fix: dependabot-auto-merge を非 Dependabot PR でも Pass で終了するように修正

.devcontainer/codespaces/devcontainer.json

@@ -33,7 +33,8 @@
   "overrideCommand": true,
   "updateRemoteUserUID": false,
   "containerEnv": {
-    "CLAUDE_ENV_FILE": "/home/vscode/.devcontainer.env"
+    "CLAUDE_ENV_FILE": "/home/vscode/.devcontainer.env",
+    "CLAUDE_CODE_DISABLE_1M_CONTEXT": "1"
   },
   "remoteEnv": {
     "CLAUDE_CONFIG_DIR": "${containerWorkspaceFolder}/.claude-data"

.devcontainer/devcontainer.json

@@ -32,7 +32,8 @@
   "overrideCommand": true,
   "updateRemoteUserUID": false,
   "containerEnv": {
-    "CLAUDE_ENV_FILE": "/home/vscode/.devcontainer.env"
+    "CLAUDE_ENV_FILE": "/home/vscode/.devcontainer.env",
+    "CLAUDE_CODE_DISABLE_1M_CONTEXT": "1"
   },
   "mounts": [
     "source=${localEnv:HOME}/.cursor,target=/home/vscode/.cursor,type=bind,consistency=cached",

.github/workflows/dependabot-auto-merge.yml

@@ -25,20 +25,25 @@ concurrency:
 
 jobs:
   dependabot-auto:
-    if: github.actor == 'dependabot[bot]'
     runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
+      # Dependabot 以外の場合はスキップ（Pass で終了）
+      - name: Skip non-Dependabot PRs
+        if: github.actor != 'dependabot[bot]'
+        run: echo "Not a Dependabot PR — skipping auto-merge."
+
       # 更新種別を取得（patch / minor / major）
       - name: Fetch Dependabot metadata
+        if: github.actor == 'dependabot[bot]'
         id: metadata
         uses: dependabot/fetch-metadata@v2
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}
 
       # patch: 自動 squash マージ（CI パス後）
       - name: Auto-merge patch updates
-        if: steps.metadata.outputs.update-type == 'version-update:semver-patch'
+        if: github.actor == 'dependabot[bot]' && steps.metadata.outputs.update-type == 'version-update:semver-patch'
         run: |
           gh pr merge "$PR_URL" --auto --squash
         env:
@@ -47,7 +52,7 @@ jobs:
 
       # minor: 自動承認（マージは手動で判断）
       - name: Auto-approve minor updates
-        if: steps.metadata.outputs.update-type == 'version-update:semver-minor'
+        if: github.actor == 'dependabot[bot]' && steps.metadata.outputs.update-type == 'version-update:semver-minor'
         run: |
           gh pr review "$PR_URL" --approve --body "Auto-approved: minor version update"
         env:
@@ -56,7 +61,7 @@ jobs:
 
       # major: ラベル付与してレビュー必須
       - name: Label major updates for review
-        if: steps.metadata.outputs.update-type == 'version-update:semver-major'
+        if: github.actor == 'dependabot[bot]' && steps.metadata.outputs.update-type == 'version-update:semver-major'
         run: |
           gh pr edit "$PR_URL" --add-label "needs-review,breaking-change"
         env:

.trivyignore

@@ -78,3 +78,14 @@ CVE-2026-29786
 # Tracking: https://github.com/npm/cli/issues
 # Review date: 2026-04-09
 CVE-2026-27903
+
+# CVE-2026-33186: gRPC-Go authorization bypass via missing leading slash in :path
+# Severity: CRITICAL
+# Affected: google.golang.org/grpc v1.79.2 (usr/bin/gh), v1.75.1 (usr/local/bin/op)
+# Fixed in: 1.79.3
+# Reason: Vulnerability is in pre-built binaries (GitHub CLI and 1Password CLI);
+#   cannot upgrade grpc directly — waiting for upstream tool releases
+# Expected resolution: Wait for gh and op to release new builds with grpc >= 1.79.3
+# Tracking: https://github.com/cli/cli/releases (gh), https://github.com/1Password/onepassword-operator/releases (op)
+# Review date: 2026-04-21
+CVE-2026-33186