chore: add exclusions for Rex false positive on git.js token handling

docs: mark all TODO stages complete
fix: align flow with README, add Step4 exclusions filter, fix step numbers
2026-05-12 01:48:00 +00:00 · 2026-05-12 01:47:52 +00:00 · 2026-05-12 01:47:43 +00:00 · 2026-05-12 01:47:43 +00:00 · 2026-05-12 01:47:43 +00:00 · 2026-05-12 01:47:43 +00:00
13 changed files with 160 additions and 441 deletions
@@ -3,41 +3,5 @@
    "role": "Rex",
    "location": "app/git.js",
    "suggestion": "請避免將敏感資料（如 GITEA_TOKEN）直接寫入環境變數"
-  },
-  {
-    "location": "app/git.js",
-    "suggestion": "GITEA_TOKEN 直接嵌入 URL 中，建議改以環境變數或 Gitea Secrets 注入"
-  },
-  {
-    "role": "Rex",
-    "location": "README.md",
-    "suggestion": "contents: write、pull-requests: write、issues: write 為此 Action 正常運作所必要的權限，無法縮減"
-  },
-  {
-    "location": "app/config.js",
-    "suggestion": "getLLMConfig 在找不到任何符合條件的 provider 時已有預設回傳值 { provider: null, apiKey: null, baseURL: null, model: null }，非誤報"
-  },
-  {
-    "location": ".gitea/ai-review/exclusions.json",
-    "suggestion": "exclusions.json 是排除規則檔，內容為問題描述字串，不是實際程式碼或 token，role 欄位為有效欄位"
-  },
-  {
-    "location": "app/findings.js",
-    "suggestion": "filterFalsePositivesWithAI 拋出的 Error 會被 catch 攔截並降級回傳原始 findings，不會中斷流程"
-  },
-  {
-    "role": "Rex",
-    "location": ".gitea/workflows/review.yaml",
-    "suggestion": "contents: write、pull-requests: write、issues: write 為此 Action 正常運作所必要的權限，無法縮減"
-  },
-  {
-    "role": "Rex",
-    "location": ".gitea/workflows/review.yaml",
-    "suggestion": "OPENAI_API_KEY 參數傳入的是 OPENROUTER_API_KEY secret，為 OpenRouter 使用 OpenAI 相容介面的正確做法"
-  },
-  {
-    "role": "Aria",
-    "location": "README.md",
-    "suggestion": "章節編號連續且正確，無需調整"
  }
 ]
@@ -1,128 +1,58 @@
 [
  {
-    "level": "warning",
+    "level": "critical",
    "role": "Rex",
-    "location": ".gitea/workflows/review.yaml:33",
-    "suggestion": "工作流程目前授予 contents、pull‑requests、issues 三項 write 權限，過於寬鬆。建議依實際需求僅授予 read 或最小必要的 write 權限，以降低被濫用的風險。",
-    "is_new": false
+    "location": "app/git.js:12",
+    "suggestion": "請避免將敏感資料（如 GITEA_TOKEN）直接寫入環境變數，應使用安全的秘密管理工具來管理這些敏感資訊。",
+    "is_new": true
  },
  {
    "level": "warning",
-    "role": "Rex",
-    "location": ".gitea/workflows/review.yaml:35",
-    "suggestion": "將 OPENAI_API_KEY 參數改為使用正確的 secret 名稱（如 OPENROUTER_API_KEY）時，請確保工作流程文件中不會同時暴露兩個不同的 secret 名稱，以免因名稱錯誤導致金鑰未傳入或意外洩漏。",
-    "is_new": false
-  },
-  {
-    "level": "warning",
-    "role": "Aria",
-    "location": ".gitea/workflows/review.yaml:33",
-    "suggestion": "在 `OPENAI_API_KEY` 後的註解前應保留一個空格，以符合常見的 YAML 註解風格：`... ${{ secrets.OPENROUTER_API_KEY }}  # OpenRouter 使用 OpenAI 相容介面，以 OPENAI_API_KEY 傳入`。",
-    "is_new": false
-  },
-  {
-    "level": "warning",
-    "role": "Aria",
-    "location": "README.md",
-    "suggestion": "文件中章節編號不連續（例如 `### 2. OpenRouter` 後直接跳到 `### 3. Anthropic Claude`），建議重新編號或使用一致的標題層級，以提升可讀性與維護性。",
-    "is_new": false
-  },
-  {
-    "level": "warning",
-    "role": "Rex",
-    "location": ".gitea/workflows/review.yaml:33-35",
-    "suggestion": "工作流程目前授予 contents、pull‑requests、issues 三項 write 權限過於寬鬆。建議依實際需求僅授予 read 或最小必要的 write 權限，降低被濫用的風險。",
-    "is_new": false
-  },
-  {
-    "level": "warning",
-    "role": "Rex",
-    "location": ".gitea/workflows/review.yaml:33",
-    "suggestion": "將 OPENAI_API_KEY 參數改為使用正確的 secret 名稱（如 OPENROUTER_API_KEY）時，請確保工作流程檔案中不會同時暴露兩個不同的 secret 名稱，以免因名稱錯誤導致金鑰未傳入或意外洩漏。",
-    "is_new": false
-  },
-  {
-    "level": "warning",
-    "role": "Aria",
-    "location": ".gitea/ai-review/findings.json",
-    "suggestion": "檔案最後缺少換行符號，請在檔案結尾加入一個空白換行。",
-    "is_new": false
-  },
-  {
-    "level": "warning",
-    "role": "Aria",
-    "location": "app/config.test.js",
-    "suggestion": "檔案最後缺少換行符號，請在檔案結尾加入空白換行。",
-    "is_new": false
-  },
-  {
-    "level": "warning",
-    "role": "Aria",
-    "location": "README.md:28",
-    "suggestion": "文件中章節編號不連續（例如 `### 2. OpenRouter` 後直接跳到 `### 3. Anthropic Claude`），請重新編號或使用自動編號方式，保持編號連續。",
-    "is_new": false
-  },
-  {
-    "level": "warning",
-    "role": "Aria",
-    "location": "README.md:42",
