feat: Optimize CI workflows with path filters and move devcontainer docs - #267
Conversation
## 変更内容 ### CI最適化 - GitHub Actions ワークフローにpath filtersを導入し、変更されたファイルに応じて必要なジョブのみを実行 - `dorny/paths-filter`を使用したジョブレベルの細かい実行制御を実装 - Quality Gateで`skipped`状態を成功として扱うように改善 ### ワークフロー変更 - `.github/workflows/ci.yml`: コード、スクリプト、ワークフロー、依存関係ごとの変更検知を追加 - `.github/workflows/docker-image.yml`: DevContainer関連ファイル変更時のみビルド実行 - `.github/workflows/security.yml`: セキュリティに影響するファイル変更時のみスキャン実行 ### ドキュメント更新 - `.codex/prompts/setup-recommended-ci.md`: Path Filters実装方法とベストプラクティスを追加 - `.github/workflows/templates/unified-ci.yml`: Path filtersの例を追加 - `.github/workflows/templates/README.md`: CI最適化セクションを追加 ### ファイル移動 - `.codex/devcontainer-recommendations.md` → `.claude/devcontainer-recommendations.md` ## 効果 - ドキュメントのみの変更: CI実行時間 90%削減 (10分 → 1分) - DevContainer変更なし: Docker Image Build スキップ (45分 → 0分) - コード変更なし: Lint/Test スキップ 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
📝 WalkthroughWalkthroughAdds path-based CI filtering and a changes-detection job to GitHub Actions workflows; conditionally gates lint/test/integration/actionlint jobs, updates the Quality Gate to aggregate results (treating skipped as success), and adds documentation describing path-filter best practices and examples. Changes
Sequence DiagramsequenceDiagram
autonumber
participant Event as Push/PR Event
participant Changes as Changes Detector\n(dorny/paths-filter)
participant Lint as Lint Job
participant Unit as Unit Test Job
participant Integration as Integration Test Job
participant Actionlint as Workflow Lint Job
participant QualityGate as Quality Gate
Event->>Changes: Trigger (changed files list)
activate Changes
Changes-->>Changes: Categorize into\ncode / scripts / workflows / deps
Changes->>Lint: signal (code || scripts || deps)
Changes->>Unit: signal (code || deps)
Changes->>Integration: signal (scripts || deps)
Changes->>Actionlint: signal (workflows)
deactivate Changes
par Conditional execution
alt Lint triggered
Lint->>Lint: run -> report (success|failure)
else skipped
Lint-->>Lint: skipped -> report (skipped)
end
alt Unit triggered
Unit->>Unit: run -> report (success|failure)
else skipped
Unit-->>Unit: skipped -> report (skipped)
end
alt Integration triggered
Integration->>Integration: run -> report (success|failure)
else skipped
Integration-->>Integration: skipped -> report (skipped)
end
alt Actionlint triggered
Actionlint->>Actionlint: run -> report (success|failure)
else skipped
Actionlint-->>Actionlint: skipped -> report (skipped)
end
end
Lint-->>QualityGate: result
Unit-->>QualityGate: result
Integration-->>QualityGate: result
Actionlint-->>QualityGate: result
activate QualityGate
QualityGate->>QualityGate: aggregate results\n(treat skipped as success)
alt all success/skipped
QualityGate-->>Event: pass
else any failure
QualityGate-->>Event: fail + notify
end
deactivate QualityGate
Estimated code review effort🎯 4 (Complex) | ⏱️ ~50 minutes Possibly related PRs
Suggested labels
Poem
Pre-merge checks✅ Passed checks (3 passed)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
There was a problem hiding this comment.
Remaining comments which cannot be posted as a review comment to avoid GitHub Rate Limit
actionlint
📝 [actionlint] reported by reviewdog 🐶
shellcheck reported issue in this script: SC2086:info:30:32: Double quote to prevent globbing and word splitting [shellcheck]
config/.github/workflows/docker-image.yml
Line 55 in 4357ed0
📝 [actionlint] reported by reviewdog 🐶
shellcheck reported issue in this script: SC2086:info:31:37: Double quote to prevent globbing and word splitting [shellcheck]
config/.github/workflows/docker-image.yml
Line 55 in 4357ed0
📝 [actionlint] reported by reviewdog 🐶
shellcheck reported issue in this script: SC2086:info:32:30: Double quote to prevent globbing and word splitting [shellcheck]
config/.github/workflows/docker-image.yml
Line 55 in 4357ed0
🚫 [actionlint] reported by reviewdog 🐶
shellcheck reported issue in this script: SC2129:style:30:1: Consider using { cmd1; cmd2; } >> file instead of individual redirects [shellcheck]
config/.github/workflows/docker-image.yml
Line 55 in 4357ed0
📝 [actionlint] reported by reviewdog 🐶
shellcheck reported issue in this script: SC2086:info:10:39: Double quote to prevent globbing and word splitting [shellcheck]
config/.github/workflows/docker-image.yml
Line 97 in 4357ed0
📝 [actionlint] reported by reviewdog 🐶
shellcheck reported issue in this script: SC2086:info:11:32: Double quote to prevent globbing and word splitting [shellcheck]
config/.github/workflows/docker-image.yml
Line 97 in 4357ed0
📝 [actionlint] reported by reviewdog 🐶
shellcheck reported issue in this script: SC2086:info:6:31: Double quote to prevent globbing and word splitting [shellcheck]
config/.github/workflows/docker-image.yml
Line 97 in 4357ed0
📝 [actionlint] reported by reviewdog 🐶
