Merge pull request 'feat: 加入階段四：排除問題過濾' (#73) from feat/refactor/kiro/fix-2 into feat/refactor/kiro/fix-1

Reviewed-on: jiantw83/code-review#73

.gitea/ai-review/exclusions.json

@@ -3,9 +3,5 @@
     "role": "Rex",
     "location": "app/git.js",
     "suggestion": "請避免將敏感資料（如 GITEA_TOKEN）直接寫入環境變數"
-  },
-  {
-    "location": "app/git.js",
-    "suggestion": "GITEA_TOKEN 直接嵌入 URL 中"
   }
 ]

.gitea/ai-review/findings.json

@@ -1 +1,37 @@
-[]
+[
+  {
+    "level": "critical",
+    "role": "Rex",
+    "location": "app/git.js:14",
+    "suggestion": "請避免將 GIT_TOKEN 直接寫入腳本中，應使用安全的秘密管理工具來管理這些敏感資訊.",
+    "is_new": true
+  },
+  {
+    "level": "warning",
+    "role": "Leo",
+    "location": "app/git.js:14",
+    "suggestion": "建議在 cloneRepo 函數中增加對於 GIT_TOKEN 的安全性處理，避免敏感資訊洩漏.",
+    "is_new": true
+  },
+  {
+    "level": "warning",
+    "role": "Leo",
+    "location": "app/findings.js:93",
+    "suggestion": "建議在 loadExclusions 函式中增加對於 JSON 格式的驗證，確保讀取的資料符合預期格式，避免潛在的錯誤.",
+    "is_new": false
+  },
+  {
+    "level": "warning",
+    "role": "Leo",
+    "location": "app/findings.js:40",
+    "suggestion": "在 applyExclusions 函式中，建議增加對於 findings 和 exclusions 參數的有效性檢查，以提高程式的健壯性.",
+    "is_new": false
+  },
+  {
+    "level": "info",
+    "role": "Leo",
+    "location": "README.md",
+    "suggestion": "建議在 README 中增加對於新功能（如排除問題過濾）的詳細說明，以便未來的維護者能快速了解其功能.",
+    "is_new": true
+  }
+]

.gitea/workflows/review.yaml

@@ -33,9 +33,8 @@ jobs:
     - name: AI Code Review
       uses: https://gitea.jsc.idv.tw/jiantw83/code-review@v${{ needs.version.outputs.version }}
       with:
-        GEMINI_API_KEY: ${{ secrets.GEMINI_API_KEY }}
-        GEMINI_BASE_URL: https://generativelanguage.googleapis.com/v1beta
-        GEMINI_MODEL: ${{ vars.GEMINI_MODEL }}
+        OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
+        OPENAI_BASE_URL: https://openrouter.ai/api/v1
     permissions:
       contents: write
       pull-requests: write

README.md

@@ -6,8 +6,8 @@
 
 1. 服務名稱、模型名稱、角色資訊(個性、符合個性的英文名稱、工作內容)，Comment 到 Push Request
 2. 每個角色個別分析 Git Diff 的內容產生新問題表格(問題等級、角色名稱、問題位置或行數、修改建議)
-3. 讀取所有未解決的舊問題(問題檔案 `.gitea/ai-review/findings.json` 存在於使用此 Action 的專案固定位置)加上新問題後，去除重複產生本次 Push Request 的問題表格(PR問題表格)覆蓋問題檔案
-4. 讀取排除問題檔案(`.gitea/ai-review/exclusions.json` 存在於使用此 Action 的專案固定位置)，用來過濾PR問題表格中不需要處理的問題
+3. 讀取所有未解決的舊問題(問題檔案存在於使用此 Action 的專案固定位置)加上新問題後，去除重複產生本次 Push Request 的問題表格(PR問題表格)覆蓋問題檔案
+4. 讀取排除問題檔案，用來過濾PR問題表格中不需要處理的問題
 5. 從PR問題表格中取出所有舊問題，依照等級排序後 Comment 到 Push Request
 6. 從PR問題表格中取出所有新問題，排除嚴重等級的問題後 Comment 到 Push Request
 7. 從PR問題表格中取出所有新問題，將每個嚴重等級的問題 Comment 到 Push Request
@@ -28,7 +28,7 @@
 2. 在 `.gitea/workflows` 資料夾中建立 `ai-review.yaml'
 3. 在 `ai-review.yaml` 中填入以下內容(選擇一個使用)：
 
