feat: 一括更新コマンド npm run update:all を追加 - #479
Conversation
npm/Claude Code/GitHub Actions の3種の依存関係更新を一括実行できる `update:all` コマンドと、GitHub Actions バージョン自動更新用の `update:actions` コマンドを追加。--skip-* オプションで個別スキップ可能。 Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
|
Warning Rate limit exceeded
⌛ How to resolve this issue?After the wait time has elapsed, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout. Please see our FAQ for further information. 📝 WalkthroughWalkthroughThis PR introduces automation for updating GitHub Actions to latest SemVer versions, along with a consolidated Changes
Sequence DiagramsequenceDiagram
participant User
participant update-all.sh
participant update-libraries.sh
participant update-claude-code.sh
participant update-actions.sh
User->>update-all.sh: npm run update:all [--skip-*]
activate update-all.sh
alt not --skip-libs
update-all.sh->>update-libraries.sh: Execute
activate update-libraries.sh
update-libraries.sh-->>update-all.sh: [OK] or [FAIL]
deactivate update-libraries.sh
else --skip-libs
update-all.sh-->>update-all.sh: Record [SKIP]
end
alt not --skip-claude
update-all.sh->>update-claude-code.sh: Execute
activate update-claude-code.sh
update-claude-code.sh-->>update-all.sh: [OK] or [FAIL]
deactivate update-claude-code.sh
else --skip-claude
update-all.sh-->>update-all.sh: Record [SKIP]
end
alt not --skip-actions
update-all.sh->>update-actions.sh: Execute
activate update-actions.sh
update-actions.sh-->>update-all.sh: [OK] or [FAIL]
deactivate update-actions.sh
else --skip-actions
update-all.sh-->>update-all.sh: Record [SKIP]
end
update-all.sh->>User: Summary + Exit Code
deactivate update-all.sh
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~25 minutes Possibly related PRs
Suggested labels
Poem
🚥 Pre-merge checks | ✅ 2 | ❌ 2❌ Failed checks (2 warnings)
✅ Passed checks (2 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
🔍 AI Code Review (Local Hook)Models: Codex (default) / Gemini (default) 🤖 Codex Review指摘事項
判定: patch is incorrect
|
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 7d4ceb4cb5
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| # 全ワークフローファイルで置換 | ||
| escaped_action=$(escape_sed "$full_action") | ||
| for wf in "${workflow_files[@]}"; do | ||
| sed -i '' "s|\(uses:.*\)${escaped_action}@${current_ref}|\1${escaped_action}@${new_ref}|g" "$wf" |
There was a problem hiding this comment.
The rewrite loop calls sed -i '' ..., which is BSD/macOS-specific; on GNU sed (used in typical Linux CI/devcontainer runs), -i is documented as -i[SUFFIX], so passing a separate empty argument makes sed treat the substitution as an input filename and fail (sed: can't read ...). This means update-actions.sh exits as soon as it hits an action that needs updating, so npm run update:actions (and the update:all step) cannot perform updates in Linux environments.
Useful? React with 👍 / 👎.
PR レビュー: 一括更新コマンド npm run update:all総合評価: ✅ 優秀全体的に非常に高品質な実装です。コード規約、エラーハンドリング、テストカバレッジのすべてが優れています。 ✅ 良い点1. 堅牢なエラーハンドリング
2. 包括的なテストカバレッジ
3. 優れたユーザビリティ
4. セキュリティ配慮
5. 保守性の高い設計
🔍 改善提案（Critical ではない）1. macOS固有のsed構文（update-actions.sh:182）現在 2. Rate Limit対策の検討全アクションに対して即座に 🧪 テスト実行結果の確認Test planの未完了項目:
マージ前にこれらの実行ログを確認することをお勧めします。 🔐 セキュリティ: ✅ 問題なし
🎯 結論: マージ推奨 ✅この実装は以下の点で優れています:
改善提案は全てオプショナルであり、現状でも十分にプロダクション品質です。 レビュー済み by Claude Sonnet 4.5 | 日付: 2026-02-16 |
- .claude/commands/update-actions.md を新規作成 - README.md の Quick Reference と Scripts テーブルに追加 - repo-maintenance.md に GitHub Actions 更新ステップ (2.5) を追加 Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
update-claude-code と update-actions を Development Environment から 独立した Updates セクションに移動し、update:all の使い方を追加。 Quick Reference テーブルのカテゴリ構造と整合性を確保。 Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
PR Review: npm run update:all 一括更新コマンド追加このPRを詳細にレビューしました。全体的に高品質な実装です。 ✅ 良い点1. 堅牢なエラーハンドリング
2. 適切なバージョン判定ロジック
3. v prefix 正規化の実装
4. 重複排除の実装
5. 包括的なテストカバレッジ
6. ユーザビリティ
|
- actions/setup-node: v6.1.0 → v6.2.0 - zaproxy/action-baseline: v0.14.0 → v0.15.0 Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 4
🤖 Fix all issues with AI agents
In @.claude/commands/README.md:
- Around line 483-503: The two fenced code blocks showing the commands
"/update-claude-code" and the block containing "/update-actions\nnpm run
update:actions" are missing language specifiers; update those three backticks to
use "bash" (i.e., change ``` to ```bash) so they match other examples and
satisfy markdownlint MD040, making sure to update both the single-line
"/update-claude-code" block and the two-line "/update-actions" block.