-    "suggestion": "標題層級使用不一致，部分章節使用 `### 1.`、`### 2.`，而後面的章節直接跳到 `### 3.`，建議統一使用相同層級的 Markdown 標題，並在每個標題後留一個空行以提升可讀性。",
-    "is_new": false
-  },
-  {
-    "level": "warning",
-    "role": "Aria",
-    "location": "action.yaml:72-99",
-    "suggestion": "大量移除的輸入欄位留下多行空白與註解，請整理檔案結構，移除不必要的空行與註解，保持檔案整潔。",
-    "is_new": false
-  },
-  {
-    "level": "info",
-    "role": "Aria",
-    "location": "app/config.test.js",
-    "suggestion": "匯入語句過長，建議改寫為多行匯入，例如：\n```js\nimport {\n  describe,\n  it,\n  beforeEach,\n  afterEach\n} from 'node:test';\n```",
-    "is_new": false
-  },
-  {
-    "level": "info",
-    "role": "Aria",
-    "location": "app/config.test.js",
-    "suggestion": "`ENV_KEYS` 陣列過長，建議分行列舉，每行放置一個環境變數，以提升可讀性。",
-    "is_new": false
-  },
-  {
-    "level": "info",
    "role": "Leo",
-    "location": "app/config.test.js:1",
-    "suggestion": "匯入語句過長，建議改寫為多行匯入，以提升可讀性，例如：\n```js\nimport {\n  describe,\n  it,\n  beforeEach,\n  afterEach\n} from 'node:test';\n```",
-    "is_new": false
+    "location": "app/git.js:21",
+    "suggestion": "建議在函式開頭添加文件註解，說明函式的用途、參數及回傳值，以增強可讀性和可維護性。",
+    "is_new": true
  },
  {
-    "level": "info",
+    "level": "warning",
    "role": "Leo",
-    "location": "app/config.test.js:9",
-    "suggestion": "`ENV_KEYS` 陣列過長，建議分行列舉，每行放置一個環境變數，以提升可讀性與維護性。",
-    "is_new": false
+    "location": "app/git.js:21",
+    "suggestion": "建議將硬編碼的 'x-token' 和 'GIT_TOKEN' 提取為常數，並在程式碼中使用這些常數，以提高可維護性。",
+    "is_new": true
+  },
+  {
+    "level": "warning",
+    "role": "Aria",
+    "location": "app/git.js:12",
+    "suggestion": "建議將註解中的「that reads the token from an env var」改為「從環境變數讀取令牌」，以提高可讀性。",
+    "is_new": true
+  },
+  {
+    "level": "warning",
+    "role": "Aria",
+    "location": "app/git.js:14",
+    "suggestion": "建議將註解中的「the token value never appears in the script file itself」改為「令牌值不會出現在腳本文件中」，以提高可讀性。",
+    "is_new": true
+  },
+  {
+    "level": "warning",
+    "role": "Maya",
+    "location": "app/git.js:21",
+    "suggestion": "應該為 commitAndPush 函數撰寫單元測試，以確保其功能正確性和邊界條件處理。",
+    "is_new": true
  },
  {
    "level": "info",
    "role": "Aria",
-    "location": "app/config.test.js:1",
-    "suggestion": "匯入語句過長，建議改寫為多行匯入，例如：\n```js\nimport {\n  describe,\n  it,\n  beforeEach,\n  afterEach\n} from 'node:test';\n```",
-    "is_new": false
+    "location": "app/git.js:15",
+    "suggestion": "考慮將 GIT_TOKEN 的命名改為 GITEA_TOKEN，以保持一致性。",
+    "is_new": true
  },
  {
    "level": "info",
-    "role": "Aria",
-    "location": "app/config.test.js:7",
-    "suggestion": "`ENV_KEYS` 陣列過長，建議每行放置一個環境變數，分行列舉以提升可讀性。",
-    "is_new": false
-  },
-  {
-    "level": "info",
-    "role": "Aria",
-    "location": ".gitea/workflows/review.yaml:33",
-    "suggestion": "在 `OPENAI_API_KEY` 後的註解前保留一個空格，以符合常見的 YAML 註解風格：`... ${{ secrets.OPENROUTER_API_KEY }}  # OpenRouter 使用 OpenAI 相容介面，以 OPENAI_API_KEY 傳入`。",
-    "is_new": false
+    "role": "Maya",
+    "location": "app/git.js:21",
+    "suggestion": "建議在測試中模擬環境變數，以避免在測試過程中暴露敏感資訊。",
+    "is_new": true
  }
-]
+]
@@ -33,9 +33,8 @@ jobs:
    - name: AI Code Review
      uses: https://gitea.jsc.idv.tw/jiantw83/code-review@v${{ needs.version.outputs.version }}
      with:
-        OPENAI_API_KEY: ${{ secrets.OPENROUTER_API_KEY }}  # OpenRouter 使用 OpenAI 相容介面，以 OPENAI_API_KEY 傳入
+        OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
        OPENAI_BASE_URL: https://openrouter.ai/api/v1
-        OPENAI_MODEL: ${{ vars.OPENROUTER_MODEL }}
    permissions:
      contents: write
      pull-requests: write
@@ -6,8 +6,8 @@

 1. 服務名稱、模型名稱、角色資訊(個性、符合個性的英文名稱、工作內容)，Comment 到 Push Request
 2. 每個角色個別分析 Git Diff 的內容產生新問題表格(問題等級、角色名稱、問題位置或行數、修改建議)
-3. 讀取所有未解決的舊問題(問題檔案 `.gitea/ai-review/findings.json` 存在於使用此 Action 的專案固定位置)加上新問題後，去除重複產生本次 Push Request 的問題表格(PR問題表格)覆蓋問題檔案
-4. 讀取排除問題檔案(`.gitea/ai-review/exclusions.json` 存在於使用此 Action 的專案固定位置)，用來過濾PR問題表格中不需要處理的問題
+3. 讀取所有未解決的舊問題(問題檔案存在於使用此 Action 的專案固定位置)加上新問題後，去除重複產生本次 Push Request 的問題表格(PR問題表格)覆蓋問題檔案
+4. 讀取排除問題檔案，用來過濾PR問題表格中不需要處理的問題
 5. 從PR問題表格中取出所有舊問題，依照等級排序後 Comment 到 Push Request
 6. 從PR問題表格中取出所有新問題，排除嚴重等級的問題後 Comment 到 Push Request
 7. 從PR問題表格中取出所有新問題，將每個嚴重等級的問題 Comment 到 Push Request
