feat: persist code review results with sqlite

Small-fish-QAQ · Small-fish-QAQ · commit 4dba7dc593b9 · 2026-07-06T09:25:40.000+08:00
diff --git a/examples/skills_code_review_agent/README.md b/examples/skills_code_review_agent/README.md
@@ -1,9 +1,10 @@
 # Skills Code Review Agent
 
-This example implements the first phase of issue #92 as a deterministic,
+This example implements the early phases of issue #92 as a deterministic,
 local-only code review loop. It reads a unified diff, scans added lines with a
 small static rule set, redacts likely secrets, and writes JSON and Markdown
-reports.
+reports. When `--db-path` is provided, it also persists the review task,
+findings, and report metadata into SQLite.
 
 It intentionally does not call an LLM, remote sandbox, or SDK core extension.
 
@@ -29,6 +30,33 @@ You can also run the clean fixture:
 python examples/skills_code_review_agent/run_agent.py --diff-file examples/skills_code_review_agent/fixtures/clean.diff --output-dir examples/skills_code_review_agent/output_clean --dry-run
 ```
 
+## Run With SQLite
+
+```bash
+python examples/skills_code_review_agent/run_agent.py --diff-file examples/skills_code_review_agent/fixtures/security.diff --output-dir examples/skills_code_review_agent/output --db-path examples/skills_code_review_agent/output/reviews.sqlite3 --dry-run
+```
+
+When `--db-path` is set, the command prints the database path and generated
+task id. The database contains three tables:
+
+- `review_tasks`
+- `findings`
+- `reports`
+
+## Verify SQLite Records
+
+Using Python:
+
+```bash
+python -c "import sqlite3; db='examples/skills_code_review_agent/output/reviews.sqlite3'; con=sqlite3.connect(db); print(con.execute('select task_id,total_findings from review_tasks order by created_at desc limit 1').fetchone()); print(con.execute('select severity,category,file,line,title from findings order by id limit 5').fetchall())"
+```
+
+Using the `sqlite3` CLI:
+
+```bash
+sqlite3 examples/skills_code_review_agent/output/reviews.sqlite3 "select severity, category, file, line, title from findings order by id;"
+```
+
 ## Current Scope
 
 - Parses unified diff hunks and added line numbers.
@@ -40,12 +68,12 @@ python examples/skills_code_review_agent/run_agent.py --diff-file examples/skill
   - `open(...)` without `with`
 - Redacts likely API keys, tokens, secrets, and passwords before writing reports.
 - Produces `review_report.json` and `review_report.md`.
+- Optionally persists review tasks, findings, and report metadata to SQLite.
 
 ## Not Implemented Yet
 
 - Real LLM review.
 - Real remote sandbox or container execution.
 - SDK core integration.
-- SQLite storage.
 - Filter governance and telemetry.
 - Multi-agent orchestration.
diff --git a/examples/skills_code_review_agent/agent/storage.py b/examples/skills_code_review_agent/agent/storage.py
@@ -0,0 +1,145 @@
+"""SQLite persistence for deterministic code review runs."""
+
+from __future__ import annotations
+
+import json
+import sqlite3
+import uuid
+from pathlib import Path
+from typing import Any
+
+
+def init_db(db_path: Path) -> None:
+    """Create the SQLite database and tables if they do not already exist."""
+
+    db_path.parent.mkdir(parents=True, exist_ok=True)
+    with sqlite3.connect(db_path) as conn:
+        conn.execute("PRAGMA foreign_keys = ON")
+        conn.execute(
+            """
+            CREATE TABLE IF NOT EXISTS review_tasks (
+                task_id TEXT PRIMARY KEY,
+                created_at TEXT NOT NULL,
+                diff_file TEXT NOT NULL,
+                dry_run INTEGER NOT NULL,
+                files_scanned TEXT NOT NULL,
+                total_findings INTEGER NOT NULL
+            )
+            """
+        )
+        conn.execute(
+            """
+            CREATE TABLE IF NOT EXISTS findings (
+                id INTEGER PRIMARY KEY AUTOINCREMENT,
+                task_id TEXT NOT NULL,
+                severity TEXT NOT NULL,
+                category TEXT NOT NULL,
+                file TEXT NOT NULL,
+                line INTEGER NOT NULL,
+                title TEXT NOT NULL,
+                evidence TEXT NOT NULL,
+                recommendation TEXT NOT NULL,
+                confidence REAL NOT NULL,
+                source TEXT NOT NULL,
+                FOREIGN KEY (task_id) REFERENCES review_tasks(task_id) ON DELETE CASCADE
+            )
+            """
+        )
+        conn.execute(
+            """
+            CREATE TABLE IF NOT EXISTS reports (
+                task_id TEXT PRIMARY KEY,
+                json_report_path TEXT NOT NULL,
+                markdown_report_path TEXT NOT NULL,
+                summary_json TEXT NOT NULL,
