fix: Add settings.local.json to Docker image and setup script

[keito4]

Summary

各環境でツール許可を再設定する必要がある問題を修正します。

問題

• settings.local.json がDockerイメージに含まれていなかった
• ホストの ~/.claude がマウントされるため、新しい環境では毎回ツール許可が必要だった

解決策

1. .devcontainer/claude-settings.local.json を作成

   • 汎用的なツール許可設定を事前に含める
   • ローカル固有のパス（/Users/...）は除外

2. Dockerfileを更新

   • settings.local.json もイメージにコピー

3. setup-claude.sh を更新

   • ホストに settings.local.json がない場合、デフォルトをコピー

動作フロー

DevContainer起動
    ↓
ホストの ~/.claude がマウント
    ↓
postCreateCommand: setup-claude.sh 実行
    ↓
settings.local.json が存在しない場合
    ↓
デフォルト設定をコピー
    ↓
ツール許可が事前設定済み ✅

Test Plan

• 新しいDevContainer環境でツール許可が不要なことを確認
• 既存の settings.local.json がある環境で上書きされないことを確認

🤖 Generated with Claude Code

Summary by CodeRabbit

• New Features

  • Added local settings configuration support for development environments.
  • Added automatic initialization of local settings during environment setup.

• Chores

  • Updated development container configuration for local settings management.

• Documentation

  • Updated README formatting in coverage action documentation.

_{✏️ Tip: You can customize this high-level summary in your review settings.}

[coderabbitai]

📝 Walkthrough

Walkthrough

The PR introduces local Claude settings configuration for DevContainers by adding a new JSON settings file with permissions schemas, MCP server configurations, and pre-tool hooks, integrated into the container via Dockerfile and setup script modifications. Documentation formatting is standardized.

Changes

Cohort / File(s)	Summary
DevContainer Configuration .devcontainer/Dockerfile, .devcontainer/claude-settings.local.json	Added COPY instruction to bundle local Claude settings into container. Introduced new JSON config file defining permissions allowlists/denylists, MCP servers (playwright, o3), plugins (kubernetes-operations), and PreToolUse hooks for Bash to enforce quality gates before tool execution.
Setup Script script/setup-claude.sh	Added setup_settings_local() function to ensure /home/vscode/.claude/settings.local.json exists by copying from default template; includes directory creation and outcome logging. Function invoked in main() before Claude CLI check.
Documentation .github/actions/coverage-comment/README.md	Markdown table formatting updates (column alignment, spacing), timestamp line styling changed from bolded asterisks to italicized underscores. No functional changes.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

Possibly related PRs

• feat: Sync Claude settings from Elu-co-jp projects #253: Introduces identical claude-settings.local.json file and related setup behavior for providing those settings to DevContainer/CLI.
• feat: devcontainer環境のclaude設定を統合 #59: Modifies devcontainer Claude configuration and Dockerfile copy steps for local Claude settings JSON files.
• Feat/add vercel cli #100: Modifies .devcontainer/Dockerfile to copy local AI config files into the container.

Suggested labels

released

Poem

🐰 Local settings bundled with care,
Permissions and hooks floating through the air,
Quality gates before each command run,
Docker and scripts, all working as one!
A rabbit hops by—configuration's done! 🎉

Pre-merge checks and finishing touches

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 50.00% which is insufficient. The required threshold is 80.00%.	You can run @coderabbitai generate docstrings to improve docstring coverage.

✅ Passed checks (2 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately summarizes the main change: adding settings.local.json to the Docker image and setup script, which is the core fix addressing the missing pre-configured permissions issue.

✨ Finishing touches

• 📝 Generate docstrings

---

📜 Recent review details

Configuration used: defaults

Review profile: CHILL

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between 030ae71 and 6db3744.

📒 Files selected for processing (4)

• .devcontainer/Dockerfile
• .devcontainer/claude-settings.local.json
• .github/actions/coverage-comment/README.md
• script/setup-claude.sh

🧰 Additional context used

🧠 Learnings (2)

📚 Learning: 2025-12-01T03:45:17.253Z

Learnt from: CR
Repo: keito4/config PR: 0
File: CLAUDE.md:0-0
Timestamp: 2025-12-01T03:45:17.253Z
Learning: Applies to **/*.{test,spec}.{js,ts,jsx,tsx} : Implement Test-Driven Development (TDD) using Red → Green → Refactor methodology with 70%+ line coverage requirement

Applied to files:

• .github/actions/coverage-comment/README.md

📚 Learning: 2025-12-09T08:39:14.049Z

Learnt from: CR
Repo: keito4/config PR: 0
File: AGENTS.md:0-0
Timestamp: 2025-12-09T08:39:14.049Z
Learning: Follow development quality standards defined in `CLAUDE.md` when using Claude Code for development assistance

Applied to files:

• script/setup-claude.sh
• .devcontainer/claude-settings.local.json

🧬 Code graph analysis (1)

script/setup-claude.sh (1)

script/lib/output.sh (3)

• log_info (138-138)
• log_success (139-139)
• log_warn (140-140)

⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (3)

• GitHub Check: claude-review
• GitHub Check: Trivy Container Scan
• GitHub Check: Generate SBOM

🔇 Additional comments (8)

.github/actions/coverage-comment/README.md (1)

45-48: LGTM! Documentation formatting improvements.

The markdown table formatting and timestamp styling updates improve consistency without changing functionality.

Also applies to: 78-87

script/setup-claude.sh (3)

32-33: Variable declarations look good.

