fix: GitHub Actions を最新バージョンに一括更新 - #674
Conversation
ワークフロー・テンプレート・ドキュメント全体で GitHub Actions の バージョンを最新に更新。SHA 固定のワークフローとタグ参照の テンプレート/ドキュメントの両方を対象とする。 主な更新: - actions/github-script: v8 → v9 - actions/upload-artifact: v7.0.0 → v7.0.1 - actions/stale: v9 → v10 - codecov/codecov-action: v5.5.3 → v6 - dependabot/fetch-metadata: v2 → v3 - docker/login-action: v4 → v4.1.0 - docker/build-push-action: v7 → v7.1.0 - peter-evans/create-pull-request: v8.1.0 → v8.1.1 - anthropics/claude-code-action: SHA 更新 - reviewdog/action-actionlint: v1.71.0 → v1.72.0 - marocchino/sticky-pull-request-comment: v3.0.2 → v3.0.4 - hashicorp/setup-terraform: v3 → v4 - テンプレート/ドキュメントの checkout v4→v6, setup-node v4→v6 等 Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (1)
📝 WalkthroughWalkthroughWidespread GitHub Actions version bumps across workflows, templates, composite actions, and documentation (e.g., Changes
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~30 minutes Possibly related PRs
Suggested labels
Poem
🚥 Pre-merge checks | ✅ 3✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
🔍 AI Code Review (Local Hook)Models: Codex (default) / Gemini (default) 🤖 Codex Review指摘事項
patch is correct — 変更はワークフロー/テンプレートのアクション更新が中心で、設定不整合や破壊的な変更の兆候が見当たらないため。信頼度 0.53 🤖 Generated by post_pr_ai_review.py hook |
🔍 AI Code Review (Local Hook)Models: Codex (default) / Gemini (default) 🤖 Codex Review発見事項:
判定: patch is correct（新規の破壊的変更や設定不整合は差分上確認できず） 信頼度: 0.32 🤖 Generated by post_pr_ai_review.py hook |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
.claude/agents/issue-resolver-dependencies.md (1)
305-324:⚠️ Potential issue | 🟠 MajorGenerated workflow still uses legacy
create-pull-request@v5.Line 323 remains on
peter-evans/create-pull-request@v5, leaving the generated workflow outdated even after bumping checkout and setup-node to v6.Suggested fix
- - name: Create Pull Request - uses: peter-evans/create-pull-request@v5 + - name: Create Pull Request + uses: peter-evans/create-pull-request@v8.1.0🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In @.claude/agents/issue-resolver-dependencies.md around lines 305 - 324, The workflow still references the legacy action identifier peter-evans/create-pull-request@v5; update that invocation to the current major release (e.g., peter-evans/create-pull-request@v6) and review the Create Pull Request step inputs for any breaking changes/new required fields so the step (named "Create Pull Request") matches the v6 action contract; locate the string peter-evans/create-pull-request@v5 in the workflow and replace it with the v6 tag, then run or lint the workflow to ensure no other adjustments are needed.
🧹 Nitpick comments (1)
.github/workflows/ci.yml (1)
201-207: PR size check still does not enforce the repository gate policy.This step currently labels/warns only, and limits are looser than the policy. Consider enforcing failure for
>400lines,>25files, and missing linked issue.Suggested patch
- pr-size-check: + pr-size-check: name: PR Size Check runs-on: ubuntu-latest timeout-minutes: 5 if: github.event_name == 'pull_request' - continue-on-error: true + continue-on-error: false @@ - - name: Check PR Size + - name: Check PR Size uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9 - continue-on-error: true + continue-on-error: false with: script: | const { additions, deletions, changed_files } = context.payload.pull_request; const totalChanges = additions + deletions; + const maxLines = 400; + const maxFiles = 25; + const prBody = context.payload.pull_request.body || ''; + const hasLinkedIssue = + /(close[sd]?|fix(e[sd])?|resolve[sd]?|refs?)\s+#\d+/i.test(prBody); @@ if (sizeLabel === 'size/XL') { @@ } + + if (totalChanges > maxLines || changed_files > maxFiles || !hasLinkedIssue) { + throw new Error( + `PR quality gate failed: lines=${totalChanges}/${maxLines}, files=${changed_files}/${maxFiles}, linked_issue=${hasLinkedIssue}` + ); + }- quality-gate: + quality-gate: @@ - needs: [changes, lint, test, integration-test, actionlint] + needs: [changes, lint, test, integration-test, actionlint, pr-size-check]Based on learnings: Enforce PR quality gates: Diff ≤ 400 lines, ≤ 25 files changed, and Linked Issue required.
Also applies to: 212-218, 250-279
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In @.github/workflows/ci.yml around lines 201 - 207, Update the "Check PR Size" workflow step (the actions/github-script usage) to enforce the repository gate policy instead of only warning: remove or set continue-on-error to false for that step and modify the script provided via the "with" block to fetch PR metadata and throw an error (causing the step to fail) when the diff exceeds 400 total changed lines, when changed files > 25, or when no linked issue is present; ensure the step throws/returns a non-zero failure on any violation so the job fails and the policy is enforced (apply same change to the related steps at the other occurrences mentioned).
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In @.claude/commands/setup-husky.md:
- Line 139: CI サンプルの steps 定義が一行で複数の uses を含んでおり GitHub Actions の YAML
として無効なので、steps の配列を複数行に分解して各エントリを "- uses:" で分けてください（該当シンボル: steps,
uses）。具体的には現行の "steps: - uses: actions/checkout@v6 - uses:
actions/setup-node@v6" をそれぞれ別の配列要素に分け、各要素に必要な追加キー（例: with,
name）を後から追加できる形に整形してください。
In @.github/workflows/templates/update-db-types.yml:
- Around line 70-73: The workflow is using the mutable tag
"peter-evans/create-pull-request@v8" which should be pinned to an immutable
commit SHA; update the `uses: peter-evans/create-pull-request@v8` entry to
reference the action's specific commit SHA (e.g.,
`peter-evans/create-pull-request@<full-sha>`) by looking up the action repo's
commit corresponding to the desired v8 release and replace the tag, and verify
the template still runs correctly.
In `@templates/workflows/stale.yml`:
- Line 32: Replace the actions/stale@v9 -> actions/stale@v10 upgrade check with
an explicit verification step: confirm that any self-hosted runners used by this
workflow support Node.js 24 by ensuring runner version >= v2.327.1 or upgrading
them, and then run the stale workflow in CI to validate compatibility; if you
cannot upgrade self-hosted runners, revert to actions/stale@v9 or add a
conditional / documentation note explaining the runner requirement. Reference:
actions/stale@v10 (the workflow invocation) and the workflow run in your CI to
perform the test.
---
Outside diff comments:
In @.claude/agents/issue-resolver-dependencies.md:
- Around line 305-324: The workflow still references the legacy action
identifier peter-evans/create-pull-request@v5; update that invocation to the
current major release (e.g., peter-evans/create-pull-request@v6) and review the
Create Pull Request step inputs for any breaking changes/new required fields so
the step (named "Create Pull Request") matches the v6 action contract; locate
the string peter-evans/create-pull-request@v5 in the workflow and replace it
with the v6 tag, then run or lint the workflow to ensure no other adjustments
are needed.
---
Nitpick comments:
In @.github/workflows/ci.yml:
- Around line 201-207: Update the "Check PR Size" workflow step (the
actions/github-script usage) to enforce the repository gate policy instead of
only warning: remove or set continue-on-error to false for that step and modify
the script provided via the "with" block to fetch PR metadata and throw an error
(causing the step to fail) when the diff exceeds 400 total changed lines, when
changed files > 25, or when no linked issue is present; ensure the step
throws/returns a non-zero failure on any violation so the job fails and the
policy is enforced (apply same change to the related steps at the other
occurrences mentioned).
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: b10152a4-d065-44bf-bcf4-9dd2d1642e85
📒 Files selected for processing (35)
.claude/agents/issue-resolver-dependencies.md.claude/agents/issue-resolver-orchestrator.md.claude/commands/repo-maintenance.md.claude/commands/setup-ci.md.claude/commands/setup-husky.md.claude/commands/setup-tests.md.github/actions/coverage-comment/action.yml.github/actions/coverage-comment/example-integration.yml.github/workflows/ci.yml.github/workflows/claude-code-review.yml.github/workflows/claude.yml.github/workflows/container-security.yml.github/workflows/coverage-report.yml.github/workflows/dependabot-auto-merge.yml.github/workflows/docker-image.yml.github/workflows/manual-release.yml.github/workflows/quality-gate-fallback.yml.github/workflows/rebuild-docker-cache.yml.github/workflows/scheduled-maintenance.yml.github/workflows/templates/README.md.github/workflows/templates/tls-evidence.yml.github/workflows/templates/unified-ci.yml.github/workflows/templates/update-db-types.yml.github/workflows/templates/zap-baseline.yml.github/workflows/update-claude-plugins.yml.github/workflows/update-dev-tools.yml.github/workflows/update-libraries.ymldocs/setup/README.mddocs/setup/web-app-nextjs.mdtemplates/testing/ci-test-jobs.ymltemplates/workflows/claude-health-check.ymltemplates/workflows/dependabot-auto-merge.ymltemplates/workflows/scheduled-maintenance.ymltemplates/workflows/stale.ymltemplates/workflows/terraform-drift.yml
| node: | ||
| runs-on: ubuntu-latest | ||
| steps: - uses: actions/checkout@v4 - uses: actions/setup-node@v4 | ||
| steps: - uses: actions/checkout@v6 - uses: actions/setup-node@v6 |
There was a problem hiding this comment.
