feat: repo-maintenance に CI 統一チェックを追加 - #603
Conversation
Step 3.5 の後に 3 つの CI 統一チェックを追加: 1. 3.5.1 CI Template Sync Check - templates/workflows/ と .github/workflows/ の差分検出 - 乖離時は diff 表示と同期提案 2. 3.5.2 CI Consistency Check - Node.js バージョン整合性（.node-version vs ワークフロー） - Actions バージョン統一（同一アクションの複数バージョン検出） - Runner バージョン一貫性 3. 3.5.3 CI Template Deployment Check - 再利用可能ワークフローの定義チェック - テンプレート内のハードコードされたリポジトリ名検出 Summary Report と Related Commands にも反映済み。 Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
|
Caution Review failedThe pull request is closed. ℹ️ Recent review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (3)
📝 WalkthroughWalkthroughAdded CI/CD validation and template-sync procedures: new workflow to detect fallback CI runs, updates to Dependabot and label-sync templates, and expanded repo-maintenance documentation with template synchronization, version/consistency checks, and deployment guidance. Changes
Sequence Diagram(s)(omitted) Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes Possibly related PRs
Suggested labels
Poem
🚥 Pre-merge checks | ✅ 3✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
🔍 AI Code Review (Local Hook)Models: Codex (default) / Gemini (default) 🤖 Codex Review指摘事項（重大度順）
総合判定: patch is incorrect
|
🔍 AI Code Review (Local Hook)Models: Codex (default) / Gemini (default) 🤖 Codex Review指摘なし。ドキュメント追加のみで、正確性・性能・セキュリティ・保守性・開発者体験に影響するアクション可能な問題は見当たりませんでした。 判定: patch is correct。理由: 変更は運用手順の追記で、内容に明確な誤りやリスク増加が見当たらないため。信頼度: 0.68 🤖 Generated by post_pr_ai_review.py hook |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 8cedc17853
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| if [ "$v" != "$NODE_FILE_VER" ] && [ "$v" != "$(cat .node-version)" ]; then | ||
| echo "MISMATCH: workflow uses node $v, .node-version is $(cat .node-version)" |
There was a problem hiding this comment.
.node-version is missing
The mismatch condition calls $(cat .node-version) inside the loop without a file-existence guard. In repositories that set node-version in workflows but do not track a .node-version file, this emits No such file errors and flags every workflow version as mismatched, so the consistency check becomes false-positive noise. Gate this logic on -f .node-version (or compute one fallback value once) before iterating.
Useful? React with 👍 / 👎.
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In @.claude/commands/repo-maintenance.md:
- Around line 743-748: Add a validation block that verifies
"ジョブ名・ステータスチェック名の一貫性" by cross-checking workflow job IDs against branch
protection required status check contexts: enumerate job IDs from parsed
workflows and compare them to the strings in required_status_checks.contexts,
flagging any contexts that don't match an existing workflow job ID (and vice
versa). Integrate this into the existing validation routine that performs
Node.js/Actions/Runner checks so it runs alongside those checks, and surface
clear error messages referencing the mismatched context and the workflow
file/job id (e.g., mention "Quality Gate" if present) so maintainers can correct
either the workflow job name or branch protection setting.
- Around line 710-720: Enable bash nullglob before any glob-based loops/greps
and disable it afterward to avoid literal unmatched-glob strings; specifically,
add shopt -s nullglob before the loop that starts with "for f in
templates/workflows/*.yml; do" (and before the code that greps
.github/workflows/templates/) so empty directories produce no matches instead of
literal patterns, and restore the original state with shopt -u nullglob (or
save/restore with shopt -p) after those blocks.
- Around line 754-760: Normalize the node versions before comparing: read and
trim .node-version into NODE_FILE_VER (remove leading "v" and surrounding
whitespace), normalize each value in WORKFLOW_VERS the same way (strip any
leading "v" prefix and whitespace) in the extraction pipeline that builds
WORKFLOW_VERS, and then use those normalized values in the loop that checks for
mismatches (the for v in $WORKFLOW_VERS loop and the comparison against
NODE_FILE_VER and $(cat .node-version)). Ensure both sides of the comparison use
the same normalization logic so prefixes like "v" or trailing spaces won't
trigger false mismatches.
