fix: governance-drift 评论按漂移指纹去重（红队 RB-B2，ADR-0016）

[randypanding]

ADR-0016（决策 7，解决 .github #46 RB-B2）

问题（复核属实）：漂移持续存在时（如破玻璃未回填的直推 commit——当前线上即有 2 项存量），if:failure 分支每日对同一 issue 追加一条全量报告评论，而 if:success 关闭分支永不可达——评论无限膨胀，真实变化被淹没在重复噪音里。

修复：指纹去重——

• 漂移指纹 = sha256(drift-report.txt)，以隐藏 HTML 注释嵌入每条报告：<!-- drift-fingerprint: FP -->
• 评论前查该 issue 最近 10 条评论：指纹已存在且漂移未变化 → 跳过（日志说明原因）
• 漂移内容变化 → 新指纹 → 新评论（变化必须可见）
• 新建 issue 同样带指纹（次日起去重生效）

语义变为：open issue + 无新评论 = 漂移未变化持续存在；新评论 = 漂移变化；关闭评论 = 漂移消除。噪音从"每日+1"降为"变化才+1"。

本地验证：YAML 解析通过。

[coderabbitai]

Warning

Review limit reached

@randypanding, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 12 minutes

Limit details: You’ve used all 3 included reviews currently available.

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits within each organization.

For paid Pro and Pro+ reviews, CodeRabbit uses a developer's included PR review attempts over the past 7 days to set the current hourly allowance. At typical activity levels, the full plan allowance applies. Higher sustained activity can lower the allowance until earlier attempts leave the 7-day window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: a4a5f123-d2e2-42c0-a949-ca1ca9966ea3

📥 Commits

Reviewing files that changed from the base of the PR and between 0ffe714 and 0618fd2.

📒 Files selected for processing (1)

• .github/workflows/governance-drift.yml

---

_{Comment @coderabbitai help to get the list of available commands.}

[qodo-code-review]

PR Summary by Qodo

按漂移报告指纹去重 governance-drift 评论

🐞 Bug fix 🕐 Less than 10 minutes

AI Description

• 对漂移报告生成 SHA-256 指纹，并嵌入隐藏评论标记。
• 检查最近十条评论，跳过内容未变化的重复报告。
• 漂移变化或新建 issue 时发布带指纹的完整报告。

Diagram

graph TD
  A["Drift report"] --> B["SHA-256 fingerprint"] --> C["Issue lookup"] --> D{"Issue exists?"}
  D -->|No| G["Create issue"]
  D -->|Yes| E{"Marker found?"}
  E -->|Yes| H["Skip duplicate"]
  E -->|No| F["Add comment"]

Loading

High-Level Assessment

The following are alternative approaches to this PR:

1. 在 issue 正文保存当前指纹

• ➕ 无需扫描评论历史即可进行常量时间比较
• ➕ 不会因人工评论挤出最近十条记录而失效
• ➖ 每次漂移变化都需编辑 issue 正文
• ➖ 需处理既有 issue 的迁移与正文更新失败
• ➖ 正文不再保持首次报告的不可变快照

Recommendation: 当前隐藏标记方案改动小、保留漂移变化历史，并直接符合“变化才新增评论”的语义，适合作为本次修复。若后续出现高频人工评论或需要严格的全历史幂等性，可改为在 issue 正文维护当前指纹，避免最近十条评论的窗口限制。

Files changed (1) +13 / -2

Bug fix (1) +13 / -2

governance-drift.yml使用报告指纹抑制重复漂移评论 +13/-2

使用报告指纹抑制重复漂移评论

• 计算 drift-report.txt 的 SHA-256 指纹，并将其作为隐藏 HTML 标记写入 issue 正文或评论。已有漂移 issue 会检查最近十条评论，仅在指纹变化时追加报告，否则输出跳过日志。

.github/workflows/governance-drift.yml

[qodo-code-review]

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 📜 Skill insights (0)

1. 动态字段破坏指纹去重 ✓ Resolved 🐞 Bug ≡ Correctness

Description

工作流对完整报告计算指纹，但报告中的检测窗口时间和直推存续秒数会随运行时间变化，因此同一项持续漂移也会每天得到新指纹。当前长期未回填直推场景仍会不断追加评论，无法实现本 PR 的去重目标。

Code

.github/workflows/governance-drift.yml[44]

+          FP=$(sha256sum drift-report.txt | cut -d' ' -f1)

Relevance

●●● Strong

Same workflow has recent accepted correctness fixes; dynamic report fields directly defeat the PR's
stated deduplication goal.

