fix: repo-maintenance 定期メンテナンス 2026-03-15 by keito4 · Pull Request #578 · keito4/config

keito4 · 2026-03-15T09:59:15Z

Summary

GitHub Actions を最新版に更新（setup-node v6.3.0, sbom-action v0.23.1, slack v3.0.1）
CLAUDE.md を AGENTS.md へのシンボリックリンクに変換
Label Sync ワークフロー + 標準ラベル定義を config リポジトリに適用
Release Drafter ワークフロー + 設定を適用
Dependabot Auto-merge ワークフローを適用
マージ済みブランチ 17件を削除

Test plan

全テスト (101) パス
Format / Lint パス
CI パス確認

🤖 Generated with Claude Code

Summary by CodeRabbit

New Features
- Added automated GitHub label synchronization from standardized configuration.
- Introduced intelligent Dependabot update automation: auto-merges patches, auto-approves minors, flags majors for review.
- Added automated release notes generation with semantic versioning support.
Chores
- Updated GitHub Actions and external action dependencies across multiple workflows.

- GitHub Actions を最新に更新（setup-node v6.3.0, sbom-action v0.23.1, slack v3.0.1） - CLAUDE.md を AGENTS.md へのシンボリックリンクに変換 - Label Sync ワークフロー + labels.yml を適用 - Release Drafter ワークフロー + 設定を適用 - Dependabot Auto-merge ワークフローを適用 - マージ済みブランチ 17件を削除 Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

coderabbitai · 2026-03-15T09:59:28Z

Caution

Review failed

Pull request was closed or merged during review

📝 Walkthrough

Walkthrough

This PR introduces GitHub repository automation and configuration standards, including label definitions, release notes automation, and dependency management workflows. Additionally, it performs widespread version updates across GitHub Actions workflows and adds a new documentation file.

Changes

Cohort / File(s)	Summary
GitHub Configuration `.github/labels.yml`, `.github/release-drafter.yml`	New configuration files: standardized label definitions (Priority, Type, Status, Dependency, CI/CD) and release notes automation config with version resolution rules and changelog templating.
Automation Workflows (New) `.github/workflows/dependabot-auto-merge.yml`, `.github/workflows/label-sync.yml`, `.github/workflows/release-drafter.yml`	New GitHub Actions workflows: dependabot auto-merge with semantic versioning-based branching (patch/minor/major), label synchronization, and automated release note generation.
Action Version Updates: setup-node `.github/workflows/ci.yml`, `.github/workflows/docker-image.yml`, `.github/workflows/manual-release.yml`, `.github/workflows/rebuild-docker-cache.yml`, `.github/workflows/security.yml`, `.github/workflows/templates/...`	Consistent version bump of actions/setup-node from v6.2.0 to v6.3.0 across 10+ workflow files and templates.
Other Action Updates `.github/workflows/container-security.yml`, `.github/workflows/coverage-report.yml`	Version bumps: anchore/sbom-action v0.23.0→v0.23.1; actions/download-artifact v8.0.0→v8.0.1; sticky-pull-request-comment v2.9.4→v3.0.2.
Documentation `AGENTS.md`	New documentation file added (placeholder/metadata).

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

Possibly related PRs

fix: Actions バージョンピンニングと自動更新パイプライン修正 #477: Updates GitHub Actions workflow action versions (setup-node, SBOM, Trivy) across multiple workflow files, similar to this PR's version bump strategy.
docs: ドキュメントを最新状態に更新 #155: Modifies AGENTS.md documentation; this PR introduces the same file.
fix: GitHub Actions のバージョンを更新 #517: Updates GitHub Actions workflow action versions (artifact upload/download, SBOM anchore) across workflow files, overlapping with this PR's version bump scope.

Suggested labels

released

Poem

🐰 New labels bloom, workflows dance with grace,
Release notes draft themselves in cyberspace,
Dependabot steps sync to a gentle beat,
Configuration standards make the setup complete! 🎯

🚥 Pre-merge checks | ✅ 2 | ❌ 1

❌ Failed checks (1 inconclusive)

Check name	Status	Explanation	Resolution
Title check	❓ Inconclusive	The title uses a mix of English and Japanese with a date suffix, making it vague about the primary change. While it indicates maintenance work, it doesn't clearly specify which type of maintenance or the main objective.	Revise the title to be more specific in English, such as 'fix: update GitHub Actions and add release automation workflows' to clearly communicate the primary changes to reviewers.

✅ Passed checks (2 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests
Post copyable unit tests in a comment
Commit unit tests in branch chore/maintenance-20260315

📝 Coding Plan

Generate coding plan for human review comments

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

claude · 2026-03-15T10:01:17Z

Claude Code レビュー

全体評価

定期メンテナンスとして適切な内容です。Actions のバージョン更新は一貫しており、新規ワークフローも基本的な構造は整っています。ただし、いくつか修正を推奨する点があります。

🔴 要対応

1. `release-drafter.yml` の権限不足

permissions:
  contents: read      # ← write が必要
  pull-requests: write

Release Drafter はドラフトリリースを作成・更新するため contents: write が必要です。現状では main へのプッシュ時にリリースドラフト更新が失敗します。

修正案:

permissions:
  contents: write
  pull-requests: write

2. `label-sync.yml` の Actions バージョンが他と不一致

- uses: actions/checkout@v4   # ← リポジトリ全体が v6.0.2 を使用

他のすべてのワークフローは actions/checkout@v6.0.2 を使用しています。統一してください。

🟡 推奨改善

3. `dependabot-auto-merge.yml` の `pull_request_target` セキュリティ考慮

pull_request_target はフォークからのコードにアクセス可能なため、セキュリティリスクがあります。このワークフローは github.actor == 'dependabot[bot]' でガードしており、actions/checkout を使っていないため現状では問題ないですが、将来的なステップ追加時に注意が必要です。コメントで明示的に注意書きを残すことを推奨します。

