AI Code Review 自动化流水线：从 PR 到合并的无人值守质量门禁

name: AI Code Review Pipeline

on:
  pull_request:
    types: [opened, synchronize, reopened]

permissions:
  contents: read
  pull-requests: write

jobs:
  static-analysis:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Run ESLint
        run: npx eslint --format json -o eslint-report.json . || true
      - name: Run Semgrep
        uses: returntocorp/semgrep-action@v1
        with:
          config: p/default
      - name: Upload reports
        uses: actions/upload-artifact@v4
        with:
          name: static-reports
          path: "*.json"

  security-scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Run Trivy
        uses: aquasecurity/trivy-action@master
        with:
          scan-type: fs
          severity: CRITICAL,HIGH
          exit-code: 1

  ai-review:
    runs-on: ubuntu-latest
    needs: [static-analysis, security-scan]
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Get PR Diff
        id: diff
        run: |
          git diff origin/${{ github.base_ref }}...HEAD \
            --unified=5 \
            --diff-filter=ACMR \
            -- '*.ts' '*.tsx' '*.py' '*.go' \
            > pr_diff.patch
          echo "diff_size=$(wc -c < pr_diff.patch)" >> $GITHUB_OUTPUT

      - name: AI Review
        if: steps.diff.outputs.diff_size > 100
        uses: actions/github-script@v7
        env:
          OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
        with:
          script: |
            const fs = require('fs');
            const diff = fs.readFileSync('pr_diff.patch', 'utf8');

            // 分块处理大 Diff
            const chunks = splitDiffByFile(diff);
            const reviews = [];

            for (const chunk of chunks) {
              const response = await callLLM(chunk);
              if (response.issues.length > 0) {
                reviews.push(...response.issues);
              }
            }

            // 发布高置信度评论
            const filtered = reviews.filter(r => r.confidence > 0.7);
            await postReviewComments(github, context, filtered);

import OpenAI from 'openai';

interface ReviewIssue {
  file: string;
  line: number;
  severity: 'critical' | 'warning' | 'suggestion';
  category: 'security' | 'performance' | 'logic' | 'style';
  message: string;
  suggestion?: string;
  confidence: number;
}

const SYSTEM_PROMPT = `You are a senior code reviewer focusing on:
1. Security vulnerabilities (SQL injection, XSS, auth bypass)
2. Performance regressions (N+1 queries, memory leaks, blocking calls)
3. Logic errors (off-by-one, race conditions, null safety)
4. API contract violations

Rules:
- Only report issues with confidence >= 0.7
- Provide specific line references
- Include fix suggestions as code snippets
- DO NOT comment on style/formatting (handled by linters)
- Output valid JSON array of ReviewIssue objects`;

async function reviewDiffChunk(
  client: OpenAI,
  diff: string,
  contextFiles: string[]
): Promise<ReviewIssue[]> {
  const response = await client.chat.completions.create({
    model: 'gpt-4o',
    temperature: 0.1,
    response_format: { type: 'json_object' },
    messages: [
      { role: 'system', content: SYSTEM_PROMPT },
      {
        role: 'user',
        content: `## Diff to review:\n\`\`\`diff\n${diff}\n\`\`\`\n\n## Related context files:\n${contextFiles.join('\n')}`
      }
    ],
    max_tokens: 2000
  });

  const result = JSON.parse(response.choices[0].message.content || '{}');
  return result.issues || [];
}

# .gitlab-ci.yml
ai-code-review:
  stage: review
  image: node:20-slim
  rules:
    - if: $CI_PIPELINE_SOURCE == "merge_request_event"
  script:
    - git diff $CI_MERGE_REQUEST_DIFF_BASE_SHA...$CI_COMMIT_SHA > diff.patch
    - node scripts/ai-review.js --diff diff.patch --mr $CI_MERGE_REQUEST_IID
  variables:
    OPENAI_API_KEY: $OPENAI_API_KEY
  allow_failure: true

# 安全检测 Prompt 模板
SECURITY_PROMPT = """
Analyze this code diff for security vulnerabilities:
- SQL/NoSQL injection via string concatenation
- Command injection through unsanitized inputs
- Path traversal in file operations
- Missing authentication/authorization checks
- Hardcoded credentials or API keys
- Insecure deserialization

For each finding, provide:
1. Vulnerability type (CWE ID if applicable)
2. Affected line numbers
3. Exploitation scenario
4. Recommended fix with code
"""

<!-- .cursor/rules/security.mdc -->
---
description: Security patterns for this project
globs: ["src/**/*.ts"]
---

## Security Rules
- NEVER concatenate user input into SQL queries, use parameterized queries
- ALWAYS validate and sanitize input at API boundaries
- NEVER log sensitive data (passwords, tokens, PII)

# 明确告诉 AI "什么不要评论"
EXCLUSION_RULES = """
DO NOT comment on:
- Code style issues (handled by linters)
- Test file changes (unless security-related)
- Auto-generated files (*.pb.go, *.generated.ts)
- Documentation-only changes
- Import reordering
"""