@@ -28,7 +28,7 @@
 2. 在 `.gitea/workflows` 資料夾中建立 `ai-review.yaml'
 3. 在 `ai-review.yaml` 中填入以下內容(選擇一個使用)：

-### 1. OpenAI
+### 1. OpenAI（OpenRouter）
 ```yaml
 name: AI
 on:
@@ -42,39 +42,17 @@ jobs:
    - name: AI Code Review
      uses: https://gitea.jsc.idv.tw/jiantw83/code-review@${{ vars.ACTION_CODE_REVIEW_VERSION }}
      with:
+        # Github (h3285@evertrust.com.tw)
+        # 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
        OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
-        OPENAI_BASE_URL: https://api.openai.com/v1
-        OPENAI_MODEL: ${{ vars.OPENAI_MODEL }}
-    permissions:
-      contents: write
-      pull-requests: write
-      issues: write
-```
-
-### 2. OpenRouter
-```yaml
-name: AI
-on:
-  pull_request:
-    types: [opened, synchronize]
-jobs:
-  code-review:
-    name: 'Code Review'
-    runs-on: ubuntu
-    steps:
-    - name: AI Code Review
-      uses: https://gitea.jsc.idv.tw/jiantw83/code-review@${{ vars.ACTION_CODE_REVIEW_VERSION }}
-      with:
-        OPENAI_API_KEY: ${{ secrets.OPENROUTER_API_KEY }}  # OpenRouter 使用 OpenAI 相容介面，以 OPENAI_API_KEY 傳入
        OPENAI_BASE_URL: https://openrouter.ai/api/v1
-        OPENAI_MODEL: ${{ vars.OPENROUTER_MODEL }}
    permissions:
      contents: write
      pull-requests: write
      issues: write
 ```

-### 3. Anthropic Claude
+### 2. Anthropic Claude
 ```yaml
 name: AI
 on:
@@ -96,7 +74,7 @@ jobs:
      issues: write
 ```

-### 4. Google Gemini
+### 3. Google Gemini
 ```yaml
 name: AI
 on:
@@ -112,14 +90,13 @@ jobs:
      with:
        GEMINI_API_KEY: ${{ secrets.GEMINI_API_KEY }}
        GEMINI_BASE_URL: https://generativelanguage.googleapis.com/v1beta
-        GEMINI_MODEL: ${{ vars.GEMINI_MODEL }}
    permissions:
      contents: write
      pull-requests: write
      issues: write
 ```

-### 5. Amazon Q
+### 4. Amazon Q
 ```yaml
 name: AI
 on:
@@ -141,6 +118,28 @@ jobs:
      issues: write
 ```

+### 5. SonarQube
+```yaml
+name: AI
+on:
+  pull_request:
+    types: [opened, synchronize]
+jobs:
+  code-review:
+    name: 'Code Review'
+    runs-on: ubuntu
+    steps:
+    - name: AI Code Review
+      uses: https://gitea.jsc.idv.tw/jiantw83/code-review@${{ vars.ACTION_CODE_REVIEW_VERSION }}
+      with:
+        SONARQUBE_TOKEN: ${{ secrets.SONARQUBE_TOKEN }}
+        SONARQUBE_URL: https://sonarqube.example.com
+    permissions:
+      contents: write
+      pull-requests: write
+      issues: write
+```
+
 ### - Ollama

 ```yaml
@@ -156,7 +155,7 @@ jobs:
    - name: AI Code Review
        uses: https://gitea.jsc.idv.tw/jiantw83/code-review@${{ vars.ACTION_CODE_REVIEW_VERSION }}
        with:
-          OLLAMA_BASE_URL: https://ollama.jsc.idv.me/v1
+          OLLAMA_BASE_URL: ${{ vars.OLLAMA_BASE_URL }}
          OLLAMA_MODEL: ${{ vars.OLLAMA_MODEL }}
    permissions:
      contents: write
@@ -15,14 +15,14 @@
 - 驗收：log 中能看到 deduplication/resolution confirmation 成功或失敗（如 402），降級時有「保留所有問題」等明確訊息。
 - 完成

-## 階段四：AI 排除問題過濾
- 目標：讀取排除問題檔案（`.gitea/ai-review/exclusions.json`）進行規則過濾，並呼叫 AI 判斷剩餘問題是否為誤報或不適用，兩層過濾後產生最終問題清單。
- 驗收：log 中能看到排除問題檔案讀取成功或不存在的訊息、規則過濾數量變化，以及「AI 誤報過濾: N -> M 筆」或降級訊息。
+## 階段四：排除問題過濾
+- 目標：讀取排除問題檔案，過濾 PR 問題表格中不需要處理的問題。
+- 驗收：log 中能看到排除問題檔案讀取成功或不存在的訊息，以及過濾後 findings 數量變化。
 - 完成

 ## 階段五：findings 寫入與 comment 發布
- 目標：`.gitea/ai-review/findings.json` 正確寫入，comment 發布順序正確（舊問題→非嚴重→嚴重），每步有 log。
- 驗收：log 中能看到 `.gitea/ai-review/findings.json` 寫入、comment sync 的詳細訊息與順序。
+- 目標：findings.jsonl 正確寫入，comment 發布順序正確（舊問題→非嚴重→嚴重），每步有 log。
+- 驗收：log 中能看到 findings 寫入、comment sync 的詳細訊息與順序。
 - 完成

 ## 階段六：記憶區 commit/push 與錯誤處理
@@ -72,6 +72,54 @@ inputs:
    description: 'Amazon Q Base URL'
    required: false

+  # SonarQube
+  SONARQUBE_TOKEN:
+    description: 'SonarQube Token'
+    required: false
+  SONARQUBE_URL:
+    description: 'SonarQube URL'
+    required: false
+
+  # Kilo Code
+  KILO_API_KEY:
+    description: 'Kilo Code API Key'
+    required: false
+  KILO_BASE_URL:
+    description: 'Kilo Code Base URL'
+    required: false
+
+  # Roo Code
+  ROO_API_KEY:
+    description: 'Roo Code API Key'
+    required: false
+  ROO_BASE_URL:
+    description: 'Roo Code Base URL'