shellcheck reported issue in this script: SC2086:info:9:34: Double quote to prevent globbing and word splitting [shellcheck]
config/.github/workflows/docker-image.yml
Line 97 in 4357ed0
🚫 [actionlint] reported by reviewdog 🐶
shellcheck reported issue in this script: SC2129:style:9:3: Consider using { cmd1; cmd2; } >> file instead of individual redirects [shellcheck]
config/.github/workflows/docker-image.yml
Line 97 in 4357ed0
📝 [actionlint] reported by reviewdog 🐶
shellcheck reported issue in this script: SC2086:info:3:50: Double quote to prevent globbing and word splitting [shellcheck]
config/.github/workflows/docker-image.yml
Line 201 in 4357ed0
📝 [actionlint] reported by reviewdog 🐶
shellcheck reported issue in this script: SC2086:info:1:31: Double quote to prevent globbing and word splitting [shellcheck]
config/.github/workflows/security.yml
Line 89 in 4357ed0
📝 [actionlint] reported by reviewdog 🐶
shellcheck reported issue in this script: SC2086:info:2:12: Double quote to prevent globbing and word splitting [shellcheck]
config/.github/workflows/security.yml
Line 89 in 4357ed0
📝 [actionlint] reported by reviewdog 🐶
shellcheck reported issue in this script: SC2086:info:3:110: Double quote to prevent globbing and word splitting [shellcheck]
config/.github/workflows/security.yml
Line 89 in 4357ed0
📝 [actionlint] reported by reviewdog 🐶
shellcheck reported issue in this script: SC2086:info:3:181: Double quote to prevent globbing and word splitting [shellcheck]
config/.github/workflows/security.yml
Line 89 in 4357ed0
📝 [actionlint] reported by reviewdog 🐶
shellcheck reported issue in this script: SC2086:info:1:29: Double quote to prevent globbing and word splitting [shellcheck]
config/.github/workflows/security.yml
Line 120 in 4357ed0
📝 [actionlint] reported by reviewdog 🐶
shellcheck reported issue in this script: SC2086:info:2:12: Double quote to prevent globbing and word splitting [shellcheck]
config/.github/workflows/security.yml
Line 120 in 4357ed0
📝 [actionlint] reported by reviewdog 🐶
shellcheck reported issue in this script: SC2086:info:3:15: Double quote to prevent globbing and word splitting [shellcheck]
config/.github/workflows/security.yml
Line 120 in 4357ed0
📝 [actionlint] reported by reviewdog 🐶
shellcheck reported issue in this script: SC2086:info:4:111: Double quote to prevent globbing and word splitting [shellcheck]
config/.github/workflows/security.yml
Line 120 in 4357ed0
📝 [actionlint] reported by reviewdog 🐶
shellcheck reported issue in this script: SC2086:info:4:30: Double quote to prevent globbing and word splitting [shellcheck]
config/.github/workflows/security.yml
Line 120 in 4357ed0
📝 [actionlint] reported by reviewdog 🐶
shellcheck reported issue in this script: SC2086:info:5:15: Double quote to prevent globbing and word splitting [shellcheck]
config/.github/workflows/security.yml
Line 120 in 4357ed0
🚫 [actionlint] reported by reviewdog 🐶
shellcheck reported issue in this script: SC2129:style:1:1: Consider using { cmd1; cmd2; } >> file instead of individual redirects [shellcheck]
config/.github/workflows/security.yml
Line 120 in 4357ed0
There was a problem hiding this comment.
🚫 [actionlint] reported by reviewdog 🐶
avoid using deprecated input "fail_on_error" in action "reviewdog/action-actionlint@v1": Deprecated, use fail_level instead [action]
config/.github/workflows/ci.yml
Line 198 in 4357ed0
There was a problem hiding this comment.
📝 [actionlint] reported by reviewdog 🐶
shellcheck reported issue in this script: SC2086:info:1:35: Double quote to prevent globbing and word splitting [shellcheck]
config/.github/workflows/ci.yml
Line 213 in 4357ed0
There was a problem hiding this comment.
📝 [actionlint] reported by reviewdog 🐶
shellcheck reported issue in this script: SC2086:info:2:12: Double quote to prevent globbing and word splitting [shellcheck]
config/.github/workflows/ci.yml
Line 213 in 4357ed0
There was a problem hiding this comment.
📝 [actionlint] reported by reviewdog 🐶
shellcheck reported issue in this script: SC2086:info:3:28: Double quote to prevent globbing and word splitting [shellcheck]
config/.github/workflows/ci.yml
Line 213 in 4357ed0
There was a problem hiding this comment.
📝 [actionlint] reported by reviewdog 🐶
shellcheck reported issue in this script: SC2086:info:4:28: Double quote to prevent globbing and word splitting [shellcheck]
config/.github/workflows/ci.yml
Line 213 in 4357ed0
There was a problem hiding this comment.
📝 [actionlint] reported by reviewdog 🐶
shellcheck reported issue in this script: SC2086:info:5:44: Double quote to prevent globbing and word splitting [shellcheck]
config/.github/workflows/ci.yml
Line 213 in 4357ed0
There was a problem hiding this comment.
📝 [actionlint] reported by reviewdog 🐶
shellcheck reported issue in this script: SC2086:info:6:41: Double quote to prevent globbing and word splitting [shellcheck]
config/.github/workflows/ci.yml
Line 213 in 4357ed0
There was a problem hiding this comment.
📝 [actionlint] reported by reviewdog 🐶
shellcheck reported issue in this script: SC2086:info:7:55: Double quote to prevent globbing and word splitting [shellcheck]
config/.github/workflows/ci.yml
Line 213 in 4357ed0
There was a problem hiding this comment.
📝 [actionlint] reported by reviewdog 🐶
shellcheck reported issue in this script: SC2086:info:8:50: Double quote to prevent globbing and word splitting [shellcheck]
config/.github/workflows/ci.yml
Line 213 in 4357ed0
There was a problem hiding this comment.
🚫 [actionlint] reported by reviewdog 🐶
shellcheck reported issue in this script: SC2129:style:1:1: Consider using { cmd1; cmd2; } >> file instead of individual redirects [shellcheck]
config/.github/workflows/ci.yml
Line 213 in 4357ed0
|
(aside) |
|
Claude finished @keito4's task in 1m 10s —— View job タスク概要PRのマージ時にCIが失敗している問題を調査しました。 チェックリスト
調査結果CI自体は成功していますが（✅ 全ジョブが成功）、reviewdogによるactionlintとshellcheckの警告が報告されています。これらの警告を修正する必要があります。 検出された問題1.
|
PR Review: CI最適化 - Path Filters導入概要GitHub Actions ワークフローに path filters を導入し、変更されたファイルに応じて必要なジョブのみを実行する最適化を実装しています。全体的に非常によく設計された実装ですが、いくつかの改善提案があります。 ✅ 良い点1. 包括的な実装
2. 詳細なドキュメント
3. 適切なスコープ
🔍 潜在的な問題と改善提案1. Critical: Path Filter の重複とメンテナンス性問題: 影響:
推奨: main ブランチでは path filters を削除し、常に全ジョブを実行する方が安全です（ 2. Path Filter のカバレッジ漏れ問題: 欠けているパターン:
推奨: ワークフローレベルとジョブレベルの filters を一致させる 3. Integration Test の条件が不適切問題: 影響:
推奨: if: needs.changes.outputs.code == 'true' || needs.changes.outputs.scripts == 'true' || needs.changes.outputs.dependencies == 'true'4. Quality Gate の堅牢性問題: 推奨: より堅牢なチェック関数 function check_result() {
local result=$1
# 空文字列の場合はスキップとみなす
[[ -z "$result" || "$result" == "success" || "$result" == "skipped" ]]
}🎯 テストカバレッジに関する懸念CLAUDE.md の要件では 70%+ のカバレッジが必要ですが、CI ワークフローの変更に対するテストが見当たりません。 推奨:
📋 まとめ優先度別の対応推奨
🎉 総合評価Overall: 良好 (Good) - いくつかの改善提案あり この PR は CI 最適化の良い第一歩です。Path filters の導入により、大幅なコスト削減が期待できます。 特に Integration test の条件 と Path filter のカバレッジ漏れ は、動作に直接影響する可能性があるため、優先的に対応することを推奨します。 レビュー実施者: Claude Sonnet 4.5 |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🧹 Nitpick comments (1)
.github/workflows/ci.yml (1)
230-230: Consider translating comment to English.The comment is in Japanese:
# skipped は成功扱い（該当ファイルの変更がない場合）For consistency with the rest of the codebase and international collaboration, consider using English:
-# skipped は成功扱い（該当ファイルの変更がない場合） +# Treat skipped as success (when relevant files haven't changed)
📜 Review details
Configuration used: defaults
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (7)
.claude/devcontainer-recommendations.md.codex/prompts/setup-recommended-ci.md.github/workflows/ci.yml.github/workflows/docker-image.yml.github/workflows/security.yml.github/workflows/templates/README.md.github/workflows/templates/unified-ci.yml
🧰 Additional context used
📓 Path-based instructions (3)
{.codex/**,.devcontainer/codex*,package*.json,npm/global.json}
📄 CodeRabbit inference engine (CLAUDE.md)
Use Conventional Commits format with release-triggering types (feat/fix/perf/revert/docs) for commits touching .codex/**, .devcontainer/codex*, package*.json, or npm/global.json
Files:
.codex/prompts/setup-recommended-ci.md
.github/workflows/ci.yml
📄 CodeRabbit inference engine (CLAUDE.md)
Validate code quality in CI pipeline (.github/workflows/ci.yml) with linting, formatting, testing, and building
Files:
.github/workflows/ci.yml
.github/workflows/docker-image.yml
📄 CodeRabbit inference engine (CLAUDE.md)
Build DevContainer images automatically with semantic versioning and multi-platform support in .github/workflows/docker-image.yml
Files:
.github/workflows/docker-image.yml
🧠 Learnings (5)
📚 Learning: 2025-12-01T03:45:17.253Z
Learnt from: CR
Repo: keito4/config PR: 0
File: CLAUDE.md:0-0
Timestamp: 2025-12-01T03:45:17.253Z
Learning: Applies to .github/workflows/ci.yml : Validate code quality in CI pipeline (.github/workflows/ci.yml) with linting, formatting, testing, and building
Applied to files:
.github/workflows/templates/README.md.github/workflows/security.yml.codex/prompts/setup-recommended-ci.md.github/workflows/ci.yml.github/workflows/docker-image.yml.github/workflows/templates/unified-ci.yml
📚 Learning: 2025-12-01T03:45:17.253Z
Learnt from: CR
Repo: keito4/config PR: 0
File: CLAUDE.md:0-0
Timestamp: 2025-12-01T03:45:17.253Z
Learning: Applies to .github/workflows/update-libraries.yml : Execute npm run update:libs on schedule and open pull requests when dependencies or Codex/Claude tooling changes in .github/workflows/update-libraries.yml
Applied to files:
.github/workflows/security.yml.github/workflows/ci.yml.github/workflows/templates/unified-ci.yml
📚 Learning: 2025-12-01T03:45:17.253Z
Learnt from: CR
Repo: keito4/config PR: 0
File: CLAUDE.md:0-0
Timestamp: 2025-12-01T03:45:17.253Z
Learning: Applies to {.codex/**,.devcontainer/codex*,package*.json,npm/global.json} : Use Conventional Commits format with release-triggering types (feat/fix/perf/revert/docs) for commits touching .codex/**, .devcontainer/codex*, package*.json, or npm/global.json
Applied to files:
.github/workflows/security.yml.github/workflows/ci.yml.github/workflows/docker-image.yml
📚 Learning: 2025-12-01T03:45:17.253Z
Learnt from: CR
Repo: keito4/config PR: 0