-### 1. OpenAI
+### 1. OpenAI（OpenRouter）
 ```yaml
 name: AI
 on:
@@ -42,29 +42,9 @@ jobs:
     - name: AI Code Review
       uses: https://gitea.jsc.idv.tw/jiantw83/code-review@${{ vars.ACTION_CODE_REVIEW_VERSION }}
       with:
+        # Github (h3285@evertrust.com.tw)
+        # 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
         OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
-        OPENAI_BASE_URL: https://api.openai.com/v1
-    permissions:
-      contents: write
-      pull-requests: write
-      issues: write
-```
-
-### 2. OpenRouter
-```yaml
-name: AI
-on:
-  pull_request:
-    types: [opened, synchronize]
-jobs:
-  code-review:
-    name: 'Code Review'
-    runs-on: ubuntu
-    steps:
-    - name: AI Code Review
-      uses: https://gitea.jsc.idv.tw/jiantw83/code-review@${{ vars.ACTION_CODE_REVIEW_VERSION }}
-      with:
-        OPENAI_API_KEY: ${{ secrets.OPENROUTER_API_KEY }}
         OPENAI_BASE_URL: https://openrouter.ai/api/v1
     permissions:
       contents: write
@@ -72,7 +52,7 @@ jobs:
       issues: write
 ```
 
-### 3. Anthropic Claude
+### 2. Anthropic Claude
 ```yaml
 name: AI
 on:
@@ -94,7 +74,7 @@ jobs:
       issues: write
 ```
 
-### 4. Google Gemini
+### 3. Google Gemini
 ```yaml
 name: AI
 on:
@@ -110,14 +90,13 @@ jobs:
       with:
         GEMINI_API_KEY: ${{ secrets.GEMINI_API_KEY }}
         GEMINI_BASE_URL: https://generativelanguage.googleapis.com/v1beta
-        GEMINI_MODEL: ${{ vars.GEMINI_MODEL }}
     permissions:
       contents: write
       pull-requests: write
       issues: write
 ```
 
-### 5. Amazon Q
+### 4. Amazon Q
 ```yaml
 name: AI
 on:
@@ -139,7 +118,7 @@ jobs:
       issues: write
 ```
 
