From 25236352af1f6b59dcec69aa09d7900b04a6ddc4 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" Date: Sat, 21 Mar 2026 07:33:33 +0900 Subject: [PATCH 1/3] =?UTF-8?q?fix:=20dependabot-auto-merge=20=E3=82=92?= =?UTF-8?q?=E9=9D=9E=20Dependabot=20PR=20=E3=81=A7=E3=82=82=20Pass=20?= =?UTF-8?q?=E3=81=A7=E7=B5=82=E4=BA=86=E3=81=99=E3=82=8B=E3=82=88=E3=81=86?= =?UTF-8?q?=E3=81=AB=E4=BF=AE=E6=AD=A3?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit ジョブレベルの `if` 条件を削除し、ステップレベルのガードに変更。 非 Dependabot PR ではステップがスキップされるだけでジョブは Pass となり、 Required Status Check としてブロックしなくなる。 Co-Authored-By: Claude Opus 4.6 (1M context) --- .github/workflows/dependabot-auto-merge.yml | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-) diff --git a/.github/workflows/dependabot-auto-merge.yml b/.github/workflows/dependabot-auto-merge.yml index 589baea0..3db62c48 100644 --- a/.github/workflows/dependabot-auto-merge.yml +++ b/.github/workflows/dependabot-auto-merge.yml @@ -25,12 +25,17 @@ concurrency: jobs: dependabot-auto: - if: github.actor == 'dependabot[bot]' runs-on: ubuntu-latest timeout-minutes: 10 steps: + # Dependabot 以外の場合はスキップ（Pass で終了） + - name: Skip non-Dependabot PRs + if: github.actor != 'dependabot[bot]' + run: echo "Not a Dependabot PR — skipping auto-merge." + # 更新種別を取得（patch / minor / major） - name: Fetch Dependabot metadata + if: github.actor == 'dependabot[bot]' id: metadata uses: dependabot/fetch-metadata@v2 with: @@ -38,7 +43,7 @@ jobs: # patch: 自動 squash マージ（CI パス後） - name: Auto-merge patch updates - if: steps.metadata.outputs.update-type == 'version-update:semver-patch' + if: github.actor == 'dependabot[bot]' && steps.metadata.outputs.update-type == 'version-update:semver-patch' run: | gh pr merge "$PR_URL" --auto --squash env: @@ -47,7 +52,7 @@ jobs: # minor: 自動承認（マージは手動で判断） - name: Auto-approve minor updates - if: steps.metadata.outputs.update-type == 'version-update:semver-minor' + if: github.actor == 'dependabot[bot]' && steps.metadata.outputs.update-type == 'version-update:semver-minor' run: | gh pr review "$PR_URL" --approve --body "Auto-approved: minor version update" env: @@ -56,7 +61,7 @@ jobs: # major: ラベル付与してレビュー必須 - name: Label major updates for review - if: steps.metadata.outputs.update-type == 'version-update:semver-major' + if: github.actor == 'dependabot[bot]' && steps.metadata.outputs.update-type == 'version-update:semver-major' run: | gh pr edit "$PR_URL" --add-label "needs-review,breaking-change" env: From 9975353af35ace503cbb5a0be783eb7844000682 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" Date: Sat, 21 Mar 2026 07:40:12 +0900 Subject: [PATCH 2/3] =?UTF-8?q?feat:=20DevContainer=20=E3=81=AB=20CLAUDE?= =?UTF-8?q?=5FCODE=5FDISABLE=5F1M=5FCONTEXT=3D1=20=E3=82=92=E8=BF=BD?= =?UTF-8?q?=E5=8A=A0?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit ローカル・Codespaces 両方の devcontainer.json の containerEnv に CLAUDE_CODE_DISABLE_1M_CONTEXT=1 を設定。 Co-Authored-By: Claude Opus 4.6 (1M context) --- .devcontainer/codespaces/devcontainer.json | 3 ++- .devcontainer/devcontainer.json | 3 ++- 2 files changed, 4 insertions(+), 2 deletions(-) diff --git a/.devcontainer/codespaces/devcontainer.json b/.devcontainer/codespaces/devcontainer.json index bc335b0f..f7974590 100644 --- a/.devcontainer/codespaces/devcontainer.json +++ b/.devcontainer/codespaces/devcontainer.json @@ -33,7 +33,8 @@ "overrideCommand": true, "updateRemoteUserUID": false, "containerEnv": { - "CLAUDE_ENV_FILE": "/home/vscode/.devcontainer.env" + "CLAUDE_ENV_FILE": "/home/vscode/.devcontainer.env", + "CLAUDE_CODE_DISABLE_1M_CONTEXT": "1" }, "remoteEnv": { "CLAUDE_CONFIG_DIR": "${containerWorkspaceFolder}/.claude-data" diff --git a/.devcontainer/devcontainer.json b/.devcontainer/devcontainer.json index 846c9964..9c91fb82 100644 --- a/.devcontainer/devcontainer.json +++ b/.devcontainer/devcontainer.json @@ -32,7 +32,8 @@ "overrideCommand": true, "updateRemoteUserUID": false, "containerEnv": { - "CLAUDE_ENV_FILE": "/home/vscode/.devcontainer.env" + "CLAUDE_ENV_FILE": "/home/vscode/.devcontainer.env", + "CLAUDE_CODE_DISABLE_1M_CONTEXT": "1" }, "mounts": [ "source=${localEnv:HOME}/.cursor,target=/home/vscode/.cursor,type=bind,consistency=cached", From 5c9139f0db58222cc8be4192737ab563bc5654b3 Mon Sep 17 00:00:00 2001 From: "claude[bot]" <41898282+claude[bot]@users.noreply.github.com> Date: Sat, 21 Mar 2026 00:05:26 +0000 Subject: [PATCH 3/3] =?UTF-8?q?fix:=20CVE-2026-33186=20=E3=82=92=20.trivyi?= =?UTF-8?q?gnore=20=E3=81=AB=E8=BF=BD=E5=8A=A0=E3=81=97=E3=81=A6=E3=82=BB?= =?UTF-8?q?=E3=82=AD=E3=83=A5=E3=83=AA=E3=83=86=E3=82=A3=E3=82=B9=E3=82=AD?= =?UTF-8?q?=E3=83=A3=E3=83=B3=E3=82=92=E4=BF=AE=E6=AD=A3?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit gh および op バイナリの google.golang.org/grpc に CRITICAL 脆弱性 (CVE-2026-33186) が検出されたため .trivyignore に追記。 いずれもプリビルドバイナリ内の依存関係であり upstream のリリースを待つ必要がある。 Co-authored-by: keito4 --- .trivyignore | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/.trivyignore b/.trivyignore index 751a3a7c..4cc81f93 100644 --- a/.trivyignore +++ b/.trivyignore @@ -78,3 +78,14 @@ CVE-2026-29786 # Tracking: https://github.com/npm/cli/issues # Review date: 2026-04-09 CVE-2026-27903 + +# CVE-2026-33186: gRPC-Go authorization bypass via missing leading slash in :path +# Severity: CRITICAL +# Affected: google.golang.org/grpc v1.79.2 (usr/bin/gh), v1.75.1 (usr/local/bin/op) +# Fixed in: 1.79.3 +# Reason: Vulnerability is in pre-built binaries (GitHub CLI and 1Password CLI); +# cannot upgrade grpc directly — waiting for upstream tool releases +# Expected resolution: Wait for gh and op to release new builds with grpc >= 1.79.3 +# Tracking: https://github.com/cli/cli/releases (gh), https://github.com/1Password/onepassword-operator/releases (op) +# Review date: 2026-04-21 +CVE-2026-33186