old-docker-actions/ai-pull-request
2
0
Fork 0
Code Pull Requests 1 Actions Releases Activity

feat: AI Pull Request action — opencode 自動產生 PR 並通過 AI review #2

Open
jiantw83 wants to merge 24 commits from ai-review-resolve/develop-20260626-114117 into develop
pull from: ai-review-resolve/develop-20260626-114117
merge into: :develop
Conversation 5 Commits 24 Files Changed 22
+2 -1
1 changed files with 2 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Showing only changes of commit 21b75caac9 - Show all commits
Dockerfile
+2 -1
View File
@@ -10,9 +10,10 @@ RUN npm install -g opencode-ai
# 複製 Node.js 應用程式
Ghost marked this conversation as resolved
gitea-actions commented 2026-06-26 06:10:55 +00:00
Review
Copy Link
Copy Source

嚴重等級：🟡 警告
審查員：Assassin
問題：Dockerfile 中使用全域 npm install 存在供應鏈風險。
建議：使用 lockfile（如 package-lock.json）確保依賴版本一致性，並定期審查更新。

**嚴重等級**：🟡 警告 **審查員**：Assassin **問題**：Dockerfile 中使用全域 `npm install` 存在供應鏈風險。 **建議**：使用 lockfile（如 `package-lock.json`）確保依賴版本一致性，並定期審查更新。
COPY app/ /app/
WORKDIR /app
# 應用程式無第三方相依套件，僅在有 package-lock 時安裝
RUN if [ -f /app/package-lock.json ]; then cd /app && npm ci --omit=dev; fi
RUN if [ -f package-lock.json ]; then npm ci --omit=dev; fi
COPY entrypoint.sh /entrypoint.sh
RUN chmod +x /entrypoint.sh