实战五：AI 测试与 CI 集成

name: AI PR Review
on:
  pull_request:
    types: [opened, synchronize, reopened]

jobs:
  digest:
    runs-on: ubuntu-latest
    timeout-minutes: 5
    permissions:
      contents: read
      pull-requests: write
    steps:
      - uses: actions/checkout@v4
        with: { fetch-depth: 2 }
      - name: collect diff
        run: |
          echo "## Changed files" >> $GITHUB_STEP_SUMMARY
          git diff --stat HEAD~1 HEAD >> $GITHUB_STEP_SUMMARY
          git diff HEAD~1 HEAD > /tmp/pr.diff          
      - name: AI digest
        env:
          ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
        run: |
          pip install -q anthropic
          python .github/scripts/ai_digest.py \
                 --diff /tmp/pr.diff   \
                 --output /tmp/digest.md          
      - name: post comment
        uses: peter-evans/create-or-update-comment@v4
        with:
          issue-number: ${{ github.event.pull_request.number }}
          body-path: /tmp/digest.md
          edit-mode: replace
          comment-author: github-actions[bot]

  sanity:
    runs-on: ubuntu-latest
    timeout-minutes: 5
    continue-on-error: true
    steps:
      - uses: actions/checkout@v4
      - uses: astral-sh/setup-uv@v3
      - run: uv tool install detect-secrets bandit semgrep
      - run: detect-secrets scan .  > secrets.json  || true
      - run: bandit -r src/ -f json -o bandit.json  || true
      - run: semgrep scan --json --output semgrep.json --config=p/python || true
      - name: parse severity & build report
        run: node .github/scripts/parse-scan.js secrets.json bandit.json semgrep.json > sanity.md
      - uses: actions/upload-artifact@v4
        with: { name: sanity-report, path: sanity.md }

  unit:
    runs-on: ubuntu-latest
    timeout-minutes: 20
    steps:
      - uses: actions/checkout@v4
      - uses: astral-sh/setup-uv@v3
      - run: uv sync
      - run: uv run pytest -x --cov --cov-report=xml
      - uses: codecov/codecov-action@v4

  skill-check:
    runs-on: ubuntu-latest
    timeout-minutes: 5
    continue-on-error: true
    steps:
      - uses: actions/checkout@v4
      - uses: opencode-ai/setup-opencode@v1
      - name: trigger docs-update skill on diff
        run: |
          opencode oneshot --skill docs-update \
                  --message "Run skill check on PR ${{ github.event.pull_request.number }}" \
                  > skill-output.md          
      - uses: actions/upload-artifact@v4
        with: { name: skill-output, path: skill-output.md }

  bot-comment:
    runs-on: ubuntu-latest
    needs: [digest, sanity, skill-check]
    timeout-minutes: 5
    steps:
      - uses: actions/download-artifact@v4
        with: { path: artifacts }
      - name: assemble
        run: |
          cat artifacts/digest/digest.md > combined.md
          echo "---" >> combined.md
          echo "## Sanity report" >> combined.md
          cat artifacts/sanity-report/sanity.md >> combined.md
          echo "---" >> combined.md
          echo "## docs-update skill output" >> combined.md
          cat artifacts/skill-output/skill-output.md >> combined.md          
      - uses: peter-evans/create-or-update-comment@v4
        with:
          issue-number: ${{ github.event.pull_request.number }}
          body-path: combined.md
          edit-mode: replace
          comment-author: github-actions[bot]

import anthropic, argparse, sys
from pathlib import Path

def main():
    parser = argparse.ArgumentParser()
    parser.add_argument("--diff", required=True)
    parser.add_argument("--output", required=True)
    args = parser.parse_args()

    diff_text = Path(args.diff).read_text()[:40_000]
    if not diff_text:
        Path(args.output).write_text("no diff")
        return

    client = anthropic.Anthropic()
    msg = client.messages.create(
        model="claude-haiku-4-5",
        max_tokens=400,
        messages=[{
            "role": "user",
            "content": f"""You are an underlying code AI reviewer for a github PR.
Write a short markdown digest for the reviewer, with these 3 sections:
1. **Changes summary** (2 lines)
2. **Risk areas** (1-3 bullets, ≤30 chars each, mention severity [low/med/high])
3. **Focus area** (1 line: "Reviewer should focus <X>")

No code blocks. No more than 200 tokens total in output.

Diff:
{diff_text}
"""
        }],
    )
    Path(args.output).write_text(msg.content[0].text)

if __name__ == "__main__":
    main()

// .github/scripts/parse-scan.js
const fs = require("fs");
const path = process.argv.slice(2);

const secrets = JSON.parse(fs.readFileSync(path[0], 'utf8'));
const bandit = JSON.parse(fs.readFileSync(path[1], 'utf8'));
const semgrep = JSON.parse(fs.readFileSync(path[2], 'utf8'));

const sHigh = (secrets.results || []).filter(r => r.suspicious);
const bHigh = (bandit.results || []).filter(r => r.issue_severity === "HIGH");
const sgHigh = (semgrep.results || []).filter(r => r.extra.severity === "ERROR");

const out = [];
out.push("## Secrets scan");
out.push(sHigh.length === 0
         ? "no suspicious secrets found ✓"
         : `Found ${sHigh.length} suspicious secrets:`);
if (sHigh.length) for (const r of sHigh) out.push(`- ${r.filename}:${r.line_number}: ${r.rule_name}`);
out.push("");
out.push("## Bandit");
out.push(bHigh.length === 0
         ? "no HIGH severity ✓"
         : `Found ${bHigh.length} HIGH:`);
for (const r of bHigh) out.push(`- ${r.filename}:${r.line_number}: ${r.test_name}`);
out.push("");
out.push("## Semgrep");
out.push(sgHigh.length === 0
         ? "no error ✓"
         : `Found ${sgHigh.length} semgrep errors:`);
for (const r of sgHigh) out.push(`- ${r.path}:${r.start.line}: ${r.check_id}`);
out.push("");

fs.writeFileSync("/dev/stdout", out.join("\n"));

重要警告:
- "运行 skill check" 在 CI 上, 不要让 Agent 改代码!
- mode 是 read-only / message-only

建议:
opencode oneshot --skill docs-update --message "Run skill for diff #${PR}" --no-edit

───────────────────── conventional AI CI ───────────────────
PR level:           digest + sanity + unit + skill check
Nightly:            full repo docs skill + secret scan
Weekly:             AI mentoring (modeled after 第 27 章的 weekly triage)
Release (pre-tag):  full repo AI review + 高风险 tag scan

local interactive mode:
  skills 文件路径: .opencode/skills/docs-update/SKILL.md
                  (本地直接使用)
CI mode:
  同一 SKILL.md 走 opencode oneshot --skill docs-update --no-edit
全局 mode:
  公司 plugin install 后所有 repo 自动装, 配置只放 opencode plugin list