AI 工具开发实战（3）：开发一个 AI 代码审查 CLI——自动检查 Git 变更、发现安全问题

aicr/
├── aicr.py              # CLI 主程序
├── reviewer.py          # AI 审查引擎
├── requirements.txt
└── .env

# reviewer.py
from openai import OpenAI
import os
from dotenv import load_dotenv
load_dotenv()

client = OpenAI(
    api_key=os.getenv("DEEPSEEK_API_KEY"),
    base_url="https://api.deepseek.com/v1",
)

REVIEW_PROMPT = """你是一个资深代码审查员。审查以下 Git diff，从三个维度分析：

1. 🔴 安全风险：SQL 注入、XSS、密钥泄露、权限问题
2. 🟡 性能问题：N+1 查询、不必要的循环、内存泄漏
3. 🔵 代码质量：命名不规范、过度复杂、缺少异常处理

格式要求：
- 只报告确实存在的问题，不要猜测
- 对于小改动或纯格式变更，直接说"✅ 未发现问题"
- 每个问题标注严重程度（高/中/低）

以下是 Git diff：
{diff}"""


def review_diff(diff: str, model="deepseek-chat") -> dict:
    """审查 Git diff 并返回问题列表。"""
    if len(diff) > 15000:
        diff = diff[:15000] + "\n... (diff truncated)"

    response = client.chat.completions.create(
        model=model,
        messages=[
            {"role": "system", "content": REVIEW_PROMPT.format(diff=diff)},
        ],
        temperature=0.1,
    )
    return response.choices[0].message.content

#!/usr/bin/env python3
# aicr.py
import subprocess
import click
from pathlib import Path
from reviewer import review_diff


def get_git_diff(staged=False, branch=None):
    """获取 Git diff。"""
    cmd = ["git", "diff"]
    if staged:
        cmd.append("--staged")
    if branch:
        cmd.extend([f"origin/{branch}..HEAD"])

    result = subprocess.run(cmd, capture_output=True, text=True)
    if result.returncode != 0:
        raise click.ClickException(f"Git error: {result.stderr}")
    return result.stdout


def get_changed_files(staged=False, branch=None):
    """获取变更文件列表。"""
    cmd = ["git", "diff", "--name-only"]
    if staged:
        cmd.append("--staged")
    if branch:
        cmd.extend([f"origin/{branch}..HEAD"])

    result = subprocess.run(cmd, capture_output=True, text=True)
    return [f for f in result.stdout.strip().split("\n") if f]


@click.group()
def cli():
    """aicr - AI 代码审查工具"""
    pass


@cli.command()
@click.option("--staged", "-s", is_flag=True, help="只审查已暂存（staged）的改动")
@click.option("--branch", "-b", default=None, help="对比远程分支（如 main）")
@click.option("--model", "-m", default="deepseek-chat", help="模型名称")
def check(staged, branch, model):
    """审查未提交的代码改动。"""
    click.echo("🔍 正在审查代码改动...")

    diff = get_git_diff(staged=staged, branch=branch)
    if not diff.strip():
        click.echo("✅ 没有待审查的改动")
        return

    files = get_changed_files(staged=staged, branch=branch)
    click.echo(f"📁 变更文件 ({len(files)} 个)：")
    for f in files:
        click.echo(f"   {f}")

    result = review_diff(diff, model=model)
    click.echo(f"\n{result}")


@cli.command()
@click.argument("commit_range", default="HEAD~1..HEAD")
@click.option("--model", "-m", default="deepseek-chat")
def history(commit_range, model):
    """审查历史提交。用法: aicr history HEAD~3..HEAD"""
    result = subprocess.run(
        ["git", "diff", commit_range],
        capture_output=True, text=True
    )
    if result.returncode != 0:
        raise click.ClickException(f"Git error: {result.stderr}")

    diff = result.stdout
    if not diff.strip():
        click.echo("✅ 没有改动")
        return

    click.echo(f"🔍 审查 {commit_range} 的改动...")
    result = review_diff(diff, model=model)
    click.echo(f"\n{result}")


@cli.command()
@click.argument("filepath", type=click.Path(exists=True))
@click.option("--model", "-m", default="deepseek-chat")
def file(filepath, model):
    """审查单个文件。"""
    with open(filepath, "r", encoding="utf-8") as f:
        content = f.read()

    # 构造一个虚拟 diff
    diff = f"+++ b/{Path(filepath).name}\n" + "\n".join(
        f"+{line}" for line in content.split("\n")
    )

    click.echo(f"🔍 审查文件：{filepath}")
    result = review_diff(diff, model=model)
    click.echo(f"\n{result}")


if __name__ == "__main__":
    cli()

# 审查未提交的改动
aicr check
# 🔍 正在审查代码改动...
# 📁 变更文件 (2 个)：
#    src/api/users.py
#    src/models/user.py
#
# 🔴 安全风险：
# [高] 第 23 行：SQL 查询直接拼接用户输入，存在注入风险
#
# 🟡 性能问题：
# [中] 第 45 行：循环内查询数据库，建议改用批量查询
#
# 🔵 代码质量：
# [低] 第 12 行：变量名 user_data 建议改为 user_profile 更清晰

# 只审查已暂存的文件
aicr check --staged

# 对比远程主分支
aicr check --branch main

# 审查最近 3 次提交
aicr history HEAD~3..HEAD

# 审查单个文件
aicr file src/api/auth.py

#!/bin/bash
echo "🔍 AI 正在审查代码..."
aicr check --staged