+    required: false
+
+  # Cline
+  CLINE_API_KEY:
+    description: 'Cline API Key'
+    required: false
+  CLINE_BASE_URL:
+    description: 'Cline Base URL'
+    required: false
+
+  # Continue
+  CONTINUE_API_KEY:
+    description: 'Continue API Key'
+    required: false
+  CONTINUE_BASE_URL:
+    description: 'Continue Base URL'
+    required: false
+
+  # Kade
+  KADE_API_KEY:
+    description: 'Kade API Key'
+    required: false
+  KADE_BASE_URL:
+    description: 'Kade Base URL'
+    required: false
+
 runs:
  using: 'docker'
  image: 'Dockerfile'
@@ -97,3 +145,15 @@ runs:
    OLLAMA_MODEL: ${{ inputs.OLLAMA_MODEL }}
    AMAZONQ_API_KEY: ${{ inputs.AMAZONQ_API_KEY }}
    AMAZONQ_BASE_URL: ${{ inputs.AMAZONQ_BASE_URL }}
+    SONARQUBE_TOKEN: ${{ inputs.SONARQUBE_TOKEN }}
+    SONARQUBE_URL: ${{ inputs.SONARQUBE_URL }}
+    KILO_API_KEY: ${{ inputs.KILO_API_KEY }}
+    KILO_BASE_URL: ${{ inputs.KILO_BASE_URL }}
+    ROO_API_KEY: ${{ inputs.ROO_API_KEY }}
+    ROO_BASE_URL: ${{ inputs.ROO_BASE_URL }}
+    CLINE_API_KEY: ${{ inputs.CLINE_API_KEY }}
+    CLINE_BASE_URL: ${{ inputs.CLINE_BASE_URL }}
+    CONTINUE_API_KEY: ${{ inputs.CONTINUE_API_KEY }}
+    CONTINUE_BASE_URL: ${{ inputs.CONTINUE_BASE_URL }}
+    KADE_API_KEY: ${{ inputs.KADE_API_KEY }}
+    KADE_BASE_URL: ${{ inputs.KADE_BASE_URL }}
@@ -12,9 +12,14 @@ export function getLLMConfig() {
  const checks = [
    ['openai',   process.env.OPENAI_API_KEY,   process.env.OPENAI_BASE_URL || 'https://api.openai.com/v1',   process.env.OPENAI_MODEL || 'gpt-4o-mini'],
    ['claude',   process.env.CLAUDE_API_KEY,   process.env.CLAUDE_BASE_URL || 'https://api.anthropic.com/v1', process.env.CLAUDE_MODEL || 'claude-3-haiku-20240307'],
-    ['gemini',   process.env.GEMINI_API_KEY,   process.env.GEMINI_BASE_URL || 'https://generativelanguage.googleapis.com/v1beta', process.env.GEMINI_MODEL || 'gemini-2.5-flash'],
+    ['gemini',   process.env.GEMINI_API_KEY,   process.env.GEMINI_BASE_URL || 'https://generativelanguage.googleapis.com/v1beta', process.env.GEMINI_MODEL || 'gemini-1.5-flash'],
    ['ollama',   'ollama',                      process.env.OLLAMA_BASE_URL,  process.env.OLLAMA_MODEL],
-    ['amazonq',  process.env.AMAZONQ_API_KEY,  process.env.AMAZONQ_BASE_URL  || 'https://q.api.aws',              process.env.AMAZONQ_MODEL  || 'amazon-q'],
+    ['amazonq',  process.env.AMAZONQ_API_KEY,  process.env.AMAZONQ_BASE_URL || 'https://q.api.aws', process.env.OPENAI_MODEL || 'amazon-q'],
+    ['kilo',     process.env.KILO_API_KEY,     process.env.KILO_BASE_URL || 'https://api.kilocode.com/v1', process.env.OPENAI_MODEL || 'kilo-default'],
+    ['roo',      process.env.ROO_API_KEY,      process.env.ROO_BASE_URL || 'https://api.roocode.com/v1', process.env.OPENAI_MODEL || 'roo-default'],
+    ['cline',    process.env.CLINE_API_KEY,    process.env.CLINE_BASE_URL || 'https://api.cline.dev/v1', process.env.OPENAI_MODEL || 'cline-default'],
+    ['continue', process.env.CONTINUE_API_KEY, process.env.CONTINUE_BASE_URL || 'https://api.continue.dev/v1', process.env.OPENAI_MODEL || 'continue-default'],
+    ['kade',     process.env.KADE_API_KEY,     process.env.KADE_BASE_URL || 'https://api.kade.dev/v1', process.env.OPENAI_MODEL || 'kade-default'],
  ];
  for (const [provider, key, baseURL, model] of checks) {
    if (key && baseURL) return { provider, apiKey: key, baseURL, model };
@@ -1,101 +0,0 @@
-import { describe, it, beforeEach, afterEach } from 'node:test';
-import assert from 'node:assert/strict';
-import { getLLMConfig } from './config.js';
-
-const ENV_KEYS = [
-  'OPENAI_API_KEY', 'OPENAI_BASE_URL', 'OPENAI_MODEL',
-  'CLAUDE_API_KEY', 'CLAUDE_BASE_URL', 'CLAUDE_MODEL',
-  'GEMINI_API_KEY', 'GEMINI_BASE_URL', 'GEMINI_MODEL',
-  'OLLAMA_BASE_URL', 'OLLAMA_MODEL',
-  'AMAZONQ_API_KEY', 'AMAZONQ_BASE_URL', 'AMAZONQ_MODEL',
-];
-
-let saved = {};
-beforeEach(() => {
-  saved = {};
-  for (const k of ENV_KEYS) { saved[k] = process.env[k]; delete process.env[k]; }
-});
-afterEach(() => {
-  for (const k of ENV_KEYS) {
-    if (saved[k] === undefined) delete process.env[k];
-    else process.env[k] = saved[k];
