feat(w4): 完整 Qwen3 外置权重、多 hart 执行与验证优化

.github/workflows/ai-code-review.yml

@@ -2,234 +2,171 @@ name: AI Code Review
 
 on:
   workflow_dispatch:
+    inputs:
+      pr_number:
+        description: Pull request number in this repository
+        required: true
+        type: number
   pull_request_target:
     branches: [main]
 
 permissions:
   contents: read
   pull-requests: write
 
+concurrency:
+  group: ai-review-${{ github.repository }}-${{ github.event.pull_request.number || inputs.pr_number }}
+  cancel-in-progress: true
+
 jobs:
-  ai-code-review:
+  prepare:
     runs-on: ubuntu-latest
-    timeout-minutes: 15
-
+    timeout-minutes: 10
+    outputs:
+      matrix: ${{ steps.plan.outputs.matrix }}
     steps:
+      # pull_request_target checks out the trusted base; never run PR head code with secrets.
+      # workflow_dispatch uses the explicitly selected trusted ref.
       - uses: actions/checkout@v4
-        # default checkout in pull_request_target = base branch
-        # only needed for reading .github/prompts/code-review-prompt.md
-
-      - name: Fetch PR diff data
-        id: fetch
+        with:
+          persist-credentials: false
+      - name: Fetch every PR file
+        uses: actions/github-script@v7
         env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: |
-          PR_NUMBER=${{ github.event.pull_request.number }}
-          # 一次性获取所有文件的 patch 数据，存为 JSON 避免重复调用 API
-          gh api "/repos/${{ github.repository }}/pulls/$PR_NUMBER/files" > pr_files.json
-          jq -r '.[].filename' pr_files.json > changed_files.txt
-          COUNT=$(wc -l < changed_files.txt)
-          echo "count=$COUNT" >> "$GITHUB_OUTPUT"
-          echo "Changed files ($COUNT):"
-          cat changed_files.txt
+          PR_NUMBER: ${{ github.event.pull_request.number || inputs.pr_number }}
+        with:
+          script: |
+            const fs = require('fs');
+            fs.mkdirSync('review-plan', {recursive: true});
+            const data = {repository: context.repo.owner + '/' + context.repo.repo, errors: []};
+            try {
+              const pull_number = Number(process.env.PR_NUMBER);
+              if (!Number.isSafeInteger(pull_number) || pull_number <= 0) throw new Error('Invalid PR number');
+              data.pr_number = pull_number;
+              const params = {...context.repo, pull_number};
+              const before = (await github.rest.pulls.get(params)).data;
+              data.head = before.head.sha;
+              data.changed_files = before.changed_files;
+              data.files = await github.paginate(github.rest.pulls.listFiles, {...params, per_page: 100});
+              const after = (await github.rest.pulls.get(params)).data;
+              data.head_after = after.head.sha;
+            } catch (error) {
+              data.errors.push('GitHub PR fetch failed; see failed step status.');
+              core.setFailed('Could not fetch a complete PR file manifest.');
+            } finally {
+              fs.writeFileSync('review-plan/raw.json', JSON.stringify(data));
+            }
+      - name: Plan bounded batches
+        id: plan
+        if: always()
+        run: python3 scripts/ai_code_review.py plan --input review-plan/raw.json --output review-plan/plan.json
+      - uses: actions/upload-artifact@v4
+        if: always()
+        with:
+          name: ai-review-plan
+          path: review-plan/
+          if-no-files-found: error
+          overwrite: true
 
