chore(ai-review 狀態): 寫回議題 #9 待人工處理問題至 findings

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
2026-07-20 17:40:50 +08:00
parent c63b1a6da2
commit deb20bb078
1 changed files with 117 additions and 0 deletions
@@ -0,0 +1,117 @@
+{
+  "generatedAt": "2026/07/20 17:37:54",
+  "commitSha": "3ef8a302911c60b9f71024e1f4b60e0d4578b8fd",
+  "prNumber": 6,
+  "tool": {
+    "name": "code-review-resolve",
+    "version": "0.0.8",
+    "model": "（工具預設）"
+  },
+  "findings": [
+    {
+      "id": "F001",
+      "reviewer": "Leo",
+      "focus": "maintainability",
+      "badge": "🧰",
+      "severity": "警告",
+      "file": "src/index.js",
+      "startLine": 121,
+      "endLine": 145,
+      "problem": "流程步驟編號硬編碼在主流程註解、日誌字串、README 與多個函式 JSDoc 中；插入一個步驟就要同步修改大量檔案，文件與實作高耦合，日後調整流程易漏改而互相矛盾。",
+      "suggestion": "共用函式 JSDoc 改以語意階段名稱描述、不引用易變動的數字；日誌集中定義階段名稱或由單一流程描述產生編號；README 流程圖也以語意名稱為主。屬跨檔重構＋設計取捨。",
+      "suggestedCode": "const STAGE = Object.freeze({\n  TOOL_DETECTION: '偵測工具',\n  DIFF_COLLECTION: '整理差異',\n  ATTACK_REVIEW: '攻擊方審查',\n  DEFENSE_REVIEW: '防守方裁決',\n});\nlog(STAGE.DIFF_COLLECTION, 'INF', message);"
+    },
+    {
+      "id": "F002",
+      "reviewer": "Maya",
+      "focus": "testing",
+      "badge": "🧪",
+      "severity": "警告",
+      "file": "src/lib/gitea.js",
+      "startLine": 172,
+      "endLine": 215,
+      "problem": "建立 issue 相依關係的 API 封裝（addIssueDependency）沒有對應測試：尚未驗證 URL 的 issue 編號與 {index, owner, repo} payload 正確、以及非 2xx 錯誤是否原樣往上傳遞。（原併提的 addLabelsToIssue 已於先前 commit 移除。）",
+      "suggestion": "mock 底層 API，驗證 addIssueDependency 的 URL issue 編號與 payload，加入 4xx／5xx 拋錯案例，並搭配主流程測試確認相依失敗會被降級而不阻斷審查。屬測試架構決策（專案無測試框架）。",
+      "suggestedCode": ""
+    },
+    {
+      "id": "F003",
+      "reviewer": "Leo",
+      "focus": "maintainability",
+      "badge": "🧰",
+      "severity": "警告",
+      "file": "src/lib/gitrepo.js",
+      "startLine": 47,
+      "endLine": 65,
+      "problem": "tryGit 將所有 git 失敗壓成布林值，resolveMergeBase 的診斷只知策略成敗、無法區分認證／refspec／網路／版本問題；CI 出錯時維護者只能重跑或自行重現，診斷成本高。",
+      "suggestion": "讓嘗試結果保留結構化且已清理的錯誤分類（exit code、git 子命令、安全化後短訊息），仍避免記錄遠端 URL 或憑證；最終錯誤彙整足以行動的原因，並可對各失敗類型做單元測試。屬診斷重構＋需測試。",
+      "suggestedCode": "function tryGit(cwd, ...args) {\n  try {\n    git(cwd, ...args);\n    return { ok: true };\n  } catch (error) {\n    return { ok: false, code: error.status ?? error.code ?? null, reason: sanitizeGitError(error) };\n  }\n}"
+    },
+    {
+      "id": "F004",
+      "reviewer": "Maya",
+      "focus": "testing",
+      "badge": "🧪",
+      "severity": "警告",
+      "file": "src/lib/gitrepo.js",
+      "startLine": 270,
+      "endLine": 291,
+      "problem": "findings 推送的認證路徑沒有測試。註：原「PAT 直接推送 vs origin 失敗重試」雙路徑已於先前 commit 合併為「一律以 token 明確認證推送」，測試仍待補：空 token 邊界、推送目標正確、錯誤與輸出不含 token 原文。",
+      "suggestion": "補單元測試攔截 git 參數／env：斷言以 token 認證推送、推送目標 refspec 正確、呼叫次數，並確保任何拋出的錯誤、log 或快照都不含原始 token。屬測試架構決策。",
+      "suggestedCode": ""
+    },
+    {
+      "id": "F005",
+      "reviewer": "Bard",
+      "focus": "style",
+      "badge": "🎼",
+      "severity": "建議",
+      "file": "action.yml",
+      "startLine": 3,
+      "endLine": 3,
+      "problem": "檔頭「更新時間」為手動維護的固定字串，與實際檔案更新時間不一致；散落各檔的手動時間戳容易走調，讀者無法判斷可信度。",
+      "suggestion": "屬 jsc spec-time-log 慣例（各檔頭「更新時間」由 doc-funcs 流程統一產生／同步）。是否移除改用版控紀錄、或如何統一更新，宜由 doc-funcs 流程處理，不在 resolve 逐條硬改。",
+      "suggestedCode": ""
+    },
+    {
+      "id": "F006",
+      "reviewer": "Bard",
+      "focus": "style",
+      "badge": "🎼",
+      "severity": "建議",
+      "file": "readme.md",
+      "startLine": 3,
+      "endLine": 3,
+      "problem": "README 檔頭手動「更新時間」與實際更新時間不符，並與 action.yml、src/index.js 重複保存同類易過期資訊，形成多個不一致的真相來源。",
+      "suggestion": "同 F005：屬 jsc spec-time-log 慣例，交 doc-funcs 流程統一維護（移除或自動注入）。",
+      "suggestedCode": ""
+    },
+    {
+      "id": "F007",
+      "reviewer": "Bard",
+      "focus": "style",
+      "badge": "🎼",
+      "severity": "建議",
+      "file": "src/index.js",
+      "startLine": 7,
+      "endLine": 7,
+      "problem": "啟動橫幅硬編碼的「更新時間」與程式實際更新時間不一致，每次改程式都要人工校準，製造噪音並讓執行日誌呈現失真版本資訊。",
+      "suggestion": "同 F005：屬 jsc spec-time-log 慣例，交 doc-funcs 流程統一維護；若日誌需辨識版本，可改顯示 CI 注入的 commit SHA／版本號（屬慣例調整）。",
+      "suggestedCode": ""
+    },
+    {
+      "id": "F008",
+      "reviewer": "Bard",
+      "focus": "style",
+      "badge": "🎼",
+      "severity": "建議",
+      "file": "src/index.js",
+      "startLine": 179,
+      "endLine": 231,
+      "problem": "main() 內新增兩個帶完整 JSDoc 的閉包函式與一大段「步驟 2：延後執行」說明，使主流程在進入步驟 3 前被近六十行細節打斷，留言路由、issue 建立與流程說明混在同一層，閱讀節奏沉重。",
+      "suggestion": "將留言路由與 issue 建立封裝成具語義名稱的輔助物件／模組（例如 createCommentPublisher），讓 main() 只保留流程級呼叫；延後清理理由縮成貼近呼叫點的簡短註解。與 F001（語意階段名稱）同屬主流程重構，宜一併處理。",
+      "suggestedCode": "const comments = createCommentPublisher({ ctx, gitea });\nawait comments.post(templates.toolComment({ /* ... */ }));"
+    }
+  ],
+  "excluded": []
+}