In `@script/update-actions.sh`:
- Around line 34-36: The escape_sed function currently fails to escape the sed
replacement metacharacter '&', so update the function (escape_sed) to also
escape '&' in its character class used by sed (i.e., include & inside the
bracket expression alongside . [ \ / * ^ $ ) so any '&' in the input is
backslash-escaped before being passed to sed; keep the same approach of printf
'%s' "$1" | sed 's/.../\\&/g' but add '&' to the set of characters to be
escaped.
- Around line 63-69: The current fallback uses the gh API call
"repos/${owner_repo}/tags?per_page=1" to set the variable tag which returns the
most recently created tag (not the highest SemVer) and can cause downgrades;
update the fallback in script/update-actions.sh to fetch multiple tags (e.g.,
increase per_page and handle pagination) and select the highest SemVer name
rather than the first returned value—collect tag names from the gh api response,
filter/normalize versions (variable tag), and pick the max using a SemVer-aware
comparator (e.g., sort -V or a semver library) before echoing and returning.
- Around line 179-183: The sed invocation using "sed -i ''" is macOS-only and
breaks on GNU/Linux; update the loop that uses escaped_action, workflow_files,
current_ref, and new_ref to perform a portable in-place replace (e.g., write
sed's output to a temp file and then mv it back) instead of relying on the
BSD-specific "-i ''" flag so the script works on both macOS and Linux CI
environments.
🧹 Nitpick comments (3)
script/update-actions.sh (1)
92-96:find | tr '\n' '\0'is less robust thanfind -print0.Using
tr '\n' '\0'breaks on filenames containing literal newlines (admittedly unlikely for workflow files). The standard idiom isfind ... -print0:♻️ Proposed fix
workflow_files=() while IFS= read -r -d '' file; do workflow_files+=("$file") -done < <(find "${WORKFLOWS_DIR}" -name '*.yml' -o -name '*.yaml' | tr '\n' '\0') +done < <(find "${WORKFLOWS_DIR}" \( -name '*.yml' -o -name '*.yaml' \) -print0)test/integration/update_all.bats (2)
23-84: Skip-flag tests exercise a copy of the logic, not the actual script.The
--skip-*tests create standalone scripts that reimplement the option-parsing loop fromupdate-all.sh. If the real script's parsing changes (e.g., renaming a flag, switching togetopts), these tests will still pass. Consider sourcing or directly runningupdate-all.sh --help/update-all.sh --skip-libs --skip-claude --skip-actions(with the sub-scripts stubbed out) to test the actual code path.
13-15: Most tests are grep-based structural checks rather than behavioral tests.Tests like "has
set -euo pipefail" or "containsstep_results" verify that certain strings exist in the source file, not that the script behaves correctly. This provides minimal regression protection. Consider adding at least one end-to-end test that runsupdate-all.shwith all three steps skipped (which should succeed quickly without external dependencies) and asserts on the output/exit code.Also applies to: 86-107
| **Usage**: | ||
|
|
||
| ``` | ||
| /update-claude-code | ||
| ``` | ||
|
|
||
| #### `update-actions.md` | ||
|
|
||
| **Purpose**: Update GitHub Actions to the latest versions | ||
| **Features**: | ||
|
|
||
| - `.github/workflows/` 配下の全ワークフローファイルをスキャン | ||
| - SemVer タグのアクションを最新バージョンに更新 | ||
| - メジャータグ固定・SHA ピンニング・ブランチ固定はスキップ | ||
|
|
||
| **Usage**: | ||
|
|
||
| ``` | ||
| /update-actions | ||
| npm run update:actions | ||
| ``` |
There was a problem hiding this comment.
Add language specifiers to fenced code blocks (markdownlint MD040).
The code blocks at lines 485 and 500 are missing language identifiers, which is flagged by markdownlint. Other code blocks in this file consistently use bash — these should match.
♻️ Proposed fix
**Usage**:
-```
+```bash
/update-claude-code
```diff
-```
+```bash
/update-actions
npm run update:actions
</details>
<details>
<summary>🧰 Tools</summary>
<details>
<summary>🪛 markdownlint-cli2 (0.20.0)</summary>
[warning] 485-485: Fenced code blocks should have a language specified
(MD040, fenced-code-language)
---
[warning] 500-500: Fenced code blocks should have a language specified
(MD040, fenced-code-language)
</details>
</details>
<details>
<summary>🤖 Prompt for AI Agents</summary>
In @.claude/commands/README.md around lines 483 - 503, The two fenced code
blocks showing the commands "/update-claude-code" and the block containing
"/update-actions\nnpm run update:actions" are missing language specifiers;
update those three backticks to use "bash" (i.e., change tobash) so they
match other examples and satisfy markdownlint MD040, making sure to update both
the single-line "/update-claude-code" block and the two-line "/update-actions"
block.
</details>
<!-- fingerprinting:phantom:medusa:phoenix -->
<!-- This is an auto-generated comment by CodeRabbit -->
| escape_sed() { | ||
| printf '%s' "$1" | sed 's/[.[\/*^$]/\\&/g' | ||
| } |
There was a problem hiding this comment.
escape_sed omits &, which is a sed replacement metacharacter.
The & character in a sed replacement string expands to the entire matched text. While unlikely to appear in a GitHub Action name, adding it to the character class makes the function correct in general.
🛡️ Proposed fix
escape_sed() {
- printf '%s' "$1" | sed 's/[.[\/*^$]/\\&/g'
+ printf '%s' "$1" | sed 's/[&.[\/*^$]/\\&/g'
}📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| escape_sed() { | |
| printf '%s' "$1" | sed 's/[.[\/*^$]/\\&/g' | |
| } | |
| escape_sed() { | |
| printf '%s' "$1" | sed 's/[&.[\/*^$]/\\&/g' | |
| } |
🤖 Prompt for AI Agents
In `@script/update-actions.sh` around lines 34 - 36, The escape_sed function
currently fails to escape the sed replacement metacharacter '&', so update the
function (escape_sed) to also escape '&' in its character class used by sed
(i.e., include & inside the bracket expression alongside . [ \ / * ^ $ ) so any
'&' in the input is backslash-escaped before being passed to sed; keep the same
approach of printf '%s' "$1" | sed 's/.../\\&/g' but add '&' to the set of
characters to be escaped.
| # フォールバック: 最新タグを取得 | ||
| tag=$(gh api "repos/${owner_repo}/tags?per_page=1" --jq '.[0].name' 2>/dev/null) || true | ||
|
|
||
| if [[ -n "$tag" ]]; then | ||
| echo "$tag" | ||
| return 0 | ||
| fi |
There was a problem hiding this comment.
Tags fallback may return a non-latest SemVer tag.
The /tags?per_page=1 endpoint returns the most recently created tag, not the highest SemVer version. If a maintainer back-ports a fix to an older major version (e.g., pushes v3.1.1 after v4.0.0 already exists), this fallback would return v3.1.1 and potentially downgrade an action.
