chore: バージョン更新を Dependabot に一本化 - #752
Conversation
`update-libraries.yml` と Dependabot が `package.json` を奪い合っていた問題、 および死にコードの `update-claude-plugins.yml` を整理する。 - `script/update-libraries.sh` から `npm-check-updates` 部分を削除し、 責務を `npm/global.json` の同期のみに縮小 - `update-libraries.yml` のサマリ生成を `npm/global.json` のみに簡素化 - `update-claude-plugins.yml`（`has_updates=false` ハードコードの死にコード）を削除 - ADR 0006 を追加して責務分担を明文化、ADR 0002 を Superseded に変更 - README.md / script/README.md / AGENTS.md の関連記述を更新 Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
|
Warning Rate limit exceeded
You’ve run out of usage credits. Purchase more in the billing tab. ⌛ How to resolve this issue?After the wait time has elapsed, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout. Please see our FAQ for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (1)
📝 WalkthroughWalkthroughThis PR consolidates version-update automation by removing the Claude plugin workflow, narrowing library updates to refresh only ChangesVersion Update Automation Consolidation
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~25 minutes Possibly related PRs
Suggested labels
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
🔍 AI Code Review (Local Hook)Models: Codex (default) / Gemini (default) ✨ Gemini ReviewMCP issues detected. Run /mcp list for status.ADR 0006（バージョン更新の Dependabot 一本化）の決定に基づき、重複していた更新メカニズムを整理し、保守性を向上させる非常に優れた変更です。 修正が必要な問題（Actionable Issues）重大な問題は見当たりません。変更は意図通りであり、プロジェクトの新しい方針に完全に合致しています。 レビューの詳細
判定patch is correct 理由: ADR 0006 に基づき、重複した自動更新の仕組みを適切に整理・統合しており、コードの品質およびドキュメントの整合性が非常に高いレベルで維持されています。 信頼度: 1.0 🤖 Generated by post_pr_ai_review.py hook |
|
Claude finished @keito4's task in 2m 5s —— View job PR レビュータスク
総評Verdict: APPROVE — 構造的に正しい変更です。ADR 0006 で意思決定を文書化したうえで実装しており、責務の境界が明確になっています。重大・主要な問題は見当たりません。以下は minor / recommendation レベルの指摘です。 指摘事項
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@script/update-libraries.sh`:
- Line 46: The script uses mktemp to create tmp_file outside the repo; change it
to create temp files under the repository-scoped .context directory instead:
ensure .context exists (mkdir -p .context) and replace the tmp_file creation
(variable tmp_file) to use mktemp with a .context-prefixed template (e.g.,
mktemp .context/tmp.XXXXXX) so all temporary artifacts live under .context; keep
any existing cleanup logic that references tmp_file working with the new path.
- Line 60: The script currently hides npm registry lookup failures by assigning
latest_version with a fallback to current_version using "npm view \"$pkg\"
version 2>/dev/null || echo \"$current_version\"" which can mask transient
errors; change the behavior in the latest_version assignment so that npm view
errors are not silently discarded—remove the silent fallback and either let npm
view's stderr surface (remove "2>/dev/null || echo \"$current_version\""), or
capture the error and fail loudly (exit non‑zero or log an explicit error via
echo/stderr) referencing the variables latest_version, pkg and current_version
so callers can see registry failures instead of returning a false "no update"
result.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 443cee09-7224-4d56-8420-08263442b717
📒 Files selected for processing (9)
.github/workflows/update-claude-plugins.yml.github/workflows/update-libraries.ymlAGENTS.mdREADME.mddocs/adr/0002-auto-version-updates.mddocs/adr/0006-consolidate-version-updates.mddocs/adr/README.mdscript/README.mdscript/update-libraries.sh
💤 Files with no reviewable changes (1)
- .github/workflows/update-claude-plugins.yml
| log "Installing updated dependencies" | ||
| npm install | ||
| log "Refreshing global CLI manifest versions" | ||
| tmp_file=$(mktemp) |
There was a problem hiding this comment.
Use repository-scoped temp files instead of OS temp directory.
At Line 46, mktemp writes outside the repository, which breaks the shared-artifact rule for this repo.
Suggested fix
log "Refreshing global CLI manifest versions"
-tmp_file=$(mktemp)
+context_tmp_dir="$REPO_PATH/.context/tmp"
+mkdir -p "$context_tmp_dir"
+tmp_file=$(mktemp "$context_tmp_dir/update-libraries.XXXXXX")
cp "$GLOBAL_FILE" "$tmp_file"Based on learnings: "Place all temporary and context files under .context/ in the repository root. Do NOT use /tmp/ or other OS-level temp directories."
📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| tmp_file=$(mktemp) | |
| log "Refreshing global CLI manifest versions" | |
| context_tmp_dir="$REPO_PATH/.context/tmp" | |
| mkdir -p "$context_tmp_dir" | |
| tmp_file=$(mktemp "$context_tmp_dir/update-libraries.XXXXXX") | |
| cp "$GLOBAL_FILE" "$tmp_file" |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@script/update-libraries.sh` at line 46, The script uses mktemp to create
tmp_file outside the repo; change it to create temp files under the
repository-scoped .context directory instead: ensure .context exists (mkdir -p
.context) and replace the tmp_file creation (variable tmp_file) to use mktemp
with a .context-prefixed template (e.g., mktemp .context/tmp.XXXXXX) so all
temporary artifacts live under .context; keep any existing cleanup logic that
references tmp_file working with the new path.
| continue | ||
| fi | ||
|
|
||
| latest_version=$(npm view "$pkg" version 2>/dev/null || echo "$current_version") |
There was a problem hiding this comment.
Do not silently suppress npm registry lookup failures.
At Line 60, falling back to current_version masks transient/npm errors and can produce false “no updates” results.
Suggested fix
- latest_version=$(npm view "$pkg" version 2>/dev/null || echo "$current_version")
+ if ! latest_version=$(npm view "$pkg" version 2>/dev/null); then
+ echo "Failed to fetch latest version for $pkg" >&2
+ exit 1
+ fiBased on learnings: "Always prefer simplicity over pathological correctness... Avoid backward-compat shims or fallback paths unless they add no cyclomatic complexity."
📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| latest_version=$(npm view "$pkg" version 2>/dev/null || echo "$current_version") | |
| if ! latest_version=$(npm view "$pkg" version 2>/dev/null); then | |
| echo "Failed to fetch latest version for $pkg" >&2 | |
| exit 1 | |
| fi |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@script/update-libraries.sh` at line 60, The script currently hides npm
registry lookup failures by assigning latest_version with a fallback to
current_version using "npm view \"$pkg\" version 2>/dev/null || echo
\"$current_version\"" which can mask transient errors; change the behavior in
the latest_version assignment so that npm view errors are not silently
discarded—remove the silent fallback and either let npm view's stderr surface
(remove "2>/dev/null || echo \"$current_version\""), or capture the error and
fail loudly (exit non‑zero or log an explicit error via echo/stderr) referencing
the variables latest_version, pkg and current_version so callers can see
registry failures instead of returning a false "no update" result.
`script/update-libraries.sh` から削除した挙動（npx 依存、REJECT_PACKAGES、 lint/test 検証）に対するテストを、新しい責務（npm/global.json 専用、 overridden:true スキップ、npm-check-updates 不使用）に置き換える。 Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
|
🎉 This PR is included in version 1.112.5 🎉 The release is available on GitHub release Your semantic-release bot 📦🚀 |
1 participant
Summary
オープンPR を眺めると、
Dependabotとupdate-libraries.ymlが 同じpackage.jsonを奪い合っており、update-claude-plugins.ymlは 空実装の死にコード（has_updates=falseハードコード）になっていました。バージョン更新の責務を Dependabot に一本化します。詳細な背景・現状の不整合は ADR 0006 を参照。
What's changed
package.json/package-lock.json.github/workflows/*.yml（Actions ピン）.devcontainer/Dockerfile（FROM 行）.devcontainer/Dockerfile（ARG 行）update-dev-tools.yml（Dependabot が ARG を読まないため）npm/global.jsonupdate-libraries.yml（custom manifest のため）具体変更
script/update-libraries.sh:npm-check-updates/npm install部分を削除し、npm/global.jsonの同期のみに縮小.github/workflows/update-libraries.yml: サマリ生成をnpm/global.jsonのみに簡素化、ヘッダコメントで責務境界を明文化.github/workflows/update-claude-plugins.yml: 削除（空実装）docs/adr/0006-consolidate-version-updates.md: 新規 ADRdocs/adr/0002-auto-version-updates.md: Status をSuperseded by 0006に残課題（本 PR では扱わない）
update-dev-tools.ymlの cron を毎日 → 毎週に変更すべきかupdate-dev-tools.ymlの 1Password CLI 取得元 (agilebits.com→1Password/connectフォールバック) が別プロダクトを指している件Test plan
npm run format:checknpm run lintnpm test（114 tests passed）npm run shellcheckpackage.json更新 PR が想定どおり立つことupdate-libraries.yml実行でnpm/global.jsonのみが対象になること🤖 Generated with Claude Code
Summary by CodeRabbit
Refactor
Documentation