fix(devcontainer): setup-claude.shのライブラリパス問題を修正 - #329
Conversation
## Why(なぜ) setup-claude-build.shが「プラグインがインストールされていません」と 表示する問題を修正するため。 ## What(何を) - プラグインインストール時にHOME=/home/vscodeを設定 - setup-claude-build.sh実行時にもHOME=/home/vscodeを明示的に設定 ## How(どのように) ROOTユーザーでプラグインインストールを実行すると、claudeコマンドは デフォルトで/root/.claudeにプラグインをインストールします。 これを防ぐため、env HOME=/home/vscodeを設定し、vscodeユーザーの ディレクトリにプラグインをインストールするようにしました。 ## Risk(リスク) なし。環境変数の明示的な設定により、より確実に動作します。 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
## 修正内容 ### 1. setup-claude.sh のライブラリパス問題 - `/usr/local/bin/setup-claude.sh` が依存する `script/lib/` を `/usr/local/script/lib` にコピー - 別リポジトリで `setup-claude.sh` を実行した際のパスエラーを解決 ### 2. playwright-skill マーケットプレイスの追加 - `install-claude-plugins.sh` に playwright-skill マーケットプレイスを追加 - plugins.txt に記載されている playwright-skill プラグインがインストールできるように修正 ## 影響範囲 - 新しいリポジトリで config-base イメージを使用した際の setup-claude.sh 実行 - playwright-skill プラグインのインストール 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
📝 WalkthroughWalkthroughAdds build-time auth args and HOME-aware plugin installation to the devcontainer build, updates the Claude plugin installer to accept a token or API key and install an extra marketplace plugin, and exposes those build args in the GitHub Actions build. Changes
Sequence Diagram(s)sequenceDiagram
participant GH as GitHub Actions
participant Build as Docker Build (devcontainer)
participant FS as Image Filesystem
participant Script as install-claude-plugins.sh
participant Claude as Claude CLI / Plugin API
GH->>Build: start image build with build-args (CLAUDE_CODE_OAUTH_TOKEN, ANTHROPIC_API_KEY)
Build->>FS: copy script/lib -> /usr/local/script/lib and /tmp/script-lib
Build->>FS: write build-time env and run setup scripts with env HOME=/home/vscode
FS->>Script: invoke install-claude-plugins.sh (reads token/API key or secret)
Script->>Claude: authenticate using token or API key -> create .credentials.json if token
Script->>Claude: register marketplace and install plugins (incl. playwright-skill)
Claude-->>Script: return install results
Script-->>Build: exit status
Build-->>GH: complete image artifact
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes Possibly related PRs
Suggested labels
Poem
🚥 Pre-merge checks | ✅ 3✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing touches
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
PR Review: setup-claude.shのライブラリパス問題を修正概要このPRは、別リポジトリでconfig-baseイメージを使用した際の ✅ Code Quality & Best Practices良い点:
改善提案:
COPY --chown=vscode:vscode script/lib /tmp/script-lib
COPY --chown=root:root script/lib /usr/local/script/lib
claude plugin marketplace add https://github.com/lackeyjb/playwright-skill.git 2>&1 || echo "[WARN] playwright-skill already exists or failed to add"現在のエラーメッセージでは「already exists」と「failed to add」を区別できません。デバッグ性向上のため、以下のように改善できます: if ! claude plugin marketplace add https://github.com/lackeyjb/playwright-skill.git 2>&1; then
if claude plugin marketplace list | grep -q "playwright-skill"; then
echo "[INFO] playwright-skill marketplace already exists"
else
echo "[WARN] playwright-skill marketplace failed to add"
fi
fi🐛 Potential Issues重要度: 低
確認推奨事項: # ビルド後のイメージで確認
ls -la /usr/local/script/lib
stat /usr/local/script/lib/*.sh⚡ Performance Considerations変更による性能への影響は最小限です:
🔒 Security Concerns良い点:
セキュリティ上の懸念はありません。 🧪 Test Coverage現状:
推奨事項:
📋 Additional Observations
📝 Recommendationsマージ前:
マージ後:
✨ Summary総合評価: 承認推奨(軽微な改善提案あり) このPRは明確な問題を適切に解決しています。提案した改善点は必須ではなく、現状のままでもマージ可能です。コードの品質は高く、セキュリティ上の懸念もありません。テスト計画に従った検証を完了後、マージして問題ありません。 🤖 Generated with Claude Code (claude-sonnet-4-5) |
There was a problem hiding this comment.
