feat(ci): ワークフロー検査をリポジトリ横断で実行できるようにする

.github/workflows/fleet-workflow-guards.yml

@@ -0,0 +1,55 @@
+# Fleet Workflow Guards
+#
+# repo-maintenance のワークフロー検査を、直近いじったリポジトリ全体に対して実行する。
+# 検査は bash と awk だけで動き、対象リポジトリのワークフロー YAML を読むだけなので、
+# 各リポジトリへスクリプトを配布せずここから一括で走らせられる。検査を直せば次回の
+# 実行から全リポジトリへ反映される。
+#
+# 走査は読み取りのみ。対象リポジトリへ Issue や PR は作らない。
+name: Fleet Workflow Guards
+
+on:
+  schedule:
+    - cron: '0 22 * * 0' # 毎週月曜 07:00 JST
+  workflow_dispatch:
+    inputs:
+      days:
+        description: '対象とする最終 push からの日数'
+        required: false
+        default: '90'
+      repos:
+        description: '走査するリポジトリ名（空白区切り）。空なら自動検出'
+        required: false
+        default: ''
+
+permissions: {}
+
+concurrency:
+  group: ${{ github.workflow }}
+  cancel-in-progress: false
+
+jobs:
+  scan:
+    name: Scan repositories
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    permissions:
+      contents: read
+    steps:
+      - name: Checkout config
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 1
+
+      # 他リポジトリを読むため PAT が要る。GITHUB_TOKEN は自リポジトリしか見えない。
+      - name: Run workflow guards across repositories
+        env:
+          GH_TOKEN: ${{ secrets.CLAUDE_PAT }}
+          FLEET_DAYS: ${{ inputs.days || '90' }}
+          FLEET_REPOS: ${{ inputs.repos || '' }}
+        run: |
+          args=(--days "$FLEET_DAYS")
+          if [ -n "$FLEET_REPOS" ]; then
+            args+=(--repos "$FLEET_REPOS")
+          fi
+          script/fleet-workflow-guards.sh "${args[@]}"

AGENTS.md

@@ -39,24 +39,24 @@ Development infrastructure template repository providing DevContainer images, CI
 
 | Directory            | Purpose                                                     |
 | -------------------- | ----------------------------------------------------------- |
+| `.claude-plugin/`    | Claude Code LSP plugin configuration                        |
 | `.claude/agents/`    | Claude Code specialized agents                              |
 | `.claude/commands/`  | Claude Code slash commands                                  |
 | `.claude/hooks/`     | Pre/post hook scripts for quality enforcement               |
 | `.claude/plugins/`   | Claude Code plugin configuration                            |
 | `.claude/rules/`     | Claude Code rules for development standards                 |
 | `.claude/skills/`    | Claude Code skill definitions                               |
-| `.claude-plugin/`    | Claude Code LSP plugin configuration                        |
 | `.codex/`            | Codex AI agent configuration                                |
 | `.context/`          | Shared intermediate artifacts (complexity reports etc.)     |
 | `.cursor/`           | Cursor editor settings                                      |
 | `.devcontainer/`     | DevContainer configuration and Dockerfile                   |
 | `.gemini/`           | Gemini AI agent configuration                               |
-| `.github/workflows/` | GitHub Actions CI/CD workflows (15 workflows)               |
+| `.github/workflows/` | GitHub Actions CI/CD workflows (16 workflows)               |
 | `.husky/`            | Git hooks (pre-commit, commit-msg)                          |
 | `.takt/`             | TAKT workflow automation for scheduled agent tasks          |
 | `.vscode/`           | VS Code workspace settings                                  |
 | `.zsh/`              | Zsh configuration (aliases, completions, functions, prompt) |
-| `automation/`        | Weekly/screenshot ingest adapters and threshold rules       |
+| `automation/`        | Weekly and screenshot ingest adapters and threshold rules   |
 | `brew/`              | Homebrew package management (Linux only)                    |
 | `credentials/`       | Credential templates and filtering documentation            |
 | `docs/`              | Documentation and ADRs                                      |
@@ -141,6 +141,7 @@ Development infrastructure template repository providing DevContainer images, CI
 | `coverage-report.yml`       | Coverage Report                      |
 | `dependabot-auto-merge.yml` | Dependabot Auto-merge                |
 | `docker-image.yml`          | Build and Release DevContainer Image |
+| `fleet-workflow-guards.yml` | Fleet Workflow Guards                |
 | `label-sync.yml`            | Label Sync                           |
 | `manual-release.yml`        | Manual Release                       |
 | `quality-gate-fallback.yml` | CI Fallback                          |

script/README.md

@@ -12,6 +12,7 @@ This directory contains utility scripts for managing configuration, credentials,
 | `version.sh`                     | Semantic versioning                                      | Makefile               |
 | `update-agents-md.sh`            | AGENTS.md 自動生成セクション更新                         | repo-maintenance       |
 | `repo-maintenance.sh`            | Repository maintenance executable workflow               | `/repo-maintenance`    |
+| `fleet-workflow-guards.sh`       | Workflow guards across every recently pushed repository  | fleet-workflow-guards  |
 | `validate-takt-auth.sh`          | Fail fast on rejected Anthropic credentials              | scheduled-maintenance  |
 | `trust-claude-workspace.sh`      | Trust a workspace in `~/.claude.json` for headless runs  | scheduled-maintenance  |
 | `setup-ci.sh`                    | CI/CD workflow setup                                     | `/setup-ci`            |
@@ -195,6 +196,28 @@ The workflow guards (`--check-claude-action-credentials`, `--check-self-cancelli
 `.github/workflows/templates/`, and `templates/workflows/`. `ci.yml` runs all four in its
 Workflow Lint job so regressions fail the pull request.
 
+### fleet-workflow-guards.sh
+
+Runs the repo-maintenance workflow guards across several repositories at once.
+The guards only read workflow YAML, so they run unchanged against any checkout;
+keeping them here means a fix to a guard reaches every repository on the next
+run without distributing this script downstream.
+
+The scan is read-only. It never opens issues or pull requests in the scanned
+repositories.
+
+**Usage**:
+
+```bash
+./script/fleet-workflow-guards.sh                       # 直近90日に push されたリポジトリ
+./script/fleet-workflow-guards.sh --days 30
+./script/fleet-workflow-guards.sh --repos "config ohana"
+```
+
+Requires `gh` authenticated with a token that can read the target repositories.
+`.github/workflows/fleet-workflow-guards.yml` runs it weekly with `CLAUDE_PAT`
+and writes the per-repository result to the job summary.
+
 ### setup-ci.sh
 
 Detects project type and package manager, then writes CI/CD workflow defaults.

script/fleet-workflow-guards.sh

@@ -0,0 +1,185 @@
+#!/usr/bin/env bash
+# Run the repo-maintenance workflow guards across several repositories.
+#
+# The guards only read workflow YAML, so they run unchanged against any
+# repository checkout. Keeping them here means a fix to a guard reaches every
+# repository at once, without distributing this script downstream.
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+# shellcheck source=script/lib/output.sh
+source "$SCRIPT_DIR/lib/output.sh"
+
+OWNER="${FLEET_OWNER:-keito4}"
+DAYS="90"
+REPOS=""
+WORK_DIR="${FLEET_WORK_DIR:-${CONTEXT_DIR:-.context}/fleet}"
+
+GUARDS=(
+  --check-claude-action-credentials
+  --check-self-cancelling-workflows
+  --check-gh-repo-context
+  --check-artifact-retention
+)
+
+usage() {
+  cat <<'EOF'
+Usage: script/fleet-workflow-guards.sh [--owner OWNER] [--days N] [--repos "name ..."]
+
+Scans each repository with the repo-maintenance workflow guards and prints a
+markdown summary. Exits non-zero when any repository reports a violation.
+
+  --owner OWNER   GitHub owner to scan (default: keito4)
+  --days N        Only scan repositories pushed within N days (default: 90)
+  --repos "..."   Scan exactly these repository names, skipping discovery
+EOF
+}
+
+while [[ $# -gt 0 ]]; do
+  case "$1" in
+    --owner)
+      OWNER="${2:?--owner requires a value}"
+      shift 2
+      ;;
+    --days)
+      DAYS="${2:?--days requires a value}"
+      shift 2
+      ;;
+    --repos)
+      REPOS="${2:?--repos requires a value}"
+      shift 2
+      ;;
+    -h | --help)
+      usage
+      exit 0
+      ;;
+    *)
+      output::fatal "Unknown argument: $1"
+      ;;
+  esac
+done
+
+validate_inputs() {
+  local repo
+
+  if [[ ! "$DAYS" =~ ^[1-9][0-9]*$ ]]; then
+    # 検証しないと date が失敗して cutoff が空になり、全リポジトリへ黙って広がる。
+    output::fatal "invalid --days: $DAYS (expected a positive integer)"
+  fi
+
+  for repo in $REPOS; do
+    # rm -rf する先を作るので、作業ディレクトリの外を指す名前は受け付けない。
+    if [[ ! "$repo" =~ ^[A-Za-z0-9._-]+$ || "$repo" == .* ]]; then
+      output::fatal "invalid repository name: $repo"
+    fi
+  done
+}
+
+discover_repos() {
+  local cutoff
+  # 直近いじったリポジトリだけを対象にする。アーカイブ済みは除外する。
+  cutoff="$(date -u -v-"${DAYS}"d +%Y-%m-%d 2>/dev/null || date -u -d "${DAYS} days ago" +%Y-%m-%d)"
+  gh repo list "$OWNER" \
+    --limit 200 \
+    --no-archived \
+    --json name,pushedAt \
+    --jq "[.[] | select(.pushedAt >= \"$cutoff\")] | .[].name"
+}
+
+# 1 リポジトリ分の違反行を stdout へ出す。違反が無ければ何も出さない。
+# チェックアウトへ入れないときは 2 を返す。ここを握り潰すと、走査できていないのに
+# 「違反なし」と報告してしまう。
+scan_repo() {
+  local dest="$1" guard output guard_status
+
+  [[ -d "$dest" ]] || return 2
+
+  for guard in "${GUARDS[@]}"; do
+    # 終了ステータスを正とする。検査によっては output::warning ではなく素の
+    # "file: message" を出すため、⚠ 行だけを拾うと違反が消える。依存不足などの
+    # 違反以外の失敗も、黙って clean にせずここで拾う。
+    # 1 つ落ちても残りを続け、まとめて直せるようにする。
+    guard_status=0
+    output="$(cd "$dest" || exit 1; "$SCRIPT_DIR/repo-maintenance.sh" "$guard" 2>&1)" || guard_status=$?
+    [[ "$guard_status" -eq 0 ]] && continue
+
+    if [[ -n "$output" ]]; then
+      printf '%s\n' "$output"
+    else
+      printf '%s: failed with no output\n' "$guard"
+    fi
+  done
+}
+
+main() {
+  local repos repo dest violations=0 summary=""
+
+  validate_inputs
+
+  if [[ -n "$REPOS" ]]; then
+    read -r -a repos <<<"$REPOS"
+  else
+    mapfile -t repos < <(discover_repos)
+  fi
+
+  if [[ "${#repos[@]}" -eq 0 ]]; then
+    output::warning "No repositories to scan"
+    return 0
+  fi
+
+  mkdir -p "$WORK_DIR"
+  summary+="## Workflow guard scan"$'\n\n'
+  summary+="| Repository | Result |"$'\n'
+  summary+="| --- | --- |"$'\n'
+
+  for repo in "${repos[@]}"; do
+    [[ -n "$repo" ]] || continue
+    dest="$WORK_DIR/$repo"
+    rm -rf "$dest"
+
+    if ! gh repo clone "$OWNER/$repo" "$dest" -- --depth 1 --no-tags >/dev/null 2>&1; then
+      output::warning "$repo: clone failed; skipped"
+      summary+="| \`$repo\` | ⚠️ clone failed |"$'\n'
+      continue
+    fi
+
+    local findings scan_status=0
+    findings="$(scan_repo "$dest")" || scan_status=$?
+
+    if [[ "$scan_status" -eq 2 ]]; then
+      violations=$((violations + 1))
+      output::warning "$repo: checkout missing; not scanned"
+      summary+="| \`$repo\` | ⚠️ not scanned |"$'\n'
+      continue
+    fi
+
+    if [[ -n "$findings" ]]; then
+      violations=$((violations + 1))
+      output::warning "$repo"
+      printf '%s\n' "$findings"
+      summary+="| \`$repo\` | ❌ $(printf '%s' "$findings" | grep -c . ) violation(s) |"$'\n'
+      while IFS= read -r line; do
+        [[ -n "$line" ]] || continue
+        summary+="| | $(printf '%s' "$line" | sed 's/\x1b\[[0-9;]*m//g; s/^[[:space:]]*⚠[[:space:]]*//') |"$'\n'
+      done <<<"$findings"
+    else
+      output::success "$repo"
+      summary+="| \`$repo\` | ✅ clean |"$'\n'
+    fi
+  done
+
+  if [[ "$violations" -eq 0 ]]; then
+    summary+=$'\n'"No workflow guard violations across ${#repos[@]} repositories."$'\n'
+    output::success "No workflow guard violations across ${#repos[@]} repositories"
+  else
+    summary+=$'\n'"$violations of ${#repos[@]} repositories reported violations."$'\n'
+  fi
+
+  if [[ -n "${GITHUB_STEP_SUMMARY:-}" ]]; then
+    printf '%s' "$summary" >>"$GITHUB_STEP_SUMMARY"
+  fi
+
+  [[ "$violations" -eq 0 ]]
+}
+
+main