File: CLAUDE.md:0-0
Timestamp: 2025-12-01T03:45:17.253Z
Learning: Applies to .github/workflows/docker-image.yml : Build DevContainer images automatically with semantic versioning and multi-platform support in .github/workflows/docker-image.yml
Applied to files:
.github/workflows/ci.yml.github/workflows/docker-image.yml.github/workflows/templates/unified-ci.yml
📚 Learning: 2025-12-01T03:45:17.253Z
Learnt from: CR
Repo: keito4/config PR: 0
File: CLAUDE.md:0-0
Timestamp: 2025-12-01T03:45:17.253Z
Learning: Apply automated linting, formatting, security analysis, and license checking as static quality gates
Applied to files:
.github/workflows/ci.yml
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (1)
- GitHub Check: claude-review
🔇 Additional comments (11)
.github/workflows/docker-image.yml (1)
6-11: LGTM! Path filters correctly optimize DevContainer builds.The path filters appropriately limit workflow execution to changes affecting the DevContainer image: container configuration, dependencies, and the workflow itself. This aligns with the PR's goal of reducing unnecessary CI runs (e.g., skipping 45-minute Docker builds when DevContainer files are unchanged).
.github/workflows/templates/unified-ci.yml (2)
14-15: LGTM! Documentation updated for path filter feature.The comments accurately describe the new path filter optimization capability.
28-46: LGTM! Comprehensive path filters for pull requests.The path filters cover all relevant file types: source code, configuration, dependencies, workflows, and test directories. The patterns are well-structured with helpful comments for customization.
.github/workflows/templates/README.md (2)
212-289: LGTM! Comprehensive documentation for path filter optimization.The new section provides clear guidance on implementing path filters at both workflow and job levels, with practical examples, recommended patterns, effect measurements, and important cautions. The bilingual content (Japanese) is well-structured and informative.
298-298: LGTM! Best practices updated to include path filter optimization.The addition correctly highlights path filters as a CI optimization strategy.
.codex/prompts/setup-recommended-ci.md (1)
219-347: LGTM! Comprehensive CI optimization guide with path filters.The new section provides detailed implementation guidance covering:
- Workflow-level path filtering with clear examples
- Job-level filtering using dorny/paths-filter with proper group definitions
- Quality gate updates to handle skipped states correctly
- Best practices table with recommendations per workflow type
- Concrete effect measurements demonstrating value
The code examples are accurate and align with the actual implementations in the repository's workflows.
.github/workflows/security.yml (2)
6-15: LGTM! Path filters appropriately scope security scans.The path filters correctly limit security scans to changes that could introduce security risks: source code, scripts, dependencies, and the workflow itself. This optimization prevents unnecessary scans on documentation-only changes while maintaining security coverage.
18-27: LGTM! PR path filters match push filters for consistency.The pull_request path filters are identical to the push filters, ensuring consistent security scan coverage across both trigger types.
.github/workflows/ci.yml (3)
231-257: LGTM! Quality gate logic correctly handles skipped jobs.The implementation properly:
- Defines a reusable function to check results
- Treats both "success" and "skipped" as passing states
- Validates all jobs (lint, test, integration-test, actionlint)
- Provides clear error messages
- Exits with appropriate status code
This aligns with the PR objective to allow PRs to merge when jobs are skipped due to no relevant file changes.
56-73: No action required. All .bats files in the repository are located intest/integration/**, which is already covered by thescriptsfilter. The workflow-level trigger for**.batswill properly detect changes, and the job-level filters will route them to appropriate jobs. Additionally,dorny/paths-filter@v3resolves to v3.0.2, the current latest release.
156-157: The integration test condition is correct as-is. These BATS tests validate shell script behavior (script structure, error handling, function definitions), not application code. Application code is tested separately by the Jest unit tests job, which already runs on code changes. Thetest/integration/**directory is correctly classified as ascriptschange in the path-filter configuration.
| paths: | ||
| - '**.js' | ||
| - '**.ts' | ||
| - '**.mjs' | ||
| - '**.cjs' | ||
| - '**.json' | ||
| - '**.sh' | ||
| - '**.bats' | ||
| - '.github/workflows/**' | ||
| - 'package.json' | ||
| - 'package-lock.json' | ||
| - '.eslintrc.*' | ||
| - '.prettierrc.*' | ||
| - 'tsconfig.json' | ||
| push: | ||
| branches: [main, master] | ||
| paths: | ||
| - '**.js' | ||
| - '**.ts' | ||
| - '**.mjs' | ||
| - '**.cjs' | ||
| - '**.json' | ||
| - '**.sh' | ||
| - '**.bats' | ||
| - '.github/workflows/**' | ||
| - 'package.json' | ||
| - 'package-lock.json' | ||
| - '.eslintrc.*' | ||
| - '.prettierrc.*' | ||
| - 'tsconfig.json' |
There was a problem hiding this comment.
