fix: リポジトリメンテナンス（Actions最適化・セキュリティ強化） - #656
Conversation
- coverage-report.yml: concurrency + timeout-minutes 追加 - manual-release.yml: concurrency + timeout-minutes 追加 - docker-image.yml: upload-artifact に retention-days: 7 追加 - templates/dependabot-auto-merge.yml: SHA 固定 - templates/label-sync.yml: SHA 固定 - AGENTS.md: 自動生成セクション更新（新ディレクトリ追加） - PR テンプレート: Why/What/How 形式に簡素化 Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
|
Caution Review failedThe pull request is closed. ℹ️ Recent review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (2)
📝 WalkthroughWalkthroughAdded workflow-level concurrency controls and per-job timeouts across CI workflows, set artifact retention for a devcontainer artifact, pinned several workflow action dependencies to specific commits, and updated AGENTS.md with new repository directories and a hook entry. (≤50 words) Changes
Estimated code review effort🎯 2 (Simple) | ⏱️ ~8 minutes Possibly related PRs
Suggested labels
Poem
🚥 Pre-merge checks | ✅ 3✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
🔍 AI Code Review (Local Hook)Models: Codex (default) / Gemini (default) 🤖 Codex Review指摘事項はありません。変更は主にワークフローの同時実行制御・タイムアウト追加・アクションの固定化・ドキュメント表の補完で、正確性/パフォーマンス/セキュリティ/保守性/開発者体験の観点で新たな問題は見当たりません。 patch is correct — 追加変更は安全な運用改善（concurrency/timeout/pin/retention）とドキュメント整備で、挙動を壊すリスクが低い。信頼度 0.62 🤖 Generated by post_pr_ai_review.py hook |
🔍 AI Code Review (Local Hook)Models: Codex (default) / Gemini (default) 🤖 Codex Review指摘事項
全体判定: patch is incorrect
|
|
Code Review PR の目的は明確で、GitHub Actions のコスト最適化・セキュリティ強化・ドキュメント同期という実用的な改善です。全体的に品質は高いですが、いくつか確認点があります。 良い点
要確認・改善点
templates/workflows/label-sync.yml にて SHA de0fac2e4500dabe0009e67214ff5f5447ce83dd を参照しています。actions/checkout の現在の最新安定版は v4 であり、v6 は存在しない可能性があります。誤った SHA はワークフローの実行時エラーになります。確認方法: gh api repos/actions/checkout/git/commits/de0fac2e4500dabe0009e67214ff5f5447ce83dd
「dist」という説明は内容が伝わりません。「Compiled/built output files」など具体的な説明に改善してください。
Trigger が「Unknown」、説明が「common」では情報として不十分です。実際のトリガー条件と機能を明記してください。自動生成の結果をそのままマージするのではなく、人間がレビューして補完することを推奨します。
JaCoCo フォーマット（Java プロジェクト）や大規模な LCOV カバレッジレポートでは 10 分では不足するケースがあります。reusable workflow の timeout はオーバーライド不可なので、15〜20分への引き上げも検討余地があります。 まとめ actions/checkout@v6 の SHA 検証とドキュメントの細部（dist/ の説明、common.py のトリガー・説明）を修正すれば、マージ問題なしと判断します。 |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🧹 Nitpick comments (1)
AGENTS.md (1)
55-55: Clarify thedist/purpose text.Line 55 uses
distas both directory and purpose, which is ambiguous. Prefer a concrete description like “Build artifacts/output bundles.”🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@AGENTS.md` at line 55, Update the table row that currently reads "| `dist/` | dist |" to use a clear purpose description; replace the second column value "dist" with a concrete phrase such as "Build artifacts/output bundles" (or similar) so the entry reads e.g. "| `dist/` | Build artifacts/output bundles |" to remove ambiguity.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@AGENTS.md`:
- Line 142: The hook metadata entry for common.py is currently listing generic
values ("Unknown"/"common"); update that row to describe the actual hook trigger
and responsibility by replacing "Unknown" with the explicit trigger (e.g.,
"pre-commit", "post-merge", "startup", or the webhook/event name) and replace
the "common" responsibility with a concise statement of what common.py does
(e.g., "initializes shared agent state and exposes helper utilities:
load_config(), init_logger(), register_handlers()"), and include any
inputs/outputs or side effects for auditability; locate and edit the AGENTS.md
table row referencing common.py and ensure the metadata fields clearly state
trigger, purpose, and key exported functions/classes used by the hook.
In `@templates/workflows/dependabot-auto-merge.yml`:
- Line 40: The dependabot action pin is using the wrong commit hash for the v2
tag: update the action reference that currently reads
dependabot/fetch-metadata@21025c705c08248db411dc16f3619e6b5f9ea21a to the
correct SHA dependabot/fetch-metadata@ffa630c65fa7e0ecfa0625b5ceda64399aea1b36
in the workflow file so the uses: line for the dependabot/fetch-metadata action
points to the actual v2 commit.
