┌─────────────────────────────────────────┐
│          层5: 架构级审查                  │  ← 跨文件、模块耦合
├─────────────────────────────────────────┤
│          层4: 业务逻辑审查                │  ← 功能正确性、边界条件
├─────────────────────────────────────────┤
│          层3: 安全审查                    │  ← SAST、依赖扫描、注入检测
├─────────────────────────────────────────┤
│          层2: 代码风格审查                │  ← Linting、格式化、最佳实践
├─────────────────────────────────────────┤
│          层1: 静态分析审查                │  ← 语法错误、类型检查、死代码
└─────────────────────────────────────────┘

from dataclasses import dataclass, field
from enum import Enum
from typing import List, Optional, Dict
import subprocess
import json
import hashlib
from datetime import datetime

class ReviewSeverity(Enum):
    CRITICAL = "critical"    # 必须修复
    HIGH = "high"            # 强烈建议修复
    MEDIUM = "medium"        # 建议修复
    LOW = "low"              # 值得注意
    INFO = "info"            # 信息性提示

@dataclass
class ReviewComment:
    file_path: str
    line_start: int
    line_end: int
    severity: ReviewSeverity
    category: str           # security/bug/style/architecture/performance
    title: str
    description: str
    suggestion: Optional[str] = None
    code_example: Optional[str] = None

@dataclass
class ReviewReport:
    pr_id: str
    commit_sha: str
    comments: List[ReviewComment]
    summary: str
    overall_score: float        # 0-100
    critical_count: int
    blocker_found: bool
    reviewed_at: str = field(default_factory=lambda: datetime.now().isoformat())

import ast
import tokenize
from io import StringIO

class StaticAnalyzer:
    """AST 级别的静态代码分析"""

    def __init__(self):
        self.findings = []

    def analyze_file(self, file_path: str) -> List[ReviewComment]:
        """分析单个 Python 文件"""
        with open(file_path, 'r') as f:
            source = f.read()

        try:
            tree = ast.parse(source, filename=file_path)
        except SyntaxError as e:
            return [ReviewComment(
                file_path=file_path,
                line_start=e.lineno or 0,
                line_end=e.lineno or 0,
                severity=ReviewSeverity.CRITICAL,
                category="bug",
                title="语法错误",
                description=f"文件包含语法错误: {e.msg}",
                suggestion=str(e)
            )]

        comments = []
        for node in ast.walk(tree):
            # 检测空 except 子句
            if isinstance(node, ast.ExceptHandler) and node.type is None:
                comments.append(ReviewComment(
                    file_path=file_path,
                    line_start=node.lineno,
                    line_end=node.end_lineno or node.lineno,
                    severity=ReviewSeverity.HIGH,
                    category="bug",
                    title="裸 except 子句",
                    description="使用裸 except 会捕获所有异常，包括 SystemExit 和 KeyboardInterrupt。建议指定具体的异常类型。",
                    suggestion="except Exception as e:  # 替代 bare except"
                ))

            # 检测可变默认参数
            if isinstance(node, ast.FunctionDef):
                for default in node.args.defaults:
                    if isinstance(default, (ast.List, ast.Dict, ast.Set)):
                        comments.append(ReviewComment(
                            file_path=file_path,
                            line_start=node.lineno,
                            line_end=node.end_lineno or node.lineno,
                            severity=ReviewSeverity.HIGH,
                            category="bug",
                            title="可变默认参数",
                            description="使用可变对象（list/dict/set）作为默认参数会导致意外行为，因为默认参数在函数定义时只初始化一次。",
                            suggestion="使用 None 作为默认值，函数内部再初始化"
                        ))

        return comments

import subprocess
import json
import re

class SecurityReviewer:
    """安全审查层：检测常见安全漏洞"""

    SECURITY_PATTERNS = {
        "sql_injection": [
            r'execute\(.*f["\'].*',
            r'cursor\.execute\(.*\+.*\)',
            r'\.format\(.*\).*WHERE',
        ],
        "command_injection": [
            r'os\.system\(f["\'].*',
            r'subprocess\.call\(.*\+.*\)',
            r'subprocess\.Popen\(.*\+.*\)',
        ],
        "secret_exposure": [
            r'api_key\s*=\s*["\'][^"\']+["\']',
            r'password\s*=\s*["\'][^"\']+["\']',
            r'token\s*=\s*["\'][^"\']+["\']',
            r'secret\s*=\s*["\'][^"\']+["\']',
        ],
        "path_traversal": [
            r'open\(.*\.\.\./.*\)',
            r'open\(.*\.\.\\\\*.*\)',
        ],
        "dangerous_eval": [
            r'eval\(.*\)',
            r'exec\(.*\)',
            r'__import__\(.*\)',
        ],
    }

