把 AI 代码审查装进终端：阿里 Open Code Review 开源实践

# 通过 pip 安装（假设项目已发布到 PyPI）
pip install open-code-review

# 或直接从 GitHub 仓库安装
pip install git+https://github.com/alibaba/open-code-review.git

# .ocr.yaml - Open Code Review 项目配置
model: qwen-coder-72b    # 使用的 AI 模型，可替换为其他支持的模型

review:
  # 关注的缺陷类别
  focus:
    - logic_error
    - security_vulnerability
    - performance_issue
    - concurrency_risk

  # 忽略的路径（生成的代码、第三方依赖等）
  ignore_paths:
    - "vendor/**"
    - "**/*.generated.go"
    - "migrations/**"

  # 审查严格度：strict / normal / loose
  severity: normal

  # 是否对建议给出修复代码片段
  suggest_fix: true

output:
  format: markdown        # 输出格式：markdown / json / plain
  language: zh-CN         # 审查意见语言

# 审查当前分支相对于 main 的 diff
ocr review --base main

# 只审查最近 3 次提交的变更
ocr review --base HEAD~3

# 审查指定文件
ocr review --base main --files src/auth/login.py,src/auth/session.py

## 🔴 严重：src/auth/login.py L42

**类型**: security_vulnerability

用户输入 `username` 直接拼入 SQL 查询字符串，存在 SQL 注入风险。

```python
# 原代码（有风险）
query = f"SELECT * FROM users WHERE username = '{username}'"

# 建议修复
query = "SELECT * FROM users WHERE username = ?"
cursor.execute(query, (username,))

### 嵌入 git hook：每次提交自动审查

让 AI 审查变成提交前的必经步骤，缺陷在进入仓库之前就被拦截：

```bash
# 在项目根目录执行，创建 pre-commit hook
cat > .git/hooks/pre-commit << 'HOOK'
#!/bin/bash
# 只审查本次提交涉及的变更
staged_files=$(git diff --cached --name-only --diff-filter=ACM)

if [ -z "$staged_files" ]; then
    exit 0
fi

echo "🔍 Open Code Review 正在审查暂存变更..."
ocr review --base HEAD --files "$staged_files"

# 如果有严重缺陷，阻止提交
# ocr 内部会返回退出码：0=通过，1=有严重问题
HOOK

chmod +x .git/hooks/pre-commit

# .github/workflows/ai-code-review.yml
name: AI Code Review

on:
  pull_request:
    types: [opened, synchronize]

jobs:
  review:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0    # 需要完整历史来生成 diff

      - name: Install Open Code Review
        run: pip install open-code-review

      - name: Run AI Review
        env:
          OCR_API_KEY: ${{ secrets.OCR_API_KEY }}   # 模型调用凭证
        run: |
          ocr review \
            --base origin/main \
            --format json \
            --output review_result.json

      - name: Post Review Comments
        if: always()
        uses: actions/github-script@v7
        with:
          script: |
            const fs = require('fs');
            const result = JSON.parse(fs.readFileSync('review_result.json', 'utf8'));
            const severe = result.findings.filter(f => f.severity === 'critical');
            if (severe.length > 0) {
              const body = severe.map(f =>
                `**${f.file} L${f.line}**: ${f.message}\n\`\`\`\n${f.suggested_fix || '无自动修复建议'}\n\`\`\``
              ).join('\n---\n');
              await github.rest.issues.createComment({
                owner: context.repo.owner,
                repo: context.repo.repo,
                issue_number: context.issue.number,
                body: `## 🤖 AI Code Review 发现 ${severe.length} 个严重问题\n\n${body}`
              });
            }