Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
24 changes: 10 additions & 14 deletions .claude/plugins/plugins.txt
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
# Claude Code Plugin List
# このファイルに記載されたプラグインは devcontainer 起動時にユーザースコープで一括インストールされます
# Claude Code Plugin List for DevContainer
# このファイルに記載されたプラグインは devcontainer ビルド時にインストールされます
# 形式: plugin-name@marketplace-name
# 行頭 # はコメント

Expand All @@ -8,22 +8,18 @@
commit-commands@claude-plugins-official
hookify@claude-plugins-official
plugin-dev@claude-plugins-official
frontend-design@claude-plugins-official

# プロジェクト固有
# LSP サポート
typescript-lsp@claude-plugins-official

# === Workflow Plugins (claude-code-workflows) ===
code-refactoring@claude-code-workflows

# === Additional Plugins ===
# Code Review
code-review@claude-plugins-official
# AI Code Review (from claude-code-workflows)
code-review-ai@claude-code-workflows
# Kubernetes Operations

# === Workflow Plugins (claude-code-workflows) ===
code-refactoring@claude-code-workflows
kubernetes-operations@claude-code-workflows
# JavaScript/TypeScript Development
javascript-typescript@claude-code-workflows
# Playwright Browser Automation
playwright-skill@playwright-skill
backend-development@claude-code-workflows
full-stack-orchestration@claude-code-workflows
database-design@claude-code-workflows
database-migrations@claude-code-workflows
11 changes: 9 additions & 2 deletions .devcontainer/Dockerfile
Original file line number Diff line number Diff line change
@@ -1,5 +1,9 @@
FROM mcr.microsoft.com/devcontainers/base:ubuntu

# Build arguments for Claude Code authentication
ARG CLAUDE_CODE_OAUTH_TOKEN

Check warning on line 4 in .devcontainer/Dockerfile

View workflow job for this annotation

GitHub Actions / Generate SBOM

Sensitive data should not be used in the ARG or ENV commands

SecretsUsedInArgOrEnv: Do not use ARG or ENV instructions for sensitive data (ARG "CLAUDE_CODE_OAUTH_TOKEN") More info: https://docs.docker.com/go/dockerfile/rule/secrets-used-in-arg-or-env/

Check warning on line 4 in .devcontainer/Dockerfile

View workflow job for this annotation

GitHub Actions / Trivy Container Scan

Sensitive data should not be used in the ARG or ENV commands

SecretsUsedInArgOrEnv: Do not use ARG or ENV instructions for sensitive data (ARG "CLAUDE_CODE_OAUTH_TOKEN") More info: https://docs.docker.com/go/dockerfile/rule/secrets-used-in-arg-or-env/
ARG ANTHROPIC_API_KEY

Check warning on line 5 in .devcontainer/Dockerfile

View workflow job for this annotation

GitHub Actions / Generate SBOM

Sensitive data should not be used in the ARG or ENV commands

SecretsUsedInArgOrEnv: Do not use ARG or ENV instructions for sensitive data (ARG "ANTHROPIC_API_KEY") More info: https://docs.docker.com/go/dockerfile/rule/secrets-used-in-arg-or-env/

Check warning on line 5 in .devcontainer/Dockerfile

View workflow job for this annotation

GitHub Actions / Trivy Container Scan

Sensitive data should not be used in the ARG or ENV commands

SecretsUsedInArgOrEnv: Do not use ARG or ENV instructions for sensitive data (ARG "ANTHROPIC_API_KEY") More info: https://docs.docker.com/go/dockerfile/rule/secrets-used-in-arg-or-env/

Comment on lines +3 to +6

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

Avoid ARG/--build-arg for auth secrets (leak risk); prefer BuildKit secrets in CI.
Adding ARG CLAUDE_CODE_OAUTH_TOKEN / ARG ANTHROPIC_API_KEY enables --build-arg flows, but build-args are not a safe secret transport (they can surface in build logs/metadata/caches depending on builder/settings). If CI is using build-args for these, I’d strongly prefer switching CI to BuildKit secrets (e.g., separate secrets for OAuth token / API key, optionally using secret-to-env mounts) and keeping build-args only as a clearly-documented local-only escape hatch (or removing them entirely).