Consider sorting tags by SemVer or fetching more tags and selecting the highest:
🔧 Proposed improvement
# フォールバック: 最新タグを取得
- tag=$(gh api "repos/${owner_repo}/tags?per_page=1" --jq '.[0].name' 2>/dev/null) || true
+ tag=$(gh api "repos/${owner_repo}/tags?per_page=100" --jq '[.[].name | select(test("^v?[0-9]+\\.[0-9]+\\.[0-9]+$"))] | sort_by(split(".") | map(ltrimstr("v") | tonumber)) | last' 2>/dev/null) || true📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| # フォールバック: 最新タグを取得 | |
| tag=$(gh api "repos/${owner_repo}/tags?per_page=1" --jq '.[0].name' 2>/dev/null) || true | |
| if [[ -n "$tag" ]]; then | |
| echo "$tag" | |
| return 0 | |
| fi | |
| # フォールバック: 最新タグを取得 | |
| tag=$(gh api "repos/${owner_repo}/tags?per_page=100" --jq '[.[].name | select(test("^v?[0-9]+\\.[0-9]+\\.[0-9]+$"))] | sort_by(split(".") | map(ltrimstr("v") | tonumber)) | last' 2>/dev/null) || true | |
| if [[ -n "$tag" ]]; then | |
| echo "$tag" | |
| return 0 | |
| fi |
🤖 Prompt for AI Agents
In `@script/update-actions.sh` around lines 63 - 69, The current fallback uses the
gh API call "repos/${owner_repo}/tags?per_page=1" to set the variable tag which
returns the most recently created tag (not the highest SemVer) and can cause
downgrades; update the fallback in script/update-actions.sh to fetch multiple
tags (e.g., increase per_page and handle pagination) and select the highest
SemVer name rather than the first returned value—collect tag names from the gh
api response, filter/normalize versions (variable tag), and pick the max using a
SemVer-aware comparator (e.g., sort -V or a semver library) before echoing and
returning.
| # 全ワークフローファイルで置換 | ||
| escaped_action=$(escape_sed "$full_action") | ||
| for wf in "${workflow_files[@]}"; do | ||
| sed -i '' "s|\(uses:.*\)${escaped_action}@${current_ref}|\1${escaped_action}@${new_ref}|g" "$wf" | ||
| done |
There was a problem hiding this comment.
sed -i '' is BSD-only and will fail on GNU/Linux (including CI).
As flagged in the PR comments, sed -i '' is macOS/BSD-specific syntax. On GNU sed (Linux), -i requires the extension to be part of the same argument (e.g., sed -i'') or omitted entirely (sed -i). Passing '' as a separate argument causes GNU sed to misinterpret it as the script.
Use a portable alternative:
🐛 Proposed fix — portable in-place sed
# 全ワークフローファイルで置換
escaped_action=$(escape_sed "$full_action")
for wf in "${workflow_files[@]}"; do
- sed -i '' "s|\(uses:.*\)${escaped_action}@${current_ref}|\1${escaped_action}@${new_ref}|g" "$wf"
+ if sed --version 2>/dev/null | grep -q 'GNU'; then
+ sed -i "s|\(uses:.*\)${escaped_action}@${current_ref}|\1${escaped_action}@${new_ref}|g" "$wf"
+ else
+ sed -i '' "s|\(uses:.*\)${escaped_action}@${current_ref}|\1${escaped_action}@${new_ref}|g" "$wf"
+ fi
doneAlternatively, a single-line portable approach that works on both:
- sed -i '' "s|\(uses:.*\)${escaped_action}@${current_ref}|\1${escaped_action}@${new_ref}|g" "$wf"
+ perl -pi -e "s|\Quses:.*?\E\Q${full_action}\E\@\Q${current_ref}\E|uses: ${full_action}\@${new_ref}|g" "$wf"Or the common temp-file idiom:
- sed -i '' "s|\(uses:.*\)${escaped_action}@${current_ref}|\1${escaped_action}@${new_ref}|g" "$wf"
+ sed "s|\(uses:.*\)${escaped_action}@${current_ref}|\1${escaped_action}@${new_ref}|g" "$wf" > "${wf}.tmp" && mv "${wf}.tmp" "$wf"🤖 Prompt for AI Agents
In `@script/update-actions.sh` around lines 179 - 183, The sed invocation using
"sed -i ''" is macOS-only and breaks on GNU/Linux; update the loop that uses
escaped_action, workflow_files, current_ref, and new_ref to perform a portable
in-place replace (e.g., write sed's output to a temp file and then mv it back)
instead of relying on the BSD-specific "-i ''" flag so the script works on both
macOS and Linux CI environments.