    def __init__(self, enable_semgrep: bool = True):
        self.enable_semgrep = enable_semgrep

    def scan_file(self, file_path: str) -> List[ReviewComment]:
        """对文件进行安全扫描"""
        with open(file_path, 'r') as f:
            content = f.read()

        comments = []
        for category, patterns in self.SECURITY_PATTERNS.items():
            for pattern in patterns:
                for match in re.finditer(pattern, content, re.MULTILINE):
                    line_no = content[:match.start()].count('\n') + 1
                    comments.append(self._build_security_comment(
                        file_path, line_no, category, match.group()
                    ))

        # 如果启用 semgrep 扫描
        if self.enable_semgrep:
            comments.extend(self._run_semgrep(file_path))

        return comments

    def _build_security_comment(self, file_path: str, line: int,
                                 category: str, matched: str) -> ReviewComment:
        severity_map = {
            "sql_injection": ReviewSeverity.CRITICAL,
            "command_injection": ReviewSeverity.CRITICAL,
            "secret_exposure": ReviewSeverity.CRITICAL,
            "path_traversal": ReviewSeverity.HIGH,
            "dangerous_eval": ReviewSeverity.CRITICAL,
        }
        title_map = {
            "sql_injection": "SQL 注入风险",
            "command_injection": "命令注入风险",
            "secret_exposure": "敏感信息泄露风险",
            "path_traversal": "路径遍历风险",
            "dangerous_eval": "危险代码执行",
        }

        return ReviewComment(
            file_path=file_path,
            line_start=line,
            line_end=line,
            severity=severity_map.get(category, ReviewSeverity.HIGH),
            category="security",
            title=title_map.get(category, "安全风险"),
            description=f"检测到潜在的安全风险({category}): `{matched[:60]}...`",
            suggestion=self._get_suggestion(category)
        )

class ArchitectureReviewer:
    """架构审查层：使用 LLM 进行跨文件架构分析"""

    def __init__(self, model_name: str = "deepseek-v4"):
        self.model_name = model_name

    def analyze_pr_diff(self, diff_content: str,
                         repo_context: Dict) -> ReviewReport:
        """
        分析 PR diff 并提出架构层面的反馈
        """
        # 构建审查 prompt
        prompt = self._build_architecture_prompt(diff_content, repo_context)

        # 调用 LLM 进行分析
        llm_response = self._call_llm(prompt)

        # 解析 LLM 输出为结构化评论
        return self._parse_llm_review(llm_response, repo_context)

    def _build_architecture_prompt(self, diff: str,
                                    context: Dict) -> str:
        return f"""你是一位资深软件架构师，正在审查以下代码变更。

## 变更文件
{diff}

## 项目上下文
- 项目名称: {context.get('project_name', 'N/A')}
- 主要语言: {context.get('language', 'Python')}
- 模块结构: {context.get('module_structure', 'N/A')}

请从以下角度审查：
1. **架构一致性**：变更是否符合现有架构模式
2. **模块耦合**：是否引入了不必要的依赖
3. **接口设计**：API 设计是否合理、向后兼容
4. **可扩展性**：是否为未来扩展留有余地
5. **性能影响**：变更可能带来的性能变化

对每个问题，请给出：
- 严重级别 (critical/high/medium/low/info)
- 具体行号范围
- 问题的具体描述
- 改进建议（含代码示例）
"""

import asyncio
from concurrent.futures import ThreadPoolExecutor
from typing import List

class ReviewPipeline:
    """审查流水线：按层级顺序执行审查"""

    def __init__(self):
        self.layers = [
            ("静态分析", StaticAnalyzer()),
            ("安全审查", SecurityReviewer()),
            ("架构审查", ArchitectureReviewer()),
        ]

    async def review_change(self, diff_content: str,
                             changed_files: List[str]) -> ReviewReport:
        """对变更执行全流程审查"""
        all_comments = []

        for layer_name, analyzer in self.layers:
            with ThreadPoolExecutor() as executor:
                future = executor.submit(
                    analyzer.analyze_files, changed_files
                )
                comments = future.result()
                all_comments.extend(comments)

