Skip to content

fix: Claude CI 自己キャンセル防止・enforce_admins 修正・ヘルスチェック追加 #619

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
keito4 merged 1 commit into from
Mar 22, 2026
Merged

fix: Claude CI 自己キャンセル防止・enforce_admins 修正・ヘルスチェック追加 #619

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions .claude/commands/setup-team-protection.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,7 +10,7 @@

| ブランチ | enforce_admins | required_reviews | code_owner_reviews |
| --------------------- | -------------- | ---------------- | ------------------ |
| main (default_branch) | true | 0 | false |
| main (default_branch) | false | 0 | false |
| pre-production | false | 1 | true |
| production | false | 1 | true |

Expand Down Expand Up @@ -87,7 +87,7 @@ bash script/setup-team-protection.sh --dry-run
main ブランチ:

```bash
# enforce_admins=true, reviewers=0, code_owner_reviews=false
# enforce_admins=false, reviewers=0, code_owner_reviews=false
bash script/setup-team-protection.sh --branches main
```

Expand Down
1 change: 1 addition & 0 deletions .github/workflows/claude.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,6 +21,7 @@ jobs:
if: |
github.actor != 'github-actions[bot]' &&
github.actor != 'dependabot[bot]' &&
github.actor != 'claude[bot]' &&
(
(github.event_name == 'issue_comment' && contains(github.event.comment.body || '', '@claude') &&
!(github.event.issue.pull_request && github.event.issue.pull_request.url && github.event.issue.draft == true)) ||
Expand Down
8 changes: 4 additions & 4 deletions script/setup-team-protection.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -26,7 +26,7 @@
#
# Branch-type defaults (when --uniform is NOT set):
# main (default_branch):
# enforce_admins=true, required_reviews=0, require_code_owner_reviews=false
# enforce_admins=false, required_reviews=0, require_code_owner_reviews=false
# pre-production / production:
# enforce_admins=false, required_reviews=1, require_code_owner_reviews=true

Expand Down Expand Up @@ -239,11 +239,11 @@ setup_branch_protection() {
info "Applying environment branch defaults (enforce_admins=false, reviewers=1, code_owner_reviews=true)"
;;
main|master)
# Default branch: admin enforcement, no mandatory reviews
enforce_admins=true
# Default branch: no admin enforcement, no mandatory reviews
enforce_admins=false

@chatgpt-codex-connector chatgpt-codex-connector Bot Mar 22, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Respect --enforce-admins for default branch

The main|master branch defaults now unconditionally set enforce_admins=false, which overrides an explicit --enforce-admins invocation (ENFORCE_ADMINS=true). In the default non---uniform path, an operator can request admin enforcement and still end up with admins exempt from protection on the default branch, which weakens branch protection contrary to the CLI option contract.

Useful? React with 👍 / 👎.

reviewers=0
require_code_owner_reviews=false
info "Applying default branch defaults (enforce_admins=true, reviewers=0, code_owner_reviews=false)"
info "Applying default branch defaults (enforce_admins=false, reviewers=0, code_owner_reviews=false)"
;;
esac
fi
Expand Down
60 changes: 60 additions & 0 deletions templates/workflows/claude-health-check.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,60 @@
name: Claude Code Health Check

on:
schedule:
- cron: '0 0 * * 1' # Every Monday 00:00 UTC
workflow_dispatch:

permissions: {}

jobs:
health-check:
runs-on: ubuntu-latest
timeout-minutes: 5
permissions:
issues: write
steps:
- name: Check Claude Code token validity
id: check
uses: anthropics/claude-code-action@d59651bd82c48d81756854675ce4fa4d69722200 # v1
with:
claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
direct_prompt: 'Reply with only: OK'
timeout_minutes: 2
continue-on-error: true

- name: Create issue on failure
if: steps.check.outcome == 'failure'
env:
GH_TOKEN: ${{ github.token }}
run: |
EXISTING=$(gh issue list --label "claude-health" --state open --json number --jq 'length')
if [ "$EXISTING" -gt 0 ]; then
echo "Open health check issue already exists. Skipping."
exit 0
fi

gh issue create \
--title "fix: Claude Code OAuth トークンが無効です" \
--label "claude-health,bug" \

@chatgpt-codex-connector chatgpt-codex-connector Bot Mar 22, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Remove undeclared label from health-check issue creation

The failure handler always passes --label "claude-health,bug", but this repository’s label definitions (.github/labels.yml and templates/github/labels.yml) do not include claude-health. GitHub’s labeling guidance requires labels to exist before being added via gh, so in repos generated from these templates the alert-creation step can fail exactly when the health check detects an invalid token, preventing the intended notification.

Useful? React with 👍 / 👎.

--body "$(cat <<'BODY'
## 問題

Claude Code Health Check が失敗しました。
`CLAUDE_CODE_OAUTH_TOKEN` が期限切れまたは無効になっている可能性があります。

## 対応手順

1. [Claude Code OAuth](https://console.anthropic.com/) でトークンを再発行
2. GitHub Settings → Secrets → `CLAUDE_CODE_OAUTH_TOKEN` を更新
3. このワークフローを手動実行して復旧を確認

## 影響

- `claude.yml` (`@claude` メンション) が機能停止
- `claude-code-review.yml` (AI コードレビュー) が機能停止

---
*このIssueは Claude Code Health Check ワークフローにより自動作成されました。*
BODY
)"
Loading