-      - name: AI Code Review
-        id: review
+  review:
+    needs: prepare
+    runs-on: ubuntu-latest
+    timeout-minutes: 40
+    strategy:
+      fail-fast: false
+      max-parallel: 1
+      matrix: ${{ fromJSON(needs.prepare.outputs.matrix) }}
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+      - uses: actions/download-artifact@v4
+        with:
+          name: ai-review-plan
+          path: review-plan
+      - name: Review batch
         env:
           SENSENOVA_API_KEY: ${{ secrets.SENSENOVA_API_KEY }}
+          REVIEW_BATCH: ${{ matrix.batch }}
         run: |
-          # ── Inline system prompt ──
-          SYSTEM_PROMPT=$(cat .github/prompts/code-review-prompt.md)
-
-           REVIEW_FILE="review_output.md"
-          : > "$REVIEW_FILE"
-          HAS_REVIEW=false
-          FILE_COUNT=0
-          MAX_REVIEW_FILES=10
-          SKIPPED_FILES=""
-          CHANGED_FILES=$(cat changed_files.txt)
-
-          # ── Check API key early ──
-          if [ -z "$SENSENOVA_API_KEY" ] || [ "${#SENSENOVA_API_KEY}" -lt 8 ]; then
-            echo "::error::SENSENOVA_API_KEY is not set or invalid. Aborting."
-            exit 1
-          fi
-
-          if [ -z "$CHANGED_FILES" ]; then
-            echo "No files changed, skipping review." >> "$REVIEW_FILE"
-          else
-            while IFS= read -r FILE; do
-              NL=$'\n'
-              [ -z "$FILE" ] && continue
-              if [ "${FILE_COUNT}" -ge "${MAX_REVIEW_FILES}" ]; then
-                echo "  [SKIP] $FILE — max ${MAX_REVIEW_FILES} files reached"
-                SKIPPED_FILES="${SKIPPED_FILES}  - $FILE${NL}"
-                continue
-              fi
-              echo "Reviewing: $FILE"
-
-              # ── Get per-file diff from cached JSON ──
-              DIFF=$(jq -r '.[] | select(.filename == "'"$FILE"'") | .patch // empty' pr_files.json)
-
-              # ── Skip if binary or not diffable (patch is null/empty) ──
-              if [ -z "$DIFF" ]; then
-                echo "  [SKIP] $FILE — binary or not diffable (no patch from API)"
-                continue
-              fi
-
-              # ── Build user message ──
-              USER_MSG="请 review 以下文件变更：${NL}${NL}文件: $FILE${NL}${NL}\`\`\`diff${NL}$DIFF${NL}\`\`\`"
-
-              # ── Escape for JSON ──
-              # Use jq to build the payload safely
-              PAYLOAD=$(jq -n \
-                --arg model "sensenova-6.8-flash-lite" \
-                --arg system "$SYSTEM_PROMPT" \
-                --arg user "$USER_MSG" \
-                '{
-                  model: $model,
-                  messages: [
-                    {role: "system", content: $system},
-                    {role: "user", content: $user}
-                  ],
-                  stream: false
-                }') || { echo "  [ERROR] Failed to build JSON payload for $FILE"; continue; }
-
-              # ── Call SenseNova API ──
-              if [ "${FILE_COUNT:-0}" -gt 0 ]; then
-                sleep 1  # rate-limit: 1s gap between files
-              fi
-              RESPONSE=$(curl -s --max-time 90 --retry 0 -w "\n%{http_code}" \
-                "https://token.sensenova.cn/v1/chat/completions" \
-                -H "Authorization: Bearer $SENSENOVA_API_KEY" \
-                -H "Content-Type: application/json" \
-                -d "$PAYLOAD") || { echo "  [WARN] curl failed for $FILE (exit $?) — skipped (no result)"; continue; }
-
-              HTTP_CODE=$(echo "$RESPONSE" | tail -1)
-              BODY=$(echo "$RESPONSE" | sed '$d')
-
-              if [ "$HTTP_CODE" != "200" ]; then
-                echo "  [ERROR] HTTP $HTTP_CODE for $FILE"
-                echo "  Response: $(echo "$BODY" | head -3)"
-                continue
-              fi
-
-              # ── Extract review text from response ──
-              REVIEW_TEXT=$(echo "$BODY" | jq -r '.choices[0].message.content // empty')
-              if [ -z "$REVIEW_TEXT" ]; then
-                echo "  [WARN] Empty response for $FILE"
-                continue
-              fi
-
-              # ── Append to review output ──
-              {
-                echo "## 📁 \`$FILE\`"
-                echo ""
-                echo "$REVIEW_TEXT"
-                echo ""
-                echo "---"
-                echo ""
-              } >> "$REVIEW_FILE"
-
-              HAS_REVIEW=true
-              FILE_COUNT=$((FILE_COUNT + 1))
-              echo "  [OK] Review completed for $FILE"
-
-            done <<< "$CHANGED_FILES"
-          fi
-
-          # ── Final summary ──
-          {
-            echo "# 🤖 AI Code Review"
-            echo ""
-            echo "> 共审查 **${FILE_COUNT}** 个变更文件"
-            if [ -n "$SKIPPED_FILES" ]; then
-              SKIP_COUNT=$(echo "$SKIPPED_FILES" | grep -c '  - ' || true)
-              echo "> ⚠️ 另有 **${SKIP_COUNT}** 个文件超过上限（最多 ${MAX_REVIEW_FILES} 个）未审查"
-            fi
-            echo ""
-            if [ "$HAS_REVIEW" = true ]; then
-              cat "$REVIEW_FILE"
-            else
-              echo "No reviewable changes found (all files binary, unchanged, or empty)."
-            fi
-            if [ -n "$SKIPPED_FILES" ]; then
-              echo ""
-              echo "---"
-              echo "### ⚠️ 未审查的文件"
-              printf '%b' "$SKIPPED_FILES"
-            fi
-          } > "${REVIEW_FILE}.tmp"
-          mv "${REVIEW_FILE}.tmp" "$REVIEW_FILE"
-
-          echo "Review written to $REVIEW_FILE"
-
-      - name: Upload review artifact
-        uses: actions/upload-artifact@v4
+          python3 scripts/ai_code_review.py review \
+            --plan review-plan/plan.json --batch "$REVIEW_BATCH" \
+            --prompt .github/prompts/code-review-prompt.md \
+            --output "review-batch/batch-$REVIEW_BATCH.json"
+      - uses: actions/upload-artifact@v4
+        if: always()
         with:
-          name: ai-code-review
-          path: review_output.md
-          if-no-files-found: ignore
+          name: ai-review-batch-${{ matrix.batch }}
+          path: review-batch/
+          if-no-files-found: error
+          overwrite: true
 