Actionable comments posted: 0
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
script/install-claude-plugins.sh (1)
47-53: Verify marketplace name derivation and establish version pinning policyThe
claude plugin marketplace addcommands hardcode GitHub URLs without consulting theknown_marketplaces.jsonconfiguration. Two concerns need verification:
Marketplace naming: Confirm that registering
https://github.com/lackeyjb/playwright-skill.gitcreates a marketplace namedplaywright-skill(to matchplaywright-skill@playwright-skillin plugins.txt). The mapping appears to rely on implicit repo name parsing rather than explicit configuration.Supply chain risk: The unpinned URLs always pull from HEAD, increasing risk of unexpected behavior. Consider pinning to specific tags/releases (e.g.,
https://github.com/lackeyjb/playwright-skill.git@v1.0.0) or migrating to theknown_marketplaces.jsonapproach used insetup-claude.sh, which allows centralized version management.
🧹 Nitpick comments (3)
.devcontainer/Dockerfile (3)
88-91:/usr/local/script/libへの COPY は目的に合うが、権限と重複 COPY を要確認
COPY --chown=root:root script/lib /usr/local/script/libでvscodeユーザーが読み取れる権限になっているか確認してください(ファイルが 600 等だと実行時に読めない可能性)。script/libを/tmp/script-libと/usr/local/script/libに二重配置しているので、/tmp/script-libが不要なら削るとイメージ肥大化を避けられます。
92-101: BuildKit secret を使うなら、可能なら “vscode で実行” に寄せるのを検討現状(root で secret にアクセスしつつ
HOME=/home/vscode)は動きますが、claude実行が/home/vscode/.claude以外にもファイルを作る場合に root-owned が混ざるリスクがあります。
BuildKit 側で secret をuid/gid=vscodeにしてUSER vscodeのまま実行できるなら、その方が安全で後処理(chown)も減らせます。
103-105:setup-claude-build.shにHOME=/home/vscodeを渡すのは良い(ただし失敗握りつぶしは意図を明確に)
env HOME=/home/vscodeは、プラグイン/設定が root 側に落ちる事故を避けられて良いです。
一方で|| echo ...で失敗を常に握りつぶすので、意図どおりなら(例: 認証なしビルドを許容)コメントや build-arg 等で “strict にしたい場合” の導線があると安心です。
📜 Review details
Configuration used: defaults
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (2)
.devcontainer/Dockerfilescript/install-claude-plugins.sh
🧰 Additional context used
🧠 Learnings (3)
📓 Common learnings
Learnt from: CR
Repo: keito4/config PR: 0
File: AGENTS.md:0-0
Timestamp: 2026-01-04T04:05:56.913Z
Learning: Use automated Claude commands from `.claude/commands/` directory for maintenance, Git workflows, code analysis, quality checks, dependency management, security reviews, and tool configuration
📚 Learning: 2026-01-04T04:05:56.913Z
Learnt from: CR
Repo: keito4/config PR: 0
File: AGENTS.md:0-0
Timestamp: 2026-01-04T04:05:56.913Z
Learning: Use automated Claude commands from `.claude/commands/` directory for maintenance, Git workflows, code analysis, quality checks, dependency management, security reviews, and tool configuration
Applied to files:
script/install-claude-plugins.sh.devcontainer/Dockerfile
📚 Learning: 2025-12-01T03:45:17.253Z
Learnt from: CR
Repo: keito4/config PR: 0