PR-#19

ⓘ Recommendations generated based on similar findings in past PRs

Evidence

检测脚本的全部标准输出被写入 drift-report.txt，新增代码随后对整个文件计算 SHA-256。脚本使用当前时间计算 SINCE 并将其写入正常检查行；对于本 PR
描述中的未回填直推漂移，还把随时间增长的 AGE 秒数写入漂移行，所以即使漂移对象和配置完全不变，报告字节及其指纹仍会变化。

.github/workflows/governance-drift.yml[28-28]
.github/workflows/governance-drift.yml[44-44]
governance/drift-check.sh[171-176]
governance/drift-check.sh[220-231]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
`drift-report.txt` 包含随运行时间变化的字段，对完整文件计算 SHA-256 会让未变化的漂移产生新指纹并继续追加评论。

## Issue Context
请根据稳定的漂移身份和实际配置值生成规范化指纹，排除检测时间、存续秒数、运行编号、OK 状态等非语义字段。可让检测脚本同时输出机器可读的稳定漂移集合，排序后再计算哈希，并补充跨日期重复运行的验证。

## Fix Focus Areas
- .github/workflows/governance-drift.yml[41-60]
- governance/drift-check.sh[171-231]

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

2. Dedup uses workflow token ✗ Dismissed 📘 Rule violation ⛨ Security

Description

The new deduplication API call authenticates through ${{ github.token }} rather than a
single-repository cloudbrid-agent token obtained from scripts/gh-app-token.sh. This prevents the
operation from using the required application identity and audit trail.

Code

.github/workflows/governance-drift.yml[56]

+            RECENT=$(gh issue view "$NUM" --repo "$REPO" --json comments --jq '[.comments[].body] | .[-10:] | join("\n---\n")')

Relevance

●●● Strong

Recent PR accepted cloudbrid-agent identity and single-repository token requirements, supporting
this workflow authentication finding.

PR-#19

ⓘ Recommendations generated based on similar findings in past PRs

Evidence

Compliance rule 2778539 requires authenticated GitHub API operations to use a single-repository
token produced by scripts/gh-app-token.sh. The workflow supplies ${{ github.token }} as
GH_TOKEN at lines 31–33, and the newly added gh issue view call at line 56 consequently uses
that noncompliant identity.

Rule 2778539: Agent operations must use the cloudbrid-agent GitHub App identity via scripts/gh-app-token.sh with single-repo tokens
.github/workflows/governance-drift.yml[31-33]
.github/workflows/governance-drift.yml[56-60]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
The new `gh issue view` operation and subsequent issue operations use the built-in workflow token instead of the required cloudbrid-agent GitHub App identity.

## Issue Context
Obtain a token by invoking `scripts/gh-app-token.sh` with `CB_APP_ID`, `AGENT_APP_SECRET`, and a repository name scoped to the current repository. Expose the generated token securely to this step as `GH_TOKEN`, replacing `${{ github.token }}` while preserving the full owner/repository value used by `gh --repo`.

## Fix Focus Areas
- .github/workflows/governance-drift.yml[29-63]

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

Context sources

✅ Compliance rules (platform): 7 rules

Review mode: ⚖️ Balanced: This changes runtime CI workflow behavior and GitHub issue-comment deduplication, with API, shell, and reporting semantics that warrant a careful single-pass review; it is localized rather than bug-dense enough for extended.

Tip of the day

💡 Did you know, you can show, collapse, or hide each part of a finding: code, evidence, and all

More tips ↗ | Customize Qodo ↗ | Qodo docs ↗