Skip to content

fix: required status checks を実際の CI ジョブ名に合わせる #581

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
keito4 merged 2 commits into from
Mar 15, 2026
Merged

fix: required status checks を実際の CI ジョブ名に合わせる #581

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
8a8ba80
fix: required status checks を実際の CI ジョブ名に合わせる
github-actions[bot] Mar 15, 2026
88f071d
fix: checkout 不要なワークフローをテストから除外
github-actions[bot] Mar 15, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
27 changes: 25 additions & 2 deletions .claude/commands/repo-maintenance.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -277,16 +277,39 @@ GitHub リポジトリの保護ルールを確認・設定：
実行内容:

- ブランチ保護ルールの確認
- 必須ステータスチェックの設定
- 必須ステータスチェックの設定（`Quality Gate` ジョブ）
- レビュー要件の設定
- Dependabot、脆弱性アラートの有効化
- Next.js プロジェクトの場合、`pre-production` / `production` ブランチの保護確認

これは `/setup-team-protection` コマンドと同等の処理を実行します。

**フレームワーク検出による保護ブランチの自動判定:**

```bash
# Next.js プロジェクトかどうかを検出
IS_NEXTJS=false
if [ -f "package.json" ]; then
if jq -e '.dependencies.next // .devDependencies.next' package.json &>/dev/null; then
IS_NEXTJS=true
fi
fi

# Next.js の場合は pre-production / production も保護対象
if [ "$IS_NEXTJS" = true ]; then
PROTECT_BRANCHES="main,pre-production,production"
PROTECTION_LEVEL="strict"
else
PROTECT_BRANCHES="main"
PROTECTION_LEVEL="standard"
fi
```
Comment on lines +287 to +306

@coderabbitai coderabbitai Bot Mar 15, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
# Check if setup-team-protection.sh reads PROTECT_BRANCHES or PROTECTION_LEVEL env vars
rg -n 'PROTECT_BRANCHES|:-\$\{?PROTECT|:-\$\{?PROTECTION_LEVEL' script/setup-team-protection.sh || echo "No env var reads found - confirms the issue"

Repository: keito4/config

Length of output: 100

🏁 Script executed:

rg -n '\-\-branches|\-\-protection-level' script/setup-team-protection.sh | head -20

Repository: keito4/config

Length of output: 277

Environment variables are not read by the target script.

The framework detection logic sets PROTECT_BRANCHES and PROTECTION_LEVEL as environment variables, but script/setup-team-protection.sh does not read these. The script only accepts --branches and --protection-level as CLI arguments (lines 64 and 80 of the script).

Either:

  1. Update this command doc to pass CLI arguments instead of setting env vars, or
  2. Update the script to fallback to environment variables
Option 1: Use CLI arguments (recommended) 
 # Next.js プロジェクトかどうかを検出
 IS_NEXTJS=false
 if [ -f "package.json" ]; then
   if jq -e '.dependencies.next // .devDependencies.next' package.json &>/dev/null; then
     IS_NEXTJS=true
   fi
 fi

 # Next.js の場合は pre-production / production も保護対象
 if [ "$IS_NEXTJS" = true ]; then
-  PROTECT_BRANCHES="main,pre-production,production"
-  PROTECTION_LEVEL="strict"
+  bash script/setup-team-protection.sh \
+    --branches main,pre-production,production \
+    --create-branches \
+    --protection-level strict
 else
-  PROTECT_BRANCHES="main"
-  PROTECTION_LEVEL="standard"
+  bash script/setup-team-protection.sh \
+    --branches main \
+    --protection-level standard
 fi
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
**フレームワーク検出による保護ブランチの自動判定:**
```bash
# Next.js プロジェクトかどうかを検出
IS_NEXTJS=false
if [ -f "package.json" ]; then
if jq -e '.dependencies.next // .devDependencies.next' package.json &>/dev/null; then
IS_NEXTJS=true
fi
fi
# Next.js の場合は pre-production / production も保護対象
if [ "$IS_NEXTJS" = true ]; then
PROTECT_BRANCHES="main,pre-production,production"
PROTECTION_LEVEL="strict"
else
PROTECT_BRANCHES="main"
PROTECTION_LEVEL="standard"
fi
```
# Next.js プロジェクトかどうかを検出
IS_NEXTJS=false
if [ -f "package.json" ]; then
if jq -e '.dependencies.next // .devDependencies.next' package.json &>/dev/null; then
IS_NEXTJS=true
fi
fi
# Next.js の場合は pre-production / production も保護対象
if [ "$IS_NEXTJS" = true ]; then
bash script/setup-team-protection.sh \
--branches main,pre-production,production \
--create-branches \
--protection-level strict
else
bash script/setup-team-protection.sh \
--branches main \
--protection-level standard
fi
🤖 Prompt for AI Agents 
Verify each finding against the current code and only fix it if needed.