-  }
-});
-
-describe('getLLMConfig', () => {
-  it('returns null provider when no env vars set', () => {
-    const cfg = getLLMConfig();
-    assert.equal(cfg.provider, null);
-    assert.equal(cfg.apiKey, null);
-  });
-
-  it('detects openai with defaults', () => {
-    process.env.OPENAI_API_KEY = 'sk-test';
-    const cfg = getLLMConfig();
-    assert.equal(cfg.provider, 'openai');
-    assert.equal(cfg.apiKey, 'sk-test');
-    assert.equal(cfg.baseURL, 'https://api.openai.com/v1');
-    assert.equal(cfg.model, 'gpt-4o-mini');
-  });
-
-  it('detects openai with custom base url and model', () => {
-    process.env.OPENAI_API_KEY = 'sk-test';
-    process.env.OPENAI_BASE_URL = 'https://openrouter.ai/api/v1';
-    process.env.OPENAI_MODEL = 'gpt-4o';
-    const cfg = getLLMConfig();
-    assert.equal(cfg.provider, 'openai');
-    assert.equal(cfg.baseURL, 'https://openrouter.ai/api/v1');
-    assert.equal(cfg.model, 'gpt-4o');
-  });
-
-  it('detects gemini with defaults', () => {
-    process.env.GEMINI_API_KEY = 'gemini-key';
-    const cfg = getLLMConfig();
-    assert.equal(cfg.provider, 'gemini');
-    assert.equal(cfg.model, 'gemini-2.5-flash');
-  });
-
-  it('detects gemini with custom model', () => {
-    process.env.GEMINI_API_KEY = 'gemini-key';
-    process.env.GEMINI_MODEL = 'gemini-2.0-flash';
-    const cfg = getLLMConfig();
-    assert.equal(cfg.model, 'gemini-2.0-flash');
-  });
-
-  it('detects claude with defaults', () => {
-    process.env.CLAUDE_API_KEY = 'claude-key';
-    const cfg = getLLMConfig();
-    assert.equal(cfg.provider, 'claude');
-    assert.equal(cfg.model, 'claude-3-haiku-20240307');
-  });
-
-  it('detects amazonq with its own model env', () => {
-    process.env.AMAZONQ_API_KEY = 'aq-key';
-    process.env.AMAZONQ_MODEL = 'my-amazon-model';
-    const cfg = getLLMConfig();
-    assert.equal(cfg.provider, 'amazonq');
-    assert.equal(cfg.model, 'my-amazon-model');
-  });
-
-  it('openai takes priority over gemini when both set', () => {
-    process.env.OPENAI_API_KEY = 'sk-test';
-    process.env.GEMINI_API_KEY = 'gemini-key';
-    const cfg = getLLMConfig();
-    assert.equal(cfg.provider, 'openai');
-  });
-
-  it('empty string api key is treated as not set', () => {
-    process.env.OPENAI_API_KEY = '';
-    process.env.GEMINI_API_KEY = 'gemini-key';
-    const cfg = getLLMConfig();
-    assert.equal(cfg.provider, 'gemini');
-  });
-
-  it('detects ollama without api key', () => {
-    process.env.OLLAMA_BASE_URL = 'http://localhost:11434';
-    process.env.OLLAMA_MODEL = 'llama3';
-    const cfg = getLLMConfig();
-    assert.equal(cfg.provider, 'ollama');
-    assert.equal(cfg.model, 'llama3');
-  });
-});
@@ -117,57 +117,16 @@ export function loadExclusions(workspace) {

 /**
 * 套用排除規則，過濾掉符合排除條件的 findings
- * location 只比對檔案路徑（忽略行數），suggestion 省略時視為萬用
+ * 排除條件：role/location/suggestion 皆符合（省略的欄位視為萬用）
 */
 export function applyExclusions(findings, exclusions) {
  if (exclusions.length === 0) return findings;
  const before = findings.length;
-  const filtered = findings.filter(f => !exclusions.some(ex => {
-    const fPath = String(f.location).split(':')[0];
-    const exPath = ex.location ? String(ex.location).split(':')[0] : null;
-    return (!exPath || fPath === exPath) &&
-           (!ex.role || ex.role === f.role);
-  }));
+  const filtered = findings.filter(f => !exclusions.some(ex =>
+    (!ex.role || ex.role === f.role) &&
+    (!ex.location || ex.location === f.location) &&
+    (!ex.suggestion || String(f.suggestion).startsWith(String(ex.suggestion).slice(0, 50)))
+  ));
  console.log(`  排除過濾: ${before} -> ${filtered.length} 筆（排除 ${before - filtered.length} 筆）`);
  return filtered;
 }
-
-/**
- * 呼叫 AI 判斷哪些問題是誤報或不需處理，回傳需保留的 findings
- * exclusions 為已知誤報清單，供 AI 參考判斷
- * 失敗時降級回傳原始 findings
- */
-export async function filterFalsePositivesWithAI(findings, exclusions = []) {
-  if (findings.length === 0) return findings;
-
-  const exclusionHint = exclusions.length > 0
-    ? `\n\n以下是已知的誤報或不需處理的問題清單（供參考，相同檔案路徑且語意相近的問題應一併排除）：\n${JSON.stringify(exclusions, null, 2)}`
-    : '';
-
