Skip to content

fix: リポジトリ品質改善（CI/セキュリティ/ドキュメント/不要ファイル削除） #483

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
keito4 merged 4 commits into from
Feb 18, 2026
Merged

fix: リポジトリ品質改善（CI/セキュリティ/ドキュメント/不要ファイル削除） #483

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
cedcafb
fix: リポジトリ品質改善（CI/セキュリティ/ドキュメント/不要ファイル削除）
github-actions[bot] Feb 17, 2026
452a2aa
fix: CI 失敗を修正（存在しないテスト削除、trivy-action バージョン修正）
github-actions[bot] Feb 17, 2026
d1aa967
fix: テストのアクションバージョン文字列を実際の値に更新
github-actions[bot] Feb 17, 2026
dbab0e1
fix: テスト修正・シェルスクリプト互換性改善・フック出力制限
github-actions[bot] Feb 18, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 0 additions & 1 deletion .claude/commands/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -556,7 +556,6 @@ npm run update:all -- --skip-libs --skip-claude # Actions のみ
| `brew-deps.sh` | Makefile | Homebrew 依存関係管理 |
| `update-libraries.sh` | npm scripts | ライブラリの更新 |
| `version.sh` | Makefile | セマンティックバージョニング |
| `check-docs-sync.sh` | CI | ドキュメント同期の確認 |

## Additional Commands

Expand Down
17 changes: 13 additions & 4 deletions .claude/hooks/pre_git_quality_gates.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -169,16 +169,25 @@
print("=" * 60, file=sys.stderr, flush=True)
print("", file=sys.stderr, flush=True)

MAX_LINES = 15 # 失敗時の出力を最大行数に制限

for failed in failed_checks:
print(f"【{failed['name']}】", file=sys.stderr, flush=True)

if "error" in failed:
print(f" エラー: {failed['error']}", file=sys.stderr, flush=True)
else:
if failed.get("stdout"):
print(f" 標準出力:\n{failed['stdout']}", file=sys.stderr, flush=True)
if failed.get("stderr"):
print(f" 標準エラー:\n{failed['stderr']}", file=sys.stderr, flush=True)
for label, key in [("stdout", "stdout"), ("stderr", "stderr")]:
output = failed.get(key, "").strip()
if not output:
continue
lines = output.splitlines()
if len(lines) <= MAX_LINES:
print(f" {label}:\n{output}", file=sys.stderr, flush=True)
else:
truncated = "\n".join(lines[-MAX_LINES:])
print(f" {label} (末尾{MAX_LINES}行 / 全{len(lines)}行):", file=sys.stderr, flush=True)
print(truncated, file=sys.stderr, flush=True)

print("", file=sys.stderr, flush=True)

Expand Down
1 change: 1 addition & 0 deletions .devcontainer/devcontainer.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,6 +7,7 @@
"features": {
"ghcr.io/devcontainers-extra/features/homebrew-package:1": {},
"ghcr.io/eitsupi/devcontainer-features/jq-likes:2": {},
// TODO: Node.js is installed in Dockerfile (v22.14.0). This feature is kept solely for pnpm installation.
"ghcr.io/devcontainers/features/node:1": {
"pnpmVersion": "latest"
},
Comment on lines 11 to 13

@coderabbitai coderabbitai Bot Feb 17, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟡 Minor

🧩 Analysis chain

🏁 Script executed:

# First, let's see what files exist in the .devcontainer directory
find .devcontainer -type f | head -20

Repository: keito4/config

Length of output: 397

🏁 Script executed:

# Read the devcontainer.json file to see the full context
cat -n .devcontainer/devcontainer.json

Repository: keito4/config

Length of output: 2814

🏁 Script executed:

# Check if there's a Dockerfile in the .devcontainer directory
ls -la .devcontainer/ | grep -i dockerfile

Repository: keito4/config

Length of output: 118

🏁 Script executed:

# Read the Dockerfile content
cat -n .devcontainer/Dockerfile

Repository: keito4/config

Length of output: 9507

Pin pnpm version for reproducible builds.

Setting pnpmVersion: "latest" reduces build reproducibility. However, note that pnpm version non-determinism also exists in the Dockerfile (line 53: npm install -g pnpm without version pinning). Consider pinning a specific pnpm version in both locations.

The TODO comment correctly documents that this feature is kept only for pnpm installation; Node.js version conflict is not a concern.

🤖 Prompt for AI Agents 
Verify each finding against the current code and only fix it if needed.

In @.devcontainer/devcontainer.json around lines 11 - 13, The devcontainer
currently sets "pnpmVersion": "latest" which harms reproducible builds; change
the pnpmVersion value to a specific pinned version (e.g., "7.29.0") and also pin
the global installer in the Dockerfile by replacing the unpinned npm install -g
pnpm command with an installation of that same specific version (ensure both the
"pnpmVersion" entry and the npm install -g pnpm invocation use the identical
pinned version string so builds are deterministic).