---
Nitpick comments:
In `@AGENTS.md`:
- Line 55: Update the table row that currently reads "| `dist/` |
dist |" to use a clear purpose
description; replace the second column value "dist" with a concrete phrase such
as "Build artifacts/output bundles" (or similar) so the entry reads e.g. "|
`dist/` | Build artifacts/output bundles |" to remove ambiguity.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 3ea6d20b-cde1-4d26-ae3e-9094247eaba1
📒 Files selected for processing (6)
.github/workflows/coverage-report.yml.github/workflows/docker-image.yml.github/workflows/manual-release.ymlAGENTS.mdtemplates/workflows/dependabot-auto-merge.ymltemplates/workflows/label-sync.yml
| | `block_config_edit.py` | Pre edit | Protect configuration files | | ||
| | `block_dangerous_commands.py` | Pre Bash | Block destructive commands | | ||
| | `block_git_no_verify.py` | Pre git commit/push | Block `--no-verify` and `HUSKY=0` | | ||
| | `common.py` | Unknown | common | |
There was a problem hiding this comment.
Hook metadata is too vague to be actionable.
Line 142 should not use Unknown/common; please document the actual trigger and specific responsibility of common.py to keep hook operations auditable.
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@AGENTS.md` at line 142, The hook metadata entry for common.py is currently
listing generic values ("Unknown"/"common"); update that row to describe the
actual hook trigger and responsibility by replacing "Unknown" with the explicit
trigger (e.g., "pre-commit", "post-merge", "startup", or the webhook/event name)
and replace the "common" responsibility with a concise statement of what
common.py does (e.g., "initializes shared agent state and exposes helper
utilities: load_config(), init_logger(), register_handlers()"), and include any
inputs/outputs or side effects for auditability; locate and edit the AGENTS.md
table row referencing common.py and ensure the metadata fields clearly state
trigger, purpose, and key exported functions/classes used by the hook.
| if: github.actor == 'dependabot[bot]' | ||
| id: metadata | ||
| uses: dependabot/fetch-metadata@v2 | ||
| uses: dependabot/fetch-metadata@21025c705c08248db411dc16f3619e6b5f9ea21a # v2 |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Verify dependabot/fetch-metadata SHA matches v2 tag
curl -s "https://api.github.com/repos/dependabot/fetch-metadata/git/refs/tags/v2" | jq -r '.object.sha'
echo "Expected SHA in workflow: 21025c705c08248db411dc16f3619e6b5f9ea21a"Repository: keito4/config
Length of output: 164
SHA does not match v2 tag — update to correct commit hash.
The pinned SHA 21025c705c08248db411dc16f3619e6b5f9ea21a does not correspond to the v2 release. The actual SHA for the v2 tag is ffa630c65fa7e0ecfa0625b5ceda64399aea1b36. Update the action reference to use the correct hash:
Current vs. correct SHA
- uses: dependabot/fetch-metadata@21025c705c08248db411dc16f3619e6b5f9ea21a # v2
+ uses: dependabot/fetch-metadata@ffa630c65fa7e0ecfa0625b5ceda64399aea1b36 # v2🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@templates/workflows/dependabot-auto-merge.yml` at line 40, The dependabot
action pin is using the wrong commit hash for the v2 tag: update the action
reference that currently reads
dependabot/fetch-metadata@21025c705c08248db411dc16f3619e6b5f9ea21a to the
correct SHA dependabot/fetch-metadata@ffa630c65fa7e0ecfa0625b5ceda64399aea1b36
in the workflow file so the uses: line for the dependabot/fetch-metadata action
points to the actual v2 commit.
macOS の case-insensitive FS により PULL_REQUEST_TEMPLATE.md と pull_request_template.md の2エントリが存在していた問題を修正。 Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
|
🎉 This PR is included in version 1.108.1 🎉 The release is available on GitHub release Your semantic-release bot 📦🚀 |
1 participant
Summary
/repo-maintenanceによる定期メンテナンス実行結果。Why
What
Actions コスト最適化
coverage-report.yml:concurrency+ 各ジョブにtimeout-minutes: 10追加manual-release.yml:concurrency+timeout-minutes: 30追加docker-image.yml:upload-artifactにretention-days: 7追加テンプレート SHA 固定
templates/workflows/dependabot-auto-merge.yml:dependabot/fetch-metadata@v2→ SHA 固定templates/workflows/label-sync.yml:actions/checkout@v6,EndBug/label-sync@v2→ SHA 固定AGENTS.md 更新
.agents/,dist/,next/追加）リポジトリ設定変更（API 経由、コミット外）
default_workflow_permissions:write→readallowed_actions:all→selected（GitHub/verified + 明示的パターン許可）core.hooksPath:.husky/_→.husky（v9 移行）How to test
🤖 Generated with Claude Code
Summary by CodeRabbit
Chores
Documentation
Chores