PR Review - #479📋 概要GitHub Actions の自動バージョン更新機能と、全依存関係を一括更新する統合コマンドの追加です。CI は全て通過しており、22 件の新規テストも追加されています。 ✅ Good Points1. コード品質
2. 機能設計
3. テストカバレッジ
4. ドキュメント
🔍 Potential Issues & Suggestions1. 🟡 Portability Issue (Medium)問題: # script/update-actions.sh:182
sed -i '' "s|\(uses:.*\)${escaped_action}@${current_ref}|\1${escaped_action}@${new_ref}|g" "$wf"影響: Linux 環境 (CI/CD, DevContainer) で実行するとエラー 推奨対応: # OS 判定で分岐
if [[ "$(uname)" == "Darwin" ]]; then
sed -i '' "s|pattern|replacement|g" "$file"
else
sed -i "s|pattern|replacement|g" "$file"
fiまたは # 一時ファイル経由で OS 非依存に
sed "s|pattern|replacement|g" "$file" > "${file}.tmp" && mv "${file}.tmp" "$file"2. 🟡 Rate Limit Risk (Medium)問題: 大量のアクションを処理する際、GitHub API のレート制限に抵触する可能性 # script/update-actions.sh:162
latest_tag=$(get_latest_tag "$local_owner_repo") || true推奨対応:
# レート制限確認
rate_remaining=$(gh api rate_limit --jq '.rate.remaining')
if [[ $rate_remaining -lt 10 ]]; then
log_warn "GitHub API レート制限が近づいています (残り: $rate_remaining)"
sleep 60
fi3. 🟢 Documentation Clarity (Low)問題: 推奨追加: ## 実行順序
1. npm 依存関係更新 (update:libs)
2. Claude Code 更新 (update:claude)
3. GitHub Actions 更新 (update:actions)
※ 各ステップは独立実行され、一部失敗しても後続ステップは継続されます4. 🟢 Test Enhancement (Low)問題: 実際の GitHub Actions ファイルを使用した E2E テストがない 推奨追加: @test "update-actions.sh updates actual workflow files" {
# テンプレートファイルをコピーしてテスト
cp "${REPO_ROOT}/.github/workflows/templates/unified-ci.yml" "${TEST_TEMP_DIR}/test.yml"
# 意図的に古いバージョンに変更
sed -i "s|actions/setup-node@v6.2.0|actions/setup-node@v6.1.0|g" "${TEST_TEMP_DIR}/test.yml"
# update-actions.sh 実行
# ...
# 更新されたことを確認
grep -q "actions/setup-node@v6.2.0" "${TEST_TEMP_DIR}/test.yml"
}🔐 Security Considerations✅ Good
|
| カテゴリ | 評価 | コメント |
|---|---|---|
| コード品質 | ⭐⭐⭐⭐⭐ | エラーハンドリング、ロバスト性、可読性が優秀 |
| テストカバレッジ | ⭐⭐⭐⭐☆ | ロジック検証は十分だが、E2E テスト追加で完璧に |
| ドキュメント | ⭐⭐⭐⭐⭐ | 包括的で分かりやすい |
| セキュリティ | ⭐⭐⭐⭐☆ | 問題なし、認証確認追加で万全 |
| パフォーマンス | ⭐⭐⭐⭐☆ | レート制限対策追加で改善可能 |
| 総合評価 | ⭐⭐⭐⭐☆ | 優秀な実装。sed -i の portability 修正のみ必須対応 |
🚀 Recommendation
Approve with Suggestions
必須対応 (Blocking)
sed -i ''の portability 修正 → Linux/macOS 両対応に
推奨対応 (Non-blocking)
- GitHub API レート制限チェック追加
- 実行順序のドキュメント明記
- E2E テスト追加
gh auth status前提条件の明記
📌 Additional Notes
CI/CD Integration
このコマンドは .github/workflows/update-libraries.yml に統合される予定でしょうか?統合する場合:
- スケジュール実行 (週次/月次)
- 自動 PR 作成
- レビュアー自動アサイン
を検討すると良いでしょう。
Conventional Commits
コミットメッセージが feat: で始まっており、semantic-release でマイナーバージョンがリリースされます。想定通りかと思いますが、確認推奨です。
素晴らしい実装です!特に:
- 包括的なスキップロジック
- v prefix 正規化の賢い処理
- 失敗時も継続実行する orchestrator 設計
が秀逸です。sed -i の修正後、安心してマージできる品質です 👍
🤖 Generated with Claude Code
|
🎉 This PR is included in version 1.75.0 🎉 The release is available on GitHub release Your semantic-release bot 📦🚀 |
1 participant
Summary
npm run update:actionsを追加: GitHub Actions のバージョンを最新に自動更新（gh apiでリリース/タグ取得）npm run update:allを追加: libs / Claude Code / Actions の3種を一括更新するオーケストレーター--skip-libs,--skip-claude,--skip-actionsオプションで個別スキップ可能Test plan
npm run update:actions単体実行で動作確認npm run update:all -- --skip-libs --skip-claudeで Actions のみ更新確認🤖 Generated with Claude Code
Summary by CodeRabbit
New Features
Documentation
Tests