        # 去重：相同文件/行/类型的评论只保留最严重的一个
        deduplicated = self._deduplicate_comments(all_comments)

        # 生成审查报告
        return self._build_report(dedup=deduplicated)

    def _deduplicate_comments(self,
                               comments: List[ReviewComment]) -> List[ReviewComment]:
        """去重评论"""
        seen = set()
        deduped = []

        severity_order = {
            ReviewSeverity.CRITICAL: 0,
            ReviewSeverity.HIGH: 1,
            ReviewSeverity.MEDIUM: 2,
            ReviewSeverity.LOW: 3,
            ReviewSeverity.INFO: 4,
        }

        for c in sorted(comments, key=lambda x: severity_order.get(x.severity, 99)):
            key = (c.file_path, c.line_start, c.category)
            if key not in seen:
                seen.add(key)
                deduped.append(c)

        return deduped

    def _build_report(self, dedup: List[ReviewComment]) -> ReviewReport:
        """生成最终审查报告"""
        critical = sum(1 for c in dedup
                       if c.severity == ReviewSeverity.CRITICAL)
        high = sum(1 for c in dedup
                   if c.severity == ReviewSeverity.HIGH)

        # 计算综合评分 (满分100)
        base_score = 100.0
        base_score -= critical * 15  # 每个严重问题扣15分
        base_score -= high * 5        # 每个高优先级扣5分
        overall_score = max(0, min(100, base_score))

        summary_parts = []
        by_category = {}
        for c in dedup:
            by_category.setdefault(c.category, []).append(c)

        for category, items in by_category.items():
            summary_parts.append(
                f"- {category}: {len(items)} 个问题"
                f" ({sum(1 for i in items if i.severity == ReviewSeverity.CRITICAL)} critical)"
            )

        return ReviewReport(
            pr_id="",
            commit_sha="",
            comments=dedup,
            summary="## 审查摘要\n\n" + "\n".join(summary_parts),
            overall_score=overall_score,
            critical_count=critical,
            blocker_found=critical > 0,
        )

# .github/workflows/ai-code-review.yml
name: AI Agent Code Review
on:
  pull_request:
    types: [opened, synchronize]

jobs:
  ai-review:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: AI Code Review
        uses: littlecorn-ai/review-action@v1
        with:
          model: deepseek-v4
          severity_threshold: critical
          comment_on_pr: true
          auto_fix: false

class AutoFixEngine:
    """自动修复引擎：能修复的绝不只报告"""

    FIX_PATTERNS = {
        "bare_except": (
            r"except\s*:",
            "except Exception as e:"
        ),
        "mutable_default": (
            r"def\s+\w+\(.*=\s*\[.*\]",
            "# TODO: 请替换默认参数为 None"
        ),
        "print_debug": (
            r'print\(["\'].*debug.*["\']\)',
            "logger.debug(...)  # 替换 print"
        ),
    }

    def apply_auto_fix(self, file_path: str,
                        comment: ReviewComment) -> bool:
        """自动修复简单问题"""
        try:
            with open(file_path, 'r') as f:
                content = f.read()

            for fix_name, (pattern, replacement) in self.FIX_PATTERNS.items():
                if comment.title.lower().startswith(fix_name.replace('_', ' ')):
                    new_content = re.sub(pattern, replacement, content)
                    if new_content != content:
                        with open(file_path, 'w') as f:
                            f.write(new_content)
                        return True

            return False
        except Exception:
            return False

# review-config.yaml
review:
  # 层级控制
  layers:
    static_analysis: true
    security_review: true
    architecture_review: true

  # 严重级别阈值
  threshold: medium  # 只报告 medium 及以上

  # 按路径配置
  path_rules:
    "src/**":        # 核心代码
      severity: low  # 更严格
    "tests/**":
      severity: high # 只报告重要的
    "docs/**":
      severity: info # 只提示

  # 自动修复配置
  auto_fix:
    enabled: true
    categories: [style, format, docstring]
    require_confirmation: true

  # 忽略模式
  ignore:
    - "**/generated/**"
    - "**/vendor/**"
    - "*.pb.go"

# Quality Gate 配置
quality_gates:
  # 阻断条件
  blockers:
    - critical_count > 0      # 严重问题 = 阻断
    - security_vulnerabilities > 0  # 安全漏洞 = 阻断

  # 警告条件（不阻断，但需要审批）
  warnings:
    - overall_score < 70      # 评分低于 70 = 经理审批
    - high_count > 5          # 高优先级问题过多

  # 自动通过条件
  auto_pass:
    - overall_score >= 90     # 高质量变更自动通过
    - changed_files <= 3      # 小型变更