feat: Gitea 自动代码审查服务

基于 OpenCodeReview 的 webhook 服务：监听 Gitea 的 push 与 Pull Request 事件，调用 OCR 审查 diff，把结果发布回 Gitea，并按阻断阈值决定是否自动合并。主要能力： - Push / PR 事件触发，支持分支 glob 过滤与 PR-only / push-only 范围 - PR 内联评论（按 diff 行号定位）、汇总评论、Issue 生命周期、提交状态 - 可配置阻断阈值（严重级别 / 类别 / 任意意见） - 无阻断问题时自动合并，审查覆盖不完整时拒绝合并 - 内置 Web 后台：仓库配置、任务日志、失败重跑、连通性自检 - SQLite 持久化，worker 重启回收卡死任务，失败自动重试实现为独立服务而非 Gitea Action：本机 act_runner 指向的实例不可达，且后台配置与任务历史需要独立进程承载。
2026-09-20 12:09:46 +08:00
commit ed172bf369
18 changed files with 3451 additions and 0 deletions
@@ -0,0 +1,272 @@
+/** Runs the OpenCodeReview CLI and parses its JSON output. */
+import { spawn } from "node:child_process";
+import { existsSync } from "node:fs";
+import { mkdtemp, rm, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+
+export class OcrError extends Error {
+  constructor(message, { exitCode, stderr, stdout } = {}) {
+    super(message);
+    this.name = "OcrError";
+    this.exitCode = exitCode;
+    this.stderr = stderr;
+    this.stdout = stdout;
+  }
+}
+
+export const CATEGORY_VALUES = [
+  "bug", "security", "performance", "maintainability",
+  "test", "style", "documentation", "other",
+];
+export const SEVERITY_RANK = { critical: 4, high: 3, medium: 2, low: 1 };
+
+const MAX_CAPTURE = 2 * 1024 * 1024;
+
+function run(command, args, { cwd, env, timeoutMs, onOutput } = {}) {
+  return new Promise((resolve) => {
+    const child = spawn(command, args, { cwd, env, windowsHide: true });
+    let stdout = "";
+    let stderr = "";
+    let settled = false;
+
+    const finish = (result) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      resolve(result);
+    };
+
+    const timer = timeoutMs
+      ? setTimeout(() => {
+          try { child.kill("SIGKILL"); } catch { /* already gone */ }
+          finish({ code: 124, stdout, stderr: `${stderr}\n[timeout after ${timeoutMs} ms]` });
+        }, timeoutMs)
+      : null;
+
+    child.stdout.on("data", (chunk) => {
+      const text = chunk.toString();
+      if (stdout.length < MAX_CAPTURE) stdout += text;
+      onOutput?.("stdout", text);
+    });
+    child.stderr.on("data", (chunk) => {
+      const text = chunk.toString();
+      if (stderr.length < MAX_CAPTURE) stderr += text;
+      onOutput?.("stderr", text);
+    });
+    child.on("error", (err) => {
+      finish({ code: 127, stdout, stderr: `${stderr}\n${err.message}` });
+    });
+    child.on("close", (code) => finish({ code, stdout, stderr }));
+  });
+}
+
+function git(args, { cwd, timeoutMs = 300000 } = {}) {
+  return run("git", args, { cwd, timeoutMs });
+}
+
+export class OcrRunner {
+  constructor({
+    command = "ocr",
+    workspaceDir,
+    llm = {},
+    timeoutMs = 45 * 60 * 1000,
+    gitTimeoutMs = 10 * 60 * 1000,
+    logger = () => {},
+  } = {}) {
+    this.command = command;
+    this.workspaceDir = workspaceDir;
+    this.llm = llm;
+    this.timeoutMs = timeoutMs;
+    this.gitTimeoutMs = gitTimeoutMs;
+    this.logger = logger;
+  }
+
+  ocrEnv(extra = {}) {
+    const env = { ...process.env, ...extra };
+    if (this.llm.url) env.OCR_LLM_URL = this.llm.url;
+    if (this.llm.token) env.OCR_LLM_TOKEN = this.llm.token;
+    if (this.llm.model) env.OCR_LLM_MODEL = this.llm.model;
+    if (this.llm.protocol) env.OCR_LLM_PROTOCOL = this.llm.protocol;