4. サードパーティ Actions がバージョンタグのみでピニングされていない

以下の Actions は SHA ピニングされておらず、タグの書き換えリスクがあります:

Action	現在	推奨
`EndBug/label-sync@v2`	タグのみ	SHAピニング
`release-drafter/release-drafter@v6`	タグのみ	SHAピニング
`dependabot/fetch-metadata@v2`	タグのみ	SHAピニング

セキュリティ要件が高い場合は SHA ピニングを検討してください。

5. `release-drafter.yml` の `concurrency` 設定

concurrency:
  group: ${{ github.workflow }}
  cancel-in-progress: true

main への連続プッシュ時に前のドラフト更新がキャンセルされる可能性があります。Release Drafter はべき等なため実害は少ないですが、cancel-in-progress: false の方が安全です。

6. `slackapi/slack-github-action` のメジャーバージョンアップ (v2→v3)

v3.0.1 は v2.x から破壊的変更があります。ci.yml の payload-template-file-path が v3 API と互換性があることを確認してください。CI 失敗通知が正常に動作するか、本番 main ブランチでのテストを推奨します。

✅ 良い点

timeout-minutes がすべての新規ジョブに設定されている
concurrency グループが適切に設定されている
Dependabot の更新種別 (patch/minor/major) に応じた段階的な自動化は合理的な設計
delete-other-labels: false で既存ラベルを保護している安全な選択

まとめ

release-drafter.yml の contents: write 不足（#1）と label-sync.yml の checkout バージョン不一致（#2）は CI 実行時に問題が発生するため、マージ前に修正を推奨します。

🤖 Reviewed by Claude Code

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 855fac4943

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector · 2026-03-15T10:02:27Z

+permissions:
+  contents: read
+  pull-requests: write


Grant contents write to Release Drafter job

The workflow is triggered on push to main, but it only grants contents: read; in that mode release-drafter/release-drafter@v6 cannot create or update the draft release and will fail with permission errors on every main-branch push. This breaks automated release-note drafting until contents is elevated to write (either at workflow or job scope).

Useful? React with 👍 / 👎.

github-actions · 2026-03-15T10:28:09Z

🎉 This PR is included in version 1.96.1 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀

keito4 merged commit 5535d05 into main Mar 15, 2026
15 of 16 checks passed

chatgpt-codex-connector Bot reviewed Mar 15, 2026

View reviewed changes

github-actions Bot added the released リリース済み label Mar 15, 2026

This was referenced Mar 20, 2026

feat: repo-maintenance に推奨ファイル同期ステップを追加 #597

Merged

fix: Release Drafter を削除 #598

Merged

fix: dependabot-auto-merge を非 Dependabot PR でも Pass で終了するように修正 #600

Merged

coderabbitai Bot mentioned this pull request May 7, 2026

fix: dependabot auto-merge のマージ方法を --merge に統一 #718

Merged

2 tasks

coderabbitai Bot mentioned this pull request May 20, 2026

fix: harden reusable CI workflows #756

Merged

This was referenced Jun 17, 2026

fix: harden repo maintenance workflows #833

Merged

docs: ドキュメント最新化 (#863) #864

Merged

Navigation Menu

fix: repo-maintenance 定期メンテナンス 2026-03-15 - #578

fix: repo-maintenance 定期メンテナンス 2026-03-15#578
keito4 merged 1 commit into
mainfrom
chore/maintenance-20260315

keito4 commented Mar 15, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

coderabbitai Bot commented Mar 15, 2026 •

edited

Loading

Review failed

Walkthrough

Changes

Estimated code review effort

Possibly related PRs

Suggested labels

Poem

❌ Failed checks (1 inconclusive)

Uh oh!

Uh oh!

claude Bot commented Mar 15, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Uh oh!

chatgpt-codex-connector Bot Mar 15, 2026

Uh oh!

github-actions Bot commented Mar 15, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

keito4 commented Mar 15, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Test plan

Summary by CodeRabbit

Uh oh!

coderabbitai Bot commented Mar 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review failed

Walkthrough

Changes

Estimated code review effort

Possibly related PRs

Suggested labels

Poem

❌ Failed checks (1 inconclusive)

Uh oh!

Uh oh!

claude Bot commented Mar 15, 2026

Claude Code レビュー

全体評価

🔴 要対応

1. release-drafter.yml の権限不足

2. label-sync.yml の Actions バージョンが他と不一致

🟡 推奨改善

3. dependabot-auto-merge.yml の pull_request_target セキュリティ考慮

4. サードパーティ Actions がバージョンタグのみでピニングされていない

5. release-drafter.yml の concurrency 設定

6. slackapi/slack-github-action のメジャーバージョンアップ (v2→v3)

✅ 良い点

まとめ

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

chatgpt-codex-connector Bot Mar 15, 2026

Choose a reason for hiding this comment

Uh oh!

github-actions Bot commented Mar 15, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

keito4 commented Mar 15, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented Mar 15, 2026 •

edited

Loading

1. `release-drafter.yml` の権限不足

2. `label-sync.yml` の Actions バージョンが他と不一致

3. `dependabot-auto-merge.yml` の `pull_request_target` セキュリティ考慮

5. `release-drafter.yml` の `concurrency` 設定

6. `slackapi/slack-github-action` のメジャーバージョンアップ (v2→v3)