Skip to content

Feature/init - #1236

Closed
AyoungYa wants to merge 2 commits into
ZhuLinsen:mainfrom
AyoungYa:feature/init
Closed

Feature/init#1236
AyoungYa wants to merge 2 commits into
ZhuLinsen:mainfrom
AyoungYa:feature/init

Conversation

@AyoungYa

@AyoungYa AyoungYa commented May 9, 2026

Copy link
Copy Markdown

PR Type

  • fix
  • feat
  • refactor
  • docs
  • chore
  • test

Background And Problem

请描述当前问题、影响范围与触发场景。
(EN) Describe the problem, its impact, and what triggers it.

Scope Of Change

请列出本 PR 修改的模块和文件范围。
(EN) List the modules and files changed in this PR.

Issue Link

必须填写以下之一 / Fill in one of:

  • Fixes #<issue_number>
  • Refs #<issue_number>
  • 无 Issue 时说明原因与验收标准 / If no issue, explain the motivation and acceptance criteria

Verification Commands And Results

请填写你实际执行过的命令和关键结果(不要只写"已测试")。
(EN) Paste the commands you actually ran and their key output (don't just write "tested"):

# example
./scripts/ci_gate.sh
python -m pytest -m "not network"

关键输出/结论 / Key output & conclusion:

Compatibility And Risk

请说明兼容性影响、潜在风险(如无请写 None)。
(EN) Describe compatibility impact and potential risks (write None if not applicable).

  • 若本 PR 修改第三方模型 / API 的兼容语义、请求参数、路由前缀或 provider fallback,请提供官方来源链接或公告,并说明这是长期约束、当前运行时约束还是临时兼容处理。
    (EN) If this PR changes third-party model/API compatibility, request parameters, routing prefixes, or provider fallback behavior, include an official source link or announcement and clarify whether the rule is permanent, runtime-specific, or a temporary compatibility workaround.)
  • 若本 PR 依赖特定运行时 / 锁定依赖窗口(例如 LiteLLM 版本范围、OpenAI-compatible 路由、YAML alias 行为),请写明当前验证过的兼容范围与覆盖路径。
    (EN) If this PR depends on a specific runtime or pinned dependency window (for example a LiteLLM version range, OpenAI-compatible routing, or YAML alias behavior), state the compatibility window you verified and which code paths were covered.)
  • 若本 PR 触及运行时配置保存、清理、迁移或回填逻辑,请明确说明旧配置是否会被自动改写、清空、迁移或保持不变,以及用户如何恢复原行为。
    (EN) If this PR touches runtime config save/cleanup/migration/backfill logic, explicitly describe whether existing config is rewritten, cleared, migrated, or left intact, and how users can restore the previous behavior.)

Rollback Plan

请至少写一句可执行的回滚方案(必填)。
(EN) Provide at least one actionable rollback step (required).

  • 如果是兼容性修复,默认应写出最小回滚方式(例如 revert this PR),并说明是否需要额外回滚配置或数据迁移。
    (EN) For compatibility fixes, include the minimal rollback path (for example revert this PR) and whether any additional config or data rollback is required.)

EXTRACT_PROMPT Change (if applicable)

若本 PR 修改了 src/services/image_stock_extractor.py 中的 EXTRACT_PROMPT,请在此处粘贴完整变更后的 prompt。
If this PR changes EXTRACT_PROMPT in src/services/image_stock_extractor.py, paste the full updated prompt here:

展开 / Expand: Full EXTRACT_PROMPT
(paste full prompt here)

Checklist

  • 本 PR 有明确动机和业务价值 / This PR has a clear motivation and value
  • 已提供可复现的验证命令与结果 / Reproducible verification commands and results are included
  • 已评估兼容性与风险 / Compatibility and risk have been assessed
  • 已提供回滚方案 / A rollback plan is provided
  • 若涉及用户可见变更,已同步更新相关文档与 docs/CHANGELOG.mdREADME.md 仅在首页级信息变化时更新,细节优先写入 docs/*.md / If user-visible changes are included, relevant docs and docs/CHANGELOG.md are updated; README.md is updated only for homepage-level changes, with details kept in docs/*.md

@AyoungYa
AyoungYa requested a review from ZhuLinsen as a code owner May 9, 2026 09:20
@github-actions github-actions Bot added configuration data-source documentation Improvements or additions to documentation feishu size/S labels May 9, 2026
@AyoungYa AyoungYa closed this May 9, 2026
@github-actions

github-actions Bot commented May 9, 2026

Copy link
Copy Markdown

🤖 自动审查报告

项目 结果
📊 变更文件 4 个
➕ 新增行数 6 行
➖ 删除行数 2 行
🔍 静态检查 ✅ 通过
🧠 AI 审查 ✅ 已完成

📁 修改的文件

  • 📝 data_provider/baostock_fetcher.py (+1/-1)
  • 📝 data_provider/tushare_fetcher.py (+5/-1)
  • 📝 docs/bot/feishu-bot-config.md (+0/-0)
  • 📝 sources/dsa_vi/darklogo.iconset/icon_512x512@2x.png (+0/-0)