File: CLAUDE.md:0-0
Timestamp: 2025-12-01T03:45:17.253Z
Learning: Applies to .github/workflows/docker-image.yml : Build DevContainer images automatically with semantic versioning and multi-platform support in .github/workflows/docker-image.yml
Applied to files:
.devcontainer/Dockerfile
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (3)
- GitHub Check: claude-review
- GitHub Check: Trivy Container Scan
- GitHub Check: Generate SBOM
## 修正内容 ### GitHub Actions ビルドでのプラグインインストール対応 **変更点**: - docker-image.yml に `build-args` で `ANTHROPIC_API_KEY` を追加 - Dockerfile に `ARG ANTHROPIC_API_KEY` を追加 - プラグインインストール時に環境変数を渡すように修正 **使用方法**: GitHub Secrets に `ANTHROPIC_API_KEY` を設定すると、ビルド時にプラグインが自動インストールされます。 ## 利点 - BuildKit secret と環境変数の両方に対応 - GitHub Actions でのビルドでプラグインがインストール可能に - ローカルビルドでも `--build-arg ANTHROPIC_API_KEY=$ANTHROPIC_API_KEY` で対応 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
## 修正内容 ### CLAUDE_CODE_OAUTH_TOKEN のサポート追加 **変更点**: 1. `install-claude-plugins.sh` に `CLAUDE_CODE_OAUTH_TOKEN` 環境変数のサポートを追加 2. Dockerfile に `ARG CLAUDE_CODE_OAUTH_TOKEN` を追加 3. docker-image.yml で `CLAUDE_CODE_OAUTH_TOKEN` を `build-args` として渡す **優先順位**: 1. BuildKit secret (`/run/secrets/claude_credentials`) 2. `CLAUDE_CODE_OAUTH_TOKEN` 環境変数 ← 新規追加 3. `ANTHROPIC_API_KEY` 環境変数(後方互換性のため残す) ## 動作確認 GitHub Secrets に `CLAUDE_CODE_OAUTH_TOKEN` を設定すると: - ビルド時に認証情報が自動生成される - プラグインが正常にインストールされる - setup-claude-build.sh が正常に実行される 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Fix all issues with AI agents
In @.devcontainer/Dockerfile:
- Around line 3-5: Remove the ARG declarations for CLAUDE_CODE_OAUTH_TOKEN and
ANTHROPIC_API_KEY because build-args expose secrets in image history; instead
rely on the BuildKit secret mount. Delete the lines declaring ARG
CLAUDE_CODE_OAUTH_TOKEN and ARG ANTHROPIC_API_KEY in the Dockerfile and update
the consumer code referenced at line 102 to read credentials only from the
BuildKit secret mount (not from environment variables populated by ARGs),
ensuring the Dockerfile and any ENTRYPOINT/CMD or shell sourcing logic no longer
reference those ARG names.
In @.github/workflows/docker-image.yml:
- Around line 173-174: Remove the insecure build-args block that passes
CLAUDE_CODE_OAUTH_TOKEN (and stop passing any API keys via --build-arg), and
rely exclusively on BuildKit secrets for sensitive values; update the workflow
to delete the build-args entry that references CLAUDE_CODE_OAUTH_TOKEN, and then
update the Dockerfile to remove corresponding ARG declarations (e.g., ARG
CLAUDE_CODE_OAUTH_TOKEN and ARG ANTHROPIC_API_KEY) and instead read secrets via
the BuildKit secret mount (e.g., via RUN
--mount=type=secret,id=claude_code_oauth_token or the ANTHROPIC_API_KEY secret
id), ensuring no secrets are embedded in image history or layer metadata.