-      - name: Post review comment
+  ai-code-review:
+    needs: [prepare, review]
+    if: always()
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+      - uses: actions/download-artifact@v4
+        continue-on-error: true
+        with:
+          pattern: ai-review-*
+          path: review-downloads
+      - name: Account for every file
+        env:
+          RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
+        run: |
+          python3 scripts/ai_code_review.py summarize \
+            --directory review-downloads --output review-summary --run-url "$RUN_URL"
+      - name: Check current head and post coverage summary
         uses: actions/github-script@v7
+        env:
+          PR_NUMBER: ${{ github.event.pull_request.number || inputs.pr_number }}
         with:
-          github-token: ${{ secrets.GITHUB_TOKEN }}
           script: |
             const fs = require('fs');
-            const reviewFile = 'review_output.md';
-
-            if (!fs.existsSync(reviewFile)) {
-              console.log('No review output file found, skipping comment.');
+            const pull_number = Number(process.env.PR_NUMBER);
+            if (!Number.isSafeInteger(pull_number) || pull_number <= 0) {
+              core.setFailed('Invalid PR number');
               return;
             }
-
-            const reviewBody = fs.readFileSync(reviewFile, 'utf8').trim();
-            if (!reviewBody) {
-              console.log('Empty review output, skipping comment.');
-              return;
-            }
-
-            const pr = context.payload.pull_request;
-
-            // For pull_request events, get the PR number
-            let issueNumber;
-            if (pr) {
-              issueNumber = pr.number;
-            } else {
-              console.log('Not a pull request event, skipping comment.');
+            const summaryPath = 'review-summary/summary.json';
+            const summary = JSON.parse(fs.readFileSync(summaryPath, 'utf8'));
+            const pr = (await github.rest.pulls.get({...context.repo, pull_number})).data;
+            if (summary.head && pr.head.sha !== summary.head) {
+              summary.complete = false;
+              summary.errors.push('PR head changed after planning; results are stale.');
+              fs.writeFileSync(summaryPath, JSON.stringify(summary, null, 2));
+              for (const path of ['review-summary/review_output.md', 'review-summary/review_comment.md']) {
+                const old = fs.readFileSync(path, 'utf8');
+                fs.writeFileSync(path, '> STALE: PR head changed; this review does not cover the current PR.\n\n' +
+                  old.replace('Coverage: **complete**', 'Coverage: **INCOMPLETE**'));
+              }
+              core.setFailed('Stale review results; not overwriting the current PR comment.');
               return;
             }
-
-            // Check if we already have a review comment from this workflow
-            const comments = await github.rest.issues.listComments({
-              owner: context.repo.owner,
-              repo: context.repo.repo,
-              issue_number: issueNumber,
-              per_page: 100,
+            const body = fs.readFileSync('review-summary/review_comment.md', 'utf8');
+            const comments = await github.paginate(github.rest.issues.listComments, {
+              ...context.repo, issue_number: pull_number, per_page: 100,
             });
-
-            const botComment = comments.data.find(c =>
-              c.user.type === 'Bot' &&
-              c.body.startsWith('# 🤖 AI Code Review')
-            );
-
-            if (botComment) {
-              // Update existing comment
-              await github.rest.issues.updateComment({
-                owner: context.repo.owner,
-                repo: context.repo.repo,
-                comment_id: botComment.id,
-                body: reviewBody,
-              });
-              console.log('Updated existing review comment.');
+            const previous = comments.find(c => c.user.type === 'Bot' && c.body.startsWith('# 🤖 AI Code Review'));
+            if (previous) {
+              await github.rest.issues.updateComment({...context.repo, comment_id: previous.id, body});
             } else {
-              // Create new comment
-              await github.rest.issues.createComment({
-                owner: context.repo.owner,
-                repo: context.repo.repo,
-                issue_number: issueNumber,
-                body: reviewBody,
-              });
-              console.log('Created new review comment.');
+              await github.rest.issues.createComment({...context.repo, issue_number: pull_number, body});
             }
+            await core.summary.addRaw(body).write();
+      - name: Upload full results even when coverage is incomplete
+        uses: actions/upload-artifact@v4
+        if: always()
+        with:
+          name: ai-code-review
+          path: review-summary/
+          if-no-files-found: error
+          overwrite: true
+      - name: Require complete review coverage
+        if: always()
+        run: python3 scripts/ai_code_review.py gate --summary review-summary/summary.json