🧠 AI 代码审查意见

结论:Not Ready

结构化结果:

  • 必要性: 不通过。PR 描述中“Background And Problem”字段为空,无法确认本次变更的明确动机和业务价值。
  • 关联性: 不通过。PR 描述中“Issue Link”字段为空,未关联任何 Issue,也未说明无 Issue 的原因与验收标准。
  • 类型: 建议将 PR 类型从 feat 修改为 fixchore。本次提交主要修改了数据提供者的初始化逻辑和日志输出,通常不属于新增用户可见功能。
  • 描述完整性: 不完整。PR 描述中“Background And Problem”、“Scope Of Change”、“Issue Link”、“Verification Commands And Results”、“Compatibility And Risk”、“Rollback Plan”等关键字段均为空,未提供本次变更的必要信息。
  • 风险级别: 高。存在严重的安全风险。

必改项(阻断项):

  1. 严重安全漏洞:硬编码凭证
    • 文件: data_provider/baostock_fetcher.py
    • 问题:BaostockFetcher_init_api 方法中,直接将 Baostock 的用户 ID 和密码 bs.login(user_id='youngyadoudou', password='uijka443$89@Yndn') 硬编码在代码中。这是严重的安全漏洞,凭证不应直接暴露在代码仓库中。任何能够访问代码的人都将获得这些敏感信息。
    • 修改建议: 凭证应通过安全的方式进行管理和加载,例如从环境变量、配置文件(且该配置文件不应被提交到版本控制中)、或更安全的密钥管理服务中获取。请移除硬编码的凭证。
  2. PR 描述信息不完整
    • 问题: PR 描述中“Background And Problem”、“Issue Link”、“Verification Commands And Results”、“Compatibility And Risk”、“Rollback Plan”等关键字段均为空。这导致无法理解变更的上下文、验证情况、潜在影响和回滚方案。
    • 修改建议: 请根据模板要求补充所有缺失的 PR 描述信息,特别是:
      • Background And Problem: 解释为何需要修改 Baostock 和 Tushare 的初始化逻辑。
      • Issue Link: 如果没有 Issue,请说明本次变更的动机和验收标准。
      • Verification Commands And Results: 提供实际执行的验证命令和关键结果,以证明修改的有效性。
      • Compatibility And Risk: 评估兼容性影响和潜在风险,特别是硬编码凭证带来的安全风险。
      • Rollback Plan: 提供明确可执行的回滚方案(例如 revert this PR)。

建议项:

  1. 执行 ./scripts/ci_gate.sh
    • PR 描述未说明是否执行了 ./scripts/ci_gate.sh。虽然本次 CI 已通过基本语法检查,但该脚本通常包含更全面的静态检查和单元测试。建议在提交前运行此脚本并附上关键结果,以确保代码质量和稳定性。
  2. docs/bot/feishu-bot-config.md 文件模式变更
    • docs/bot/feishu-bot-config.md 文件的模式从 100644 (普通文件) 变为 100755 (可执行文件)。请确认这一模式变更是否是有意为之,以及其必要性。如果此 Markdown 文件不需要可执行权限,建议保持原模式 100644
  3. Tushare token 日志优化
    • 文件: data_provider/tushare_fetcher.py
    • 优化: PR 中将 Tushare token 在日志中进行了部分屏蔽(仅显示后5位),这是一个良好的安全实践,值得肯定。

💡 提示: 请确保代码已通过本地测试,并遵循项目代码规范。

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: efa2143810

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

try:
# 登录 Baostock
login_result = bs.login()
login_result = bs.login(user_id='youngyadoudou', password='uijka443$89@Yndn')

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Remove hard-coded Baostock account credentials

This login call now embeds a specific user_id and password directly in source, which both leaks a credential and forces every deployment to use a single external account. If that account is rotated, locked, or rate-limited, Baostock fetching will fail globally instead of using environment-specific/default authentication behavior.

Useful? React with 👍 / 👎.


except Exception as e:
logger.warning(f"Tushare 获取股票名称失败 {stock_code}: {e}")
logger.warning(f"Tushare 获取股票名称失败 {stock_code}, token: {self._api.token[-5:]}: {e}")

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Guard token access inside Tushare exception logging

The exception handler dereferences self._api.token[-5:] while already handling a failure; when _api is None (for example, token not configured or client init failed), this raises a new AttributeError and masks the original error, so get_stock_name no longer degrades gracefully to None in that path.

Useful? React with 👍 / 👎.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant