让 AI 生成的代码安全上线：三层约束框架与 QA 左移实践

name: ai-code-quality-gate

on:
  pull_request:
    paths:
      - 'src/**'          # 只对业务代码目录触发
      - 'ai-prompts/**'   # Prompt 模板变更也触发，确保输入约束同步更新

jobs:
  # ── Stage 1: 输入约束校验 ──
  input-guard:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: 校验 Prompt 模板必填字段
        run: |
          # 检查每个 Prompt 模板是否包含必填段落
          MISSING=0
          for f in ai-prompts/*.md; do
            for field in "函数签名" "入参校验" "异常处理" "禁止依赖"; do
              if ! grep -q "$field" "$f"; then
                echo "❌ $f 缺少必填字段: $field"
                MISSING=1
              fi
            done
          done
          if [ "$MISSING" -eq 1 ]; then
            echo "::error::Prompt 模板校验失败，缺少必填字段"
            exit 1
          fi
          echo "✅ Prompt 模板校验通过"

      - name: 校验上下文注入范围
        run: |
          # 上下文文件清单不得超过 20 个，避免窗口膨胀
          COUNT=$(wc -l < ai-prompts/context-manifest.txt)
          if [ "$COUNT" -gt 20 ]; then
            echo "::error::上下文文件数 $COUNT 超过阈值 20"
            exit 1
          fi

  # ── Stage 2: 生成结果抽取与结构校验 ──
  generate-extract:
    needs: input-guard
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: 抽取代码块 & 校验语法完整性
        run: |
          python3 scripts/extract_code_blocks.py \
            --input src/ \
            --output .extracted/ \
            --whitelist-deps "utils,models,api" \
            --blocklist-deps "os.system,subprocess,eval,exec"

          # 用 Python AST 检查抽取结果是否语法完整
          python3 scripts/ast_check.py --dir .extracted/ || {
            echo "::error::生成代码语法树不完整"
            exit 1
          }

  # ── Stage 3: 输出质量门 ──
  output-gate:
    needs: generate-extract
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Lint & Type Check
        run: |
          pip install ruff mypy
          ruff check src/ --strict
          mypy src/ --strict --ignore-missing-imports

      - name: 单测覆盖率卡点
        run: |
          pip install pytest pytest-cov
          pytest src/ --cov=src/ --cov-fail-under=80

      - name: 安全扫描
        uses: zizmorcore/zizmor-action@v0      # 扫描硬编码密钥等
        with:
          severity: high

      - name: 依赖漏洞检查
        run: |
          pip install pip-audit
          pip-audit --strict

"""从 AI 生成文件中抽取代码块，过滤禁止依赖"""
import ast, re, sys, pathlib

WHITELIST = {"utils", "models", "api"}
BLOCKLIST = {"os.system", "subprocess", "eval", "exec"}

def extract_blocks(text: str) -> list[str]:
    """抽取 ```python ... ``` 代码块"""
    return re.findall(r"```python\n(.*?)```", text, re.DOTALL)

def check_imports(code: str) -> list[str]:
    """返回违规 import 列表"""
    violations = []
    tree = ast.parse(code)
    for node in ast.walk(tree):
        if isinstance(node, ast.Import):
            for alias in node.names:
                root = alias.name.split(".")[0]
                if root not in WHITELIST:
                    violations.append(alias.name)
        if isinstance(node, ast.ImportFrom):
            if node.module and node.module.split(".")[0] not in WHITELIST:
                violations.append(node.module)
    return violations

def check_blocklist(code: str) -> list[str]:
    """返回出现的禁止调用"""
    found = [b for b in BLOCKLIST if b in code]
    return found

def main(src_dir: str, out_dir: str):
    violations_total = []
    out_path = pathlib.Path(out_dir)
    out_path.mkdir(exist_ok=True)

    for f in pathlib.Path(src_dir).rglob("*.py"):
        blocks = extract_blocks(f.read_text())
        for i, block in enumerate(blocks):
            imp_violations = check_imports(block)
            blk_violations = check_blocklist(block)
            if imp_violations or blk_violations:
                violations_total.append(
                    f"{f.name} block#{i}: imports={imp_violations} blocklist={blk_violations}"
                )
                continue
            # 语法完整性校验
            try:
                ast.parse(block)
            except SyntaxError as e:
                violations_total.append(f"{f.name} block#{i}: syntax error {e}")
                continue
            # 写出合法代码块
            (out_path / f"{f.stem}_block{i}.py").write_text(block)

    if violations_total:
        for v in violations_total:
            print(f"❌ {v}")
        sys.exit(1)
    print("✅ 所有代码块校验通过")

if __name__ == "__main__":
    main(sys.argv[1], sys.argv[2])