Skip to content

Conversation

@wangshijun
Copy link
Contributor

@wangshijun wangshijun commented Aug 4, 2025

关联 Issue

主要改动

界面截图

测试计划

检查清单

  • 这次变更包含 breaking change,我为 breaking change 编写了 migration script【如果不是 breaking change 可以勾选】
  • 本次变更需要更新文档,并且我更新了相关文档,如果还没更新文档,请新建文档更新的 Issue 并关联上来
  • 本次变更的地方已经有测试覆盖,并且我调整了变更部分的测试覆盖
  • 本次变更新增的代码逻辑也增加了测试覆盖
  • 本次变更的兼容性测试覆盖了 Chrome
  • 本次变更的兼容性测试覆盖了移动端【手机浏览器、钱包内置浏览器】
  • 本次变更中有用户输入的逻辑,用户输入的后端、前端都增加了校验、错误提示
  • 本次变更中新增了修改后端数据的 API,我给这个 API 增加了 AuditLog
  • 本次变更新增了文件需要被包含在 npm 包的文件,且对应 package.json 的 files 字段包括了这些新增的文件
  • 本次变更增加了依赖
  • 本次变更我已经把依赖升级到了最新:taze -w -r && pnpm i

Summary by AIGNE

发布说明:

新功能:

  • 新增基于 @blocklet/sdk 的身份验证系统,支持访问密钥的创建和验证
  • 增强了 API 安全性和访问控制能力

优化改进:

  • 优化了 CI/CD 工作流配置,提升了自动化代码审查的效率
  • 改进了触发条件和路径过滤规则,使自动化流程更加精准

技术升级:

  • 升级代码审查工具至最新版本,提供更全面的代码质量保障

这些更新主要增强了系统的安全性和可靠性,同时改进了开发流程的自动化程度。用户将受益于更安全的身份验证机制。

@github-actions
Copy link

github-actions bot commented Aug 4, 2025

Image description AIGNE CodeSmith

Walkthrough

此次变更主要包含两个核心部分:增强身份验证机制和优化 CI/CD 流程。在身份验证方面,引入了基于 @blocklet/sdk 的访问密钥管理系统,提供了创建和验证功能。同时,更新了 GitHub Actions 工作流配置,优化了代码审查流程,提高了自动化效率。

Changes

文件 变更说明
blocklets/image-bin/api/sdk.js 实现基于 @blocklet/sdk 的身份验证系统,包含访问密钥的创建和验证功能。引入了更结构化的错误处理和模块化设计。
.github/workflows/code-reviewer.yml 优化 GitHub Actions 工作流配置:调整触发条件,升级代码审查工具,完善路径过滤规则。保持现有环境变量配置不变。

Copy link

@github-actions github-actions bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Image description AIGNE CodeSmith

Commits Files that changed from the base of the PR and between f6b1bf3 and e3dfcd9 commits.
Files selected (2)
  • .github/workflows/code-reviewer.yml (2)
  • blocklets/image-bin/api/sdk.js (1)
Review comments generated (7)
  • Review: 6
  • LGTM: 1

提示

Image description AIGNE CodeSmith (@codesmith) 聊天

  • 回复此机器人留下的审查评论以提出后续问题。审查评论是对差异或文件的评论。
  • 通过在回复中标记 @codesmith 邀请机器人加入审查评论链。

代码建议

  • 机器人可能会提出代码建议,但在提交前请仔细审查它们,因为行号范围可能会不对齐。
  • 你可以编辑机器人做出的评论,并在建议稍有偏差时手动调整。

暂停增量审查

  • 在 PR 描述中的任何位置添加 @codesmith: ignore 以暂停机器人的进一步审查。

Comment on lines +5 to +16
(async () => {
let result = await auth.createAccessKey({
remark: 'from-cli',
});
console.log(result.data);

result = await auth.verifyAccessKey({
accessKeyId: result.data.accessKeySecret,
});

console.log(result.data);
})();
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Image description AIGNE CodeSmith

这段代码存在几个重要问题:

  1. 缺少错误处理:
 (async () => {
+  try {
     let result = await auth.createAccessKey({
       remark: 'from-cli',
     });
     console.log(result.data);
 
     result = await auth.verifyAccessKey({
       accessKeyId: result.data.accessKeySecret,
     });
 
     console.log(result.data);
+  } catch (err) {
+    console.error('身份验证失败:', err);
+    process.exit(1);
+  }
 })();
  1. 验证密钥时使用了错误的参数:
     result = await auth.verifyAccessKey({
-      accessKeyId: result.data.accessKeySecret,
+      accessKeyId: result.data.accessKeyId,
+      accessKeySecret: result.data.accessKeySecret
     });

Comment on lines +12 to +13
accessKeyId: result.data.accessKeySecret,
});
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Image description AIGNE CodeSmith

验证密钥时需要同时提供 accessKeyId 和 accessKeySecret:

-    accessKeyId: result.data.accessKeySecret,
+    accessKeyId: result.data.accessKeyId,
+    accessKeySecret: result.data.accessKeySecret

@@ -0,0 +1,16 @@
const Auth = require('@blocklet/sdk/service/auth');

const auth = new Auth();
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Image description AIGNE CodeSmith

建议添加配置参数:

- const auth = new Auth();
+ const auth = new Auth({
+   timeout: 5000,  // 设置超时时间
+   retries: 3      // 设置重试次数
+ });

runs-on: ubuntu-latest
steps:
- uses: blocklet/aigne-code-reviewer@v0.1.14
- uses: aigne-io/aigne-codesmith@v0.1.0
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Image description AIGNE CodeSmith

使用固定版本号可能会错过重要的安全更新,建议使用语义化版本范围:

- uses: aigne-io/aigne-codesmith@v0.1.0
+ uses: aigne-io/aigne-codesmith@^0.1.0

Comment on lines 24 to +27
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
DEBUG: "@aigne/*"
DEBUG: '@aigne/*'
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Image description AIGNE CodeSmith

缩进不一致会导致YAML解析错误:

- env:
-  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-   ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
-  DEBUG: '@aigne/*'
+ env:
+   GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+   ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
+   DEBUG: '@aigne/*'

Comment on lines 28 to +39
with:
debug: true
language: "zh-CN"
language: 'zh-CN'
disable_review: false
review_simple_changes: false
review_comment_lgtm: false
disable_review: true
path_filters: |
!core/types/**
!core/schema/lib/**
!core/proto/lib/**
!**/types.js
!**/package.json
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Image description AIGNE CodeSmith

缩进问题同样存在于with部分,需要统一缩进风格:

 with:
-   debug: true
-  language: 'zh-CN'
-  disable_review: false
-   review_simple_changes: false
-   review_comment_lgtm: false
-   path_filters: |
-     !core/types/**
-     !core/schema/lib/**
-    !core/proto/lib/**
-     !**/types.js
-    !**/package.json
+   debug: true
+   language: 'zh-CN'
+   disable_review: false
+   review_simple_changes: false
+   review_comment_lgtm: false
+   path_filters: |
+     !core/types/**
+     !core/schema/lib/**
+     !core/proto/lib/**
+     !**/types.js
+     !**/package.json

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants