@kernel-sig/console 0.1.0

package/backend/app/core/security.py

@@ -0,0 +1,69 @@
+"""密码哈希与 JWT 签发/校验。"""
+
+from datetime import UTC, datetime, timedelta
+from enum import StrEnum
+from typing import Any
+
+import jwt
+from argon2 import PasswordHasher
+from argon2.exceptions import InvalidHashError, VerifyMismatchError
+
+_ALGORITHM = "HS256"
+_hasher = PasswordHasher()
+
+
+class TokenType(StrEnum):
+    ACCESS = "access"
+    REFRESH = "refresh"
+
+
+def hash_password(password: str) -> str:
+    return _hasher.hash(password)
+
+
+def verify_password(password: str, password_hash: str) -> bool:
+    try:
+        return _hasher.verify(password_hash, password)
+    except (VerifyMismatchError, InvalidHashError, ValueError):
+        return False
+
+
+def needs_rehash(password_hash: str) -> bool:
+    try:
+        return _hasher.check_needs_rehash(password_hash)
+    except (InvalidHashError, ValueError):
+        return True
+
+
+def create_token(
+    subject: str,
+    token_type: TokenType,
+    secret: str,
+    expires_delta: timedelta | None = None,
+    extra_claims: dict[str, Any] | None = None,
+) -> str:
+    now = datetime.now(UTC)
+    if expires_delta is None:
+        expires_delta = (
+            timedelta(minutes=30) if token_type is TokenType.ACCESS else timedelta(days=7)
+        )
+
+    payload: dict[str, Any] = {
+        "sub": subject,
+        "type": token_type.value,
+        "iat": int(now.timestamp()),
+        "exp": int((now + expires_delta).timestamp()),
+    }
+    if extra_claims:
+        payload.update(extra_claims)
+
+    return jwt.encode(payload, secret, algorithm=_ALGORITHM)
+
+
+def decode_token(token: str, secret: str, expected_type: TokenType) -> dict[str, Any]:
+    payload = jwt.decode(token, secret, algorithms=[_ALGORITHM])
+    if payload.get("type") != expected_type.value:
+        raise jwt.InvalidTokenError(
+            f"令牌类型不匹配：期望 {expected_type.value}，实际 {payload.get('type')}"
+        )
+    return payload

package/backend/app/domain/attention.py

@@ -0,0 +1,618 @@
+"""关注项规则。
+
+把散落在上千个 PR 上的问题收敛成一份可操作的待办清单。
+规则是纯函数：输入一个 PR 的快照，输出命中与否及原因。
+
+**可解释优先**：每条命中都带上证据（等了几天、哪个文件是二进制、
+缺什么签名），而不是只给一个"有问题"的结论。维护者需要据此判断
+"这条要不要理"、"该怎么回"。
+"""
+
+from __future__ import annotations
+
+from collections.abc import Callable, Sequence
+from dataclasses import dataclass, field
+from datetime import UTC, datetime
+from enum import StrEnum
+
+from app.domain.review import GateStage
+
+
+class Severity(StrEnum):
+    BLOCKER = "blocker"
+    CRITICAL = "critical"
+    WARNING = "warning"
+    INFO = "info"
+
+
+SEVERITY_ORDER: dict[Severity, int] = {
+    Severity.BLOCKER: 0,
+    Severity.CRITICAL: 1,
+    Severity.WARNING: 2,
+    Severity.INFO: 3,
+}
+
+
+class Rule(StrEnum):
+    """规则标识。
+
+    "持续超时"不单列为规则，而是同一规则内升级 severity ——
+    否则同一条 PR 会同时出现"CI 失败"与"CI 长期失败"两条待办，
+    使用者还得自己判断哪条更要紧。
+
+    数据库枚举（app.models.attention.AttentionRule）必须与此保持一致。
+    """
+
+    STALE = "stale"
+    REVIEW_SLA_BREACH = "review_sla_breach"
+    CI_FAILED = "ci_failed"
+    MERGE_CONFLICT = "merge_conflict"
+    NEEDS_ISSUE = "needs_issue"
+    CLA_DENIED = "cla_denied"
+    CLA_PENDING_LONG = "cla_pending_long"
+    REJECTED = "rejected"
+    BINARY_FILE = "binary_file"
+    MISSING_SIGNED_OFF = "missing_signed_off"
+    CVE_AGING = "cve_aging"
+    ISSUE_UNASSIGNED = "issue_unassigned"
+    ISSUE_STALE = "issue_stale"
+
+
+@dataclass
+class Thresholds:
+    """各规则的阈值。集中一处便于按团队节奏调整。"""
+
+    stale_days: int = 30
+    review_sla_days: int = 7
+    ci_failed_days: int = 3
+    conflict_days: int = 2
+    cla_pending_days: int = 1
+    cve_aging_hours: int = 24
+    # Issue 的时限宽于 PR：Issue 常需长时间讨论，催得太急反而制造噪音
+    issue_unassigned_days: int = 7
+    issue_stale_days: int = 90
+
+
+@dataclass
+class PullSnapshot:
+    """规则求值所需的 PR 快照。
+
+    刻意只取必要字段：规则不该依赖完整 ORM 对象，
+    这样它们既能用于实时查询，也能用于批处理，且易于测试。
+    """
+
+    number: int
+    title: str
+    state: str
+    gate_stage: str
+    created_at: datetime | None
+    updated_at: datetime | None
+    is_draft: bool = False
+    merge_conflict: bool = False
+    label_names: Sequence[str] = field(default_factory=list)
+    kind: str = "unknown"
+    cve_ids: Sequence[str] = field(default_factory=list)
+    binary_files: Sequence[str] = field(default_factory=list)
+    commits_without_signed_off: int = 0
+    total_commits: int = 0
+    changed_files: Sequence[str] = field(default_factory=list)
+
+    @property
+    def is_open(self) -> bool:
+        return self.state == "open"
+
+
+@dataclass
+class IssueSnapshot:
+    """规则求值所需的 Issue 快照。字段取法与 PullSnapshot 同理。"""
+
+    number: int
+    title: str
+    state: str
+    created_at: datetime | None
+    updated_at: datetime | None
+    issue_type: str | None = None
+    priority: str | None = None
+    assignee_login: str | None = None
+    label_names: Sequence[str] = field(default_factory=list)
+
+    @property
+    def is_open(self) -> bool:
+        return self.state == "open"
+
+
+@dataclass
+class AttentionHit:
+    rule: Rule
+    severity: Severity
+    title: str
+    detail: str
+    evidence: dict
+
+
+def _days_since(moment: datetime | None, now: datetime) -> float:
+    if moment is None:
+        return 0.0
+    if moment.tzinfo is None:
+        moment = moment.replace(tzinfo=UTC)
+    return max(0.0, (now - moment).total_seconds() / 86400)
+
+
+# ---------------------------------------------------------------------------
+# 规则实现
+# ---------------------------------------------------------------------------
+
+KABI_BREAKING_MARKERS = ("-EXPORT_SYMBOL", "-EXPORT_SYMBOL_GPL", "-EXPORT_UNWIND_FIRST")
+
+
+def rule_ci_failed(pull: PullSnapshot, now: datetime, t: Thresholds) -> AttentionHit | None:
+    """CI 失败。这是明确的阻塞信号，优先于"未完成"展示。"""
+    if pull.gate_stage not in (GateStage.CI_FAILED.value,):
+        return None
+
+    days = _days_since(pull.updated_at, now)
+    severity = Severity.CRITICAL if days >= t.ci_failed_days else Severity.WARNING
+    return AttentionHit(
+        rule=Rule.CI_FAILED,
+        severity=severity,
+        title=f"CI 未通过（已 {int(days)} 天）" if days >= 1 else "CI 未通过",
+        detail="门禁检查失败会阻塞合入，需修复后重新触发。",
+        evidence={"days_since_update": round(days, 1), "gate_stage": pull.gate_stage},
+    )
+
+
+def rule_merge_conflict(pull: PullSnapshot, now: datetime, t: Thresholds) -> AttentionHit | None:
+    if not pull.merge_conflict or not pull.is_open:
+        return None
+    days = _days_since(pull.updated_at, now)
+    severity = Severity.CRITICAL if days >= t.conflict_days else Severity.WARNING
+    return AttentionHit(
+        rule=Rule.MERGE_CONFLICT,
+        severity=severity,
+        title="存在合并冲突",
+        detail="目标分支已前进，需要 rebase 或合并后再评审。",
+        evidence={"days_since_update": round(days, 1), "target_branch_changed": True},
+    )
+
+
+def rule_review_sla_breach(pull: PullSnapshot, now: datetime, t: Thresholds) -> AttentionHit | None:
+    """待评审超期。
+
+    只看"仍在等待评审"的 PR —— 已经拿到 LGTM 的不算超期，
+    否则会把已完成的评审也算成欠账。
+    """
+    if not pull.is_open or pull.gate_stage != GateStage.REVIEW_PENDING.value:
+        return None
+    days = _days_since(pull.created_at, now)
+    if days < t.review_sla_days:
+        return None
+
+    severity = Severity.CRITICAL if days >= t.review_sla_days * 3 else Severity.WARNING
+    return AttentionHit(
+        rule=Rule.REVIEW_SLA_BREACH,
+        severity=severity,
+        title=f"等待评审已 {int(days)} 天",
+        detail=f"超过 {t.review_sla_days} 天的评审时限，建议推进或明确拒绝。",
+        evidence={"waiting_days": round(days, 1), "sla_days": t.review_sla_days},
+    )
+
+
+def rule_cve_aging(pull: PullSnapshot, now: datetime, t: Thresholds) -> AttentionHit | None:
+    """CVE 修复久未推进。安全问题的处理时限远紧于普通 PR。"""
+    if not pull.is_open or not pull.cve_ids:
+        return None
+    if pull.gate_stage in (GateStage.MERGED.value, GateStage.CLOSED.value):
+        return None
+
+    hours = _days_since(pull.created_at, now) * 24
+    if hours < t.cve_aging_hours:
+        return None
+
+    return AttentionHit(
+        rule=Rule.CVE_AGING,
+        severity=Severity.CRITICAL,
+        title=f"CVE 修复已 {int(hours)} 小时未推进",
+        # 实测有单次涉及 30+ 个 CVE 的补丁，全量列出会把这条待办本身淹掉。
+        # 完整列表在 evidence 里，需要时再取。
+        detail=f"涉及 {_cve_preview(pull.cve_ids)}，安全修复通常要求 24 小时内响应。",
+        evidence={"cve_ids": list(pull.cve_ids), "hours": round(hours, 1)},
+    )
+
+
+CVE_PREVIEW_COUNT = 3
+
+
+def _cve_preview(cve_ids: Sequence[str]) -> str:
+    shown = ", ".join(cve_ids[:CVE_PREVIEW_COUNT])
+    if len(cve_ids) <= CVE_PREVIEW_COUNT:
+        return shown
+    return f"{shown} 等 {len(cve_ids)} 项"
+
+
+def rule_needs_issue(pull: PullSnapshot, now: datetime, t: Thresholds) -> AttentionHit | None:
+    """未关联 Issue。openEuler 的硬性门禁。"""
+    if not pull.is_open or pull.gate_stage != GateStage.NEEDS_ISSUE.value:
+        return None
+    return AttentionHit(
+        rule=Rule.NEEDS_ISSUE,
+        severity=Severity.WARNING,
+        title="未关联 Issue",
+        detail="openEuler 要求 PR 至少关联一个 Issue，需在描述中补充 fixes #<编号>。",
+        evidence={"gate_stage": pull.gate_stage},
+    )
+
+
+def rule_cla(pull: PullSnapshot, now: datetime, t: Thresholds) -> AttentionHit | None:
+    if not pull.is_open:
+        return None
+
+    if pull.gate_stage == GateStage.CLA_DENIED.value:
+        return AttentionHit(
+            rule=Rule.CLA_DENIED,
+            severity=Severity.CRITICAL,
+            title="CLA 未通过",
+            detail="贡献者许可协议校验失败，无法合入。需贡献者完成签署。",
+            evidence={"gate_stage": pull.gate_stage},
+        )
+
+    if pull.gate_stage == GateStage.CLA_PENDING.value:
+        days = _days_since(pull.created_at, now)
+        if days < t.cla_pending_days:
+            return None
+        return AttentionHit(
+            rule=Rule.CLA_PENDING_LONG,
+            severity=Severity.WARNING,
+            title=f"CLA 已等待 {int(days)} 天",
+            detail="CLA 校验长时间未完成，通常意味着签署环节被卡住。",
+            evidence={"days": round(days, 1)},
+        )
+    return None
+
+
+def rule_rejected(pull: PullSnapshot, now: datetime, t: Thresholds) -> AttentionHit | None:
+    if not pull.is_open or pull.gate_stage != GateStage.REJECTED.value:
+        return None
+    return AttentionHit(
+        rule=Rule.REJECTED,
+        severity=Severity.CRITICAL,
+        title="已被 NACK",
+        detail="评审人明确否决，需处理反馈后重新申请评审。",
+        evidence={"labels": [n for n in pull.label_names if n == "NACK"]},
+    )
+
+
+def rule_stale(pull: PullSnapshot, now: datetime, t: Thresholds) -> AttentionHit | None:
+    """长期无活动。"""
+    if not pull.is_open:
+        return None
+    days = _days_since(pull.updated_at, now)
+    if days < t.stale_days:
+        return None
+    return AttentionHit(
+        rule=Rule.STALE,
+        severity=Severity.WARNING,
+        title=f"已 {int(days)} 天无活动",
+        detail="长期无更新，考虑推进、明确拒绝或关闭。",
+        evidence={"days_since_update": round(days, 1), "threshold_days": t.stale_days},
+    )
+
+
+def rule_binary_file(pull: PullSnapshot, now: datetime, t: Thresholds) -> AttentionHit | None:
+    """二进制文件。内核仓库明令禁止提交。"""
+    if not pull.is_open or not pull.binary_files:
+        return None
+    preview = list(pull.binary_files[:5])
+    return AttentionHit(
+        rule=Rule.BINARY_FILE,
+        severity=Severity.BLOCKER,
+        title=f"含 {len(pull.binary_files)} 个二进制文件",
+        detail="内核仓库禁止提交二进制文件：无法审查、增大仓库体积、难以追踪变更。"
+        "固件应提交到 linux-firmware，工具应提供源码与构建脚本。",
+        evidence={"files": preview, "total": len(pull.binary_files)},
+    )
+
+
+def rule_missing_signed_off(
+    pull: PullSnapshot, now: datetime, t: Thresholds
+) -> AttentionHit | None:
+    """缺少 Signed-off-by。openEuler 要求签名链完整。"""
+    if not pull.is_open or pull.total_commits == 0:
+        return None
+    if pull.commits_without_signed_off == 0:
+        return None
+    return AttentionHit(
+        rule=Rule.MISSING_SIGNED_OFF,
+        severity=Severity.WARNING,
+        title=f"{pull.commits_without_signed_off} 个提交缺少 Signed-off-by",
+        detail="签名链不完整会阻塞合入，需作者用 git commit -s 补签。",
+        evidence={
+            "missing": pull.commits_without_signed_off,
+            "total": pull.total_commits,
+        },
+    )
+
+
+# ---------------------------------------------------------------------------
+# Issue 规则
+# ---------------------------------------------------------------------------
+
+
+# 未指派且长期无人认领的 Issue 是社区协作里的黑洞：
+# 报告者等不到回应，维护者也不知道有这条。只有超过宽限期才提示，
+# 避免新提交的 Issue 一进来就出现在待办里。
+def rule_issue_unassigned(
+    issue: IssueSnapshot, now: datetime, t: Thresholds
+) -> AttentionHit | None:
+    if not issue.is_open or issue.assignee_login:
+        return None
+    days = _days_since(issue.created_at, now)
+    if days < t.issue_unassigned_days:
+        return None
+    return AttentionHit(
+        rule=Rule.ISSUE_UNASSIGNED,
+        severity=Severity.WARNING,
+        title=f"Issue 已 {int(days)} 天无人认领",
+        detail="长期未指派通常意味着报告得不到回应，建议指派或明确排除。",
+        evidence={"days_open": round(days, 1), "threshold_days": t.issue_unassigned_days},
+    )
+
+
+def rule_issue_stale(issue: IssueSnapshot, now: datetime, t: Thresholds) -> AttentionHit | None:
+    if not issue.is_open:
+        return None
+    days = _days_since(issue.updated_at, now)
+    if days < t.issue_stale_days:
+        return None
+    return AttentionHit(
+        rule=Rule.ISSUE_STALE,
+        severity=Severity.INFO,
+        title=f"Issue 已 {int(days)} 天无更新",
+        detail="长期停滞，考虑推动、明确结论或关闭。",
+        evidence={"days_since_update": round(days, 1), "threshold_days": t.issue_stale_days},
+    )
+
+
+ISSUE_RULES: tuple[Callable[[IssueSnapshot, datetime, Thresholds], AttentionHit | None], ...] = (
+    rule_issue_unassigned,
+    rule_issue_stale,
+)
+
+
+def evaluate_issue(
+    issue: IssueSnapshot,
+    now: datetime | None = None,
+    thresholds: Thresholds | None = None,
+) -> list[AttentionHit]:
+    """对一个 Issue 求值全部 Issue 规则。已关闭的 Issue 返回空。"""
+    if not issue.is_open:
+        return []
+
+    now = now or datetime.now(UTC)
+    thresholds = thresholds or Thresholds()
+
+    hits = [hit for rule in ISSUE_RULES if (hit := rule(issue, now, thresholds)) is not None]
+    hits.sort(key=lambda h: (SEVERITY_ORDER[h.severity], h.rule.value))
+    return hits
+
+
+ALL_RULES: tuple[Callable[[PullSnapshot, datetime, Thresholds], AttentionHit | None], ...] = (
+    rule_binary_file,
+    rule_ci_failed,
+    rule_merge_conflict,
+    rule_cve_aging,
+    rule_rejected,
+    rule_cla,
+    rule_needs_issue,
+    rule_missing_signed_off,
+    rule_review_sla_breach,
+    rule_stale,
+)
+
+
+def evaluate(
+    pull: PullSnapshot,
+    now: datetime | None = None,
+    thresholds: Thresholds | None = None,
+) -> list[AttentionHit]:
+    """对一个 PR 求值全部规则，按严重程度排序返回。
+
+    已合并/已关闭的 PR 直接返回空 —— 对它们提"待处理"是噪音。
+    """
+    if pull.state in ("merged", "closed"):
+        return []
+
+    now = now or datetime.now(UTC)
+    thresholds = thresholds or Thresholds()
+
+    hits: list[AttentionHit] = []
+    for rule in ALL_RULES:
+        hit = rule(pull, now, thresholds)
+        if hit is not None:
+            hits.append(hit)
+
+    hits.sort(key=lambda h: (SEVERITY_ORDER[h.severity], h.rule.value))
+    return hits
+
+
+# ---------------------------------------------------------------------------
+# 规则说明（供界面展示"这条是什么意思"）
+# ---------------------------------------------------------------------------
+
+RULE_DESCRIPTIONS: dict[Rule, str] = {
+    Rule.BINARY_FILE: "内核仓库禁止提交二进制文件，属阻塞性问题",
+    Rule.CI_FAILED: "门禁检查失败，无法合入",
+    Rule.MERGE_CONFLICT: "与目标分支存在冲突",
+    Rule.CVE_AGING: "安全修复响应超时",
+    Rule.REJECTED: "评审人明确否决",
+    Rule.CLA_DENIED: "贡献者许可协议未通过",
+    Rule.CLA_PENDING_LONG: "CLA 校验长时间未完成",
+    Rule.NEEDS_ISSUE: "未按要求关联 Issue",
+    Rule.MISSING_SIGNED_OFF: "补丁缺少 Signed-off-by",
+    Rule.REVIEW_SLA_BREACH: "等待评审超出时限",
+    Rule.STALE: "长期无活动",
+    Rule.ISSUE_UNASSIGNED: "Issue 长期未指派",
+    Rule.ISSUE_STALE: "Issue 长期无更新",
+}
+
+
+# ---------------------------------------------------------------------------
+# 规则元信息
+# ---------------------------------------------------------------------------
+
+
+@dataclass(frozen=True)
+class RuleInfo:
+    """一条规则对使用者意味着什么。
+
+    集中一处，供三处共用：关注设置页（说明与阈值）、队列分组（标题与说明）、
+    首页摘要。分散写会让同一规则在三处显示成三种说法。
+    """
+
+    rule: Rule
+    label: str
+    """短名，用于标签与分组标题。"""
+
+    meaning: str
+    """这条规则在提醒什么。使用者要能由此判断"与我有关系吗"。"""
+
+    action: str
+    """看到之后该做什么。只说问题不给出路，队列就只是噪音来源。"""
+
+    subject: str
+    """``pull_request`` 或 ``issue``。"""
+
+    default_days: int
+    threshold_field: str
+    """``Thresholds`` 中对应的字段名。设置页改的就是它。"""
+
+    # 命中的对象通常很多（每个未推进的 CVE PR 都算一条）。
+    # 这类规则必须聚合展示，逐条列等于没筛选。
+    high_volume: bool = False
+
+
+RULE_INFO: tuple[RuleInfo, ...] = (
+    RuleInfo(
+        rule=Rule.CI_FAILED,
+        label="CI 失败",
+        meaning="门禁检查未通过，且已超过阈值天数没有恢复。",
+        action="看构建日志定位失败原因；若为偶发失败，重新触发一次。",
+        subject="pull_request",
+        default_days=3,
+        threshold_field="ci_failed_days",
+    ),
+    RuleInfo(