-### 6. SonarQube
+### 5. SonarQube
 ```yaml
 name: AI
 on:

TODO.md

@@ -16,13 +16,13 @@
 - 完成
 
 ## 階段四：AI 排除問題過濾
-- 目標：讀取排除問題檔案（`.gitea/ai-review/exclusions.json`）進行規則過濾，並呼叫 AI 判斷剩餘問題是否為誤報或不適用，兩層過濾後產生最終問題清單。
+- 目標：讀取排除問題檔案（exclusions.json）進行規則過濾，並呼叫 AI 判斷剩餘問題是否為誤報或不適用，兩層過濾後產生最終問題清單。
 - 驗收：log 中能看到排除問題檔案讀取成功或不存在的訊息、規則過濾數量變化，以及「AI 誤報過濾: N -> M 筆」或降級訊息。
 - 完成
 
 ## 階段五：findings 寫入與 comment 發布
-- 目標：`.gitea/ai-review/findings.json` 正確寫入，comment 發布順序正確（舊問題→非嚴重→嚴重），每步有 log。
-- 驗收：log 中能看到 `.gitea/ai-review/findings.json` 寫入、comment sync 的詳細訊息與順序。
+- 目標：findings.jsonl 正確寫入，comment 發布順序正確（舊問題→非嚴重→嚴重），每步有 log。
+- 驗收：log 中能看到 findings.json 寫入、comment sync 的詳細訊息與順序。
 - 完成
 
 ## 階段六：記憶區 commit/push 與錯誤處理

app/config.js

@@ -12,7 +12,7 @@ export function getLLMConfig() {
   const checks = [
     ['openai',   process.env.OPENAI_API_KEY,   process.env.OPENAI_BASE_URL || 'https://api.openai.com/v1',   process.env.OPENAI_MODEL || 'gpt-4o-mini'],
     ['claude',   process.env.CLAUDE_API_KEY,   process.env.CLAUDE_BASE_URL || 'https://api.anthropic.com/v1', process.env.CLAUDE_MODEL || 'claude-3-haiku-20240307'],
-    ['gemini',   process.env.GEMINI_API_KEY,   process.env.GEMINI_BASE_URL || 'https://generativelanguage.googleapis.com/v1beta', process.env.GEMINI_MODEL || 'gemini-2.5-flash'],
+    ['gemini',   process.env.GEMINI_API_KEY,   process.env.GEMINI_BASE_URL || 'https://generativelanguage.googleapis.com/v1beta', process.env.GEMINI_MODEL || 'gemini-1.5-flash'],
     ['ollama',   'ollama',                      process.env.OLLAMA_BASE_URL,  process.env.OLLAMA_MODEL],
     ['amazonq',  process.env.AMAZONQ_API_KEY,  process.env.AMAZONQ_BASE_URL || 'https://q.api.aws', process.env.OPENAI_MODEL || 'amazon-q'],
     ['kilo',     process.env.KILO_API_KEY,     process.env.KILO_BASE_URL || 'https://api.kilocode.com/v1', process.env.OPENAI_MODEL || 'kilo-default'],

app/git.test.js

@@ -3,7 +3,7 @@ import assert from 'node:assert/strict';
 import fs from 'fs';
 import os from 'os';
 import path from 'path';
-import { commitAndPush, cloneRepo } from './git.js';
+import { commitAndPush } from './git.js';
 
 // --- helpers ---
 function makeTmpWorkspace() {
@@ -91,59 +91,3 @@ describe('commitAndPush', () => {
     await assert.doesNotReject(() => commitAndPush(workspace, failSpawn));
   });
 });
-
-describe('cloneRepo', () => {
-  let workspace;
-
-  before(() => { workspace = fs.mkdtempSync(path.join(os.tmpdir(), 'clone-test-')); });
-  after(() => { fs.rmSync(workspace, { recursive: true, force: true }); });
-
-  it('clones repo when repoDir does not exist', () => {
-    const spawn = makeSpawn();
-    cloneRepo(workspace, spawn);
-    const cloneCalled = spawn.calls.some(c => c.args[0] === 'clone');
-    assert.ok(cloneCalled, 'expected git clone to be called');
-  });
-
-  it('fetches and checks out when repoDir already exists', () => {
-    const repoDir = path.join(workspace, 'repo');
-    fs.mkdirSync(repoDir, { recursive: true });
-    const spawn = makeSpawn();
-    cloneRepo(workspace, spawn);
-    const cloneCalled = spawn.calls.some(c => c.args[0] === 'clone');
-    const fetchCalled = spawn.calls.some(c => c.args[0] === 'fetch');
-    assert.ok(!cloneCalled, 'clone should not run when repoDir exists');
-    assert.ok(fetchCalled, 'fetch should run when repoDir exists');
-  });
-
-  it('does not embed token in any git command argument', () => {
-    const spawn = makeSpawn();
-    cloneRepo(workspace, spawn);
-    for (const { args } of spawn.calls) {
-      assert.ok(!args.join(' ').includes('test-token'), `Token leaked in git args: ${args.join(' ')}`);
-    }
-  });
-
-  it('uses GIT_ASKPASS for network operations', () => {
-    const spawn = makeSpawn();
-    cloneRepo(workspace, spawn);
-    const networkCalls = spawn.calls.filter(c => ['clone', 'fetch'].includes(c.args[0]));
-    assert.ok(networkCalls.length > 0, 'expected at least one network git call');
-    for (const { args, opts } of networkCalls) {
-      assert.ok(opts?.env?.GIT_ASKPASS, `GIT_ASKPASS missing for git ${args[0]}`);
-    }
-  });
-
-  it('cleans up askpass script after run', () => {
-    const spawn = makeSpawn();
-    cloneRepo(workspace, spawn);
-    const leftover = fs.readdirSync(workspace).filter(f => f.endsWith('.git-askpass.sh'));
-    assert.equal(leftover.length, 0, 'askpass script was not cleaned up');
-  });
-
-  it('returns repoDir path', () => {
-    const spawn = makeSpawn();
-    const result = cloneRepo(workspace, spawn);
-    assert.equal(result, path.join(workspace, 'repo'));
-  });
-});

app/roles.js

@@ -12,13 +12,9 @@ export function loadRoles() {
 }
 
 export function getRoleIntro(roles) {
-  const lines = [
-    '## 🤖 AI Code Review 團隊', '',
-    '| 👤 名稱 | 🎯 職責 | 🧠 個性 |',
-    '|--------|--------|--------|',
-  ];
+  const lines = ['## 🤖 AI Code Review 團隊', ''];
   for (const r of roles) {
-    lines.push(`| **${r.name}** | ${r.role} | ${r.personality} |`);
+    lines.push(`- **${r.name}** (${r.role})：${r.personality}`);
   }
   return lines.join('\n');
 }