+    if (this.llm.authHeader) env.OCR_LLM_AUTH_HEADER = this.llm.authHeader;
+    if (this.llm.extraHeaders) env.OCR_LLM_EXTRA_HEADERS = this.llm.extraHeaders;
+    if (this.llm.timeoutSeconds) env.OCR_LLM_TIMEOUT = String(this.llm.timeoutSeconds);
+    env.OCR_ENABLE_TELEMETRY = "0";
+    return env;
+  }
+
+  /** Verify the OCR binary and the configured LLM endpoint. */
+  async selfTest() {
+    const version = await run(this.command, ["version"], {
+      env: this.ocrEnv(), timeoutMs: 60000,
+    });
+    if (version.code !== 0) {
+      throw new OcrError(`cannot run '${this.command} version'`, {
+        exitCode: version.code, stderr: version.stderr, stdout: version.stdout,
+      });
+    }
+    const test = await run(this.command, ["llm", "test"], {
+      env: this.ocrEnv(), timeoutMs: 120000,
+    });
+    return {
+      version: version.stdout.trim(),
+      llmOk: test.code === 0,
+      llmOutput: `${test.stdout}\n${test.stderr}`.trim(),
+    };
+  }
+
+  async gitClone({ cloneUrl, token, dir, extraHeader = true }) {
+    const args = ["clone", "--no-tags", "--filter=blob:none"];
+    const env = { ...process.env, GIT_TERMINAL_PROMPT: "0" };
+    if (token) {
+      if (extraHeader) {
+        env.GIT_CONFIG_COUNT = "1";
+        env.GIT_CONFIG_KEY_0 = "http.extraHeader";
+        env.GIT_CONFIG_VALUE_0 = `Authorization: token ${token}`;
+      } else {
+        const url = new URL(cloneUrl);
+        url.username = "oauth2";
+        url.password = token;
+        cloneUrl = url.toString();
+      }
+    }
+    args.push(cloneUrl, dir);
+    const res = await run("git", args, { env, timeoutMs: this.gitTimeoutMs });
+    if (res.code !== 0) {
+      throw new OcrError(`git clone failed for ${cloneUrl}`, {
+        exitCode: res.code, stderr: res.stderr, stdout: res.stdout,
+      });
+    }
+    return dir;
+  }
+
+  async fetch(dir, { refs = [], token } = {}) {
+    const env = { ...process.env, GIT_TERMINAL_PROMPT: "0" };
+    if (token) {
+      env.GIT_CONFIG_COUNT = "1";
+      env.GIT_CONFIG_KEY_0 = "http.extraHeader";
+      env.GIT_CONFIG_VALUE_0 = `Authorization: token ${token}`;
+    }
+    const args = ["fetch", "--prune", "--no-tags", "origin"];
+    for (const ref of refs) args.push(ref);
+    const res = await run("git", args, { cwd: dir, env, timeoutMs: this.gitTimeoutMs });
+    if (res.code !== 0) {
+      throw new OcrError(`git fetch failed in ${dir}`, {
+        exitCode: res.code, stderr: res.stderr, stdout: res.stdout,
+      });
+    }
+    return res;
+  }
+
+  async revParse(dir, ref) {
+    const res = await git(["rev-parse", "--verify", `${ref}^{commit}`], { cwd: dir, timeoutMs: 60000 });
+    if (res.code !== 0) return null;
+    return res.stdout.trim().split("\n")[0];
+  }
+
+  async mergeBase(dir, a, b) {
+    const res = await git(["merge-base", a, b], { cwd: dir, timeoutMs: 120000 });
+    if (res.code !== 0) return null;
+    return res.stdout.trim().split("\n")[0];
+  }
+
+  async changedFiles(dir, fromSha, toSha) {
+    const res = await git(
+      ["diff", "--name-only", "--diff-filter=ACMRTUXB", fromSha, toSha],
+      { cwd: dir, timeoutMs: this.gitTimeoutMs },
+    );
+    if (res.code !== 0) return [];
+    return res.stdout.split("\n").map((s) => s.trim()).filter(Boolean);
+  }
+
+  /**
+   * Run a diff review.