+                FOREIGN KEY (task_id) REFERENCES review_tasks(task_id) ON DELETE CASCADE
+            )
+            """
+        )
+
+
+def persist_review(
+    *,
+    db_path: Path,
+    report: dict[str, Any],
+    json_report_path: Path,
+    markdown_report_path: Path,
+) -> str:
+    """Persist one review task, its findings, and report metadata."""
+
+    init_db(db_path)
+    task_id = str(uuid.uuid4())
+    summary = report["summary"]
+    findings = report["findings"]
+
+    with sqlite3.connect(db_path) as conn:
+        conn.execute("PRAGMA foreign_keys = ON")
+        conn.execute(
+            """
+            INSERT INTO review_tasks (
+                task_id,
+                created_at,
+                diff_file,
+                dry_run,
+                files_scanned,
+                total_findings
+            ) VALUES (?, ?, ?, ?, ?, ?)
+            """,
+            (
+                task_id,
+                summary["generated_at"],
+                summary["diff_file"],
+                1 if summary["dry_run"] else 0,
+                json.dumps(summary["files_scanned"], ensure_ascii=False),
+                int(summary["total_findings"]),
+            ),
+        )
+        conn.executemany(
+            """
+            INSERT INTO findings (
+                task_id,
+                severity,
+                category,
+                file,
+                line,
+                title,
+                evidence,
+                recommendation,
+                confidence,
+                source
+            ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+            """,
+            [
+                (
+                    task_id,
+                    finding["severity"],
+                    finding["category"],
+                    finding["file"],
+                    int(finding["line"]),
+                    finding["title"],
+                    finding["evidence"],
+                    finding["recommendation"],
+                    float(finding["confidence"]),
+                    finding["source"],
+                )
+                for finding in findings
+            ],
+        )
+        conn.execute(
+            """
+            INSERT INTO reports (
+                task_id,
+                json_report_path,
+                markdown_report_path,
+                summary_json
+            ) VALUES (?, ?, ?, ?)
+            """,
+            (
+                task_id,
+                str(json_report_path),
+                str(markdown_report_path),
+                json.dumps(summary, ensure_ascii=False),
+            ),
+        )
+
+    return task_id
diff --git a/examples/skills_code_review_agent/run_agent.py b/examples/skills_code_review_agent/run_agent.py
@@ -17,6 +17,7 @@
 from agent.report import build_report
 from agent.report import write_reports
 from agent.rules import run_static_rules
+from agent.storage import persist_review
 
 
 def _resolve_path(raw: str) -> Path:
@@ -47,13 +48,19 @@ def parse_args(argv: Sequence[str] | None = None) -> argparse.Namespace:
         action="store_true",
         help="Record the run as dry-run. No external services are called either way.",
     )
+    parser.add_argument(
+        "--db-path",
+        default="",
+        help="Optional SQLite database path for persisting review tasks, findings, and reports.",
+    )
     return parser.parse_args(argv)
 
 
 def main(argv: Sequence[str] | None = None) -> int:
     args = parse_args(argv)
     diff_file = _resolve_path(args.diff_file)
     output_dir = _resolve_path(args.output_dir)
+    db_path = _resolve_path(args.db_path) if args.db_path else None
 
     if not diff_file.exists():
         raise FileNotFoundError(f"diff file not found: {diff_file}")
@@ -68,6 +75,14 @@ def main(argv: Sequence[str] | None = None) -> int:
         dry_run=args.dry_run,
     )
     json_path, md_path = write_reports(report, output_dir)
+    task_id = ""
+    if db_path is not None:
+        task_id = persist_review(
+            db_path=db_path,
+            report=report,
+            json_report_path=json_path,
+            markdown_report_path=md_path,
+        )
 
     high_count = report["summary"]["severity_counts"].get("high", 0)
     medium_count = report["summary"]["severity_counts"].get("medium", 0)
@@ -79,6 +94,9 @@ def main(argv: Sequence[str] | None = None) -> int:
     print(f"Findings: high={high_count} medium={medium_count} low={low_count}")
     print(f"JSON report: {json_path}")
     print(f"Markdown report: {md_path}")
+    if db_path is not None:
+        print(f"Database: {db_path}")
+        print(f"Task ID: {task_id}")
     return 0
 
 
