JefferyandClaude Opus 4.8
d8dd5ce92e
- exclusions.json 新增一條誤報（gitrepo.js:276 使用者名稱固定 ai-review-bot，依管理員指示）。 - 新增 findings 檔追蹤 4 條待人工處理問題（步驟編號硬編碼、兩處缺測試、debug 輸出取捨）。 Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
66 lines
3.9 KiB
JSON
66 lines
3.9 KiB
JSON
{
|
||
"generatedAt": "2026/07/20 18:00:02",
|
||
"commitSha": "d354f30c270e99baa9dcfc6aa76510710c0193ca",
|
||
"prNumber": null,
|
||
"tool": {
|
||
"name": "code-review-resolve",
|
||
"version": "0.0.8",
|
||
"model": "（工具預設）"
|
||
},
|
||
"findings": [
|
||
{
|
||
"id": "F001",
|
||
"reviewer": "🧰 Leo",
|
||
"focus": "maintainability",
|
||
"badge": "🧰",
|
||
"severity": "警告",
|
||
"file": "src/index.js",
|
||
"startLine": 257,
|
||
"endLine": 307,
|
||
"problem": "流程步驟編號同時硬編碼在 log 字串、區段註解、JSDoc、README 與多個函式庫中。插入或調整一個步驟就必須跨大量檔案全面改號，容易讓文件與實際紀錄不一致。",
|
||
"suggestion": "程式內改用穩定的語意階段名稱（如 diff、attack、defend、publish），由單一流程定義集中決定顯示順序；JSDoc 以階段名稱互相引用，README 流程圖由同一份階段資料產生或僅在文件層維護展示編號。",
|
||
"suggestedCode": "const PHASE = Object.freeze({\n RESOLVE_OLD: '清理舊留言',\n DETECT_TOOL: '偵測工具',\n COLLECT_DIFF: '整理差異',\n ATTACK: '攻擊方審查',\n DEFEND: '防守方裁決',\n});\n\nlog(PHASE.COLLECT_DIFF, 'INF', `變更檔案 ${allFiles.length} 個…`);"
|
||
},
|
||
{
|
||
"id": "F002",
|
||
"reviewer": "🧪 Maya",
|
||
"focus": "testing",
|
||
"badge": "🧪",
|
||
"severity": "警告",
|
||
"file": "src/lib/gitrepo.js",
|
||
"startLine": 252,
|
||
"endLine": 289,
|
||
"problem": "commitAndPushFindings 的推送行為（有無變更、認證方式、空 commit 防護、是否觸發 CI）缺少測試證明。此為本次變更的核心行為，卻沒有任何測試覆蓋。",
|
||
"suggestion": "mock git 命令，斷言：無 staged diff 時回傳 false 且不執行 commit／push；有變更時以認證方式推送到正確 refspec 與分支。注意：原 finding 描述的 pushToken 對比 origin 雙軌邏輯已於重構後移除（現行一律以 token 經 pushWithCredential 認證推送），撰寫測試前需依現行程式碼重新界定情境。",
|
||
"suggestedCode": ""
|
||
},
|
||
{
|
||
"id": "F003",
|
||
"reviewer": "🗡️ Assassin",
|
||
"focus": "security",
|
||
"badge": "🗡️",
|
||
"severity": "警告",
|
||
"file": "src/lib/review.js",
|
||
"startLine": 64,
|
||
"endLine": 80,
|
||
"problem": "agentFailureDetail 於 AI CLI 失敗時會把（經 redactSecrets 盡力遮罩的）stderr／stdout 片段寫入 CI log。redactSecrets 屬盡力遮罩，無法可靠辨識 PII、短密碼或私鑰片段；長期保存且多人可讀的 CI log 有洩漏風險。",
|
||
"suggestion": "屬安全（避免洩漏）與可除錯性的設計取捨：現行程式碼已於註解明確權衡並選擇「附上遮罩後輸出以利除錯」。是否改為只記錄退出碼／訊號／逾時狀態＋隨機診斷 ID（內容級診斷改寫入有存取控制與短保存期的獨立 artifact）需由維護者裁示，故保留現行行為、標為待人工處理。",
|
||
"suggestedCode": "if (verbose) {\n parts.push('已啟用除錯；為避免洩漏原始碼、PII 或憑證，CLI 輸出仍不寫入日誌');\n}"
|
||
},
|
||
{
|
||
"id": "F004",
|
||
"reviewer": "🧪 Maya",
|
||
"focus": "testing",
|
||
"badge": "🧪",
|
||
"severity": "建議",
|
||
"file": "src/lib/gitea.js",
|
||
"startLine": 171,
|
||
"endLine": 215,
|
||
"problem": "addLabelsToIssue 與 addIssueDependency 缺少契約測試驗證 endpoint、HTTP method 與 request body；相依關係方向由 URL 與 body 決定，參數次序寫反時粗略 mock 的主流程測試不易察覺。",
|
||
"suggestion": "補 Gitea client 單元測試：labels 為空或缺少時不呼叫 API 並回傳 null；有 labels 時送出正確陣列；相依 API 以 PR 編號置於 URL、追蹤 issue 編號置於 index，並帶入正確 owner／repo。",
|
||
"suggestedCode": ""
|
||
}
|
||
],
|
||
"excluded": []
|
||
}
|