From deb20bb07852967328c70baace1409e259c32fdd Mon Sep 17 00:00:00 2001 From: Jeffery Date: Mon, 20 Jul 2026 17:40:50 +0800 Subject: [PATCH] =?UTF-8?q?chore(ai-review=20=E7=8B=80=E6=85=8B):=20?= =?UTF-8?q?=E5=AF=AB=E5=9B=9E=E8=AD=B0=E9=A1=8C=20#9=20=E5=BE=85=E4=BA=BA?= =?UTF-8?q?=E5=B7=A5=E8=99=95=E7=90=86=E5=95=8F=E9=A1=8C=E8=87=B3=20findin?= =?UTF-8?q?gs?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Co-Authored-By: Claude Opus 4.8 (1M context) --- .../findings/2026-07-20-17:37:54.json | 117 ++++++++++++++++++ 1 file changed, 117 insertions(+) create mode 100644 .gitea/ai-review/findings/2026-07-20-17:37:54.json diff --git a/.gitea/ai-review/findings/2026-07-20-17:37:54.json b/.gitea/ai-review/findings/2026-07-20-17:37:54.json new file mode 100644 index 0000000..c760ca0 --- /dev/null +++ b/.gitea/ai-review/findings/2026-07-20-17:37:54.json @@ -0,0 +1,117 @@ +{ + "generatedAt": "2026/07/20 17:37:54", + "commitSha": "3ef8a302911c60b9f71024e1f4b60e0d4578b8fd", + "prNumber": 6, + "tool": { + "name": "code-review-resolve", + "version": "0.0.8", + "model": "（工具預設）" + }, + "findings": [ + { + "id": "F001", + "reviewer": "Leo", + "focus": "maintainability", + "badge": "🧰", + "severity": "警告", + "file": "src/index.js", + "startLine": 121, + "endLine": 145, + "problem": "流程步驟編號硬編碼在主流程註解、日誌字串、README 與多個函式 JSDoc 中；插入一個步驟就要同步修改大量檔案，文件與實作高耦合，日後調整流程易漏改而互相矛盾。", + "suggestion": "共用函式 JSDoc 改以語意階段名稱描述、不引用易變動的數字；日誌集中定義階段名稱或由單一流程描述產生編號；README 流程圖也以語意名稱為主。屬跨檔重構＋設計取捨。", + "suggestedCode": "const STAGE = Object.freeze({\n TOOL_DETECTION: '偵測工具',\n DIFF_COLLECTION: '整理差異',\n ATTACK_REVIEW: '攻擊方審查',\n DEFENSE_REVIEW: '防守方裁決',\n});\nlog(STAGE.DIFF_COLLECTION, 'INF', message);" + }, + { + "id": "F002", + "reviewer": "Maya", + "focus": "testing", + "badge": "🧪", + "severity": "警告", + "file": "src/lib/gitea.js", + "startLine": 172, + "endLine": 215, + "problem": "建立 issue 相依關係的 API 封裝（addIssueDependency）沒有對應測試：尚未驗證 URL 的 issue 編號與 {index, owner, repo} payload 正確、以及非 2xx 錯誤是否原樣往上傳遞。（原併提的 addLabelsToIssue 已於先前 commit 移除。）", + "suggestion": "mock 底層 API，驗證 addIssueDependency 的 URL issue 編號與 payload，加入 4xx／5xx 拋錯案例，並搭配主流程測試確認相依失敗會被降級而不阻斷審查。屬測試架構決策（專案無測試框架）。", + "suggestedCode": "" + }, + { + "id": "F003", + "reviewer": "Leo", + "focus": "maintainability", + "badge": "🧰", + "severity": "警告", + "file": "src/lib/gitrepo.js", + "startLine": 47, + "endLine": 65, + "problem": "tryGit 將所有 git 失敗壓成布林值，resolveMergeBase 的診斷只知策略成敗、無法區分認證／refspec／網路／版本問題；CI 出錯時維護者只能重跑或自行重現，診斷成本高。", + "suggestion": "讓嘗試結果保留結構化且已清理的錯誤分類（exit code、git 子命令、安全化後短訊息），仍避免記錄遠端 URL 或憑證；最終錯誤彙整足以行動的原因，並可對各失敗類型做單元測試。