feat: pre-production/production ブランチ対応と strict 保護レベル追加 - #566
Conversation
環境ブランチ（pre-production, production）の作成・保護に対応するため、 setup-team-protection.sh に --protection-level strict オプションを追加し、 CI ワークフローのトリガー対象ブランチも拡張した。 Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
|
Caution Review failedThe pull request is closed. ℹ️ Recent review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (2)
📝 WalkthroughWalkthroughThis PR extends branch protection configuration and CI/security workflows to cover additional branches (pre-production and production) alongside main, while introducing a new protection level feature with strict mode that enforces additional security requirements like signed commits and stricter reviewer policies. Changes
Sequence Diagram(s)sequenceDiagram
actor User
participant Script as setup-team-protection.sh
participant GitHubAPI as GitHub API
participant Repo as Repository
User->>Script: Run with --protection-level strict
Script->>Script: Parse protection level argument
Script->>Script: Set variables (reviewers=2,<br/>enforce_admins=true,<br/>require_signed_commits=true, ...)
Script->>Script: Display protection level in confirmation
User->>Script: Confirm setup
Script->>GitHubAPI: POST branch protection config<br/>(require_signed_commits field)
GitHubAPI->>Repo: Apply standard protection
GitHubAPI-->>Script: Success response
Script->>GitHubAPI: POST required_signatures endpoint<br/>(enforce signed commits)
GitHubAPI->>Repo: Enable signed commit requirement
GitHubAPI-->>Script: Success/warning response
Script-->>User: Display final protection status
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~25 minutes Possibly related PRs
Poem
🚥 Pre-merge checks | ✅ 3✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches
🧪 Generate unit tests (beta)
📝 Coding Plan
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
🔍 AI Code Review (Local Hook)Models: Codex (default) / Gemini (default) 🤖 Codex Review指摘事項はありません。変更はドキュメント整形、ワークフローの対象ブランチ拡張、ブランチ保護スクリプトの保護レベル追加で、いずれも整合しています。新規パラメータやAPI呼び出しの構造も既存の保護設定フローに自然に組み込まれており、重大なリグレッションは見当たりません。 判定: patch is correct ✨ Gemini ReviewMCP server 'supabase' requires authentication using: /mcp auth supabaseMCP server 'vercel' requires authentication using: /mcp auth vercelご提示いただいたGit Diffのレビュー結果を報告します。 レビュー結果1. GitHub API リクエストボディのデータ型不整合ファイル: 2. CIワークフローのトリガー設定の不足（一貫性の欠如）ファイル: 3. JSON 構築方法の堅牢性ファイル: 判定: patch is incorrect 理由: 信頼度: 0.95
|
🔍 AI Code Review (Local Hook)Models: Codex (default) / Gemini (default) 🤖 Codex Review指摘事項なし。 全体判定: ✨ Gemini ReviewMCP server 'supabase' requires authentication using: /mcp auth supabaseMCP server 'vercel' requires authentication using: /mcp auth vercelご提示いただいたGit diffのレビュー結果を報告します。 指摘事項
判定: patch is incorrect 信頼度スコア: 0.92
|
コードレビュー全体的に有用な機能追加ですが、いくつか注意すべき点があります。 🔴 重大な懸念
|
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: e28c65c790
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| reviewers=2 | ||
| fi | ||
| enforce_admins=true | ||
| require_linear_history=true |
There was a problem hiding this comment.
When --protection-level strict is used, this enables linear-history enforcement, but the script still uses MERGE_METHOD="merge" by default in setup_repository_settings unless callers override it. In that default path, strict mode can make PRs effectively unmergeable (merge commits are the only allowed method while linear history forbids them), or cause API updates to fail depending on repository settings. Add a compatibility check or auto-select a linear-history-compatible merge method (squash/rebase) when strict mode is requested.
Useful? React with 👍 / 👎.
| local require_conversation_resolution=false | ||
| local require_signed_commits=false | ||
|
|
||
| if [[ "$PROTECTION_LEVEL" == "strict" ]]; then |
There was a problem hiding this comment.
Any value other than strict silently falls back to standard behavior because the script only special-cases strict and never validates the user input. A typo such as --protection-level strcit will complete successfully while applying weaker protection than intended, which is especially risky for production-branch hardening. Validate PROTECTION_LEVEL against allowed values and exit on invalid input.
Useful? React with 👍 / 👎.
| if [[ "$require_signed_commits" == "true" ]]; then | ||
| if gh api "repos/$REPO/branches/$branch/protection/required_signatures" \ |
There was a problem hiding this comment.
The script enables required signed commits with POST .../required_signatures in strict mode, but it never disables that requirement when strict mode is not selected. If a branch was previously configured as strict, rerunning with standard leaves signed commits enforced, so --protection-level standard is not idempotent and cannot restore the documented baseline. Add the corresponding disable call (DELETE .../required_signatures) when require_signed_commits is false.
Useful? React with 👍 / 👎.
- docker-image.yml を main のみに戻す（リリースWFの誤発火防止） - ci.yml の pull_request にも pre-production/production ブランチ追加 - protection-level の入力バリデーション追加 - strict + merge method "merge" の競合を自動解決（squash に切替） - GitHub API のオブジェクト形式を boolean 形式に修正 - standard モードで signed commits を無効化（冪等性確保） - zzzax-preview ヘッダーを application/vnd.github+json に修正 - dry-run で strict の実際の適用値を表示 Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
|
🎉 This PR is included in version 1.95.0 🎉 The release is available on GitHub release Your semantic-release bot 📦🚀 |
1 participant
Summary
setup-team-protection.shに--protection-level strictオプションを追加（最厳格なブランチ保護設定）pre-production,productionブランチを追加--protection-level strictで適用される設定使い方
Test plan
--dry-runで strict レベルの設定内容を確認--protection-level standardで既存動作に影響がないことを確認--protection-level strict --create-branchesでブランチ作成・保護が適用されることを確認🤖 Generated with Claude Code
Summary by CodeRabbit
New Features
Documentation