-  const systemPrompt = `你是一位資深程式碼審查專家，負責判斷審查問題是否為誤報或不需處理。
-給你一份問題清單（JSON 陣列），每筆包含 level、role、location、suggestion。
-請移除以下類型的問題：
-1. 誤報：問題描述與實際程式碼不符（例如：程式碼已正確使用環境變數或 secrets，卻被標記為硬編碼敏感資料）
-2. 不適用：問題在此專案情境下不需處理（例如：CI/CD action 本來就需要透過環境變數傳遞 token）
-3. 與已知誤報清單語意相近的問題（檔案路徑相同且建議內容相似）
-只回傳需要保留的問題 JSON 陣列，不要有其他文字。${exclusionHint}`;
-
-  const userContent = `請判斷以下問題清單，移除誤報或不需處理的問題：\n\n${JSON.stringify(findings, null, 2)}`;
-
-  try {
-    const result = await chatJSON(systemPrompt, userContent);
-    if (Array.isArray(result) && result.length > 0) {
-      console.log(`  AI 誤報過濾: ${findings.length} -> ${result.length} 筆`);
-      return result;
-    }
-    throw new Error('AI 回傳空陣列或非陣列');
-  } catch (e) {
-    const status = e.response?.status;
-    if (status === 402 || status === 429) {
-      console.log(`  ⚠️  AI 誤報過濾失敗（${status} 額度/限流），降級：保留所有問題`);
-    } else {
-      console.log(`  ⚠️  AI 誤報過濾失敗（${e.message}），降級：保留所有問題`);
-    }
-    return findings;
-  }
-}
@@ -14,34 +14,6 @@ function makeRunner(spawn) {
  };
 }

-/**
- * Clone PR head branch to workspace/repo (idempotent)
- */
-export function cloneRepo(workspace, _spawnSync = spawnSync) {
-  const run = makeRunner(_spawnSync);
-  const baseUrl = GITEA_SERVER_URL.replace(/\/$/, '');
-  const remoteUrl = `${baseUrl}/${GITEA_REPOSITORY}.git`;
-  const repoDir = path.join(workspace, 'repo');
-
-  const askpassScript = path.join(workspace, '.git-askpass.sh');
-  fs.writeFileSync(askpassScript, '#!/bin/sh\necho "$GIT_TOKEN"\n', { mode: 0o700 });
-  const credEnv = { ...process.env, GIT_ASKPASS: askpassScript, GIT_USERNAME: 'x-token', GIT_TOKEN: GITEA_TOKEN };
-
-  try {
-    if (!fs.existsSync(repoDir)) {
-      run(['clone', '--depth=1', '--branch', PR_HEAD_BRANCH, remoteUrl, repoDir], workspace, credEnv);
-      console.log(`  ✅ repo cloned to ${repoDir}`);
-    } else {
-      run(['fetch', 'origin', PR_HEAD_BRANCH], repoDir, credEnv);
-      run(['checkout', PR_HEAD_BRANCH], repoDir);
-      console.log(`  ✅ repo already exists, fetched latest`);
-    }
-  } finally {
-    try { fs.unlinkSync(askpassScript); } catch {}
-  }
-  return repoDir;
-}
-
 export async function commitAndPush(workspace, _spawnSync = spawnSync) {
  const run = makeRunner(_spawnSync);

@@ -3,7 +3,7 @@ import assert from 'node:assert/strict';
 import fs from 'fs';
 import os from 'os';
 import path from 'path';
-import { commitAndPush, cloneRepo } from './git.js';
+import { commitAndPush } from './git.js';

 // --- helpers ---
 function makeTmpWorkspace() {
@@ -91,59 +91,3 @@ describe('commitAndPush', () => {
    await assert.doesNotReject(() => commitAndPush(workspace, failSpawn));
  });
 });
-
-describe('cloneRepo', () => {
-  let workspace;
-
-  before(() => { workspace = fs.mkdtempSync(path.join(os.tmpdir(), 'clone-test-')); });
-  after(() => { fs.rmSync(workspace, { recursive: true, force: true }); });
-
-  it('clones repo when repoDir does not exist', () => {
-    const spawn = makeSpawn();
-    cloneRepo(workspace, spawn);
-    const cloneCalled = spawn.calls.some(c => c.args[0] === 'clone');
-    assert.ok(cloneCalled, 'expected git clone to be called');
-  });
-
-  it('fetches and checks out when repoDir already exists', () => {
-    const repoDir = path.join(workspace, 'repo');
-    fs.mkdirSync(repoDir, { recursive: true });
-    const spawn = makeSpawn();
-    cloneRepo(workspace, spawn);
-    const cloneCalled = spawn.calls.some(c => c.args[0] === 'clone');
-    const fetchCalled = spawn.calls.some(c => c.args[0] === 'fetch');
-    assert.ok(!cloneCalled, 'clone should not run when repoDir exists');
-    assert.ok(fetchCalled, 'fetch should run when repoDir exists');
-  });
-
-  it('does not embed token in any git command argument', () => {
-    const spawn = makeSpawn();
-    cloneRepo(workspace, spawn);
-    for (const { args } of spawn.calls) {
-      assert.ok(!args.join(' ').includes('test-token'), `Token leaked in git args: ${args.join(' ')}`);
-    }
-  });
-
-  it('uses GIT_ASKPASS for network operations', () => {
-    const spawn = makeSpawn();
-    cloneRepo(workspace, spawn);
-    const networkCalls = spawn.calls.filter(c => ['clone', 'fetch'].includes(c.args[0]));
