Claude API 代码审查流水线：从 hook 到 CI

# 只取暂存区，忽略生成物
git diff --cached --unified=3 --no-color -- . \
  ':(exclude)*.lock' ':(exclude)package-lock.json' \
  ':(exclude)dist/*' ':(exclude)*.min.js'

{
  "name": "report_findings",
  "description": "提交代码审查结果",
  "input_schema": {
    "type": "object",
    "properties": {
      "findings": {
        "type": "array",
        "items": {
          "type": "object",
          "properties": {
            "file":       {"type": "string"},
            "line":       {"type": "integer"},
            "severity":   {"type": "string", "enum": ["high", "medium", "low"]},
            "issue":      {"type": "string"},
            "suggestion": {"type": "string"}
          },
          "required": ["file", "line", "severity", "issue", "suggestion"]
        }
      }
    },
    "required": ["findings"]
  }
}

#!/usr/bin/env python3
"""ai-review：用 Claude Messages API 审查 git diff。"""
import argparse, os, subprocess, sys, time
import requests

BASE  = os.environ.get("ZAIMOD_BASE", "https://api.zaimod.com").rstrip("/")
MODEL = os.environ.get("REVIEW_MODEL", "claude-sonnet-5")
KEY   = os.environ["ZAIMOD_API_KEY"]
MAX_CHARS = 60_000
IGNORE = ("*.lock", "package-lock.json", "dist/*", "*.min.js", "*.svg")

RULES = """你是资深代码审查者。规则：
1. 只评论 diff 中新增或修改的行，不评论未改动的历史代码。
2. 不报纯风格问题（缩进、命名习惯、注释缺失、import 顺序）。
3. 只报六类：正确性缺陷、边界条件、并发与事务、安全、资源泄漏、错误处理缺失。
4. 每条必须能落到具体行；说不出具体行为后果的，不要报。
5. severity=high 仅用于会导致数据错误、线上故障或安全漏洞的问题。
6. 没有问题就返回空数组，不要为了凑数而报。
常见误报（不要报）：日志文案、TODO 注释、测试文件里的硬编码、示例代码中的密钥占位符。
团队约定：所有外部调用必须有超时；数据库写操作必须显式事务；错误必须带上下文重新抛出。"""

TOOL = {
    "name": "report_findings",
    "description": "提交代码审查结果",
    "input_schema": {
        "type": "object",
        "properties": {"findings": {"type": "array", "items": {
            "type": "object",
            "properties": {
                "file": {"type": "string"}, "line": {"type": "integer"},
                "severity": {"type": "string", "enum": ["high", "medium", "low"]},
                "issue": {"type": "string"}, "suggestion": {"type": "string"}},
            "required": ["file", "line", "severity", "issue", "suggestion"]}}},
        "required": ["findings"]},
}

def collect_diff(staged=False, path=None):
    if path:
        with open(path, encoding="utf-8", errors="replace") as fh:
            return fh.read()
    cmd = ["git", "diff", "--unified=3", "--no-color"]
    if staged:
        cmd.append("--cached")
    cmd += ["--", "."] + [f":(exclude){p}" for p in IGNORE]
    return subprocess.run(cmd, capture_output=True, text=True, check=True).stdout

def review(diff_text):
    if not diff_text.strip():
        return []
    body = {
        "model": MODEL, "max_tokens": 2048, "temperature": 0,
        "system": [{"type": "text", "text": RULES,
                    "cache_control": {"type": "ephemeral"}}],
        "tools": [TOOL],
        "tool_choice": {"type": "tool", "name": "report_findings"},
        "messages": [{"role": "user",
                      "content": "审查以下 diff：\n\n```diff\n"
                                 + diff_text[:MAX_CHARS] + "\n```"}],
    }
    for attempt in range(3):
        r = requests.post(f"{BASE}/v1/messages",
            headers={"x-api-key": KEY, "anthropic-version": "2023-06-01",
                     "content-type": "application/json"},
            json=body, timeout=120)
        if r.status_code in (429, 500, 502, 503, 504):
            time.sleep(2 ** attempt)
            continue
        r.raise_for_status()
        for block in r.json().get("content", []):
            if block.get("type") == "tool_use":
                return block["input"].get("findings", [])
        return []
    raise SystemExit("review failed: retries exhausted")

def to_markdown(findings):
    if not findings:
        return "### AI 审查\n\n未发现需要处理的问题。"
    out = [f"### AI 审查：{len(findings)} 条", ""]
    for f in findings:
        out.append(f"- **{f['severity']}** `{f['file']}:{f['line']}` — {f['issue']}")
        out.append(f"  - 建议：{f['suggestion']}")
    return "\n".join(out)

if __name__ == "__main__":
    ap = argparse.ArgumentParser()
    ap.add_argument("--staged", action="store_true")
    ap.add_argument("--file")
    ap.add_argument("--fail-on", default="high", choices=["high", "medium", "none"])
    ap.add_argument("--markdown-out")
    a = ap.parse_args()

    findings = review(collect_diff(a.staged, a.file))
    for f in findings:
        print(f"{f['severity'].upper():6} {f['file']}:{f['line']}  {f['issue']}")
        print(f"       → {f['suggestion']}")
    print(f"\n共 {len(findings)} 条")
    if a.markdown_out:
        with open(a.markdown_out, "w", encoding="utf-8") as fh:
            fh.write(to_markdown(findings))
    if a.fail_on == "high" and any(f["severity"] == "high" for f in findings):
        sys.exit(1)

#!/usr/bin/env bash
# .git/hooks/pre-commit
set -euo pipefail
[ "${SKIP_AI_REVIEW:-0}" = "1" ] && exit 0
command -v python3 >/dev/null || exit 0
python3 scripts/review.py --staged || {
  echo ""
  echo "AI 审查发现 high 级问题，提交已被阻止。"
  echo "确认无误可跳过：SKIP_AI_REVIEW=1 git commit ..."
  exit 1
}

name: ai-review
on:
  pull_request:
    types: [opened, synchronize, reopened]
concurrency:
  group: ai-review-${{ github.event.pull_request.number }}
  cancel-in-progress: true

jobs:
  review:
    runs-on: ubuntu-latest
    timeout-minutes: 10
    permissions:
      pull-requests: write
      contents: read
    steps:
      - uses: actions/checkout@v4
        with: { fetch-depth: 0 }
      - uses: actions/setup-python@v5
        with: { python-version: "3.12" }
      - run: pip install requests
      - name: Build diff
        run: |
          git diff "origin/${{ github.base_ref }}...HEAD" \
            --unified=3 --no-color -- . > /tmp/pr.diff
          wc -c /tmp/pr.diff
      - name: Review
        env:
          ZAIMOD_API_KEY: ${{ secrets.ZAIMOD_API_KEY }}
        run: python scripts/review.py --file /tmp/pr.diff --markdown-out review.md --fail-on none
      - name: Comment
        if: always()
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: gh pr comment "${{ github.event.pull_request.number }}" --body-file review.md