Expand Down
4 changes: 2 additions & 2 deletions .github/workflows/ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -186,7 +186,7 @@ jobs:
- name: Run Bats integration tests
run: |
mkdir -p reports
bats test/integration/*.bats --formatter tap > reports/bats-results.tap || true
bats test/integration/*.bats --formatter tap > reports/bats-results.tap

- name: Upload integration test results
uses: actions/upload-artifact@v6.0.0
Expand Down Expand Up @@ -364,7 +364,7 @@ jobs:
uses: slackapi/slack-github-action@v2.1.1
with:
channel-id: ${{ vars.SLACK_CI_CHANNEL_ID }}
payload-file-path: '.github/slack-ci-failure.json'
payload-template-file-path: '.github/slack-ci-failure.json'

@chatgpt-codex-connector chatgpt-codex-connector Bot Feb 17, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Use supported Slack payload input key

In notify-failure, slackapi/slack-github-action@v2.1.1 is configured with payload-template-file-path, but this action expects payload-file-path (and payload-templated: true when template expansion is needed). With the current key, failures on main can skip or break Slack notifications because the payload file is not actually consumed.

Useful? React with 👍 / 👎.

env:
SLACK_BOT_TOKEN: ${{ secrets.SLACK_BOT_TOKEN }}
REPO: ${{ github.repository }}
Expand Down
6 changes: 3 additions & 3 deletions .github/workflows/container-security.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -60,7 +60,7 @@ jobs:
cache-from: type=registry,ref=ghcr.io/${{ github.repository_owner }}/config-base:cache

- name: Run Trivy vulnerability scanner
uses: aquasecurity/trivy-action@v0.34.0
uses: aquasecurity/trivy-action@0.34.0
with:
image-ref: 'config-base:scan'
format: 'sarif'
Expand All @@ -76,7 +76,7 @@ jobs:
sarif_file: 'trivy-results.sarif'

- name: Run Trivy for summary
uses: aquasecurity/trivy-action@v0.34.0
uses: aquasecurity/trivy-action@0.34.0
with:
image-ref: 'config-base:scan'
format: 'table'
Expand All @@ -85,7 +85,7 @@ jobs:
trivyignores: '.trivyignore'

- name: Fail on critical vulnerabilities
uses: aquasecurity/trivy-action@v0.34.0
uses: aquasecurity/trivy-action@0.34.0
with:
image-ref: 'config-base:scan'
format: 'table'
Expand Down
1 change: 0 additions & 1 deletion .github/workflows/docker-image.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -178,7 +178,6 @@ jobs:
cache-to: type=registry,ref=ghcr.io/${{ github.repository_owner }}/config-base:cache,mode=max
build-args: |
IMAGE_VERSION=${{ steps.release.outputs.version }}
CLAUDE_CODE_OAUTH_TOKEN=${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
secrets: |
claude_credentials=${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}

Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/update-libraries.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -65,7 +65,7 @@ jobs:
} >> $GITHUB_OUTPUT

- name: Create pull request
uses: peter-evans/create-pull-request@v6
uses: peter-evans/create-pull-request@v7
with:
token: ${{ secrets.GITHUB_TOKEN }}
branch: fix/auto-library-update
Expand Down
5 changes: 5 additions & 0 deletions .trivyignore
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,6 +12,7 @@
# Fixed in: 1.19.8, 1.20.3
# Reason: Transitive dependency via Vercel CLI, esbuild only used at build-time
# Expected resolution: Wait for Vercel to update esbuild
# Review date: 2026-02-17
CVE-2023-24538

# CVE-2023-24540: golang: html/template: improper handling of JavaScript whitespace
Expand All @@ -20,6 +21,7 @@ CVE-2023-24538
# Fixed in: 1.19.9, 1.20.4
# Reason: Transitive dependency via Vercel CLI, esbuild only used at build-time
# Expected resolution: Wait for Vercel to update esbuild
# Review date: 2026-02-17
CVE-2023-24540

# CVE-2024-24790: golang: net/netip: Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses
Expand All @@ -28,6 +30,7 @@ CVE-2023-24540
# Fixed in: 1.21.11, 1.22.4
# Reason: Transitive dependency via Vercel CLI, esbuild only used at build-time
# Expected resolution: Wait for Vercel to update esbuild
# Review date: 2026-02-17
CVE-2024-24790

# CVE-2025-68121: golang: crypto/tls: session resumption vulnerability
Expand All @@ -37,6 +40,7 @@ CVE-2024-24790
# Reason: Doppler CLI is built with older Go stdlib, waiting for upstream update
# Expected resolution: Wait for Doppler to rebuild with patched Go version
# Tracking: https://github.com/DopplerHQ/cli/issues (monitor for Go version update)
# Review date: 2026-02-17
CVE-2025-68121

