AI 智能体混进 Fedora 核心代码：一个胡乱生成的 PR 暴露了开源审查的盲区

name: ai-pr-sentinel

on:
  pull_request:
    types: [opened, edited, synchronize]

jobs:
  flag-suspicious-pr:
    runs-on: ubuntu-latest
    permissions:
      pull-requests: write
    steps:
      - name: 检出代码
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: 检测可疑 PR 特征
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          PR_NUMBER: ${{ github.event.pull_request.number }}
          PR_AUTHOR: ${{ github.event.pull_request.user.login }}
          PR_BODY: ${{ github.event.pull_request.body }}
          PR_COMMITS: ${{ github.event.pull_request.commits }}
          PR_CHANGED_FILES: ${{ github.event.pull_request.changed_files }}
        run: |
          SUSPICIOUS=0
          REASONS=""

          # 1. 检查 PR 描述中的 AI 生成痕迹
          AI_KEYWORDS="generated-by-ai|ai-generated|copilot|chatgpt|claude|gemini|auto-generated|autonomous agent"
          if echo "$PR_BODY" | grep -qiE "$AI_KEYWORDS"; then
            SUSPICIOUS=1
            REASONS="$REASONS\n- PR 描述包含 AI 生成关键词"
          fi

          # 2. 检查提交消息中的 AI 痕迹
          AI_COMMIT_MARKERS="co-authored-by.*bot|generated.*ai|autonomous"
          AI_COMMITS=$(git log origin/main..HEAD --oneline --grep="$AI_COMMIT_MARKERS" -i 2>/dev/null | wc -l)
          if [ "$AI_COMMITS" -gt 0 ]; then
            SUSPICIOUS=1
            REASONS="$REASONS\n- $AI_COMMITS 个提交包含 AI 生成标记"
          fi

          # 3. 检查是否来自已知 bot 账号
          KNOWN_BOTS="dependabot|renovate|copilot-suggest|ai-coder"
          if echo "$PR_AUTHOR" | grep -qiE "$KNOWN_BOTS"; then
            SUSPICIOUS=1
            REASONS="$REASONS\n- 提交者 $PR_AUTHOR 是已知 bot 账号"
          fi

          # 4. 微小变更 + 新贡献者 = 高风险组合
          if [ "$PR_CHANGED_FILES" -le 2 ] && [ "$PR_COMMITS" -le 1 ]; then
            # 查该作者在本仓库的历史 PR 数量
            AUTHOR_PRS=$(gh pr list --author "$PR_AUTHOR" --state all --limit 100 --json number -q '.[].number' | wc -l)
            if [ "$AUTHOR_PRS" -le 3 ]; then
              SUSPICIOUS=1
              REASONS="$REASONS\n- 微小变更(1提交/$PR_CHANGED_FILES文件) + 新贡献者(历史${AUTHOR_PRS}个PR)"
            fi
          fi

          # 5. 检查代码差异中是否有典型 AI 生成模式
          #    AI 生成代码常出现过度注释、冗余空行、不自然的格式
          DIFF_STATS=$(git diff origin/main..HEAD --stat | tail -1)
          TOTAL_LINES=$(echo "$DIFF_STATS" | grep -oE '[0-9]+ insertion' | grep -oE '[0-9]+' || echo "0")
          COMMENT_LINES=$(git diff origin/main..HEAD | grep '^+' | grep -cE '^\+\s*(#|//|--|"""|'''|/\*)' || echo "0")
          if [ "$TOTAL_LINES" -gt 0 ]; then
            RATIO=$((COMMENT_LINES * 100 / TOTAL_LINES))
            if [ "$RATIO" -gt 40 ]; then
              SUSPICIOUS=1
              REASONS="$REASONS\n- 注释占比 ${RATIO}%，超过 40% 阈值（AI 生成代码常过度注释）"
            fi
          fi

          if [ "$SUSPICIOUS" -eq 1 ]; then
            echo "::warning::检测到可疑 PR 特征"
            gh pr comment "$PR_NUMBER" --body "⚠️ **AI PR Sentinel 检测到以下可疑特征：**$REASONS\n\n请维护者进行额外审查，重点关注：\n1. 代码逻辑是否正确且必要\n2. 是否存在幻觉式变更（修改不存在的函数、引用错误的 API）\n3. 测试是否真正覆盖了变更意图\n\n建议：要求提交者明确标注代码来源，并人工验证每一行逻辑。"
            # 要求至少两位维护者审查
            gh pr edit "$PR_NUMBER" --add-label "needs-2-reviewers" --add-label "ai-suspicious"
          else
            echo "PR 未检测到可疑特征，走正常审查流程。"
          fi

# 查看最近 60 天内由新贡献者提交且只改了 1-2 个文件的合并 PR
# 适配 GitHub 仓库，替换 OWNER/REPO
gh pr list --state merged --limit 200 --json number,title,author,mergedAt,changedFiles,commits \
  --jq '.[] | select(.changedFiles <= 2 and .commits <= 1) | {number, title, author: .author.login, mergedAt, changedFiles}'