-    assert.ok(networkCalls.length > 0, 'expected at least one network git call');
-    for (const { args, opts } of networkCalls) {
-      assert.ok(opts?.env?.GIT_ASKPASS, `GIT_ASKPASS missing for git ${args[0]}`);
-    }
-  });
-
-  it('cleans up askpass script after run', () => {
-    const spawn = makeSpawn();
-    cloneRepo(workspace, spawn);
-    const leftover = fs.readdirSync(workspace).filter(f => f.endsWith('.git-askpass.sh'));
-    assert.equal(leftover.length, 0, 'askpass script was not cleaned up');
-  });
-
-  it('returns repoDir path', () => {
-    const spawn = makeSpawn();
-    const result = cloneRepo(workspace, spawn);
-    assert.equal(result, path.join(workspace, 'repo'));
-  });
-});
@@ -1,9 +1,9 @@
 import { GITEA_REPOSITORY, PR_NUMBER, PR_HEAD_BRANCH, PR_BASE_BRANCH, getLLMConfig } from './config.js';
 import { loadRoles, getRoleIntro } from './roles.js';
 import { getPRDiff, postComment } from './gitea.js';
-import { analyzeWithRole, loadOldFindings, mergeFindings, sortByLevel, deduplicateWithAI, loadExclusions, applyExclusions, filterFalsePositivesWithAI } from './findings.js';
+import { analyzeWithRole, loadOldFindings, mergeFindings, sortByLevel, deduplicateWithAI, loadExclusions, applyExclusions } from './findings.js';
 import { saveFindings, postOldFindingsComment, postNewNonCriticalComment, postNewCriticalComments } from './comments.js';
-import { cloneRepo, commitAndPush } from './git.js';
+import { commitAndPush } from './git.js';

 const WORKSPACE = process.env.GITHUB_WORKSPACE || '/workspace';

@@ -65,14 +65,7 @@ async function main() {

  // Step3: 讀取舊 findings，合併去重（含 AI 語意去重）
  console.log('\n🔀 Step3: Findings 合併');
-  // Clone repo 以讀取舊 findings 與排除清單
-  let repoDir;
-  try {
-    repoDir = cloneRepo(WORKSPACE);
-  } catch (e) {
-    console.log(`  ⚠️  clone repo 失敗（繼續執行）: ${e.message}`);
-  }
-  const oldFindings = loadOldFindings(repoDir || WORKSPACE);
+  const oldFindings = loadOldFindings(WORKSPACE);
  const mergedFindings = mergeFindings(oldFindings, newFindings);
  console.log(`  Step3 merged findings total=${mergedFindings.length}`);

@@ -81,11 +74,10 @@ async function main() {
  const sorted = sortByLevel(deduped);
  console.log(`  Step3b dedup findings total=${sorted.length} (critical=${sorted.filter(f=>f.level==='critical').length} warning=${sorted.filter(f=>f.level==='warning').length} info=${sorted.filter(f=>f.level==='info').length})`);

-  // Step4: 讀取排除問題檔案，過濾 PR 問題表格，並請 AI 判斷誤報
-  console.log('\n🚫 Step4: AI 排除問題過濾');
-  const exclusions = loadExclusions(repoDir || WORKSPACE);
-  const ruleFiltered = applyExclusions(sorted, exclusions);
-  const filtered = await filterFalsePositivesWithAI(ruleFiltered, exclusions);
+  // Step4: 讀取排除問題檔案，過濾 PR 問題表格
+  console.log('\n🚫 Step4: 排除問題過濾');
+  const exclusions = loadExclusions(WORKSPACE);
+  const filtered = applyExclusions(sorted, exclusions);
  console.log(`  Step4 完成: findings total=${filtered.length}`);

  // Step5: 寫入 findings.json，依序發布 comment
@@ -12,13 +12,9 @@ export function loadRoles() {
 }

 export function getRoleIntro(roles) {
-  const lines = [
-    '## 🤖 AI Code Review 團隊', '',
-    '| 👤 名稱 | 🎯 職責 | 🧠 個性 |',
-    '|--------|--------|--------|',
-  ];
+  const lines = ['## 🤖 AI Code Review 團隊', ''];
  for (const r of roles) {
-    lines.push(`| **${r.name}** | ${r.role} | ${r.personality} |`);
+    lines.push(`- **${r.name}** (${r.role})：${r.personality}`);
  }
  return lines.join('\n');
 }
Author	SHA1	Message	Date
jiantw83	ef3654b091	chore: add exclusions for Rex false positive on git.js token handling	2026-05-12 01:48:00 +00:00
jiantw83	5d0c9fd691	docs: mark all TODO stages complete	2026-05-12 01:47:52 +00:00
jiantw83	5860588588	fix: align flow with README, add Step4 exclusions filter, fix step numbers	2026-05-12 01:47:43 +00:00
jiantw83	53a7ec7a3e	refactor: reorganize TODO stages for clarity and accuracy in workflow steps Co-authored-by: Copilot <copilot@github.com>	2026-05-12 01:47:43 +00:00
jiantw83	42241c5000	refactor: update processing steps in README for clarity and accuracy	2026-05-12 01:47:43 +00:00