+        rule=Rule.MERGE_CONFLICT,
+        label="合并冲突",
+        meaning="与目标分支产生冲突，无法直接合入。",
+        action="请作者 rebase 到目标分支最新提交。",
+        subject="pull_request",
+        default_days=2,
+        threshold_field="conflict_days",
+    ),
+    RuleInfo(
+        rule=Rule.CLA_DENIED,
+        label="CLA 未通过",
+        meaning="签署检查未通过，通常是提交缺少 Signed-off-by 或签署账号不匹配。",
+        action="请作者补签并确认提交邮箱与签署账号一致。",
+        subject="pull_request",
+        default_days=0,
+        threshold_field="cla_pending_days",
+    ),
+    RuleInfo(
+        rule=Rule.CLA_PENDING_LONG,
+        label="CLA 停滞",
+        meaning="签署长时间停留在待处理状态。",
+        action="确认是否卡在签署流程上，必要时联系作者。",
+        subject="pull_request",
+        default_days=1,
+        threshold_field="cla_pending_days",
+    ),
+    RuleInfo(
+        rule=Rule.REJECTED,
+        label="已被 NACK",
+        meaning="有评审人明确反对合入。",
+        action="确认反对意见是否已被处理；已处理则请评审人撤回。",
+        subject="pull_request",
+        default_days=0,
+        threshold_field="review_sla_days",
+    ),
+    RuleInfo(
+        rule=Rule.NEEDS_ISSUE,
+        label="缺关联 Issue",
+        meaning="openEuler 要求 PR 关联 Issue，这条没有。",
+        action="请作者在描述中补 Fixes #编号。",
+        subject="pull_request",
+        default_days=0,
+        threshold_field="review_sla_days",
+    ),
+    RuleInfo(
+        rule=Rule.MISSING_SIGNED_OFF,
+        label="缺签名",
+        meaning="提交缺少 Signed-off-by，不符合 DCO 要求。",
+        action="请作者用 git commit -s 补签。",
+        subject="pull_request",
+        default_days=0,
+        threshold_field="review_sla_days",
+    ),
+    RuleInfo(
+        rule=Rule.BINARY_FILE,
+        label="含二进制文件",
+        meaning="补丁中包含二进制文件，无法逐行评审。",
+        action="确认该二进制是必要的；固件之类通常需要说明来源与许可。",
+        subject="pull_request",
+        default_days=0,
+        threshold_field="review_sla_days",
+    ),
+    RuleInfo(
+        rule=Rule.REVIEW_SLA_BREACH,
+        label="评审超期",
+        meaning="已过评审时限仍无人评审。",
+        action="按 committers.md 的模块归属指定评审人。",
+        subject="pull_request",
+        default_days=7,
+        threshold_field="review_sla_days",
+        high_volume=True,
+    ),
+    RuleInfo(
+        rule=Rule.STALE,
+        label="长期无活动",
+        meaning="超过阈值天数没有任何更新。",
+        action="确认是否已被放弃；放弃则应关闭，否则催促推进。",
+        subject="pull_request",
+        default_days=30,
+        threshold_field="stale_days",
+        high_volume=True,
+    ),
+    RuleInfo(
+        rule=Rule.CVE_AGING,
+        label="CVE 未推进",
+        meaning="安全补丁在时限内没有推进。这是唯一有外部时限的一类。",
+        action="优先安排评审；确认是否缺少上游补丁或需要回合。",
+        subject="pull_request",
+        default_days=1,
+        threshold_field="cve_aging_hours",
+        high_volume=True,
+    ),
+    RuleInfo(
+        rule=Rule.ISSUE_UNASSIGNED,
+        label="Issue 未指派",
+        meaning="Issue 没有指派给任何人，因此没有人会去处理它。",
+        action="按模块归属指派处理人。",
+        subject="issue",
+        default_days=7,
+        threshold_field="issue_unassigned_days",
+        high_volume=True,
+    ),
+    RuleInfo(
+        rule=Rule.ISSUE_STALE,
+        label="Issue 长期无活动",
+        meaning="Issue 长时间没有更新，通常意味着被遗忘了。",
+        action="确认是否仍然有效；无效则关闭，有效则重新指派。",
+        subject="issue",
+        default_days=90,
+        threshold_field="issue_stale_days",
+        high_volume=True,
+    ),
+)
+
+RULE_INFO_BY_KEY: dict[str, RuleInfo] = {item.rule.value: item for item in RULE_INFO}