feat: official-grade GitHub CI — composite action, review bot, status-check gate

CHANGELOG.md

@@ -4,6 +4,19 @@ All notable changes to this project are documented in this file. The format
 is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and this
 project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.6.0] - 2026-08-16
+
+### Added
+
+- **CI integration surface**: a composite GitHub Action (`action.yml`) that reviews PRs, fixes CI, and writes the report; a polling review bot with idempotent inline comments and a status-check gate published per PR head commit; and the one-shot `ci_run` tool plus the `/ci` command family.
+- `ci` config section: master switch, review engine (`static`/`model`), CI-driver auto-approve list, status-check name and blocking behavior, fail-on severity, poll interval, label/path filters, sensitive-path and test-existence rules, change-size caps, concurrency cap, comment posting, and report directory.
+- `ci.run` write action joins the `allowedActions` default list.
+- `requestTimeoutMs` config: hard per-request timeout that aborts the fetch when exceeded.
+
+### Changed
+
+- The README "planned v2 companion repository" note is replaced: the CI / GitHub Action surface now ships in this repository.
+
 ## [0.5.0] - 2026-08-15
 
 ### Added

README.es.md

@@ -144,9 +144,11 @@ Validado con Schemastery en el momento de carga (falla de forma evidente). Sobre
 | `maxRetries` | `3` | Intentos de reintento 429 por solicitud |
 | `retryBaseMs` | `500` | Base del retroceso de reintento (se duplica por intento) |
 | `retryMaxWaitMs` | `60000` | Tope del retroceso de reintento |
+| `requestTimeoutMs` | `30000` | Tiempo máximo por solicitud; aborta el fetch al superarse |
 | `apiBaseUrl` | `https://api.github.com` | URL base de la API REST de GitHub (GitHub Enterprise) |
-| `allowedActions` | `['pr.create','pr.merge','pr.update','review.post','issue.create','issue.comment','issue.close']` | Lista blanca de acciones de escritura; cualquier otra se deniega antes de la aprobación |
+| `allowedActions` | `['pr.create','pr.merge','pr.update','review.post','issue.create','issue.comment','issue.close','ci.run']` | Lista blanca de acciones de escritura; cualquier otra se deniega antes de la aprobación |
 | `workspaceDir` | process cwd | Directorio de trabajo para la inspección de git de solo lectura |
+| `ci` | `{ enabled: false, … }` | Sección de integración CI: bot de revisión por sondeo, puerta de status-check y la herramienta de un solo uso `ci_run` (contiene todas las claves `ci.*`) |
 
 ## 🛠 Herramientas
 
@@ -223,7 +225,7 @@ Validado con Schemastery en el momento de carga (falla de forma evidente). Sobre
 - **Analizador estático por defecto** — reglas deterministas (`src/review.ts`), cero tokens, reproducible. `reviewMode: "model"` delega el diff limitado a un subagente de un solo uso a través de la seam `subagents` del host para una revisión por LLM (consume tokens; requiere la seam y un proveedor registrado).
 - **Trabajos y registros locales al proceso** — el informe de revisión vive en la memoria del plugin indexado por el id del trabajo, coincidiendo con el ciclo de vida del registro de trabajos del host; el mapa de registros está limitado por `maxReviewRecords` (los registros finalizados más antiguos se eliminan primero).
 - **Las dist-tags `latest` de npm están obsoletas** — el plugin declara rangos de pares `^0.1.0-rc.5` para resolverse contra el cierre de perfil que proporciona `dsh-base`, y fija `0.1.0-rc.6` para desarrollo. Nunca instales con un simple `npm i @deepseek-ai/dsh-tools`.
-- **CI / GitHub Action** (`dsh-github-action`, bucle headless de revisión→comentario en el espíritu de claude-code-action / codex-action) es un repositorio complementario v2 planificado.
+- **CI / GitHub Action** — incluido en este repositorio (v0.6.0): una acción compuesta (`action.yml`) que revisa PRs, arregla CI y escribe el informe; un bot de revisión por sondeo con comentarios inline idempotentes; y una puerta de status-check. Todas las escrituras siguen sujetas a aprobación.
 
 ## 🧪 Desarrollo
 

README.hi.md

@@ -144,9 +144,11 @@ Load time पर Schemastery-सत्यापित (fail loud)। Profile क
 | `maxRetries` | `3` | प्रति request 429 retry प्रयास |
 | `retryBaseMs` | `500` | Retry backoff आधार (प्रति प्रयास दोगुना) |
 | `retryMaxWaitMs` | `60000` | Retry backoff की अधिकतम सीमा |
+| `requestTimeoutMs` | `30000` | प्रति request का hard timeout; exceed होने पर fetch abort |
 | `apiBaseUrl` | `https://api.github.com` | GitHub REST base URL (GitHub Enterprise) |
-| `allowedActions` | `['pr.create','pr.merge','pr.update','review.post','issue.create','issue.comment','issue.close']` | Write-action whitelist; बाकी सब approval से पहले अस्वीकार |
+| `allowedActions` | `['pr.create','pr.merge','pr.update','review.post','issue.create','issue.comment','issue.close','ci.run']` | Write-action whitelist; बाकी सब approval से पहले अस्वीकार |
 | `workspaceDir` | process cwd | read-only git inspection के लिए working directory |
+| `ci` | `{ enabled: false, … }` | CI integration section: polling review bot, status-check gate, और one-shot `ci_run` tool (सभी `ci.*` keys इसी में हैं) |
 