Workflow-level path filters are broader than job-level filters.
The workflow-level paths include patterns like **.json, **.sh, and **.bats that may trigger the workflow even when no jobs will actually run. For example:
**.jsonat workflow level, but job-level only checks specific files (package.json,tsconfig.json)- If a JSON file unrelated to dependencies/tsconfig changes, the workflow runs but all jobs skip
This creates unnecessary workflow runs with no actual CI execution.
Consider removing workflow-level path filters
Since you're using job-level filtering with dorny/paths-filter, the workflow-level paths are redundant and can cause mismatches. Remove them entirely and rely solely on job-level filtering:
on:
pull_request:
- paths:
- - '**.js'
- - '**.ts'
- - '**.mjs'
- - '**.cjs'
- - '**.json'
- - '**.sh'
- - '**.bats'
- - '.github/workflows/**'
- - 'package.json'
- - 'package-lock.json'
- - '.eslintrc.*'
- - '.prettierrc.*'
- - 'tsconfig.json'
push:
branches: [main, master]
- paths:
- - '**.js'
- - '**.ts'
- - '**.mjs'
- - '**.cjs'
- - '**.json'
- - '**.sh'
- - '**.bats'
- - '.github/workflows/**'
- - 'package.json'
- - 'package-lock.json'
- - '.eslintrc.*'
- - '.prettierrc.*'
- - 'tsconfig.json'The changes job already runs quickly (5 min timeout) and will cause dependent jobs to skip appropriately. This approach is more maintainable and eliminates filter duplication.
Committable suggestion skipped: line range outside the PR's diff.
🤖 Prompt for AI Agents
.github/workflows/ci.yml lines 5-34: The workflow-level paths filter is broader
than the job-level filters and causes unnecessary runs; remove the top-level
paths block (the '**.js', '**.ts', '**.json', '**.sh', '**.bats',
'.github/workflows/**', 'package.json', 'package-lock.json', '.eslintrc.*',
'.prettierrc.*', 'tsconfig.json' entries) so the workflow triggers only on
branches (keep the push/pull_request branch settings) and rely on the existing
job-level dorny/paths-filter checks to decide which jobs run; alternatively, if
you prefer keeping workflow-level filters, narrow them to exactly match the
job-level patterns (e.g., only package.json and tsconfig.json) to avoid
mismatches.
| # Less restrictive on main/develop to ensure all checks run | ||
| paths: | ||
| - '**.js' | ||
| - '**.ts' | ||
| - '**.jsx' | ||
| - '**.tsx' | ||
| - '**.json' | ||
| - 'package.json' | ||
| - 'package-lock.json' | ||
| - '.github/workflows/**' |
There was a problem hiding this comment.
Push trigger path filters are MORE restrictive than pull_request, contradicting the comment and best practices.
Line 49's comment states "Less restrictive on main/develop to ensure all checks run," but the push trigger actually has fewer path patterns than the pull_request trigger. Missing patterns include:
.jsx,.tsx(only has.js,.ts)pnpm-lock.yaml,yarn.locksrc/**,test/**,tests/**
This could cause important checks to be skipped on main/develop branches. Best practice is to run comprehensive checks on protected branches.
🔎 Recommended fix: Align push paths with PR paths or remove paths entirely
Option 1 (Recommended): Remove path filters on push to main/develop
push:
branches: [main, develop]
- # Less restrictive on main/develop to ensure all checks run
- paths:
- - '**.js'
- - '**.ts'
- - '**.jsx'
- - '**.tsx'
- - '**.json'
- - 'package.json'
- - 'package-lock.json'
- - '.github/workflows/**'
+ # Run all checks on main/develop branches (no path filters)Option 2: Match PR path filters
push:
branches: [main, develop]
# Less restrictive on main/develop to ensure all checks run
paths:
- '**.js'
- '**.ts'
- '**.jsx'
- '**.tsx'
- '**.json'
- 'package.json'
- 'package-lock.json'
+ - 'pnpm-lock.yaml'
+ - 'yarn.lock'
- '.github/workflows/**'
+ - 'src/**'
+ - 'test/**'
+ - 'tests/**'Committable suggestion skipped: line range outside the PR's diff.
