spawn);
+    const cloneCalled = spawn.calls.some(c => c.args[0] === 'clone');
+    assert.ok(cloneCalled, 'expected git clone to be called');
+  });
+
+  it('fetches and checks out when repoDir already exists', () => {
+    const repoDir = path.join(workspace, 'repo');
+    fs.mkdirSync(repoDir, { recursive: true });
+    const spawn = makeSpawn();
+    cloneRepo(workspace, spawn);
+    const cloneCalled = spawn.calls.some(c => c.args[0] === 'clone');
+    const fetchCalled = spawn.calls.some(c => c.args[0] === 'fetch');
+    assert.ok(!cloneCalled, 'clone should not run when repoDir exists');
+    assert.ok(fetchCalled, 'fetch should run when repoDir exists');
+  });
+
+  it('does not embed token in any git command argument', () => {
+    const spawn = makeSpawn();
+    cloneRepo(workspace, spawn);
+    for (const { args } of spawn.calls) {
+      assert.ok(!args.join(' ').includes('test-token'), `Token leaked in git args: ${args.join(' ')}`);
+    }
+  });
+
+  it('uses GIT_ASKPASS for network operations', () => {
+    const spawn = makeSpawn();
+    cloneRepo(workspace, spawn);
+    const networkCalls = spawn.calls.filter(c => ['clone', 'fetch'].includes(c.args[0]));
+    assert.ok(networkCalls.length > 0, 'expected at least one network git call');
+    for (const { args, opts } of networkCalls) {
+      assert.ok(opts?.env?.GIT_ASKPASS, `GIT_ASKPASS missing for git ${args[0]}`);
+    }
+  });
+
+  it('cleans up askpass script after run', () => {
+    const spawn = makeSpawn();
+    cloneRepo(workspace, spawn);
+    const leftover = fs.readdirSync(workspace).filter(f => f.endsWith('.git-askpass.sh'));
+    assert.equal(leftover.length, 0, 'askpass script was not cleaned up');
+  });
+
+  it('returns repoDir path', () => {
+    const spawn = makeSpawn();
+    const result = cloneRepo(workspace, spawn);
+    assert.equal(result, path.join(workspace, 'repo'));
+  });
+});

app/main.js

@@ -1,9 +1,9 @@
 import { GITEA_REPOSITORY, PR_NUMBER, PR_HEAD_BRANCH, PR_BASE_BRANCH, getLLMConfig } from './config.js';
 import { loadRoles, getRoleIntro } from './roles.js';
 import { getPRDiff, postComment } from './gitea.js';
-import { analyzeWithRole, loadOldFindings, mergeFindings, sortByLevel, deduplicateWithAI, loadExclusions, applyExclusions } from './findings.js';
+import { analyzeWithRole, loadOldFindings, mergeFindings, sortByLevel, deduplicateWithAI, loadExclusions, applyExclusions, filterFalsePositivesWithAI } from './findings.js';
 import { saveFindings, postOldFindingsComment, postNewNonCriticalComment, postNewCriticalComments } from './comments.js';
-import { commitAndPush } from './git.js';
+import { cloneRepo, commitAndPush } from './git.js';
 
 const WORKSPACE = process.env.GITHUB_WORKSPACE || '/workspace';
 
@@ -65,7 +65,14 @@ async function main() {
 
   // Step3: 讀取舊 findings，合併去重（含 AI 語意去重）
   console.log('\n🔀 Step3: Findings 合併');
-  const oldFindings = loadOldFindings(WORKSPACE);
+  // Clone repo 以讀取舊 findings 與排除清單
+  let repoDir;
+  try {
+    repoDir = cloneRepo(WORKSPACE);
+  } catch (e) {
+    console.log(`  ⚠️  clone repo 失敗（繼續執行）: ${e.message}`);
+  }
+  const oldFindings = loadOldFindings(repoDir || WORKSPACE);
   const mergedFindings = mergeFindings(oldFindings, newFindings);
   console.log(`  Step3 merged findings total=${mergedFindings.length}`);
 
@@ -74,10 +81,11 @@ async function main() {
   const sorted = sortByLevel(deduped);
   console.log(`  Step3b dedup findings total=${sorted.length} (critical=${sorted.filter(f=>f.level==='critical').length} warning=${sorted.filter(f=>f.level==='warning').length} info=${sorted.filter(f=>f.level==='info').length})`);
 
-  // Step4: 讀取排除問題檔案，過濾 PR 問題表格
-  console.log('\n🚫 Step4: 排除問題過濾');
-  const exclusions = loadExclusions(WORKSPACE);
-  const filtered = applyExclusions(sorted, exclusions);
+  // Step4: 讀取排除問題檔案，過濾 PR 問題表格，並請 AI 判斷誤報
+  console.log('\n🚫 Step4: AI 排除問題過濾');
+  const exclusions = loadExclusions(repoDir || WORKSPACE);
+  const ruleFiltered = applyExclusions(sorted, exclusions);
+  const filtered = await filterFalsePositivesWithAI(ruleFiltered);
   console.log(`  Step4 完成: findings total=${filtered.length}`);
 
   // Step5: 寫入 findings.json，依序發布 comment