// 收集开发者反馈
interface ReviewFeedback {
  issueId: string;
  action: 'accepted' | 'dismissed' | 'modified';
  reason?: string;
}

// 定期分析反馈数据，调优 Prompt
function analyzeWeeklyFeedback(feedbacks: ReviewFeedback[]) {
  const dismissRate = feedbacks.filter(f => f.action === 'dismissed').length / feedbacks.length;
  const topDismissReasons = groupBy(feedbacks.filter(f => f.reason), 'reason');

  // 如果某类建议 dismiss 率 > 50%，自动从 Prompt 中移除
  return generatePromptAdjustments(topDismissReasons);
}

import subprocess
from typing import List

def get_relevant_diff(base_branch: str, file_patterns: List[str]) -> str:
    """只提取变更文件的 diff，忽略无关文件"""
    patterns = ' '.join(f"-- '{p}'" for p in file_patterns)
    cmd = f"git diff {base_branch}...HEAD --unified=3 --diff-filter=ACMR {patterns}"
    return subprocess.check_output(cmd, shell=True).decode()

def chunk_diff_by_file(diff: str, max_tokens: int = 3000) -> List[str]:
    """按文件分块，避免超出上下文窗口"""
    files = diff.split('diff --git')
    chunks, current_chunk = [], ''

    for file_diff in files:
        if estimate_tokens(current_chunk + file_diff) > max_tokens:
            if current_chunk:
                chunks.append(current_chunk)
            current_chunk = file_diff
        else:
            current_chunk += file_diff

    if current_chunk:
        chunks.append(current_chunk)
    return chunks

function getIncrementalDiff(prNumber: number, lastReviewedSha: string): string {
  // 只获取上次审查之后的新增变更
  return execSync(
    `git diff ${lastReviewedSha}...HEAD --unified=3`
  ).toString();
}

#!/usr/bin/env python3
"""AI Code Review Pipeline - Production Implementation"""

import os
import json
import subprocess
from dataclasses import dataclass, asdict
from typing import Optional
from openai import OpenAI

@dataclass
class ReviewComment:
    path: str
    line: int
    body: str
    severity: str
    confidence: float
    category: str
    suggestion: Optional[str] = None

class AIReviewPipeline:
    def __init__(self):
        self.client = OpenAI(api_key=os.environ['OPENAI_API_KEY'])
        self.confidence_threshold = 0.7
        self.max_comments_per_pr = 15

    def run(self, base_ref: str, head_ref: str) -> list[ReviewComment]:
        diff = self._get_diff(base_ref, head_ref)
        if not diff.strip():
            return []

        chunks = self._split_by_file(diff)
        all_comments = []

        for chunk in chunks:
            comments = self._review_chunk(chunk)
            all_comments.extend(comments)

        # 过滤低置信度 + 限制总数
        filtered = [c for c in all_comments if c.confidence >= self.confidence_threshold]
        filtered.sort(key=lambda x: x.confidence, reverse=True)
        return filtered[:self.max_comments_per_pr]

    def _get_diff(self, base: str, head: str) -> str:
        result = subprocess.run(
            ['git', 'diff', f'{base}...{head}', '--unified=5',
             '--diff-filter=ACMR', '--', '*.py', '*.ts', '*.go'],
            capture_output=True, text=True
        )
        return result.stdout

    def _split_by_file(self, diff: str) -> list[str]:
        parts = diff.split('diff --git ')
        return [f'diff --git {p}' for p in parts[1:] if p.strip()]

    def _review_chunk(self, chunk: str) -> list[ReviewComment]:
        response = self.client.chat.completions.create(
            model='gpt-4o',
            temperature=0.1,
            messages=[
                {'role': 'system', 'content': REVIEW_SYSTEM_PROMPT},
                {'role': 'user', 'content': f'```diff\n{chunk}\n```'}
            ],
            response_format={'type': 'json_object'}
        )
        data = json.loads(response.choices[0].message.content)
        return [ReviewComment(**item) for item in data.get('comments', [])]


REVIEW_SYSTEM_PROMPT = """You are a senior code reviewer. Analyze the diff and return JSON:
{"comments": [{"path": "file.py", "line": 10, "body": "...", "severity": "critical|warning|suggestion", "confidence": 0.0-1.0, "category": "security|performance|logic", "suggestion": "fixed code"}]}

Focus ONLY on: security issues, performance regressions, logic errors, race conditions.
DO NOT comment on: style, formatting, naming, documentation."""


if __name__ == '__main__':
    pipeline = AIReviewPipeline()
    comments = pipeline.run(
        base_ref=os.environ.get('BASE_REF', 'main'),
        head_ref=os.environ.get('HEAD_REF', 'HEAD')
    )
    print(json.dumps([asdict(c) for c in comments], indent=2))