📜 Review details
Configuration used: defaults
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (3)
.devcontainer/Dockerfile.github/workflows/docker-image.ymlscript/install-claude-plugins.sh
🧰 Additional context used
📓 Path-based instructions (1)
.github/workflows/docker-image.yml
📄 CodeRabbit inference engine (CLAUDE.md)
Build DevContainer images automatically with semantic versioning and multi-platform support in .github/workflows/docker-image.yml
Files:
.github/workflows/docker-image.yml
🧠 Learnings (3)
📓 Common learnings
Learnt from: CR
Repo: keito4/config PR: 0
File: CLAUDE.md:0-0
Timestamp: 2025-12-01T03:45:17.253Z
Learning: Applies to .github/workflows/claude.yml : Trigger automatic AI assistance on claude mentions in issues, PRs, and comments using .github/workflows/claude.yml
Learnt from: CR
Repo: keito4/config PR: 0
File: CLAUDE.md:0-0
Timestamp: 2025-12-01T03:45:17.253Z
Learning: Applies to .github/workflows/update-libraries.yml : Execute npm run update:libs on schedule and open pull requests when dependencies or Codex/Claude tooling changes in .github/workflows/update-libraries.yml
Learnt from: CR
Repo: keito4/config PR: 0
File: CLAUDE.md:0-0
Timestamp: 2025-12-01T03:45:17.253Z
Learning: Applies to .github/workflows/docker-image.yml : Build DevContainer images automatically with semantic versioning and multi-platform support in .github/workflows/docker-image.yml
Learnt from: CR
Repo: keito4/config PR: 0
File: AGENTS.md:0-0
Timestamp: 2026-01-04T04:05:56.913Z
Learning: Use automated Claude commands from `.claude/commands/` directory for maintenance, Git workflows, code analysis, quality checks, dependency management, security reviews, and tool configuration
📚 Learning: 2026-01-04T04:05:56.913Z
Learnt from: CR
Repo: keito4/config PR: 0
File: AGENTS.md:0-0
Timestamp: 2026-01-04T04:05:56.913Z
Learning: Use automated Claude commands from `.claude/commands/` directory for maintenance, Git workflows, code analysis, quality checks, dependency management, security reviews, and tool configuration
Applied to files:
script/install-claude-plugins.sh.devcontainer/Dockerfile
📚 Learning: 2025-12-01T03:45:17.253Z
Learnt from: CR
Repo: keito4/config PR: 0
File: CLAUDE.md:0-0
Timestamp: 2025-12-01T03:45:17.253Z
Learning: Applies to .github/workflows/docker-image.yml : Build DevContainer images automatically with semantic versioning and multi-platform support in .github/workflows/docker-image.yml
Applied to files:
.devcontainer/Dockerfile.github/workflows/docker-image.yml
🔇 Additional comments (5)
script/install-claude-plugins.sh (2)
29-39: OAuth token authentication path looks correct.The CLAUDE_CODE_OAUTH_TOKEN authentication logic is correctly implemented with appropriate JSON structure and expiration timestamp. The priority order (BuildKit secret → OAuth token → API key) is sensible.
Note: This depends on resolving the security issue in
.github/workflows/docker-image.ymlwhere secrets are currently passed via insecure build-args instead of exclusively using BuildKit secrets.
62-62: LGTM: playwright-skill marketplace addition.The marketplace addition correctly supports the
playwright-skill@playwright-skillplugin mentioned in the PR objectives. The URL format and error handling are consistent with existing marketplace additions..devcontainer/Dockerfile (3)
93-93: LGTM: Library path fix for setup-claude.sh.Copying
script/libto/usr/local/script/libcorrectly resolves the library path issue described in the PR objectives. Whensetup-claude.shis invoked from/usr/local/bin/in other repositories using the config-base image, it can now find its dependencies (output.sh,claude_plugins.sh) at/usr/local/script/lib/.The dual copy (line 92 to
/tmp/script-liband line 93 to/usr/local/script/lib) serves distinct purposes: build-time vs. runtime usage.
96-106: Plugin installation logic is correct, but depends on fixing the ARG security issue.The environment-aware plugin installation correctly:
- Sets
HOME=/home/vscodeto install plugins in the correct user directory while running as root (needed for BuildKit secret access)- Passes authentication credentials to the installation script
- Handles installation failures gracefully
However, passing
CLAUDE_CODE_OAUTH_TOKENandANTHROPIC_API_KEYfrom ARGs (line 102) relies on the insecure build-args pattern flagged in lines 3-5 anddocker-image.yml. Once the ARG security issue is resolved, update line 102 to remove the ARG-sourced environment variables.