In @.claude/commands/repo-maintenance.md around lines 287 - 306, The doc's
framework-detection sets PROTECT_BRANCHES/PROTECTION_LEVEL but the target script
script/setup-team-protection.sh expects CLI args --branches and
--protection-level; update the example to invoke that script and pass the
computed values as CLI arguments (use the IS_NEXTJS logic to compute values,
then call script/setup-team-protection.sh with --branches set to the
PROTECT_BRANCHES value and --protection-level set to the PROTECTION_LEVEL
value), or alternatively modify script/setup-team-protection.sh to accept
fallback environment variables PROTECT_BRANCHES and PROTECTION_LEVEL when those
CLI flags are not provided.


結果:

- ✅ 保護ルール設定済み
- ⚠️ 未設定の保護ルールあり（詳細をリスト）
- ⚠️ Next.js プロジェクト: `pre-production` / `production` ブランチ未保護 → strict レベルで保護を提案
- 🔧 設定を適用

### 3.2 Husky Setup Check
Expand Down Expand Up @@ -567,7 +590,7 @@ CI/CD ワークフローの設定状況を確認：
実行内容:

- GitHub Actions ワークフローの存在確認
- 必須ジョブ（lint, test, build）の確認
- 必須ジョブ（Quality Gate による全チェック集約）の確認
- セキュリティスキャンの設定確認
- Claude Code Review の統合確認

Expand Down
20 changes: 17 additions & 3 deletions .claude/commands/setup-team-protection.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -82,7 +82,7 @@ bash script/setup-team-protection.sh --dry-run
gh api repos/{owner}/{repo}/branches/main/protection \
--method PUT \
--field required_status_checks[strict]=true \
--field required_status_checks[contexts][]=CI \
--field required_status_checks[contexts][]="Quality Gate" \
--field required_pull_request_reviews[required_approving_review_count]=1 \
--field required_pull_request_reviews[dismiss_stale_reviews]=true \
--field required_pull_request_reviews[require_code_owner_reviews]=false \
Expand All @@ -95,8 +95,8 @@ gh api repos/{owner}/{repo}/branches/main/protection \

**必須ステータスチェック**

以下のワークフローが必須:
• CI（テスト、リント、ビルド）
以下のチェックが必須:
• Quality Gate（CI ワークフローの全ジョブ結果を集約するゲートジョブ）
• セキュリティスキャン（オプション）

**レビュー要件**
Expand Down Expand Up @@ -241,6 +241,20 @@ Error: Branch not found
3. main ブランチに適用
4. 必要に応じて厳格化

**フレームワーク別の推奨ブランチ保護**

• Next.js / Vercel プロジェクト:
`main`, `pre-production`, `production` の3ブランチを保護（strict レベル推奨）

```bash
bash script/setup-team-protection.sh \
--branches main,pre-production,production \
--create-branches \
--protection-level strict
```

• それ以外のプロジェクト: `main` のみ（デフォルト）

**チームサイズに応じた設定**

• 小規模チーム（2-5名）: レビュー1名
Expand Down
4 changes: 3 additions & 1 deletion script/setup-team-protection.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -232,7 +232,9 @@ setup_branch_protection() {

if [[ "$SKIP_STATUS_CHECKS" == "false" ]]; then
protection_config+='"strict":true,'
protection_config+='"contexts":["CI"]'
# CI workflow の Quality Gate ジョブが全チェックを集約するため、
# 単一の required check として使用する
protection_config+='"contexts":["Quality Gate"]'
else
protection_config+='"strict":false,'
protection_config+='"contexts":[]'
Expand Down
8 changes: 7 additions & 1 deletion test/integration/workflows.bats
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -113,9 +113,15 @@ load ../test_helper/test_helper

@test "all workflows use checkout action" {
local workflows_dir="${REPO_ROOT}/.github/workflows"
# Workflows that don't need checkout (no source code access required)
local skip_patterns="dependabot-auto-merge|release-drafter"

for workflow in "$workflows_dir"/*.yml; do
# Every workflow should checkout the repository
local basename
basename=$(basename "$workflow")
if echo "$basename" | grep -qE "$skip_patterns"; then
continue
fi
if grep -q "^jobs:" "$workflow"; then
grep -q "actions/checkout@" "$workflow"
fi
Expand Down
Loading