🤖 Prompt for AI Agents
.github/workflows/templates/unified-ci.yml around lines 49 to 58: the push
trigger's path filters are more restrictive than the pull_request filters which
contradicts the file comment; fix by either removing the push path filters
entirely for main/develop (preferred) so all checks always run on protected
branches, or expand the push 'paths' list to exactly match the pull_request
paths (add .jsx, .tsx, pnpm-lock.yaml, yarn.lock, src/**, test/**, tests/** and
any other patterns used by PR) and update the inline comment to reflect the
chosen behavior.
config-base-sync-updateコマンドのStep 4を改善し、devcontainer.jsonの変更がimageバージョンのみの場合は自動的に上書きするようにしました。 ## 変更内容 ### Step 4の詳細化 **4.1: devcontainer.jsonのみの変更をチェック** - 変更ファイルが`.devcontainer/devcontainer.json`のみかを確認 **4.2: バージョンのみの変更を検出** - `"image"`フィールドのバージョン変更のみかを検証 - 他のフィールド（features, mounts等）の変更がないことを確認 - バージョンのみの変更の場合は自動的に`git restore`して続行 **4.3: その他のファイルの変更処理** - 他のファイルやdevcontainer.jsonの複数フィールドに変更がある場合は従来通りエラーを報告 ## 効果 - バージョン更新のたびに手動でコミット/stashする必要がなくなる - より自動化された更新フローを実現 - 誤った上書きを防ぐための安全な検証ロジック 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
There was a problem hiding this comment.
Remaining comments which cannot be posted as a review comment to avoid GitHub Rate Limit
actionlint
📝 [actionlint] reported by reviewdog 🐶
shellcheck reported issue in this script: SC2086:info:1:31: Double quote to prevent globbing and word splitting [shellcheck]
config/.github/workflows/security.yml
Line 89 in a97beeb
📝 [actionlint] reported by reviewdog 🐶
shellcheck reported issue in this script: SC2086:info:2:12: Double quote to prevent globbing and word splitting [shellcheck]
config/.github/workflows/security.yml
Line 89 in a97beeb
📝 [actionlint] reported by reviewdog 🐶
shellcheck reported issue in this script: SC2086:info:3:110: Double quote to prevent globbing and word splitting [shellcheck]
config/.github/workflows/security.yml
Line 89 in a97beeb
📝 [actionlint] reported by reviewdog 🐶
shellcheck reported issue in this script: SC2086:info:3:181: Double quote to prevent globbing and word splitting [shellcheck]
config/.github/workflows/security.yml
Line 89 in a97beeb
📝 [actionlint] reported by reviewdog 🐶
shellcheck reported issue in this script: SC2086:info:1:29: Double quote to prevent globbing and word splitting [shellcheck]
config/.github/workflows/security.yml
Line 120 in a97beeb
📝 [actionlint] reported by reviewdog 🐶
shellcheck reported issue in this script: SC2086:info:2:12: Double quote to prevent globbing and word splitting [shellcheck]
config/.github/workflows/security.yml
Line 120 in a97beeb
📝 [actionlint] reported by reviewdog 🐶
shellcheck reported issue in this script: SC2086:info:3:15: Double quote to prevent globbing and word splitting [shellcheck]
config/.github/workflows/security.yml
Line 120 in a97beeb
📝 [actionlint] reported by reviewdog 🐶
shellcheck reported issue in this script: SC2086:info:4:111: Double quote to prevent globbing and word splitting [shellcheck]
config/.github/workflows/security.yml
Line 120 in a97beeb
📝 [actionlint] reported by reviewdog 🐶
shellcheck reported issue in this script: SC2086:info:4:30: Double quote to prevent globbing and word splitting [shellcheck]
config/.github/workflows/security.yml
Line 120 in a97beeb
📝 [actionlint] reported by reviewdog 🐶
shellcheck reported issue in this script: SC2086:info:5:15: Double quote to prevent globbing and word splitting [shellcheck]
config/.github/workflows/security.yml
Line 120 in a97beeb
🚫 [actionlint] reported by reviewdog 🐶
shellcheck reported issue in this script: SC2129:style:1:1: Consider using { cmd1; cmd2; } >> file instead of individual redirects [shellcheck]
config/.github/workflows/security.yml
Line 120 in a97beeb
There was a problem hiding this comment.
📝 [actionlint] reported by reviewdog 🐶
shellcheck reported issue in this script: SC2086:info:30:32: Double quote to prevent globbing and word splitting [shellcheck]
config/.github/workflows/docker-image.yml
Line 55 in a97beeb
There was a problem hiding this comment.
📝 [actionlint] reported by reviewdog 🐶
shellcheck reported issue in this script: SC2086:info:31:37: Double quote to prevent globbing and word splitting [shellcheck]
config/.github/workflows/docker-image.yml
Line 55 in a97beeb
There was a problem hiding this comment.
📝 [actionlint] reported by reviewdog 🐶
shellcheck reported issue in this script: SC2086:info:32:30: Double quote to prevent globbing and word splitting [shellcheck]
config/.github/workflows/docker-image.yml
Line 55 in a97beeb
There was a problem hiding this comment.
🚫 [actionlint] reported by reviewdog 🐶
shellcheck reported issue in this script: SC2129:style:30:1: Consider using { cmd1; cmd2; } >> file instead of individual redirects [shellcheck]
config/.github/workflows/docker-image.yml
Line 55 in a97beeb
There was a problem hiding this comment.
📝 [actionlint] reported by reviewdog 🐶
shellcheck reported issue in this script: SC2086:info:10:39: Double quote to prevent globbing and word splitting [shellcheck]
config/.github/workflows/docker-image.yml
Line 97 in a97beeb
There was a problem hiding this comment.
📝 [actionlint] reported by reviewdog 🐶
shellcheck reported issue in this script: SC2086:info:11:32: Double quote to prevent globbing and word splitting [shellcheck]
config/.github/workflows/docker-image.yml
Line 97 in a97beeb
There was a problem hiding this comment.
📝 [actionlint] reported by reviewdog 🐶
shellcheck reported issue in this script: SC2086:info:6:31: Double quote to prevent globbing and word splitting [shellcheck]
config/.github/workflows/docker-image.yml
Line 97 in a97beeb
There was a problem hiding this comment.