 ## 🛠 टूल्स
 
@@ -223,7 +225,7 @@ Load time पर Schemastery-सत्यापित (fail loud)। Profile क
 - **Static analyzer by default** — deterministic rules (`src/review.ts`), शून्य tokens, reproducible। `reviewMode: "model"` LLM review के लिए capped diff को host के `subagents` seam के ज़रिए एक one-shot subagent को सौंपता है (tokens खर्च होते हैं; seam और एक registered provider की आवश्यकता होती है)।
 - **Jobs और records process-local हैं** — review report plugin memory में job id के आधार पर रहता है, जो host job registry के lifetime से मेल खाता है; record map `maxReviewRecords` से capped है (सबसे पुराने settled records पहले evict होते हैं)।
 - **npm `latest` dist-tags पुराने हैं** — plugin `^0.1.0-rc.5` peer ranges घोषित करता है ताकि यह `dsh-base` द्वारा दिए गए profile closure के विरुद्ध resolve हो, और विकास के लिए `0.1.0-rc.6` pin करता है। कभी भी bare `npm i @deepseek-ai/dsh-tools` से install न करें।
-- **CI / GitHub Action** (`dsh-github-action`, claude-code-action / codex-action की भावना में headless review→comment loop) एक नियोजित v2 companion repository है।
+- **CI / GitHub Action** — इसी repository में शामिल है (v0.6.0): एक composite action (`action.yml`) जो PRs की समीक्षा करती है, CI ठीक करती है, और report लिखती है; idempotent inline comments वाला polling review bot; और एक status-check gate। हर write approval-gated रहता है।
 
 ## 🧪 विकास
 

README.md

@@ -146,9 +146,11 @@ Schemastery-validated at load time (fail loud). Override any key in the profile'
 | `maxRetries` | `3` | 429 retry attempts per request |
 | `retryBaseMs` | `500` | Retry backoff base (doubles per attempt) |
 | `retryMaxWaitMs` | `60000` | Retry backoff ceiling |
+| `requestTimeoutMs` | `30000` | Hard per-request timeout; aborts the fetch when exceeded |
 | `apiBaseUrl` | `https://api.github.com` | GitHub REST base URL (GitHub Enterprise) |
-| `allowedActions` | `['pr.create','pr.merge','pr.update','review.post','issue.create','issue.comment','issue.close']` | Write-action whitelist; anything else is denied before approval |
+| `allowedActions` | `['pr.create','pr.merge','pr.update','review.post','issue.create','issue.comment','issue.close','ci.run']` | Write-action whitelist; anything else is denied before approval |
 | `workspaceDir` | process cwd | Working directory for read-only git inspection |
+| `ci` | `{ enabled: false, … }` | CI integration section: polling review bot, status-check gate, and the one-shot `ci_run` tool (all `ci.*` keys live inside it) |
 
 ## 🛠 Tools
 
@@ -225,7 +227,7 @@ Schemastery-validated at load time (fail loud). Override any key in the profile'
 - **Static analyzer by default** — deterministic rules (`src/review.ts`), zero tokens, reproducible. `reviewMode: "model"` delegates the capped diff to a one-shot subagent through the host's `subagents` seam for an LLM review (costs tokens; requires the seam and a registered provider).
 - **Jobs and records are process-local** — the review report lives in plugin memory keyed by job id, matching the host job registry's lifetime; the record map is capped by `maxReviewRecords` (oldest settled records evict first).
 - **npm `latest` dist-tags are stale** — the plugin declares `^0.1.0-rc.5` peer ranges so it resolves against the profile closure that `dsh-base` provides, and pins `0.1.0-rc.6` for development. Never install by bare `npm i @deepseek-ai/dsh-tools`.
-- **CI / GitHub Action** (`dsh-github-action`, headless review→comment loop in the spirit of claude-code-action / codex-action) is a planned v2 companion repository.
+- **CI / GitHub Action** — ships in this repository (v0.6.0): a composite action (`action.yml`) that reviews PRs, fixes CI, and writes the report; a polling review bot with idempotent inline comments; and a status-check gate. Every write stays approval-gated.
 