# Install dependencies and Node.js using official binaries
RUN apt-get update && apt-get install -y \
curl \
Expand Down Expand Up @@ -86,13 +90,16 @@
COPY --chown=root:root script/setup-claude.sh /usr/local/bin/setup-claude.sh
COPY --chown=vscode:vscode script/setup-claude-build.sh /tmp/setup-claude-build.sh
COPY --chown=vscode:vscode script/lib /tmp/script-lib
COPY --chown=root:root script/lib /usr/local/script/lib
RUN chmod +x /usr/local/bin/setup-claude.sh /tmp/setup-claude-build.sh

# Install Claude plugins using BuildKit secret
# Install Claude plugins using BuildKit secret or environment variables
# Build with: DOCKER_BUILDKIT=1 docker build --secret id=claude_credentials,src=$HOME/.claude/.credentials.json .
# Or with: docker build --build-arg CLAUDE_CODE_OAUTH_TOKEN=$CLAUDE_CODE_OAUTH_TOKEN .
# Or with: docker build --build-arg ANTHROPIC_API_KEY=$ANTHROPIC_API_KEY .
# Note: Run as root to access BuildKit secret, but use vscode's HOME for plugin installation
RUN --mount=type=secret,id=claude_credentials,uid=0,gid=0 \
env HOME=/home/vscode /tmp/install-claude-plugins.sh /home/vscode/.claude/plugins/plugins.txt || ( \
env HOME=/home/vscode CLAUDE_CODE_OAUTH_TOKEN="${CLAUDE_CODE_OAUTH_TOKEN}" ANTHROPIC_API_KEY="${ANTHROPIC_API_KEY}" /tmp/install-claude-plugins.sh /home/vscode/.claude/plugins/plugins.txt || ( \
echo "[WARN] Claude プラグインのインストールに失敗しました(認証情報が不足している可能性があります)" && \
echo "[INFO] コンテナ起動後に手動でインストールしてください: claude plugin install <plugin>@<marketplace>" \
) \
Expand Down
2 changes: 2 additions & 0 deletions .github/workflows/docker-image.yml

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

📝 [actionlint] reported by reviewdog 🐶
shellcheck reported issue in this script: SC2086:info:30:32: Double quote to prevent globbing and word splitting [shellcheck]

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

📝 [actionlint] reported by reviewdog 🐶
shellcheck reported issue in this script: SC2086:info:31:37: Double quote to prevent globbing and word splitting [shellcheck]

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

📝 [actionlint] reported by reviewdog 🐶
shellcheck reported issue in this script: SC2086:info:32:30: Double quote to prevent globbing and word splitting [shellcheck]

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🚫 [actionlint] reported by reviewdog 🐶
shellcheck reported issue in this script: SC2129:style:30:1: Consider using { cmd1; cmd2; } >> file instead of individual redirects [shellcheck]

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

📝 [actionlint] reported by reviewdog 🐶
shellcheck reported issue in this script: SC2086:info:10:39: Double quote to prevent globbing and word splitting [shellcheck]

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

📝 [actionlint] reported by reviewdog 🐶
shellcheck reported issue in this script: SC2086:info:11:32: Double quote to prevent globbing and word splitting [shellcheck]

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

📝 [actionlint] reported by reviewdog 🐶
shellcheck reported issue in this script: SC2086:info:6:31: Double quote to prevent globbing and word splitting [shellcheck]

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

📝 [actionlint] reported by reviewdog 🐶
shellcheck reported issue in this script: SC2086:info:9:34: Double quote to prevent globbing and word splitting [shellcheck]

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🚫 [actionlint] reported by reviewdog 🐶
shellcheck reported issue in this script: SC2129:style:9:3: Consider using { cmd1; cmd2; } >> file instead of individual redirects [shellcheck]

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

📝 [actionlint] reported by reviewdog 🐶
shellcheck reported issue in this script: SC2086:info:3:50: Double quote to prevent globbing and word splitting [shellcheck]

Original file line number Diff line number Diff line change
Expand Up @@ -170,6 +170,8 @@ jobs:
platforms: linux/amd64,linux/arm64
cache-from: type=registry,ref=ghcr.io/${{ github.repository_owner }}/config-base:cache
cache-to: type=registry,ref=ghcr.io/${{ github.repository_owner }}/config-base:cache,mode=max
build-args: |
CLAUDE_CODE_OAUTH_TOKEN=${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
secrets: |
claude_credentials=${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}

Expand Down
12 changes: 12 additions & 0 deletions docs/devcontainer.json.example
Original file line number Diff line number Diff line change
@@ -0,0 +1,12 @@
{
"name": "Management Tools",
"image": "ghcr.io/keito4/config-base:latest",
"remoteEnv": {
"TMPDIR": "/home/vscode/.claude/tmp"
},
"customizations": {
"vscode": {
"extensions": ["esbenp.prettier-vscode", "dbaeumer.vscode-eslint"]
}
}
}
30 changes: 20 additions & 10 deletions docs/using-config-base-image.md
Original file line number Diff line number Diff line change
Expand Up @@ -11,22 +11,31 @@
- Git hooks(Quality Gates)
- 開発ツール(Node.js, pnpm, Rust, terraform, aws-cli など)

