feat(ci): 完善门禁签名去重、Fork隔离与依赖版本升级 #9
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,111 +1,92 @@ | ||
| name: AI Review | ||
|
|
||
| on: | ||
| issue_comment: | ||
| types: [created] | ||
| workflow_dispatch: | ||
| inputs: | ||
| pr_number: | ||
| description: "Pull Request Number" | ||
| required: true | ||
| type: string | ||
|
|
||
| concurrency: | ||
| group: ai-review-${{ github.event.issue.number || inputs.pr_number }} | ||
| cancel-in-progress: true | ||
|
|
||
| jobs: | ||
| review: | ||
| name: Timi Reviewer | ||
| runs-on: ubuntu-latest | ||
| if: >- | ||
| vars.AI_REVIEW_ENABLED == 'true' && | ||
| ( | ||
| github.event_name == 'workflow_dispatch' || | ||
| ( | ||
| github.event.issue.pull_request != null && | ||
| contains(github.event.comment.body, '@timi-ai') && | ||
| (github.event.comment.author_association == 'OWNER' || | ||
| github.event.comment.author_association == 'MEMBER' || | ||
| github.event.comment.author_association == 'COLLABORATOR') | ||
| ) | ||
| ) | ||
| timeout-minutes: 20 | ||
| permissions: | ||
| contents: read | ||
| actions: read | ||
| steps: | ||
| - name: 检出代码 | ||
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | ||
| with: | ||
| ref: refs/pull/${{ github.event.issue.number || inputs.pr_number }}/head | ||
| fetch-depth: 0 | ||
| persist-credentials: false | ||
|
|
||
| - name: 恢复受信任的审查资源 | ||
| run: git checkout origin/main -- scripts/ai-review.ts REVIEW_GUIDELINES.md 2>/dev/null || true | ||
|
|
||
| - name: 获取 Timi AI Bot 凭据 | ||
| id: bot-token | ||
| uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0 | ||
| with: | ||
| app-id: ${{ secrets.TIMI_AI_APP_ID }} | ||
| private-key: ${{ secrets.TIMI_AI_PRIVATE_KEY }} | ||
|
|
||
| - name: 安装 Bun 运行时 | ||
| uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0 | ||
| with: | ||
| bun-version: "1.3.14" | ||
|
|
||
| - name: 安装依赖 | ||
| env: | ||
| PI_CODING_AGENT_DIR: ${{ runner.temp }}/pi-agent | ||
| run: | | ||
| bun install -g @earendil-works/pi-coding-agent | ||
| pi install git:github.com/earendil-works/pi-review | ||
|
|
||
| - name: 写入认证 | ||
| env: | ||
| PI_AUTH_JSON: ${{ secrets.PI_AUTH_JSON }} | ||
| run: | | ||
| mkdir -p "$RUNNER_TEMP/pi-agent" | ||
| printf '%s' "$PI_AUTH_JSON" > "$RUNNER_TEMP/pi-agent/auth.json" | ||
| chmod 600 "$RUNNER_TEMP/pi-agent/auth.json" | ||
|
|
||
| - name: 运行审查 | ||
| env: | ||
| BOT_TOKEN: ${{ steps.bot-token.outputs.token }} | ||
| GH_REPO: ${{ github.repository }} | ||
| PR_NUMBER: ${{ github.event.issue.number || inputs.pr_number }} | ||
| EVENT_NAME: ${{ github.event_name }} | ||
| COMMENT_BODY: ${{ github.event.comment.body }} | ||
| RUNNER_TEMP: ${{ runner.temp }} | ||
| run: bun run scripts/ai-review.ts | ||
|
|
||
| - name: 保存会话工件 | ||
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | ||
| if: always() | ||
| with: | ||
| name: pi-session-pr-${{ github.event.issue.number || inputs.pr_number }} | ||
| path: ${{ runner.temp }}/pi-session/ | ||
| retention-days: 15 | ||
| overwrite: true | ||
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,7 +1,6 @@ | ||
| name: Cache Cleanup | ||
|
|
||
| # PR 生命周期管理：当 PR 合并或关闭时，自动清除该 PR 独占的分支编译缓存与 AI 审查会话工件。 | ||
|
|
||
| on: | ||
| pull_request: | ||
|
|
@@ -13,7 +12,7 @@ permissions: | |
|
|
||
| jobs: | ||
| cleanup: | ||
| name: 清理已关闭 PR 缓存与会话 | ||
| runs-on: ubuntu-latest | ||
| steps: | ||
| - name: 删除当前 PR 命名空间下的所有缓存与会话工件 | ||
|
|
@@ -22,9 +21,9 @@ jobs: | |
| GH_REPO: ${{ github.repository }} | ||
| PR_NUMBER: ${{ github.event.pull_request.number }} | ||
| run: | | ||
| # 1. 删除当前 PR 的分支独占编译缓存 | ||
| gh cache delete --all --ref "refs/pull/${PR_NUMBER}/merge" 2>/dev/null || true | ||
| # 2. 物理销毁当前 PR 的 AI 审查会话工件 | ||
| gh api --paginate "repos/${GH_REPO}/actions/artifacts" \ | ||
| --jq ".artifacts[] | select(.name == \"pi-session-pr-${PR_NUMBER}\") | .id" \ | ||
| | xargs -r -I{} gh api --method DELETE "repos/${GH_REPO}/actions/artifacts/{}" | ||
|
Comment on lines
+26
to
+29
There was a problem hiding this comment. 🗄️ Data Integrity & Integration | 🟠 Major | 🏗️ Heavy lift 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -e
printf '%s\n' '--- workflow files ---'
git ls-files '.github/workflows/*'
printf '%s\n' '--- cache-cleanup.yml ---'
cat -n .github/workflows/cache-cleanup.yml
printf '%s\n' '--- ai-review.yml relevant sections ---'
cat -n .github/workflows/ai-review.yml | sed -n '1,125p'
printf '%s\n' '--- references to session artifact and cleanup ---'
rg -n -C 3 'pi-session-pr-|cache-cleanup|workflow_run|pull_request|actions/artifacts|always\(\)' .github/workflowsRepository: 0xTimi-labs/rust-template Length of output: 15905 🌐 Web query:
💡 Result: In GitHub Actions, concurrency control, artifact management, and job execution behavior work as follows: Concurrency and Cancel-in-Progress The concurrency keyword limits how many workflow runs or jobs within the same concurrency group execute at once [1][2]. By default, a concurrency group allows at most one running job/workflow and one pending job/workflow [3][4]. If a new job is queued while another is pending, the existing pending job is cancelled and replaced by the new one [1][3]. Setting cancel-in-progress: true will also cancel any currently running job in that concurrency group [1][3]. You can also use conditional expressions with cancel-in-progress to dynamically control this behavior based on the branch or other context [3][4]. Note that cancel-in-progress cannot be used with the queue: max option [1][3]. Artifact Upload and Overwrite In version 4 and later of the upload-artifact action, artifacts are immutable by default [5][6][7]. If you attempt to upload an artifact with a name that already exists in the same workflow run, the action will fail [7]. To effectively "overwrite" an artifact, you must set overwrite: true in the upload-artifact action; this deletes the existing artifact before the new one is uploaded [8][9]. Note that this assigns the new artifact a different ID [5][6]. Artifact Retention By default, artifacts are retained for 90 days [10][11]. This period can be customized at the organization or repository level, ranging from 1 to 90 days for public repositories, or up to 400 days for private repositories [10]. You can also set a custom retention period for an individual artifact using the retention-days parameter within the upload-artifact action [12][11]. This custom value cannot exceed the maximum retention limit configured for the repository or organization [12]. Always Function The always expression is a function used in job-level or step-level if conditionals [1]. It ensures that a job or step runs even if previous steps have failed, were canceled, or were skipped [1]. This is commonly used for cleanup steps or reporting, such as uploading logs or artifacts even after a test failure. Top Results: [1], [3], [8], [7], [10], [12] Citations:
🌐 Web query:
💡 Result: The Citations:
🏁 Script executed: #!/bin/bash
set -e
python3 - <<'PY'
from pathlib import Path
import re
cleanup = Path(".github/workflows/cache-cleanup.yml").read_text()
review = Path(".github/workflows/ai-review.yml").read_text()
print("cleanup trigger:", re.search(r"on:\s*\n\s*pull_request:\s*\n\s*types:\s*\[([^\]]+)\]", cleanup).group(1))
print("review triggers:", re.search(r"on:\s*\n((?:\s{2,}.*\n)+?)\nconcurrency:", review).group(1).strip())
print("cleanup concurrency:", "present" if re.search(r"^concurrency:", cleanup, re.M) else "absent")
print("review concurrency group:",
re.search(r"group:\s*(.+)", review).group(1).strip())
print("review cancellation:",
re.search(r"cancel-in-progress:\s*(.+)", review).group(1).strip())
print("upload condition:",
re.search(r"^\s*if:\s*(.+)", review[review.index("uses: actions/upload-artifact"):], re.M).group(1).strip())
print("upload overwrite:",
re.search(r"^\s*overwrite:\s*(.+)", review[review.index("uses: actions/upload-artifact"):], re.M).group(1).strip())
print("upload retention:",
re.search(r"^\s*retention-days:\s*(.+)", review[review.index("uses: actions/upload-artifact"):], re.M).group(1).strip())
PYRepository: 0xTimi-labs/rust-template Length of output: 591 协调 PR 关闭与 AI 审查工件上传 PR 关闭事件不会取消独立的 AI Review 运行。清理任务只删除查询时存在的工件；AI Review 随后可能通过 请在删除前取消并等待相关运行结束，并阻止已取消运行上传工件；或在 AI Review 完成事件中执行幂等清理，覆盖上传与删除之间的竞态。 |
||
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -39,7 +39,7 @@ jobs: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | ||
| with: | ||
| persist-credentials: false | ||
| - uses: taiki-e/install-action@b6ff580856c41316412a0b9b60540fbc6f8c82cc # v2.86.7 | ||
| with: | ||
| tool: cargo-deny | ||
| - name: 检查依赖合规与安全漏洞 | ||
|
|
||
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
两个工作流签发的 App token 都未限定范围。
actions/create-github-app-token在缺省配置下签发覆盖该 App 全部安装权限、全部可访问仓库的 token。请在两处都显式声明owner、repositories和permission-*，按最小权限收窄。.github/workflows/ai-review.yml#L48-L53：添加owner、repositories，并限定为permission-issues: write与permission-actions: read（restoreSessionArtifact需要读取工件）。该 token 通过BOT_TOKEN传给scripts/ai-review.ts执行gh api，暴露面最大。.github/workflows/review-gate.yml#L104-L109：添加owner、repositories，并限定为permission-pull-requests: read与permission-issues: write。🧰 Tools
🪛 zizmor (1.29.0)
[error] 50-50: dangerous use of GitHub App tokens (github-app): app token inherits blanket installation permissions
(github-app)
📍 Affects 2 files
.github/workflows/ai-review.yml#L48-L53(this comment).github/workflows/review-gate.yml#L104-L109Source: Linters/SAST tools