CIサンプルの steps を複数行YAMLに分解してください
この1行だと GitHub Actions のYAMLとしてそのまま使えません。- uses: を各行に分ける形に直したほうが安全です。
💡 Suggested fix
-steps: - uses: actions/checkout@v6 - uses: actions/setup-node@v6
+steps:
+ - uses: actions/checkout@v6
+ - uses: actions/setup-node@v6📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| steps: - uses: actions/checkout@v6 - uses: actions/setup-node@v6 | |
| steps: | |
| - uses: actions/checkout@v6 | |
| - uses: actions/setup-node@v6 |
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In @.claude/commands/setup-husky.md at line 139, CI サンプルの steps 定義が一行で複数の uses
を含んでおり GitHub Actions の YAML として無効なので、steps の配列を複数行に分解して各エントリを "- uses:"
で分けてください（該当シンボル: steps, uses）。具体的には現行の "steps: - uses: actions/checkout@v6 -
uses: actions/setup-node@v6" をそれぞれ別の配列要素に分け、各要素に必要な追加キー（例: with,
name）を後から追加できる形に整形してください。
| - name: Create Pull Request | ||
| if: steps.changes.outputs.changed == 'true' | ||
| uses: peter-evans/create-pull-request@v7 | ||
| uses: peter-evans/create-pull-request@v8 | ||
| with: |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Find unpinned third-party actions in workflow files/templates.
rg -nP 'uses:\s*(?!actions/|github/)[^/\s]+/[^@\s]+@(?![0-9a-f]{40})' .github/workflowsRepository: keito4/config
Length of output: 987
🏁 Script executed:
cat -n .github/workflows/templates/update-db-types.yml | sed -n '68,75p'Repository: keito4/config
Length of output: 377
Pin this third-party action to a full commit SHA instead of a mutable major tag.
Line 72 uses @v8, which can change unexpectedly. Since this template is reusable and copied into production workflows, it should pin to a specific commit SHA for consistency and security.
Suggested fix
- uses: peter-evans/create-pull-request@v8
+ uses: peter-evans/create-pull-request@8c591753191dd9303e33c7236c8a9ef36f2ba529 # v8.1.1📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| - name: Create Pull Request | |
| if: steps.changes.outputs.changed == 'true' | |
| uses: peter-evans/create-pull-request@v7 | |
| uses: peter-evans/create-pull-request@v8 | |
| with: | |
| - name: Create Pull Request | |
| if: steps.changes.outputs.changed == 'true' | |
| uses: peter-evans/create-pull-request@8c591753191dd9303e33c7236c8a9ef36f2ba529 # v8.1.1 | |
| with: |
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In @.github/workflows/templates/update-db-types.yml around lines 70 - 73, The
workflow is using the mutable tag "peter-evans/create-pull-request@v8" which
should be pinned to an immutable commit SHA; update the `uses:
peter-evans/create-pull-request@v8` entry to reference the action's specific
commit SHA (e.g., `peter-evans/create-pull-request@<full-sha>`) by looking up
the action repo's commit corresponding to the desired v8 release and replace the
tag, and verify the template still runs correctly.
| timeout-minutes: 10 | ||
| steps: | ||
| - uses: actions/stale@v9 | ||
| - uses: actions/stale@v10 |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Verify actions/stale@v10 exists and fetch release information
# Check if v10 tag exists
gh api repos/actions/stale/git/ref/tags/v10 --jq '.ref' 2>/dev/null || echo "v10 tag not found"
# Fetch recent releases to find v10 changelog
gh api repos/actions/stale/releases --jq '.[] | select(.tag_name | startswith("v10")) | {tag_name, published_at, html_url}'
# Check the action.yml to see required inputs
gh api repos/actions/stale/contents/action.yml?ref=v10 --jq '.content' | base64 -d | grep -A 50 "inputs:"Repository: keito4/config
Length of output: 400
🌐 Web query:
actions/stale v10 breaking changes migration guide
💡 Result:
The primary breaking change in actions/stale v10.0.0 (released September 2025) is the upgrade from Node.js 20 to Node.js 24 runtime. This requires GitHub Actions runners version v2.327.1 or later for compatibility. No other major breaking changes or configuration alterations are noted beyond dependency updates and minor enhancements like the new 'sort-by' option. Migration guide: 1. Update your workflow YAML to use uses: actions/stale@v10 (or latest like v10.2.0). 2. Ensure your runner meets the minimum version: GitHub-hosted runners automatically satisfy this as they are kept up-to-date; self-hosted runners must be updated to v2.327.1+. 3. Review Node.js 24 release notes for any potential script impacts, though the action handles this internally. 4. Test the workflow after upgrade. The README and release notes explicitly warn: "Make sure your runner is on version v2.327.1 or later to ensure compatibility with this release." Latest version as of 2026-04-13: v10.2.0 (Feb 2026), with bug fixes and dependency updates but no additional breaking changes.