## 最小構成(マウントなし)
## 推奨構成(DevContainer用)

新しいリポジトリで最小限の設定で使用する場合:
新しいリポジトリで使用する場合の推奨設定:

```json
// .devcontainer/devcontainer.json
{
"name": "My Project",
"image": "ghcr.io/keito4/config-base:1.43.0",
"image": "ghcr.io/keito4/config-base:latest",
"remoteEnv": {
"TMPDIR": "/home/vscode/.claude/tmp"
}
}
```

この構成では、イメージに含まれているすべての設定がそのまま利用できます。
**重要**: ホストの `~/.claude` をマウント**しない**ことで、イメージに含まれている設定がそのまま使えます。

📝 **サンプル**: [devcontainer.json.example](./devcontainer.json.example) を参照してください。

この構成では以下がすぐに利用できます:

- 事前インストールされたプラグイン
- カスタムコマンド
- カスタムエージェント
- Git hooks

### 利用可能なコマンド

Expand Down Expand Up @@ -59,15 +68,15 @@ claude --help
- `javascript-typescript@claude-code-workflows`
- `playwright-skill@playwright-skill`

## 推奨構成(ホスト設定の永続化)
## 高度な構成(ホスト設定の永続化)

プラグインの追加インストールや設定のカスタマイズを永続化したい場合:

```json
// .devcontainer/devcontainer.json
{
"name": "My Project",
"image": "ghcr.io/keito4/config-base:1.43.0",
"image": "ghcr.io/keito4/config-base:latest",
"remoteEnv": {
"TMPDIR": "/home/vscode/.claude/tmp"
},
Expand All @@ -77,11 +86,12 @@ claude --help
}
```

この構成では:
**注意**: この構成では:

- ホストの `~/.claude` をマウントして設定を永続化
- `setup-claude.sh` でイメージの設定をホスト側にコピー
- 追加のプラグインインストールや設定変更が保持される
- ホストの `~/.claude` をマウントすると、**イメージの設定が上書きされます**
- `setup-claude.sh` がイメージの設定をホスト側にコピーします
- ホスト側の設定が優先されるため、存在しないプラグインのエラーが出る可能性があります
- **DevContainer 専用で使う場合は、マウントなしの構成を推奨します**

## プロジェクト固有の設定を追加

Expand Down
15 changes: 13 additions & 2 deletions script/install-claude-plugins.sh
Original file line number Diff line number Diff line change
Expand Up @@ -26,7 +26,17 @@ if [[ -f "$CREDENTIALS_SECRET" ]]; then
echo "[INFO] BuildKit secret から認証情報を読み込み中..."
cp "$CREDENTIALS_SECRET" "${CLAUDE_DIR}/.credentials.json"
chmod 600 "${CLAUDE_DIR}/.credentials.json"
# 方法2: 環境変数から作成(API キー)
# 方法2: 環境変数から作成(OAuth トークンまたは API キー)
elif [[ -n "${CLAUDE_CODE_OAUTH_TOKEN:-}" ]]; then
echo "[INFO] CLAUDE_CODE_OAUTH_TOKEN から認証情報を作成中..."
cat > "${CLAUDE_DIR}/.credentials.json" << EOF
{
"claudeAiOauth": {
"accessToken": "${CLAUDE_CODE_OAUTH_TOKEN}",
"expiresAt": 9999999999999
}
}
EOF
elif [[ -n "${ANTHROPIC_API_KEY:-}" ]]; then
echo "[INFO] ANTHROPIC_API_KEY から認証情報を作成中..."
cat > "${CLAUDE_DIR}/.credentials.json" << EOF
Expand All @@ -40,7 +50,7 @@ EOF
else
echo "[ERROR] 認証情報が見つかりません"
echo " - BuildKit secret: $CREDENTIALS_SECRET"
echo " - 環境変数: ANTHROPIC_API_KEY"
echo " - 環境変数: CLAUDE_CODE_OAUTH_TOKEN または ANTHROPIC_API_KEY"
exit 1
fi

Expand All @@ -49,6 +59,7 @@ echo "[INFO] マーケットプレイスを初期化中..."
claude plugin marketplace add https://github.com/anthropics/claude-plugins-official.git 2>&1 || echo "[WARN] claude-plugins-official already exists or failed to add"
claude plugin marketplace add https://github.com/anthropics/claude-code.git 2>&1 || echo "[WARN] claude-code-plugins already exists or failed to add"
claude plugin marketplace add https://github.com/wshobson/agents.git 2>&1 || echo "[WARN] claude-code-workflows already exists or failed to add"
claude plugin marketplace add https://github.com/lackeyjb/playwright-skill.git 2>&1 || echo "[WARN] playwright-skill already exists or failed to add"

echo "[INFO] プラグインをインストール中..."
echo "[DEBUG] Claude version: $(claude --version 2>&1 || echo 'not found')"
Expand Down
Loading