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: e3416f3e-0dfb-4a82-98b3-568ee8a68dff
📒 Files selected for processing (1)
.claude/commands/repo-maintenance.md
| for f in templates/workflows/*.yml; do | ||
| base=$(basename "$f") | ||
| actual=".github/workflows/$base" | ||
| if [ -f "$actual" ]; then | ||
| if ! diff -q "$f" "$actual" > /dev/null 2>&1; then | ||
| echo "DIFF: $base — テンプレートと実ファイルが乖離" | ||
| fi | ||
| else | ||
| echo "MISS: $base — テンプレートはあるがワークフロー未配置" | ||
| fi | ||
| done |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Verify whether unmatched globs are handled before loops
rg -n -C2 'for f in (templates/workflows/\*\.yml|\.github/workflows/templates/\*\.yml)' .claude/commands/repo-maintenance.md
rg -n -C2 'nullglob' .claude/commands/repo-maintenance.mdRepository: keito4/config
Length of output: 430
🏁 Script executed:
#!/bin/bash
# Verify the exact content at the specified line ranges
sed -n '705,725p' .claude/commands/repo-maintenance.md
echo "---"
sed -n '800,815p' .claude/commands/repo-maintenance.mdRepository: keito4/config
Length of output: 866
🏁 Script executed:
#!/bin/bash
# Check if the directories referenced in the globs actually exist
ls -la templates/workflows/ 2>&1 | head -20
echo "---"
ls -la .github/workflows/templates/ 2>&1 | head -20Repository: keito4/config
Length of output: 959
Add nullglob to handle empty template directories safely.
Without shopt -s nullglob, unmatched glob patterns expand to literal strings (templates/workflows/*.yml), causing:
- Line 710-720: Silent misdetection if
templates/workflows/is empty - Line 804-808: Grep errors if
.github/workflows/templates/is empty
Directories currently exist with files, but the code lacks resilience to future emptying or misconfiguration.
🔧 Suggested fix
+shopt -s nullglob
+
for f in templates/workflows/*.yml; do
base=$(basename "$f")
actual=".github/workflows/$base"
@@ -716,0 +720,2 @@
done
+
+shopt -u nullglobAlso applies to: 804–808
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In @.claude/commands/repo-maintenance.md around lines 710 - 720, Enable bash
nullglob before any glob-based loops/greps and disable it afterward to avoid
literal unmatched-glob strings; specifically, add shopt -s nullglob before the
loop that starts with "for f in templates/workflows/*.yml; do" (and before the
code that greps .github/workflows/templates/) so empty directories produce no
matches instead of literal patterns, and restore the original state with shopt
-u nullglob (or save/restore with shopt -p) after those blocks.
| | # | チェック | 確認方法 | 推奨 | | ||
| | --- | -------------------------------------- | --------------------------------------------------------------------------- | ------------------------------ | | ||
| | 1 | Node.js バージョン統一 | `grep -rh 'node-version' .github/workflows/*.yml` と `.node-version` を比較 | `.node-version` の値と一致 | | ||
| | 2 | Actions バージョン統一 | 同一アクションのバージョンがワークフロー間で一致しているか | 全ワークフローで同一バージョン | | ||
| | 3 | ジョブ名・ステータスチェック名の一貫性 | Required Status Checks に使われるジョブ名が正しいか | `Quality Gate` 等の統一名 | | ||
| | 4 | Runner バージョン | `runs-on` の値がワークフロー間で一貫しているか | `ubuntu-latest` に統一 | |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Verify that a concrete check exists for required status checks / job-name consistency
rg -n -C3 'ジョブ名・ステータスチェック名|Required Status Checks|Quality Gate' .claude/commands/repo-maintenance.md
rg -n -C3 'branch protection|required_status_checks|contexts|jobs:' .claude/commands/repo-maintenance.mdRepository: keito4/config
Length of output: 1909
🏁 Script executed:
sed -n '750,779p' .claude/commands/repo-maintenance.mdRepository: keito4/config
Length of output: 1084
The documented check for job/status check name consistency (line 747) has no corresponding implementation in the validation script.
The confirmation logic (lines 750–779) includes checks for Node.js versions, Actions versions, and Runner versions, but completely omits validation for the job name/status check consistency documented in line 747 (ジョブ名・ステータスチェック名の一貫性). This creates a false confidence that all four checks are being performed when only three are actually implemented.
Add a validation block to verify that job names used in Required Status Checks are consistent with workflow job IDs.
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In @.claude/commands/repo-maintenance.md around lines 743 - 748, Add a
validation block that verifies "ジョブ名・ステータスチェック名の一貫性" by cross-checking workflow
job IDs against branch protection required status check contexts: enumerate job
IDs from parsed workflows and compare them to the strings in
required_status_checks.contexts, flagging any contexts that don't match an
existing workflow job ID (and vice versa). Integrate this into the existing
validation routine that performs Node.js/Actions/Runner checks so it runs
alongside those checks, and surface clear error messages referencing the
mismatched context and the workflow file/job id (e.g., mention "Quality Gate" if
present) so maintainers can correct either the workflow job name or branch
protection setting.
| NODE_FILE_VER=$(cat .node-version 2>/dev/null | cut -d. -f1) | ||
| WORKFLOW_VERS=$(grep -rh 'node-version' .github/workflows/*.yml \ | ||
| | sed "s/.*node-version[: ]*['\"]*//" | sed "s/['\"].*//" | sort -u) | ||
| for v in $WORKFLOW_VERS; do | ||
| if [ "$v" != "$NODE_FILE_VER" ] && [ "$v" != "$(cat .node-version)" ]; then | ||
| echo "MISMATCH: workflow uses node $v, .node-version is $(cat .node-version)" | ||
| fi |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Verify current parsing logic and likely mismatch-prone patterns
rg -n -C2 'NODE_FILE_VER|WORKFLOW_VERS|node-version' .claude/commands/repo-maintenance.mdRepository: keito4/config
Length of output: 1229
🏁 Script executed:
cat .node-versionRepository: keito4/config
Length of output: 64
🏁 Script executed:
find .github/workflows -name "*.yml" -o -name "*.yaml" | head -20Repository: keito4/config
Length of output: 805
🏁 Script executed:
grep -rh 'node-version' .github/workflows/ 2>/dev/null | head -20Repository: keito4/config
Length of output: 658
🏁 Script executed:
grep -rh 'node-version' .github/workflows/*.yml | head -30Repository: keito4/config
Length of output: 490
🏁 Script executed:
grep -rh 'node-version' .github/workflows/*.yml | \
sed "s/.*node-version[: ]*['\"]*//" | sed "s/['\"].*//" | sort -uRepository: keito4/config
Length of output: 60
🏁 Script executed:
grep -rh 'node-version' .github/workflows/ | grep -E "v[0-9]|'v" | head -10Repository: keito4/config
Length of output: 39
🏁 Script executed:
cat .github/workflows/ci.yml | grep -A2 -B2 'node-version'Repository: keito4/config
Length of output: 419
Normalize Node version values before comparison.
Current comparison can mis-detect when .node-version contains formats like v22.14.0 or trailing spaces. While the current file uses a clean format (22.22.0), the parsing logic extracts only the first version segment and doesn't account for prefixes or whitespace, which could cause false positives if the file format changes.
