fix(gitea TLS): 固定略過憑證驗證並改用 Gitea context

action.yaml

@@ -2,34 +2,6 @@ name: 'AI Code Review'
 description: 'AI Code Review'
 author: 'Jeffery'
 inputs:
-  # Gitea context
-  gitea_token:
-    description: 'Gitea API Token'
-    required: true
-  gitea_comment_token:
-    description: 'Gitea API Token for posting comments only'
-    required: false
-  gitea_server_url:
-    description: 'Gitea Server URL'
-    required: false
-  gitea_repository:
-    description: 'Gitea Repository (owner/repo)'
-    required: false
-  gitea_skip_tls_verify:
-    description: '跳過 Gitea SSL/TLS 憑證驗證（自簽憑證時使用）'
-    required: false
-    default: 'false'
-  pr_number:
-    description: 'Pull Request Number'
-    required: false
-  pr_head_sha:
-    description: 'PR head commit SHA'
-    required: false
-  pr_head_branch:
-    description: 'PR 來源分支'
-    required: false
-
-  # OpenCode Server
   opencode_base_url:
     description: 'OpenCode server Base URL'
     required: false
@@ -43,16 +15,14 @@ runs:
   using: 'docker'
   image: 'Dockerfile'
   env:
-    # Gitea context（改為只從 inputs 取得）
-    GITEA_TOKEN: ${{ inputs.gitea_token }}
-    GITEA_COMMENT_TOKEN: ${{ inputs.gitea_comment_token }}
-    GITEA_SERVER_URL: ${{ inputs.gitea_server_url || gitea.server_url }}
-    GITEA_REPOSITORY: ${{ inputs.gitea_repository || gitea.repository }}
-    GITEA_SKIP_TLS_VERIFY: ${{ inputs.gitea_skip_tls_verify }}
-    PR_NUMBER: ${{ inputs.pr_number || gitea.event.pull_request.number }}
-    PR_HEAD_SHA: ${{ inputs.pr_head_sha || gitea.event.pull_request.head.sha }}
-    PR_HEAD_BRANCH: ${{ inputs.pr_head_branch || gitea.event.pull_request.head.ref }}
-    # LLM
+    GITEA_SERVER_URL: ${{ gitea.server_url }}
+    GITEA_REPOSITORY: ${{ gitea.repository }}
+    GITEA_TOKEN: ${{ gitea.token }}
+    GITEA_COMMENT_TOKEN: ${{ gitea.token }}
+    PR_NUMBER: ${{ gitea.event.pull_request.number }}
+    PR_HEAD_SHA: ${{ gitea.event.pull_request.head.sha }}
+    PR_HEAD_BRANCH: ${{ gitea.event.pull_request.head.ref }}
+    PR_BASE_BRANCH: ${{ gitea.event.pull_request.base.ref }}
     OPENCODE_BASE_URL: ${{ inputs.opencode_base_url }}
     OPENCODE_MODEL: ${{ inputs.opencode_model }}
     OPENCODE_PROVIDER: ${{ inputs.opencode_provider }}

app/config.js

@@ -4,7 +4,6 @@ export const GITEA_TOKEN = process.env.GITEA_TOKEN || '';
 export const GITEA_COMMENT_TOKEN = process.env.GITEA_COMMENT_TOKEN || '';
 export const GITEA_SERVER_URL = process.env.GITEA_SERVER_URL || 'https://gitea.com';
 export const GITEA_REPOSITORY = process.env.GITEA_REPOSITORY || '';
-export const GITEA_SKIP_TLS_VERIFY = process.env.GITEA_SKIP_TLS_VERIFY === 'true';
 export const PR_NUMBER = process.env.PR_NUMBER || '';
 export const PR_HEAD_SHA = process.env.PR_HEAD_SHA || '';
 export const PR_HEAD_BRANCH = process.env.PR_HEAD_BRANCH || '';

app/gitea.js

@@ -1,9 +1,9 @@
 import axios from 'axios';
 import https from 'https';
-import { GITEA_TOKEN, GITEA_COMMENT_TOKEN, GITEA_SERVER_URL, GITEA_REPOSITORY, GITEA_SKIP_TLS_VERIFY, PR_NUMBER, PR_HEAD_SHA, PR_HEAD_BRANCH } from './config.js';
+import { GITEA_TOKEN, GITEA_COMMENT_TOKEN, GITEA_SERVER_URL, GITEA_REPOSITORY, PR_NUMBER, PR_HEAD_SHA, PR_HEAD_BRANCH } from './config.js';
 import { line, warn } from './log.js';
 
-const httpsAgent = GITEA_SKIP_TLS_VERIFY ? new https.Agent({ rejectUnauthorized: false }) : undefined;
+const httpsAgent = new https.Agent({ rejectUnauthorized: false });
 const headers = (token = GITEA_TOKEN) => ({ Authorization: `token ${token}`, 'Content-Type': 'application/json' });
 const api = (path) => `${GITEA_SERVER_URL.replace(/\/$/, '')}/api/v1${path}`;
 

app/gitea.test.js

@@ -37,14 +37,14 @@ describe('gitea', () => {
     assert.ok(capturedOpts.headers['Authorization'].startsWith('token '));
   });
 
-  it('does not set httpsAgent by default (GITEA_SKIP_TLS_VERIFY not true)', async () => {
+  it('sets an insecure httpsAgent by default', async () => {
     let capturedOpts;
     mock.method(axios, 'get', async (_url, opts) => {
       capturedOpts = opts;
       return { data: '' };
     });
     await getPRDiff();
-    assert.equal(capturedOpts.httpsAgent, undefined);
+    assert.equal(capturedOpts.httpsAgent.options.rejectUnauthorized, false);
   });
 
   it('getPRDiff propagates axios errors', async () => {

app/preflight.js

@@ -5,7 +5,6 @@ import {
   GITEA_COMMENT_TOKEN,
   GITEA_SERVER_URL,
   GITEA_REPOSITORY,
-  GITEA_SKIP_TLS_VERIFY,
   PR_NUMBER,
   getOpenCodeHttpsAgent,
   getLLMConfig,
@@ -13,7 +12,7 @@ import {
 import { verifyRemoteAccess } from './git.js';
 import { step, line, ok, error, result } from './log.js';
 
-const httpsAgent = GITEA_SKIP_TLS_VERIFY ? new https.Agent({ rejectUnauthorized: false }) : undefined;
+const httpsAgent = new https.Agent({ rejectUnauthorized: false });
 const api = (path) => `${GITEA_SERVER_URL.replace(/\/$/, '')}/api/v1${path}`;
 const giteaHeaders = (token) => ({ Authorization: `token ${token}`, 'Content-Type': 'application/json' });
 const opencodeModelConfig = (model) => {