110-110: LGTM: Explicit HOME setting for Claude setup.Setting
HOME=/home/vscodeexplicitly during the Claude setup ensures the build script operates in the correct user context, which is necessary for proper configuration file placement and initialization.
| # Build arguments for Claude Code authentication | ||
| ARG CLAUDE_CODE_OAUTH_TOKEN | ||
| ARG ANTHROPIC_API_KEY |
There was a problem hiding this comment.
Critical: Remove ARG declarations for secrets.
These ARG declarations receive secrets from build-args (passed in docker-image.yml), which exposes them in Docker image history and metadata. This undermines the security provided by BuildKit secrets already configured in the build.
🔒 Recommended fix: Remove ARG declarations and rely on BuildKit secrets
Remove the ARG declarations:
-# Build arguments for Claude Code authentication
-ARG CLAUDE_CODE_OAUTH_TOKEN
-ARG ANTHROPIC_API_KEY
-Update line 102 to source credentials only from the BuildKit secret mount, not from environment variables populated by ARGs.
🤖 Prompt for AI Agents
In @.devcontainer/Dockerfile around lines 3 - 5, Remove the ARG declarations for
CLAUDE_CODE_OAUTH_TOKEN and ANTHROPIC_API_KEY because build-args expose secrets
in image history; instead rely on the BuildKit secret mount. Delete the lines
declaring ARG CLAUDE_CODE_OAUTH_TOKEN and ARG ANTHROPIC_API_KEY in the
Dockerfile and update the consumer code referenced at line 102 to read
credentials only from the BuildKit secret mount (not from environment variables
populated by ARGs), ensuring the Dockerfile and any ENTRYPOINT/CMD or shell
sourcing logic no longer reference those ARG names.
| build-args: | | ||
| CLAUDE_CODE_OAUTH_TOKEN=${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }} |
There was a problem hiding this comment.
Critical: Build args expose secrets in image history.
Passing CLAUDE_CODE_OAUTH_TOKEN (and ANTHROPIC_API_KEY declared in the Dockerfile) as build arguments exposes these credentials in Docker image history and layer metadata, which can be inspected via docker history. BuildKit secrets (already configured on line 176) are specifically designed to handle sensitive data securely without leaving traces in the image.
🔒 Recommended fix: Remove build-args and rely exclusively on BuildKit secrets
Remove the insecure build-args block:
- build-args: |
- CLAUDE_CODE_OAUTH_TOKEN=${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
secrets: |
claude_credentials=${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}Then update .devcontainer/Dockerfile to remove the corresponding ARG declarations and rely solely on the BuildKit secret mount.
🤖 Prompt for AI Agents
In @.github/workflows/docker-image.yml around lines 173 - 174, Remove the
insecure build-args block that passes CLAUDE_CODE_OAUTH_TOKEN (and stop passing
any API keys via --build-arg), and rely exclusively on BuildKit secrets for
sensitive values; update the workflow to delete the build-args entry that
references CLAUDE_CODE_OAUTH_TOKEN, and then update the Dockerfile to remove
corresponding ARG declarations (e.g., ARG CLAUDE_CODE_OAUTH_TOKEN and ARG
ANTHROPIC_API_KEY) and instead read secrets via the BuildKit secret mount (e.g.,
via RUN --mount=type=secret,id=claude_code_oauth_token or the ANTHROPIC_API_KEY
secret id), ensuring no secrets are embedded in image history or layer metadata.
|
(aside) |
|
Claude finished @keito4's task in 2m 39s —— View job マージコンフリクトの解決完了 ✅タスクリスト
解決内容origin/mainをベースに、このPRの本来の目的である2つの変更のみを適用しました: 適用した変更:
除外した変更(セキュリティ上の理由でorigin/mainの状態を維持):
結果
|
There was a problem hiding this comment.