# Vercel CLI path-to-regexp vulnerability
Expand All @@ -50,4 +54,5 @@ CVE-2025-68121
# Reason: Transitive dependency via Vercel CLI, cannot override without upstream fix
# Expected resolution: Wait for Vercel to complete migration to path-to-regexp@6.3.0+
# Tracking: https://github.com/vercel/vercel/issues
# Review date: 2026-02-17
CVE-2024-45296
2 changes: 1 addition & 1 deletion README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,7 +20,7 @@ It includes settings for various tools, such as the shell (Zsh), Git, npm, and V
- `dot/`: Directory for dotfiles and configuration files that are typically placed in the home directory, including Zsh configuration with comprehensive aliases, functions, and environment setup.
- `git/`: Contains Git configuration files including gitconfig, gitignore, commitlint configuration with i18n support, and modular configuration files in the `gitconfig.d/` subdirectory. See [git/README.md](git/README.md) for details.
- `npm/`: Contains npm global package configuration.
- `script/`: Contains utility scripts for exporting configuration settings (`export.sh`), importing configuration settings (`import.sh`), credential management (`credentials.sh`), Homebrew dependency management (`brew-deps.sh`), semantic versioning (`version.sh`), documentation sync checking (`check-docs-sync.sh`), and automated library updates for Codex/Claude Code tooling (`update-libraries.sh`). See [script/README.md](script/README.md) for details.
- `script/`: Contains utility scripts for exporting configuration settings (`export.sh`), importing configuration settings (`import.sh`), credential management (`credentials.sh`), Homebrew dependency management (`brew-deps.sh`), semantic versioning (`version.sh`), and automated library updates for Codex/Claude Code tooling (`update-libraries.sh`). See [script/README.md](script/README.md) for details.
- `vscode/`: Contains Visual Studio Code configuration including extensions list and installation documentation. The `templates/` subdirectory contains project-specific settings templates such as Tailwind CSS + CVA IntelliSense configuration. See [vscode/README.md](vscode/README.md) for details.

## Security
Expand Down
6 changes: 3 additions & 3 deletions docs/setup/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -96,7 +96,7 @@ jobs:
code: ${{ steps.filter.outputs.code }}
scripts: ${{ steps.filter.outputs.scripts }}
steps:
- uses: actions/checkout@v4
- uses: actions/checkout@v6
- uses: dorny/paths-filter@v3
id: filter
with:
Expand Down Expand Up @@ -185,7 +185,7 @@ notify-failure:
- uses: slackapi/slack-github-action@v2
with:
channel-id: ${{ vars.SLACK_CI_CHANNEL_ID }}
payload-file-path: '.github/slack-ci-failure.json'
payload-template-file-path: '.github/slack-ci-failure.json'
env:
SLACK_BOT_TOKEN: ${{ secrets.SLACK_BOT_TOKEN }}
```
Expand Down Expand Up @@ -368,7 +368,7 @@ jobs:
update:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: actions/checkout@v6
- run: npm update
- uses: peter-evans/create-pull-request@v7
with:
Expand Down
2 changes: 1 addition & 1 deletion package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,7 +12,7 @@
"lint:fix": "npm run lint -- --fix",
"format": "prettier --write .",
"format:check": "prettier --check .",
"shellcheck": "find script -name '*.sh' -type f | grep -v 'import.sh\\|export.sh\\|credentials.sh\\|brew-deps.sh\\|codespaces-secrets.sh\\|/lib/\\|credentials/providers/' | xargs -r shellcheck -x",
"shellcheck": "find script -name '*.sh' -type f | grep -v 'import.sh\\|export.sh\\|credentials.sh\\|brew-deps.sh\\|codespaces-secrets.sh\\|credentials/providers/\\|lib/config.sh\\|lib/devcontainer.sh\\|lib/output.sh\\|lib/platform.sh' | xargs -r shellcheck -x",
"test": "jest --runInBand",
"test:integration": "bats test/integration/",
"test:all": "npm test && npm run test:integration",
Expand Down
14 changes: 0 additions & 14 deletions script/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -176,19 +176,6 @@ Generates changelog from conventional commits.

**Claude command**: `/changelog-generator`

### check-docs-sync.sh

Verifies that generated documentation is synchronized with code changes.

**Usage**: `./script/check-docs-sync.sh`

**Configuration**:

```bash
export DOC_GENERATE_CMD="npm run docs:generate" # Documentation generation command
export DOCS_DIR="docs" # Documentation directory
```

## Infrastructure & DevContainer

### version.sh
Expand Down Expand Up @@ -358,7 +345,6 @@ Shared library functions used by multiple scripts:
| `devcontainer.sh` | DevContainer-specific utilities |
| `claude_plugins.sh` | Claude plugin management utilities |
| `brew_categories.py` | Homebrew package categorization |
| `docs-common.js` | Documentation generation utilities |

## Credential Providers (credentials/providers/)

Expand Down
74 changes: 0 additions & 74 deletions script/check-docs-sync.sh
View file
Open in desktop

This file was deleted.

103 changes: 0 additions & 103 deletions script/lib/docs-common.js
View file
Open in desktop

This file was deleted.

Empty file modified script/lib/output.sh
100644 → 100755
View file
Open in desktop
Empty file.
Loading
Loading