script/lib/repo_maintenance_checks.sh

@@ -183,22 +183,39 @@ check_gh_repo_context() {
     [[ -n "$workflow" ]] || continue
 
     # ジョブ単位で判定する。あるジョブの checkout や GH_REPO は別ジョブの gh を設定しない。
-    # --repo は同じコマンド行にある場合だけ有効とみなす。
+    # 行継続は 1 つの論理行に結合してから見る。--repo が継続行にある書き方は普通で、
+    # 同一行しか見ないと正常動作しているワークフローを誤検知する。
     if ! awk '
       function flush() {
         if (in_job && bad_cmd && !has_checkout && !has_gh_repo) bad = 1
         bad_cmd = 0; has_checkout = 0; has_gh_repo = 0
       }
+      function eval_line(l) {
+        if (!in_job) return
+        if (l ~ /actions\/checkout/) has_checkout = 1
+        if (l ~ /^[[:space:]]*GH_REPO:/) has_gh_repo = 1
+        if (l ~ /(^|[^A-Za-z0-9_-])gh[[:space:]]+((label|issue|release|run|workflow)|pr[[:space:]]+(create|list|status))([^A-Za-z0-9_-]|$)/) {
+          # gh は -R / --repo= も受け付ける。落とすと正当なワークフローを止める。
+          if (l !~ /(--repo[[:space:]=]|-R[[:space:]])/) bad_cmd = 1
+        }
+      }
       { line = $0; sub(/^[[:space:]]*#.*$/, "", line) }
-      /^jobs:[[:space:]]*$/ { in_jobs = 1; next }
-      in_jobs && /^  [A-Za-z0-9_-]+:/ { flush(); in_job = 1; next }
-      in_job && line ~ /actions\/checkout/ { has_checkout = 1 }
-      in_job && line ~ /^[[:space:]]*GH_REPO:/ { has_gh_repo = 1 }
-      in_job && line ~ /(^|[^A-Za-z0-9_-])gh[[:space:]]+((label|issue|release|run|workflow)|pr[[:space:]]+(create|list|status))([^A-Za-z0-9_-]|$)/ {
-        # gh は -R / --repo= も受け付ける。落とすと正当なワークフローを止める。
-        if (line !~ /(--repo[[:space:]=]|-R[[:space:]])/) bad_cmd = 1
+      pending == "" && /^jobs:[[:space:]]*$/ { in_jobs = 1; next }
+      pending == "" && in_jobs && /^  [A-Za-z0-9_-]+:/ { flush(); in_job = 1; next }
+      {
+        if (pending != "") { line = pending " " line; pending = "" }
+        if (line ~ /\\[[:space:]]*$/) {
+          sub(/\\[[:space:]]*$/, "", line)
+          pending = line
+          next
+        }
+        eval_line(line)
+      }
+      END {
+        if (pending != "") eval_line(pending)
+        flush()
+        exit bad ? 1 : 0
       }
-      END { flush(); exit bad ? 1 : 0 }
     ' "$workflow"; then
       output::warning "$(basename "$workflow"): gh has no repository to resolve without a checkout"
       echo "Add the repository to the step environment:"