name: SonarCloud 扫描与 Devin 问题修复
on:
  workflow_dispatch:
  push:
    branches:
      - '**'
  pull_request:
    branches:
      - '**'

jobs:
  analyze:
    name: 分析与修复
    runs-on: ubuntu-latest

    steps:
    - uses: actions/checkout@v4
      with:
        fetch-depth: 0

    - name: SonarCloud 扫描
      uses: SonarSource/sonarqube-scan-action@v4
      env:
        SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
        SONAR_ORG: ${{ secrets.SONAR_ORG }}
      with:
        args: >
          -Dsonar.organization=${{ env.SONAR_ORG }}
          -Dsonar.sources=.
    - name: 设置 Python
      uses: actions/setup-python@v5
      with:
        python-version: '3.x'

    - name: 安装依赖项
      run: pip install aiohttp

    - name: 配置 Git
      run: |
        git config --global user.name "GitHub Action"
        git config --global user.email "action@github.com"
    - name: 运行 Devin 问题修复
      env:
        DEVIN_API_KEY: ${{ secrets.DEVIN_API_KEY }}
        DEVIN_ORG_ID: ${{ secrets.DEVIN_ORG_ID }}
        SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        SONAR_ORG: ${{ secrets.SONAR_ORG }}
        SONAR_PROJECT_KEY: {SONAR_PROJECT_KEY}
      run: python .github/scripts/devin_remediation.py

import asyncio
import aiohttp
import os
import time
from datetime import datetime

# 环境变量
GITHUB_REPOSITORY = os.getenv("GITHUB_REPOSITORY")
SONAR_TOKEN = os.getenv("SONAR_TOKEN")
DEVIN_API_KEY = os.getenv("DEVIN_API_KEY")
DEVIN_ORG_ID = os.getenv("DEVIN_ORG_ID")
SONAR_ORG = os.getenv("SONAR_ORG")
SONAR_PROJECT_KEY = os.getenv("SONAR_PROJECT_KEY")
DEVIN_API_BASE = f"https://api.devin.ai/v3/organizations/{DEVIN_ORG_ID}"

# GET /v3/organizations/{org_id}/sessions/{session_id} 返回的值
# Devin 完成任务后，status_detail 为 "finished"；会话结束后，status 为 "exit"
FAILURE_STATUSES = {"error", "suspended"}
POLL_INTERVAL_SECONDS = 15
REQUEST_TIMEOUT_SECONDS = 30
MAX_POLL_SECONDS = 30 * 60

async def get_sonarcloud_issues():
    """Fetch open vulnerabilities from SonarCloud."""
    url = "https://sonarcloud.io/api/issues/search"
    headers = {"Authorization": f"Bearer {SONAR_TOKEN}"}
    params = {
        "organization": SONAR_ORG,
        "projectKeys": SONAR_PROJECT_KEY,
        "types": "VULNERABILITY",
        "statuses": "OPEN"
    }

    async with aiohttp.ClientSession() as session:
        async with session.get(url, headers=headers, params=params) as response:
            if response.status != 200:
                print(f"Error getting SonarCloud issues: {await response.text()}")
                return []
            result = await response.json()
            print(f"Found {len(result.get('issues', []))} issues")
            return result.get('issues', [])

async def delegate_task_to_devin(issue):
    """Delegate the entire task of fixing, committing, and pushing to Devin AI."""
    async with aiohttp.ClientSession() as session:
        headers = {"Authorization": f"Bearer {DEVIN_API_KEY}"}
        prompt = f"""
        Fix the following vulnerability in {GITHUB_REPOSITORY}: {issue['message']} in file {issue['component']}.
        1. Create a new branch named 'devin/{issue['key']}-fix-vulnerability'.
        2. Implement the fix.
        3. Write a detailed commit message explaining the changes:
            - Issue Key: {issue['key']}
            - Component: {issue['component']}
            - Fixed by Devin AI at {datetime.now().isoformat()}
            - Include 'Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>'.
        4. Push the branch to the remote repository.
        5. Open a pull request with a description of the fix.
        """

        data = {"prompt": prompt}

        async with session.post(f"{DEVIN_API_BASE}/sessions", json=data, headers=headers) as response:
            if response.status != 200:
                print(f"Error delegating task to Devin: {await response.text()}")
                return None
            result = await response.json()
            print(f"Devin session created: {result}")
            return result

async def monitor_devin_session(session_id):
    """Poll the session until it reaches a terminal status or the time limit is hit."""
    deadline = time.monotonic() + MAX_POLL_SECONDS
    timeout = aiohttp.ClientTimeout(total=REQUEST_TIMEOUT_SECONDS)

    async with aiohttp.ClientSession(timeout=timeout) as session:
        headers = {"Authorization": f"Bearer {DEVIN_API_KEY}"}

        while time.monotonic() < deadline:
            try:
                async with session.get(f"{DEVIN_API_BASE}/sessions/{session_id}", headers=headers) as response:
                    if response.status != 200:
                        print(f"Error monitoring Devin session: {await response.text()}")
                        return None

                    result = await response.json()
                    status = result.get("status")
                    status_detail = result.get("status_detail")

                    if status_detail == "finished" or status == "exit":
                        print(f"Devin finished the task: {result}")
                        return result
                    if status in FAILURE_STATUSES or status_detail in {"waiting_for_user", "waiting_for_approval"}:
                        print(f"Devin session needs attention (status '{status}', detail '{status_detail}'). Please check manually.")
                        return None
            except (asyncio.TimeoutError, aiohttp.ClientError) as e:
                print(f"Status request failed ({e!r}); retrying in {POLL_INTERVAL_SECONDS}s.")

            await asyncio.sleep(POLL_INTERVAL_SECONDS)

        print(f"Timed out after {MAX_POLL_SECONDS} seconds waiting for Devin session {session_id}.")
        return None

async def main():
    try:
        issues = await get_sonarcloud_issues()

        for issue in issues:
            print(f"Processing issue: {issue['key']}")

            # 将任务委托给 Devin AI
            session_data = await delegate_task_to_devin(issue)

            if session_data:
                session_id = session_data["session_id"]

                # 监控 Devin 的进度
                await monitor_devin_session(session_id)

    except Exception as e:
        print(f"Error occurred: {str(e)}")
        raise

if __name__ == "__main__":
    asyncio.run(main())