Electrobun 脱钩 Bun：vibe coding 正在侵蚀基础设施信任

# 设置 main 分支保护规则：强制至少 2 人 review，禁止强制推送
curl -X PUT \
  -H "Authorization: token $GITHUB_TOKEN" \
  -H "Accept: application/vnd.github+json" \
  https://api.github.com/repos/:owner/:repo/branches/main/protection \
  -d '{
    "required_status_checks": {
      "strict": true,
      "contexts": ["ci/lint", "ci/test"]
    },
    "required_pull_request_reviews": {
      "dismiss_stale_reviews": true,
      "require_code_owner_reviews": true,
      "required_approving_review_count": 2
    },
    "restrictions": null,
    "enforce_admins": true
  }'

# .github/workflows/guard.yml
name: Change Size Guard
on:
  pull_request:
    types: [opened, edited, synchronize]

jobs:
  size-check:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - name: Count changed lines
        id: lines
        run: |
          ADDED=$(git diff --numstat origin/main...HEAD | awk '{s+=$1} END {print s}')
          DELETED=$(git diff --numstat origin/main...HEAD | awk '{s+=$2} END {print s}')
          TOTAL=$((ADDED + DELETED))
          echo "total=$TOTAL" >> "$GITHUB_OUTPUT"
          echo "Added: $ADDED, Deleted: $DELETED, Total: $TOTAL"
      - name: Reject oversized PRs
        if: |
          steps.lines.outputs.total > 400 &&
          !contains(github.event.pull_request.labels.*.name, 'large-change')
        run: |
          echo "::error::PR changes ${TOTAL} lines, exceeds 400-line limit."
          echo "If this is intentional, add the 'large-change' label and request 3+ reviewers."
          exit 1

# .git/hooks/pre-commit（或用 husky/lint-staged 管理）
#!/usr/bash
# 检查新增代码中超过 20 行无注释的连续块

STAGED_FILES=$(git diff --cached --name-only --diff-filter=ACM | grep -E '\.(ts|js|rs|py)$')

for FILE in $STAGED_FILES; do
  # 提取新增行
  NEW_LINES=$(git diff --cached "$FILE" | grep '^+' | grep -v '^+++' | sed 's/^+//')

  # 统计连续无注释行的最大长度（注释以 // 或 # 或 /// 开头）
  MAX_BLANK=0
  CURRENT=0
  while IFS= read -r line; do
    trimmed=$(echo "$line" | xargs)
    if [[ -z "$trimmed" ]] || [[ "$trimmed" =~ ^(//|#|///) ]]; then
      CURRENT=0
    else
      CURRENT=$((CURRENT + 1))
      if (( CURRENT > MAX_BLANK )); then
        MAX_BLANK=$CURRENT
      fi
    fi
  done <<< "$NEW_LINES"

  if (( MAX_BLANK > 20 )); then
    echo "⚠ $FILE: found $MAX_BLANK consecutive lines without comments."
    echo "  Large uncommented blocks often indicate AI-generated code."
    echo "  Add intent comments or break the block into smaller reviewed chunks."
    # 不阻塞提交，只警告；CI 中可以做硬拦截
  fi
done

exit 0

# 临时策略：CI 中将 Bun 测试降级为非阻塞，观察稳定性
# .github/workflows/ci.yml 片段
jobs:
  test-bun:
    runs-on: ubuntu-latest
    continue-on-error: true  # Bun 测试失败不阻塞整体 CI
    steps:
      - uses: actions/checkout@v4
      - uses: oven-sh/setup-bun@v2
      - run: bun test
  test-node:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: 22
      - run: npm test