Citations:
- 1: https://github.com/actions/stale/releases
- 2: https://github.com/actions/stale/releases/tag/v10.0.0
- 3: https://github.com/actions/stale/blob/main/CHANGELOG.md
- 4: https://github.com/actions/stale
- 5: actions/stale@v9...v10
- 6: https://github.com/actions/stale?tab=readme-ov-file
- 7: Upgrade to node 24 actions/stale#1279
- 8: actions/stale@3a9db7e
🌐 Web query:
actions/stale v10 changelog release notes
💡 Result:
The GitHub Actions "actions/stale" v10 series changelog and release notes cover versions v10.0.0 (Sep 2025), v10.1.0 (Oct 2025), v10.1.1, and v10.2.0 (Feb 2026). Official sources are the GitHub releases page and CHANGELOG.md. v10.0.0 (https://github.com/actions/stale/releases/tag/v10.0.0): - Breaking: Upgrade to Node.js 24 (requires runner v2.327.1+). - Enhancement: New 'sort-by' option. - Dependencies: Various upgrades (e.g., @actions/cache, undici, form-data). - Docs: Changelog and permissions updates. v10.1.0 (https://github.com/actions/stale/releases/tag/v10.1.0): - New 'only-issue-types' option to filter issues by type. v10.2.0 (https://github.com/actions/stale/releases/tag/v10.2.0): - Bug fix: State cache checking and Octokit helpers (#1152). - Dependencies: js-yaml, lodash, actions/cache@5.0.2, actions/github@7.0.0. Full details in CHANGELOG.md (https://github.com/actions/stale/blob/main/CHANGELOG.md) and releases (https://github.com/actions/stale/releases). Latest as of 2026-04-13 is v10.2.0.
Citations:
- 1: https://github.com/actions/stale/releases
- 2: https://github.com/actions/stale/blob/main/CHANGELOG.md
- 3: https://github.com/actions/stale/releases/tag/v10.2.0
- 4: https://github.com/actions/stale/releases/tag/v10.0.0
- 5: https://github.com/actions/stale/releases/tag/v10.1.0
Verify runner compatibility for actions/stale@v10's Node.js 24 runtime.
The v10 upgrade introduces a breaking change: the runtime now requires Node.js 24 (previously v20), which mandates GitHub Actions runners v2.327.1 or later. GitHub-hosted runners are automatically kept current and will satisfy this requirement; self-hosted runners must be verified. All workflow configuration parameters remain compatible with v10—no input changes are needed.
Given that CI workflow verification is incomplete per the PR objectives, ensure the update is tested in your CI environment to confirm runner compatibility.
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@templates/workflows/stale.yml` at line 32, Replace the actions/stale@v9 ->
actions/stale@v10 upgrade check with an explicit verification step: confirm that
any self-hosted runners used by this workflow support Node.js 24 by ensuring
runner version >= v2.327.1 or upgrading them, and then run the stale workflow in
CI to validate compatibility; if you cannot upgrade self-hosted runners, revert
to actions/stale@v9 or add a conditional / documentation note explaining the
runner requirement. Reference: actions/stale@v10 (the workflow invocation) and
the workflow run in your CI to perform the test.
main で更新された claude-code-action SHA と構造変更を取り込みつつ、 全アクションを最新の v1 タグ SHA に統一。 Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
|
(aside) |
|
Claude finished @keito4's task in 7m 41s —— View job CI修正完了 ✅
根本原因コンフリクト解消コミット（ # .github/actions/setup-node-ci/action.yml
- if: ${{ inputs.install == 'true' }}
+ if: inputs.install == 'true'composite action の 修正内容
|
コンフリクト解消コミット（9a50c92）で誤って追加された
`if: ${{ inputs.install == 'true' }}` を正しい
`if: inputs.install == 'true'` に修正。
composite action の if フィールドでは ${{ }} は不要かつ
GitHub Actions の startup_failure の原因となっていた。
Co-authored-by: keito4 <keito4@users.noreply.github.com>
|
🎉 This PR is included in version 1.109.0 🎉 The release is available on GitHub release Your semantic-release bot 📦🚀 |
1 participant
Summary
Changes
メジャー更新
マイナー/パッチ更新
SHA 更新
テンプレート/ドキュメントのタグ更新
actions/checkoutv4 → v6actions/setup-nodev4 → v6actions/upload-artifactv3/v4/v6 → v7codecov/codecov-actionv4 → v6actions/github-scriptv7/v8 → v9peter-evans/create-pull-requestv7 → v8Test plan
🤖 Generated with Claude Code
Summary by CodeRabbit