屬診斷重構＋需測試。", + "suggestedCode": "function tryGit(cwd, ...args) {\n try {\n git(cwd, ...args);\n return { ok: true };\n } catch (error) {\n return { ok: false, code: error.status ?? error.code ?? null, reason: sanitizeGitError(error) };\n }\n}" + }, + { + "id": "F004", + "reviewer": "Maya", + "focus": "testing", + "badge": "🧪", + "severity": "警告", + "file": "src/lib/gitrepo.js", + "startLine": 270, + "endLine": 291, + "problem": "findings 推送的認證路徑沒有測試。註：原「PAT 直接推送 vs origin 失敗重試」雙路徑已於先前 commit 合併為「一律以 token 明確認證推送」，測試仍待補：空 token 邊界、推送目標正確、錯誤與輸出不含 token 原文。", + "suggestion": "補單元測試攔截 git 參數／env：斷言以 token 認證推送、推送目標 refspec 正確、呼叫次數，並確保任何拋出的錯誤、log 或快照都不含原始 token。屬測試架構決策。", + "suggestedCode": "" + }, + { + "id": "F005", + "reviewer": "Bard", + "focus": "style", + "badge": "🎼", + "severity": "建議", + "file": "action.yml", + "startLine": 3, + "endLine": 3, + "problem": "檔頭「更新時間」為手動維護的固定字串，與實際檔案更新時間不一致；散落各檔的手動時間戳容易走調，讀者無法判斷可信度。", + "suggestion": "屬 jsc spec-time-log 慣例（各檔頭「更新時間」由 doc-funcs 流程統一產生／同步）。是否移除改用版控紀錄、或如何統一更新，宜由 doc-funcs 流程處理，不在 resolve 逐條硬改。", + "suggestedCode": "" + }, + { + "id": "F006", + "reviewer": "Bard", + "focus": "style", + "badge": "🎼", + "severity": "建議", + "file": "readme.md", + "startLine": 3, + "endLine": 3, + "problem": "README 檔頭手動「更新時間」與實際更新時間不符，並與 action.yml、src/index.js 重複保存同類易過期資訊，形成多個不一致的真相來源。", + "suggestion": "同 F005：屬 jsc spec-time-log 慣例，交 doc-funcs 流程統一維護（移除或自動注入）。", + "suggestedCode": "" + }, + { + "id": "F007", + "reviewer": "Bard", + "focus": "style", + "badge": "🎼", + "severity": "建議", + "file": "src/index.js", + "startLine": 7, + "endLine": 7, + "problem": "啟動橫幅硬編碼的「更新時間」與程式實際更新時間不一致，每次改程式都要人工校準，製造噪音並讓執行日誌呈現失真版本資訊。", + "suggestion": "同 F005：屬 jsc spec-time-log 慣例，交 doc-funcs 流程統一維護；若日誌需辨識版本，可改顯示 CI 注入的 commit SHA／版本號（屬慣例調整）。", + "suggestedCode": "" + }, + { + "id": "F008", + "reviewer": "Bard", + "focus": "style", + "badge": "🎼", + "severity": "建議", + "file": "src/index.js", + "startLine": 179, + "endLine": 231, + "problem": "main() 內新增兩個帶完整 JSDoc 的閉包函式與一大段「步驟 2：延後執行」說明，使主流程在進入步驟 3 前被近六十行細節打斷，留言路由、issue 建立與流程說明混在同一層，閱讀節奏沉重。", + "suggestion": "將留言路由與 issue 建立封裝成具語義名稱的輔助物件／模組（例如 createCommentPublisher），讓 main() 只保留流程級呼叫；延後清理理由縮成貼近呼叫點的簡短註解。與 F001（語意階段名稱）同屬主流程重構，宜一併處理。", + "suggestedCode": "const comments = createCommentPublisher({ ctx, gitea });\nawait comments.post(templates.toolComment({ /* ... */ }));" + } + ], + "excluded": [] +}