The path variables are properly defined relative to the expected locations in both the container and host environments.

---

63-64: Correct placement in the execution flow.

Calling setup_settings_local before the Claude CLI check ensures settings are available early, which aligns with the PR objective of pre-configuring tool permissions.

---

35-53: Well-structured settings setup function with proper error handling.

The implementation correctly handles the case where the host's mounted ~/.claude directory lacks settings.local.json. The error handling and logging are appropriate. The default settings file exists at .devcontainer/claude-settings.local.json, and both referenced Python hooks (block_git_no_verify.py and pre_git_quality_gates.py) are properly configured in the settings and present in the repository.

.devcontainer/claude-settings.local.json (3)

1-322: Well-structured permissions configuration for DevContainer environment.

The permissions schema is comprehensive with:

• Extensive allow list covering common development tools and workflows
• Deny list blocking dangerous operations (force push, db resets, destructive commands)
• Container-specific paths (/home/vscode/, //workspaces/**) appropriate for the DevContainer context

The permissive allow list is acceptable for a development environment given the safety guardrails in the deny list.

---

325-345: Verify Python hook scripts are present and functional.

The PreToolUse hooks reference Python scripts that must exist for the hooks to execute:

• .claude/hooks/block_git_no_verify.py
• .claude/hooks/pre_git_quality_gates.py

Ensure these scripts are present in the repository and properly implement the intended quality gates.

The verification script in the previous file will check for these hook files.

---

323-324: MCP and plugin configuration looks appropriate.

The flags enable project MCP servers and specific servers (playwright, o3), with the kubernetes-operations plugin enabled. This aligns with the development workflow requirements.

Also applies to: 347-349

.devcontainer/Dockerfile (1)

78-78: Settings file properly integrated into container image.

The COPY instruction correctly places claude-settings.local.json in the image with proper ownership. While this file will typically be hidden by the host ~/.claude mount at runtime, having it in the image provides a sensible fallback for scenarios where the container runs without the mount.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[claude]

Pull Request Review - PR #303

概要

ツール許可を各環境で再設定する必要がある問題を修正するPRです。settings.local.json をDockerイメージに含め、新しい環境で自動的にセットアップする仕組みを導入しています。

✅ コード品質・ベストプラクティス

良い点

1. 問題の明確な特定と解決 - ホストの ~/.claude がマウントされることで、新環境では毎回ツール許可が必要になる問題を正しく特定
2. 適切なエラーハンドリング (script/setup-claude.sh:38-52) - ファイル存在チェック、コピー失敗時のログ出力が適切
3. ログ出力の充実 - 各ステップで適切なログ出力を実装

改善提案

1. テストカバレッジの追加

現在、script/setup-claude.sh の変更に対するテストが不足しています。CLAUDE.mdの品質基準では 70%+ 行カバレッジ が求められています。

推奨: 以下のテストケースを追加してください:

• settings.local.json が存在しない場合、デフォルトがコピーされる
• settings.local.json が既に存在する場合、上書きされない
• デフォルト設定ファイルが存在しない場合、適切な警告が出力される

2. Dockerfileの重複削減

.devcontainer/Dockerfile:78 で settings.local.json をコピーしていますが、postCreateCommand で setup-claude.sh が実行される際にも設定がコピーされるため、重複する可能性があります。

推奨: 動作フローを明確にするため、Dockerfileでのコピーを削除し、セットアップスクリプトのみに統一することを検討してください。

🔒 セキュリティ

Permission設定の妥当性検証

.devcontainer/claude-settings.local.json には 278個のallow権限 が定義されています。

広範な権限:

• Bash(rm:*) (L30) - 削除コマンドの無制限許可
• Bash(git reset:*) (L115) - Git履歴の変更許可
• Bash(kubectl delete pods:*) (L182-183) - Kubernetes Pod削除許可

推奨: 最小権限の原則に基づき、実際に必要な権限のみに絞り込むことを検討してください。

🐛 潜在的なバグ

ディレクトリ作成のタイミング

script/setup-claude.sh:41 で mkdir -p CLAUDE_DIR を実行していますが、setup-claude.sh:60 で既に mkdir -p CLAUDE_DIR/tmp が実行されています。

影響: 軽微（冗長だが動作には問題なし）
推奨: L41の mkdir -p を削除（L60で既に作成済み）

📋 テスト計画の完了状況

PRのTest Planに記載されているチェック項目が未完了です:

• 新しいDevContainer環境でツール許可が不要なことを確認
• 既存の settings.local.json がある環境で上書きされないことを確認

推奨: これらのテストを実施し、結果をPRコメントで報告してください。

🎯 総合評価

項目	評価	コメント
コード品質	⚠️ 良好	テストカバレッジの追加が必要
セキュリティ	⚠️ 要検討	権限設定の妥当性確認が必要
パフォーマンス	✅ 問題なし	軽微な最適化提案あり
ドキュメント	⚠️ 要改善	README更新推奨

推奨アクション

マージ前に対応すべき項目:

1. テストケースの追加（TDD要件: 70%+ カバレッジ）
2. Test Planの実施と結果報告
3. 権限設定の妥当性確認

マージ後に対応可能な項目:
4. README.mdへのドキュメント追記
5. パフォーマンス最適化

---

レビュー日時: 2026-01-03 | 基準: CLAUDE.md (TDD, Quality Gates, Conventional Commits)

[github-actions]

🎉 This PR is included in version 1.43.0 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