 ## 🧪 Development
 

README.pt.md

@@ -144,9 +144,11 @@ Validado pelo Schemastery no momento do carregamento (falha em alto e bom som).
 | `maxRetries` | `3` | Tentativas de nova tentativa em 429 por requisição |
 | `retryBaseMs` | `500` | Base do backoff de nova tentativa (dobra a cada tentativa) |
 | `retryMaxWaitMs` | `60000` | Teto do backoff de nova tentativa |
+| `requestTimeoutMs` | `30000` | Timeout rígido por requisição; aborta o fetch ao exceder |
 | `apiBaseUrl` | `https://api.github.com` | URL base da API REST do GitHub (GitHub Enterprise) |
-| `allowedActions` | `['pr.create','pr.merge','pr.update','review.post','issue.create','issue.comment','issue.close']` | Allowlist de ações de gravação; qualquer outra coisa é negada antes da aprovação |
+| `allowedActions` | `['pr.create','pr.merge','pr.update','review.post','issue.create','issue.comment','issue.close','ci.run']` | Allowlist de ações de gravação; qualquer outra coisa é negada antes da aprovação |
 | `workspaceDir` | process cwd | Diretório de trabalho para inspeção somente leitura do git |
+| `ci` | `{ enabled: false, … }` | Seção de integração CI: bot de revisão por polling, gate de status-check e a ferramenta de execução única `ci_run` (contém todas as chaves `ci.*`) |
 
 ## 🛠 Ferramentas
 
@@ -223,7 +225,7 @@ Validado pelo Schemastery no momento do carregamento (falha em alto e bom som).
 - **Analisador estático por padrão** — regras determinísticas (`src/review.ts`), zero tokens, reproduzível. `reviewMode: "model"` delega o diff limitado a um subagente de uso único pela seam `subagents` do host para uma revisão por LLM (consome tokens; requer a seam e um provedor registrado).
 - **Jobs e registros são locais ao processo** — o relatório de revisão vive na memória do plugin, indexado pelo id do job, acompanhando o tempo de vida do registro de jobs do host; o mapa de registros é limitado por `maxReviewRecords` (os registros concluídos mais antigos são removidos primeiro).
 - **As dist-tags `latest` do npm estão desatualizadas** — o plugin declara faixas de peer `^0.1.0-rc.5` para resolver contra o fechamento de perfil que o `dsh-base` fornece, e fixa `0.1.0-rc.6` para desenvolvimento. Nunca instale por meio de um `npm i @deepseek-ai/dsh-tools` simples.
-- **CI / GitHub Action** (`dsh-github-action`, loop headless revisão→comentário no espírito do claude-code-action / codex-action) é um repositório complementar v2 planejado.
+- **CI / GitHub Action** — incluído neste repositório (v0.6.0): uma ação composta (`action.yml`) que revisa PRs, corrige CI e escreve o relatório; um bot de revisão por polling com comentários inline idempotentes; e um gate de status-check. Toda gravação permanece sujeita a aprovação.
 
 ## 🧪 Desenvolvimento
 

README.zh-CN.md

@@ -144,9 +144,11 @@ allowBuilds:
 | `maxRetries` | `3` | 单请求的 429 重试次数 |
 | `retryBaseMs` | `500` | 重试退避基数（逐次翻倍） |
 | `retryMaxWaitMs` | `60000` | 重试退避上限 |
+| `requestTimeoutMs` | `30000` | 单次请求硬超时；超时即中止 fetch |
 | `apiBaseUrl` | `https://api.github.com` | GitHub REST 基地址（GitHub Enterprise） |
-| `allowedActions` | `['pr.create','pr.merge','pr.update','review.post','issue.create','issue.comment','issue.close']` | 写动作白名单；名单外直接拒绝 |
+| `allowedActions` | `['pr.create','pr.merge','pr.update','review.post','issue.create','issue.comment','issue.close','ci.run']` | 写动作白名单；名单外直接拒绝 |
 | `workspaceDir` | 进程 cwd | 只读 git 检查的工作目录 |
+| `ci` | `{ enabled: false, … }` | CI 集成段：轮询式审查机器人、状态检查门禁与一次性 `ci_run` 工具（其下为全部 `ci.*` 子键） |
 
 ## 🛠 工具
 
@@ -222,7 +224,7 @@ allowBuilds:
 - **默认静态分析器** —— 确定性规则集（`src/review.ts`），零 token、可复现。`reviewMode: "model"` 会把截断后的 diff 交给宿主 `subagents` 接缝的一次性 subagent 做 LLM 评审（消耗 token；需要接缝与已注册的 provider）。
 - **job 与记录是进程内状态** —— 审查报告按 job id 存于插件内存，与宿主 job 注册表同为进程级生命周期；记录表受 `maxReviewRecords` 上限约束（最旧已终态记录先淘汰）。
 - **npm `latest` 标签过期** —— 本插件用 `^0.1.0-rc.5` peer 范围对齐 `dsh-base` 提供的 profile 闭包，开发时钉 `0.1.0-rc.6`。不要裸跑 `npm i @deepseek-ai/dsh-tools`。
-- **CI / GitHub Action**（`dsh-github-action`，对标 claude-code-action / codex-action 的 headless「审查 PR → 评论」闭环）是计划中的 v2 配套仓库。
+- **CI / GitHub Action** — 随本仓库发布（v0.6.0）：复合动作（`action.yml`）负责审查 PR、修复 CI 并产出报告；轮询式审查机器人带幂等行内评论；外加状态检查门禁。所有写动作仍需审批。
 
 ## 🧪 开发