🔧 Suggested fix
-NODE_FILE_VER=$(cat .node-version 2>/dev/null | cut -d. -f1)
+NODE_FILE_RAW=$(tr -d '[:space:]' < .node-version 2>/dev/null)
+NODE_FILE_VER=$(echo "$NODE_FILE_RAW" | sed -E 's/^v//' | cut -d. -f1)
@@
-for v in $WORKFLOW_VERS; do
- if [ "$v" != "$NODE_FILE_VER" ] && [ "$v" != "$(cat .node-version)" ]; then
- echo "MISMATCH: workflow uses node $v, .node-version is $(cat .node-version)"
+for v in $WORKFLOW_VERS; do
+ WV=$(echo "$v" | tr -d '[:space:]' | sed -E "s/^['\"]|['\"]$//g; s/^v//" | cut -d. -f1)
+ if [ -n "$NODE_FILE_VER" ] && [ "$WV" != "$NODE_FILE_VER" ]; then
+ echo "MISMATCH: workflow uses node $v, .node-version is $NODE_FILE_RAW"
fi
done📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| NODE_FILE_VER=$(cat .node-version 2>/dev/null | cut -d. -f1) | |
| WORKFLOW_VERS=$(grep -rh 'node-version' .github/workflows/*.yml \ | |
| | sed "s/.*node-version[: ]*['\"]*//" | sed "s/['\"].*//" | sort -u) | |
| for v in $WORKFLOW_VERS; do | |
| if [ "$v" != "$NODE_FILE_VER" ] && [ "$v" != "$(cat .node-version)" ]; then | |
| echo "MISMATCH: workflow uses node $v, .node-version is $(cat .node-version)" | |
| fi | |
| NODE_FILE_RAW=$(tr -d '[:space:]' < .node-version 2>/dev/null) | |
| NODE_FILE_VER=$(echo "$NODE_FILE_RAW" | sed -E 's/^v//' | cut -d. -f1) | |
| WORKFLOW_VERS=$(grep -rh 'node-version' .github/workflows/*.yml \ | |
| | sed "s/.*node-version[: ]*['\"]*//" | sed "s/['\"].*//" | sort -u) | |
| for v in $WORKFLOW_VERS; do | |
| WV=$(echo "$v" | tr -d '[:space:]' | sed -E "s/^['\"]|['\"]$//g; s/^v//" | cut -d. -f1) | |
| if [ -n "$NODE_FILE_VER" ] && [ "$WV" != "$NODE_FILE_VER" ]; then | |
| echo "MISMATCH: workflow uses node $v, .node-version is $NODE_FILE_RAW" | |
| fi | |
| done |
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In @.claude/commands/repo-maintenance.md around lines 754 - 760, Normalize the
node versions before comparing: read and trim .node-version into NODE_FILE_VER
(remove leading "v" and surrounding whitespace), normalize each value in
WORKFLOW_VERS the same way (strip any leading "v" prefix and whitespace) in the
extraction pipeline that builds WORKFLOW_VERS, and then use those normalized
values in the loop that checks for mismatches (the for v in $WORKFLOW_VERS loop
and the comparison against NODE_FILE_VER and $(cat .node-version)). Ensure both
sides of the comparison use the same normalization logic so prefixes like "v" or
trailing spaces won't trigger false mismatches.
|
PR #603 レビュー結果 変更ファイルは .claude/commands/repo-maintenance.md のみで、Claude が実行するシェルスクリプトのサンプルロジックとして埋め込まれているため、バグはランタイムに影響します。 バグ・ロジックの問題:
軽微な指摘: 良い点:
まとめ: Reviewed with Claude Code |
1. quality-gate-fallback.yml を追加 - CI が paths フィルタでスキップされた場合に Quality Gate を Pass で報告 - Required Status Check が pending にならなくなる - CI 本体が実行された場合は重複せず CI 側が優先 2. テンプレート同期 - dependabot-auto-merge.yml: Pass 終了修正をテンプレートに反映 - label-sync.yml: checkout@v4 → @v6 に更新 Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
|
🎉 This PR is included in version 1.100.0 🎉 The release is available on GitHub release Your semantic-release bot 📦🚀 |
1 participant
Summary
/repo-maintenanceコマンドに CI 統一チェックの 3 ステップを追加:3.5.1 CI Template Sync Check
templates/workflows/と.github/workflows/の差分を自動検出3.5.2 CI Consistency Check
.node-versionvs ワークフロー）3.5.3 CI Template Deployment Check
workflow_call定義チェックTest plan
/repo-maintenance --mode check-onlyで CI 統一チェックが表示されること/repo-maintenance --mode fullでテンプレート同期が提案されること🤖 Generated with Claude Code
Summary by CodeRabbit
New Features
Documentation
Chores