📝 [actionlint] reported by reviewdog 🐶
shellcheck reported issue in this script: SC2086:info:30:32: Double quote to prevent globbing and word splitting [shellcheck]
config/.github/workflows/docker-image.yml
Line 55 in 31938e2
There was a problem hiding this comment.
📝 [actionlint] reported by reviewdog 🐶
shellcheck reported issue in this script: SC2086:info:31:37: Double quote to prevent globbing and word splitting [shellcheck]
config/.github/workflows/docker-image.yml
Line 55 in 31938e2
There was a problem hiding this comment.
📝 [actionlint] reported by reviewdog 🐶
shellcheck reported issue in this script: SC2086:info:32:30: Double quote to prevent globbing and word splitting [shellcheck]
config/.github/workflows/docker-image.yml
Line 55 in 31938e2
There was a problem hiding this comment.
🚫 [actionlint] reported by reviewdog 🐶
shellcheck reported issue in this script: SC2129:style:30:1: Consider using { cmd1; cmd2; } >> file instead of individual redirects [shellcheck]
config/.github/workflows/docker-image.yml
Line 55 in 31938e2
There was a problem hiding this comment.
📝 [actionlint] reported by reviewdog 🐶
shellcheck reported issue in this script: SC2086:info:10:39: Double quote to prevent globbing and word splitting [shellcheck]
config/.github/workflows/docker-image.yml
Line 97 in 31938e2
There was a problem hiding this comment.
📝 [actionlint] reported by reviewdog 🐶
shellcheck reported issue in this script: SC2086:info:11:32: Double quote to prevent globbing and word splitting [shellcheck]
config/.github/workflows/docker-image.yml
Line 97 in 31938e2
There was a problem hiding this comment.
📝 [actionlint] reported by reviewdog 🐶
shellcheck reported issue in this script: SC2086:info:6:31: Double quote to prevent globbing and word splitting [shellcheck]
config/.github/workflows/docker-image.yml
Line 97 in 31938e2
There was a problem hiding this comment.
📝 [actionlint] reported by reviewdog 🐶
shellcheck reported issue in this script: SC2086:info:9:34: Double quote to prevent globbing and word splitting [shellcheck]
config/.github/workflows/docker-image.yml
Line 97 in 31938e2
There was a problem hiding this comment.
🚫 [actionlint] reported by reviewdog 🐶
shellcheck reported issue in this script: SC2129:style:9:3: Consider using { cmd1; cmd2; } >> file instead of individual redirects [shellcheck]
config/.github/workflows/docker-image.yml
Line 97 in 31938e2
There was a problem hiding this comment.
📝 [actionlint] reported by reviewdog 🐶
shellcheck reported issue in this script: SC2086:info:3:50: Double quote to prevent globbing and word splitting [shellcheck]
config/.github/workflows/docker-image.yml
Line 203 in 31938e2
|
🎉 This PR is included in version 1.45.2 🎉 The release is available on GitHub release Your semantic-release bot 📦🚀 |
概要
別リポジトリで config-base イメージを使用した際に
/usr/local/bin/setup-claude.shがライブラリファイルを見つけられない問題を修正しました。修正内容
1. setup-claude.sh のライブラリパス問題
問題:
/usr/local/bin/setup-claude.shが依存するscript/lib/output.shとscript/lib/claude_plugins.shを見つけられない/usr/local/script/lib/output.sh: No such file or directoryエラーが発生修正:
script/lib/を/usr/local/script/libにコピー/usr/local/script/lib/から正しくライブラリを読み込める2. playwright-skill マーケットプレイスの追加
問題:
playwright-skill@playwright-skillが記載されているが、マーケットプレイスが追加されていない修正:
install-claude-plugins.shに playwright-skill マーケットプレイスを追加claude plugin marketplace add https://github.com/lackeyjb/playwright-skill.git影響範囲
テスト計画
/usr/local/script/lib/が正しく作成されること検証方法
🤖 Generated with Claude Code
Summary by CodeRabbit
New Features
Chores
✏️ Tip: You can customize this high-level summary in your review settings.