fix: Actions SHA 固定・permissions 追加・CODEOWNERS 設定

[keito4]

Summary

• 全 15 ワークフローの 3rd-party actions をフル SHA（40文字）で固定し、タグ改ざんリスクを排除
• permissions 未設定の 6 ワークフローに permissions: {} を追加（最小権限の原則）
• .github/CODEOWNERS を追加（@keito4）
• .husky/pre-commit に check-file-length を追加
• core.hooksPath を v8 (.husky/_) → v9 (.husky) に移行
• AGENTS.md に nix/ ディレクトリを反映

Test plan

• 全テスト通過（95 tests）
• format:check 通過
• lint 通過
• CI ワークフローが SHA 固定後も正常動作すること

🤖 Generated with Claude Code

Summary by CodeRabbit

• Chores
  • Pinned third-party GitHub Actions across all CI/CD workflows to specific commits for enhanced supply chain security and build reproducibility
  • Implemented file-length validation in pre-commit hooks to enforce code quality standards
  • Enhanced repository documentation with clarified directory structure and purpose descriptions
  • Added code owner configuration for the repository

[coderabbitai]

Caution

Review failed

Pull request was closed or merged during review

📝 Walkthrough

Walkthrough

This pull request implements security hardening and administrative improvements across the repository: adds a CODEOWNERS file designating code ownership, pins GitHub Actions workflows to specific commit SHAs instead of version tags, restricts workflow token permissions, integrates file-length validation into pre-commit hooks, and updates documentation for development environment descriptions.

Changes

Cohort / File(s)	Summary
Code ownership setup .github/CODEOWNERS	Added default code owner assignment for all repository files.
GitHub Actions security hardening .github/workflows/ci.yml, .github/workflows/claude-code-review.yml, .github/workflows/claude.yml, .github/workflows/container-security.yml, .github/workflows/docker-image.yml, .github/workflows/label-sync.yml, .github/workflows/manual-release.yml, .github/workflows/rebuild-docker-cache.yml, .github/workflows/security.yml, .github/workflows/update-claude-plugins.yml, .github/workflows/update-dev-tools.yml, .github/workflows/update-libraries.yml	Pinned third-party GitHub Actions to specific commit SHAs instead of version tags; added permissions: {} to restrict default token scope in multiple workflows.
Coverage and dependabot workflows .github/workflows/coverage-report.yml, .github/workflows/dependabot-auto-merge.yml, .github/workflows/quality-gate-fallback.yml	Pinned action versions to commit SHAs for reproducibility and security.
Pre-commit validation .husky/pre-commit	Added file-length validation step running script/check-file-length.sh in the pre-commit hook sequence.
Documentation AGENTS.md	Refined directory descriptions and added nix environment entry for macOS setup documentation.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~30 minutes

Possibly related PRs

• feat: ファイル行数チェック機能を追加 #484: Introduces the script/check-file-length.sh script that this PR integrates into the pre-commit hook.
• feat: add act-local-ci-manager Claude agent #258: Modifies the same .github/workflows/ci.yml file with related GitHub Actions version updates.
• fix: align CI tooling and MCP setup #392: Updates multiple GitHub Actions workflow files with similar action version pinning and permission restrictions.

Suggested labels

enhancement

Poem

🐰 Actions pinned secure, commit SHAs tight,
Permissions locked down to guard the night,
File-length checks and ownership clear,
Workflows hardened without a fear!
✨ The rabbit hops through safer code.

🚥 Pre-merge checks | ✅ 2 | ❌ 1

❌ Failed checks (1 inconclusive)

Check name	Status	Explanation	Resolution
Title check	❓ Inconclusive	The title uses Japanese and is overly broad, covering multiple unrelated changes (SHA pinning, permissions, CODEOWNERS, pre-commit hook, husky version migration, and documentation updates) without highlighting the primary objective.	Simplify the title to focus on the main change (e.g., 'fix: Pin GitHub Actions to full commit SHAs for security') or use English for clarity and team consistency.

✅ Passed checks (2 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch chore/repo-maintenance-20260322

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[keito4]

🔍 AI Code Review (Local Hook)

Models: Codex (default) / Gemini (default)

🤖 Codex Review

指摘事項: なし

テスト実行: 未実施（差分レビューのみ）

全体判定: patch is correct
理由: 変更は主にGitHub ActionsのSHAピン留めと権限の明示、ドキュメント更新であり、機能的な挙動変更や破壊的変更は見当たりません。
信頼度: 0.74

---

🤖 Generated by post_pr_ai_review.py hook

[github-actions]

🎉 This PR is included in version 1.104.0 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