jiantw83	1a12ec4e2e	refactor: remove outdated AI Code configurations for Kilo, Roo, Cline, Continue, and Kade	2026-05-12 01:47:43 +00:00
AI Review Bot	a90886e924	chore: update ai-review findings [skip ci]	2026-05-12 01:13:53 +00:00
jiantw83	57285ce145	fix: update askpass script to securely read token from env var	2026-05-12 01:12:32 +00:00
jiantw83	0aefa66224	feat: refactor commitAndPush to use a runner function and improve token security; add tests for git operations	2026-05-12 01:08:39 +00:00
jiantw83	66d93abe24	Merge pull request 'feat: master 不會觸發 review.yaml' (#66 ) from feat/refactor/kiro/1 into feat/refactor/main Reviewed-on: jiantw83/code-review#66	2026-05-11 14:12:38 +00:00
jiantw83	0063f3282f	Merge pull request 'refactor: 改用 execSync' (#65 ) from feat/refactor/kiro/1 into feat/refactor/main Reviewed-on: jiantw83/code-review#65	2026-05-11 13:56:13 +00:00
jiantw83	8c3d0d9a6d	Merge pull request 'fix: add bash to Dockerfile dependencies' (#64 ) from feat/refactor/kiro/1 into feat/refactor/main Reviewed-on: jiantw83/code-review#64	2026-05-11 10:54:08 +00:00
jiantw83	3849bb2168	Merge pull request 'fix: switch Dockerfile base image to alpine and install dependencies using apk' (#63 ) from feat/refactor/kiro/1 into feat/refactor/main Reviewed-on: jiantw83/code-review#63	2026-05-11 10:46:43 +00:00
jiantw83	379938d6dc	Merge pull request 'fix: Dockerfile 加入 git 安裝驗證，git.js 改回 git binary' (#62 ) from feat/refactor/kiro/1 into feat/refactor/main Reviewed-on: jiantw83/code-review#62	2026-05-11 10:38:59 +00:00
jiantw83	5bf39966d0	Merge pull request 'fix: 換用 node:20 完整版（內建 git，不需要 apt-get）' (#61 ) from feat/refactor/kiro/1 into feat/refactor/main Reviewed-on: jiantw83/code-review#61	2026-05-11 10:34:11 +00:00
jiantw83	3509a882e1	Merge pull request 'chore: add newline at end of TODO.md for better formatting' (#60 ) from feat/refactor/kiro/1 into feat/refactor/main Reviewed-on: jiantw83/code-review#60	2026-05-11 10:19:46 +00:00
jiantw83	1d2e8236de	Merge pull request 'chore: remove duplicate log assistance note in TODO.md' (#59 ) from feat/refactor/kiro/1 into feat/refactor/main Reviewed-on: jiantw83/code-review#59	2026-05-11 10:18:13 +00:00
jiantw83	d8423c74b1	Merge pull request 'chore: remove test findings' (#58 ) from feat/refactor/kiro/1 into feat/refactor/main Reviewed-on: jiantw83/code-review#58	2026-05-11 10:12:32 +00:00
jiantw83	94e974b5dc	Merge pull request 'feat/refactor/kiro/1' (#57 ) from feat/refactor/kiro/1 into feat/refactor/main Reviewed-on: jiantw83/code-review#57	2026-05-11 10:10:23 +00:00
jiantw83	a9a0b43ea5	Merge pull request 'debug: commit/push 失敗時顯示詳細錯誤' (#56 ) from feat/refactor/kiro/1 into feat/refactor/main Reviewed-on: jiantw83/code-review#56	2026-05-11 10:04:49 +00:00
jiantw83	aa8234b5c7	Merge pull request 'fix: commitAndPush 加上 await' (#55 ) from feat/refactor/kiro/1 into feat/refactor/main Reviewed-on: jiantw83/code-review#55	2026-05-11 10:01:12 +00:00
jiantw83	b0f2d45c11	Merge pull request 'fix: add newline at end of TODO.md for proper formatting' (#54 ) from feat/refactor/kiro/1 into feat/refactor/main Reviewed-on: jiantw83/code-review#54	2026-05-11 09:59:14 +00:00
jiantw83	3fd9a7e13d	Merge pull request 'feat: 階段五六 - findings commit/push 到來源分支，critical 問題 exit 1' (#53 ) from feat/refactor/kiro/1 into feat/refactor/main Reviewed-on: jiantw83/code-review#53	2026-05-11 09:54:39 +00:00
jiantw83	39cc5c932c	Merge pull request 'feat: 階段四 - findings 寫入與 comment 依序發布（舊問題→非嚴重→嚴重）' (#52 ) from feat/refactor/kiro/1 into feat/refactor/main Reviewed-on: jiantw83/code-review#52	2026-05-11 09:48:41 +00:00
jiantw83	255adbabe4	Merge pull request 'feat: 階段三 - AI 語意去重，失敗時降級保留所有問題' (#51 ) from feat/refactor/kiro/1 into feat/refactor/main Reviewed-on: jiantw83/code-review#51	2026-05-11 09:44:10 +00:00
jiantw83	a10fc8f176	Merge pull request 'feat/refactor/kiro/1' (#50 ) from feat/refactor/kiro/1 into feat/refactor/main Reviewed-on: jiantw83/code-review#50	2026-05-11 09:40:12 +00:00
jiantw83	9b39908394	Merge pull request 'feat: 階段一 - 基本流程串接骨架' (#47 ) from feat/refactor/kiro/1 into feat/refactor/main Reviewed-on: jiantw83/code-review#47	2026-05-11 07:53:38 +00:00