📝 [actionlint] reported by reviewdog 🐶
shellcheck reported issue in this script: SC2086:info:9:34: Double quote to prevent globbing and word splitting [shellcheck]
config/.github/workflows/docker-image.yml
Line 97 in a97beeb
There was a problem hiding this comment.
🚫 [actionlint] reported by reviewdog 🐶
shellcheck reported issue in this script: SC2129:style:9:3: Consider using { cmd1; cmd2; } >> file instead of individual redirects [shellcheck]
config/.github/workflows/docker-image.yml
Line 97 in a97beeb
There was a problem hiding this comment.
📝 [actionlint] reported by reviewdog 🐶
shellcheck reported issue in this script: SC2086:info:3:50: Double quote to prevent globbing and word splitting [shellcheck]
config/.github/workflows/docker-image.yml
Line 201 in a97beeb
PR Review - Path Filters導入によるCI最適化このPRは、GitHub Actions ワークフローにpath filtersを導入してCI実行を最適化する優れた改善です。全体的に非常に良い実装ですが、いくつかの改善点と確認事項があります。 ✅ 良い点
|
There was a problem hiding this comment.
Actionable comments posted: 2
🧹 Nitpick comments (1)
.claude/commands/config-base-sync-update.md (1)
114-125: Clarify error reporting sequence for uncommitted files.The flow at lines 118–125 mixes error description with file listing and suggested actions. Line 118 ("Report error"), line 119 ("List the uncommitted files"), and lines 120–124 ("Suggested actions") should be presented as a clearer, sequential workflow.
🔎 Suggested improvement
Restructure for clarity:
### 4.3: Handle other uncommitted files If there are uncommitted changes in **other files** (not just devcontainer.json): **Step 1: Report Error** - Report: "❌ Uncommitted changes detected in other files. Please commit or stash before updating." **Step 2: List Files** - Show the uncommitted files using: `git status --porcelain` **Step 3: Suggest Remediation** - Suggested actions: 1. Review the changes: `git diff <file>` 2. Commit the changes: `git add <file> && git commit -m "your message"` 3. Or stash the changes: `git stash` 4. Then re-run this command **Step 4: Stop Execution** - Stop executionThis makes the sequential steps explicit and easier to follow.
📜 Review details
Configuration used: defaults
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (1)
.claude/commands/config-base-sync-update.md
🧰 Additional context used
🧠 Learnings (3)
📓 Common learnings
Learnt from: CR
Repo: keito4/config PR: 0
File: CLAUDE.md:0-0
Timestamp: 2025-12-01T03:45:17.253Z
Learning: Applies to {.codex/**,.devcontainer/codex*,package*.json,npm/global.json} : Use Conventional Commits format with release-triggering types (feat/fix/perf/revert/docs) for commits touching .codex/**, .devcontainer/codex*, package*.json, or npm/global.json
Learnt from: CR
Repo: keito4/config PR: 0
File: CLAUDE.md:0-0
Timestamp: 2025-12-01T03:45:17.253Z
Learning: Applies to .github/workflows/docker-image.yml : Build DevContainer images automatically with semantic versioning and multi-platform support in .github/workflows/docker-image.yml
Learnt from: CR
Repo: keito4/config PR: 0
File: CLAUDE.md:0-0
Timestamp: 2025-12-01T03:45:17.253Z
Learning: Applies to .github/workflows/ci.yml : Validate code quality in CI pipeline (.github/workflows/ci.yml) with linting, formatting, testing, and building
Learnt from: CR
Repo: keito4/config PR: 0
File: CLAUDE.md:0-0
Timestamp: 2025-12-01T03:45:17.253Z
Learning: Apply automated linting, formatting, security analysis, and license checking as static quality gates
📚 Learning: 2025-12-01T03:45:17.253Z
Learnt from: CR
Repo: keito4/config PR: 0
File: CLAUDE.md:0-0
Timestamp: 2025-12-01T03:45:17.253Z
Learning: Applies to .github/workflows/docker-image.yml : Build DevContainer images automatically with semantic versioning and multi-platform support in .github/workflows/docker-image.yml
Applied to files:
.claude/commands/config-base-sync-update.md
📚 Learning: 2025-12-01T03:45:17.253Z
Learnt from: CR
Repo: keito4/config PR: 0
File: CLAUDE.md:0-0
Timestamp: 2025-12-01T03:45:17.253Z
Learning: Applies to {.codex/**,.devcontainer/codex*,package*.json,npm/global.json} : Use Conventional Commits format with release-triggering types (feat/fix/perf/revert/docs) for commits touching .codex/**, .devcontainer/codex*, package*.json, or npm/global.json
Applied to files:
.claude/commands/config-base-sync-update.md
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (1)
- GitHub Check: claude-review
| ### 4.1: Check if only devcontainer.json is modified | ||
|
|
||
| Check if the only modified file is `.devcontainer/devcontainer.json`: | ||
|
|
||
| ```bash | ||
| MODIFIED_FILES=$(git status --porcelain | awk '{print $2}') | ||
| ``` | ||
|
|
There was a problem hiding this comment.
Improve robustness of git status parsing to handle edge cases.
The current awk '{print $2}' extraction assumes single-word filenames and doesn't account for spaces or other special cases in the status output format. Additionally, the actual conditional check for "if ONLY devcontainer.json is modified" is missing—only the extraction is shown, not the validation.
