Dev (#14)

* 合并 (#8)

* chore: add comprehensive contributing guide (#10)

* chore: add comprehensive contributing guide

* Update CONTRIBUTING.md

Co-authored-by: greptile-apps[bot] <165735046+greptile-apps[bot]@users.noreply.github.com>

* Update CONTRIBUTING.md

Co-authored-by: greptile-apps[bot] <165735046+greptile-apps[bot]@users.noreply.github.com>

---------

Co-authored-by: greptile-apps[bot] <165735046+greptile-apps[bot]@users.noreply.github.com>

* ci: restore pr-check.yml workflow for dev branch

- Restore backend and frontend PR checks
- Enable Python syntax check and import test for backend
- Enable pnpm build check for frontend
- Fix 'Expected — Waiting for status to be reported' issue

* feat(ci): upgrade PR review + add CI auto-fix & review responder

- Upgrade codex-pr-review.md to 6-perspective review with confidence scoring
- Rewrite claude-pr-review.yml with Codex-first fallback pattern
- Add claude-ci-autofix.yml for auto-fixing CI failures + dev sync
- Add claude-review-responder.yml for auto-responding to PR reviews
- Update CI_CD_SETUP.md with new workflow documentation

* fix(ci): address Codex review security findings

- [Critical] auto-fix: restrict to same-repo PRs only (fork protection)
- [High] review-responder: require explicit @claude mention, restrict to same-repo
- [Medium] auto-fix: use `gh run view --log-failed` instead of broken API call
- [Medium] pr-review: fix Codex matching to use head_sha + pull_requests
- [Low] auto-fix: correct workflow name "Tests" → "Test Suite"

---------

Co-authored-by: greptile-apps[bot] <165735046+greptile-apps[bot]@users.noreply.github.com>

Author: FutureUnreal

.github/workflows/claude-ci-autofix.yml

@@ -2,7 +2,7 @@ name: Claude CI Auto-Fix
 
 on:
   workflow_run:
-    workflows: ["PR Checks", "Tests"]
+    workflows: ["PR Checks", "Test Suite"]
     types: [completed]
 
   workflow_dispatch:
@@ -189,6 +189,8 @@ jobs:
     if: |
       (github.event_name == 'workflow_run' &&
        github.event.workflow_run.conclusion == 'failure' &&
+       github.event.workflow_run.event == 'pull_request' &&
+       github.event.workflow_run.head_repository.full_name == github.repository &&
        !startsWith(github.event.workflow_run.head_branch, 'claude-fix-')) ||
       (github.event_name == 'workflow_dispatch' && github.event.inputs.task_type == 'ci-fix')
     runs-on: ubuntu-latest
@@ -205,6 +207,14 @@ jobs:
           ref: ${{ github.event.workflow_run.head_branch }}
           fetch-depth: 0
 
+      - name: Fetch failed logs
+        id: failed_logs
+        env:
+          GH_TOKEN: ${{ secrets.GH_PAT || github.token }}
+        run: |
+          gh run view ${{ github.event.workflow_run.id }} --log-failed > failed.log 2>/dev/null || echo "Failed to fetch logs" > failed.log
+          echo "log_path=failed.log" >> "$GITHUB_OUTPUT"
+
       - name: Get CI failure details
         id: failure_details
         uses: actions/github-script@v7
@@ -224,33 +234,13 @@ jobs:
 
             const failedJobs = jobs.data.jobs.filter(job => job.conclusion === 'failure');
 
-            let errorLogs = [];
-            for (const job of failedJobs) {
-              try {
-                const logs = await github.rest.actions.downloadJobLogsForWorkflowRun({
-                  owner: context.repo.owner,
-                  repo: context.repo.repo,
-                  job_id: job.id
-                });
-                const logLines = logs.data.split('\n');
-                const relevantLogs = logLines.slice(-3000).join('\n');
-                errorLogs.push({
-                  jobName: job.name,
-                  logs: relevantLogs
-                });
-              } catch (error) {
-                console.log(`Failed to get logs for job ${job.name}: ${error.message}`);
-              }
-            }
-
             const pullRequests = ${{ toJSON(github.event.workflow_run.pull_requests) }};
             const hasPR = pullRequests && pullRequests.length > 0;
 
             return {
               runUrl: run.data.html_url,
               workflowName: run.data.name,
               failedJobs: failedJobs.map(j => j.name),
-              errorLogs: errorLogs,
               hasPR: hasPR,
               prNumber: hasPR ? pullRequests[0].number : null,
               headBranch: '${{ github.event.workflow_run.head_branch }}'
@@ -262,7 +252,7 @@ jobs:
           ANTHROPIC_BASE_URL: ${{ secrets.ANTHROPIC_BASE_URL }}
         with:
           anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
-          github_token: ${{ secrets.GITHUB_TOKEN || secrets.GH_PAT }}
+          github_token: ${{ secrets.GH_PAT || secrets.GITHUB_TOKEN }}
 
           prompt: |
             # Role: CI Failure Auto-Fix Assistant
@@ -284,9 +274,7 @@ jobs:
 
             ## Error Logs
 
-            ```
-            ${{ toJSON(fromJSON(steps.failure_details.outputs.result).errorLogs) }}
-            ```
+            Read the CI failure logs from the file `failed.log` in the workspace root. This file contains the output from the failed CI jobs.
 
             ---
 

.github/workflows/claude-pr-review.yml

@@ -52,11 +52,10 @@ jobs:
               });
 
               const prNumber = context.payload.pull_request.number;
-              const matchingRun = runs.data.workflow_runs.find(run => {
-                const runTime = new Date(run.created_at).getTime();
-                const prTime = new Date(context.payload.pull_request.updated_at).getTime();
-                return Math.abs(runTime - prTime) < 120000 && run.head_sha === context.payload.pull_request.head.sha;
-              });
+              const matchingRun = runs.data.workflow_runs.find(run =>
+                run.head_sha === context.payload.pull_request.head.sha &&
+                run.pull_requests?.some(pr => pr.number === prNumber)
+              );
 
               if (matchingRun) {
                 if (matchingRun.status === 'completed') {

.github/workflows/claude-review-responder.yml

@@ -8,8 +8,8 @@ jobs:
   review-responder:
     if: |
       !endsWith(github.event.review.user.login, '[bot]') &&
-      (github.event.review.state == 'changes_requested' ||
-       contains(github.event.review.body, '@claude'))
+      contains(github.event.review.body, '@claude') &&
+      github.event.pull_request.head.repo.full_name == github.repository
     runs-on: ubuntu-latest
     concurrency:
       group: ${{ github.workflow }}-${{ github.event.pull_request.number }}
@@ -23,7 +23,7 @@ jobs:
         uses: actions/checkout@v5
         with:
           fetch-depth: 0
-          ref: ${{ github.event.pull_request.head.sha }}
+          ref: ${{ github.event.pull_request.head.ref }}
 
       - name: Run Claude Code for Review Response
         uses: anthropics/claude-code-action@v1