+   * @returns {{ comments: object[], summary: object|null, raw: object, stderr: string }}
+   */
+  async review({
+    dir, fromSha, toSha, excludes = [], background, concurrency = 4,
+    maxComments = 30, maxTokensBudget = 0, rulePath, onOutput,
+  }) {
+    const outFile = join(await mkdtemp(join(tmpdir(), "ocr-out-")), "result.json");
+    const args = [
+      "review",
+      "--repo", dir,
+      "--from", fromSha,
+      "--to", toSha,
+      "--format", "json",
+      "--audience", "agent",
+      "--concurrency", String(concurrency),
+      "--output", outFile,
+    ];
+    if (excludes.length) args.push("--exclude", excludes.join(","));
+    if (background) args.push("--background", background);
+    if (rulePath && existsSync(rulePath)) args.push("--rule", rulePath);
+    if (maxTokensBudget > 0) args.push("--max-tokens-budget", String(maxTokensBudget));
+
+    this.logger(`ocr review --from ${fromSha} --to ${toSha} (cwd=${dir})`);
+    const res = await run(this.command, args, {
+      cwd: dir, env: this.ocrEnv(), timeoutMs: this.timeoutMs, onOutput,
+    });
+
+    let raw = null;
+    try {
+      const { readFile } = await import("node:fs/promises");
+      raw = JSON.parse(await readFile(outFile, "utf8"));
+    } catch (err) {
+      if (res.code !== 0) {
+        throw new OcrError(`ocr review failed (exit ${res.code})`, {
+          exitCode: res.code, stderr: res.stderr, stdout: res.stdout,
+        });
+      }
+      throw new OcrError(`cannot parse ocr JSON output: ${err.message}`, {
+        exitCode: res.code, stderr: res.stderr, stdout: res.stdout,
+      });
+    } finally {
+      await rm(outFile, { force: true }).catch(() => {});
+    }
+
+    const comments = Array.isArray(raw?.comments) ? raw.comments : [];
+    const selected = comments
+      .filter((c) => c && typeof c.path === "string" && c.path.length > 0)
+      .slice(0, Math.max(1, maxComments));
+    return {
+      comments: selected,
+      totalComments: comments.length,
+      summary: raw?.summary ?? null,
+      status: raw?.status ?? null,
+      projectSummary: raw?.project_summary ?? "",
+      warnings: raw?.warnings ?? [],
+      raw,
+      stderr: res.stderr,
+      exitCode: res.code,
+    };
+  }
+
+  async preview({ dir, fromSha, toSha, excludes = [], onOutput }) {
+    const args = [
+      "review", "--repo", dir, "--from", fromSha, "--to", toSha,
+      "--format", "json", "--audience", "agent", "--preview",
+    ];
+    if (excludes.length) args.push("--exclude", excludes.join(","));
+    const res = await run(this.command, args, {
+      cwd: dir, env: this.ocrEnv(), timeoutMs: 300000, onOutput,
+    });
+    if (res.code !== 0) {
+      throw new OcrError(`ocr review --preview failed (exit ${res.code})`, {
+        exitCode: res.code, stderr: res.stderr, stdout: res.stdout,
+      });
+    }
+    return JSON.parse(res.stdout);
+  }
+}
+
+export function severityAtLeast(severity, threshold) {
+  const a = SEVERITY_RANK[String(severity || "").toLowerCase()] ?? 0;
+  const b = SEVERITY_RANK[String(threshold || "").toLowerCase()] ?? 0;
+  return a > 0 && b > 0 && a >= b;
+}
+
+export function parseList(value) {
+  if (!value) return [];
+  return String(value).split(",").map((s) => s.trim()).filter(Boolean);
+}