🔎 Suggested improvements
Replace the fragile awk parsing with a more robust approach that explicitly validates the file count:
# Safer extraction of modified files
MODIFIED_FILES=$(git status --porcelain | awk '{print $2}')
# Count modified files and validate only devcontainer.json is modified
FILE_COUNT=$(echo "$MODIFIED_FILES" | wc -l)
if [ "$FILE_COUNT" -eq 1 ] && echo "$MODIFIED_FILES" | grep -q '^\.devcontainer/devcontainer\.json$'; then
# Only devcontainer.json is modified; proceed to 4.2
else
# Multiple files or different file; skip to 4.3
fiAlternatively, use git diff --name-only which is more robust:
MODIFIED_FILES=$(git diff --name-only)🤖 Prompt for AI Agents
.claude/commands/config-base-sync-update.md around lines 67 to 74: the current
extraction using awk '{print $2}' is fragile and there is no conditional to
verify "only .devcontainer/devcontainer.json" was modified; replace the
extraction with a more robust command (e.g. use git diff --name-only to list
modified paths), count the number of returned paths, and add a conditional that
proceeds only if the count is exactly 1 and the single path equals
.devcontainer/devcontainer.json, otherwise skip to the alternative branch.
| Check if: | ||
|
|
||
| 1. The only change is in the `"image"` field | ||
| 2. The change is a version number update (e.g., `ghcr.io/keito4/config-base:1.13.1` → `ghcr.io/keito4/config-base:1.15.0`) | ||
| 3. No other fields are modified | ||
|
|
||
| **Detection logic**: | ||
|
|
||
| - Count the number of changed lines (excluding +/- prefixes) | ||
| - Verify all changes match the pattern: `"image": "ghcr.io/keito4/config-base:X.Y.Z"` | ||
| - Ensure both old and new versions point to the same registry and repository | ||
|
|
||
| If the change is **version-only**: | ||
|
|
||
| - Report: "✅ Detected version-only change in devcontainer.json (auto-overwrite enabled)" | ||
| - Show the version change: `X.Y.Z → target-version` | ||
| - Automatically discard the change and continue: | ||
| ```bash | ||
| git restore .devcontainer/devcontainer.json | ||
| ``` | ||
| - Proceed to Step 5 |
There was a problem hiding this comment.
Clarify and concretize version-only change detection logic.
The detection logic (lines 85–96) is described in prose and pseudo-code but lacks concrete implementation details. This vagueness creates risk: if the detection is incorrect, git restore at line 103 could discard non-version changes unintentionally.
🔎 Suggested improvements
Replace the descriptive pseudo-logic with explicit, testable steps:
# 1. Extract the diff for devcontainer.json
DIFF_OUTPUT=$(git diff .devcontainer/devcontainer.json)
# 2. Validate the diff contains only one "image" field change
# Check that added/removed lines match pattern: "image": "ghcr.io/keito4/config-base:X.Y.Z"
CHANGED_KEYS=$(echo "$DIFF_OUTPUT" | grep -E '^\+.*"image":|^-.*"image":' | wc -l)
# 3. Ensure exactly one add and one remove (version change, not new/deleted field)
if [ "$CHANGED_KEYS" -eq 2 ]; then
OLD_VERSION=$(echo "$DIFF_OUTPUT" | grep '^-.*"image":' | sed -E 's/.*config-base:([0-9.]+).*/\1/')
NEW_VERSION=$(echo "$DIFF_OUTPUT" | grep '^\+.*"image":' | sed -E 's/.*config-base:([0-9.]+).*/\1/')
# 4. Verify registry and repository are unchanged
REGISTRY_MISMATCH=$(git diff .devcontainer/devcontainer.json | grep -E '^\+|^-' | grep -v 'image' | wc -l)
if [ "$REGISTRY_MISMATCH" -eq 0 ] && [ -n "$OLD_VERSION" ] && [ -n "$NEW_VERSION" ]; then
echo "✅ Detected version-only change: $OLD_VERSION → $NEW_VERSION"
git restore .devcontainer/devcontainer.json
else
echo "❌ Detected non-version changes; please commit or stash"
exit 1
fi
else
echo "❌ Detected non-version changes; please commit or stash"
exit 1
fiThis approach explicitly validates each condition before auto-restore.
|
🎉 This PR is included in version 1.39.0 🎉 The release is available on GitHub release Your semantic-release bot 📦🚀 |
1 participant
概要
GitHub Actions ワークフローにpath filtersを導入し、変更されたファイルに応じて必要なジョブのみを実行することで、CI実行時間とコストを大幅に削減します。
変更内容
CI最適化
dorny/paths-filterを使用してファイル変更を検知し、必要なジョブのみを実行skipped状態を成功として扱い、スキップされたジョブでもPRをマージ可能に変更されたワークフロー
.github/workflows/ci.yml.github/workflows/docker-image.yml.github/workflows/security.ymlドキュメント更新
.codex/prompts/setup-recommended-ci.md: Path Filters実装方法とベストプラクティスを追加.github/workflows/templates/unified-ci.yml: Path filtersの例を追加.github/workflows/templates/README.md: CI最適化セクションを追加ファイル移動
.codex/devcontainer-recommendations.md→.claude/devcontainer-recommendations.md期待される効果
変更統計
テスト
🤖 Generated with Claude Code
Summary by CodeRabbit
Documentation
New Features
Chores
✏️ Tip: You can customize this high-level summary in your review settings.