feat(repo-maintenance): 組織横断監査の知見を反映した9つのチェックを追加・強化 - #820
Conversation
10リポジトリの横断監査で頻出した運用課題を /repo-maintenance で検出・修正 できるようにする。 - 2.9 拡張: SHA固定チェックを first-party actions にも適用 - 3.1 強化: ブランチ保護の両輪検証（reviews + required checks）と delete_branch_on_merge の確認・自動修正 - 3.5.4 新設: 品質スクリプトの CI 参照確認と continue-on-error 検出 - 3.16 拡張: SECURITY.md のプレースホルダー残存・記載と実態の乖離検証 - 3.18 新設: CONTRIBUTING.md チェック（テンプレート配布） - 3.23 新設: カバレッジ閾値ラチェット方式チェック - 4.3 新設: 追跡生成物・大容量ファイル・ルートクラッター検出 - 4.4 新設: submodule ピン先の健全性確認 - 4.5 新設: stale PR・未マージ security ブランチ検出 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
📝 WalkthroughWalkthroughThe repo-maintenance.md documentation expands GitHub Actions security (first-party + third-party SHA pinning), team protection API validation, SECURITY.md/CONTRIBUTING.md integrity checks, CI blocking-gate enforcement, coverage threshold ratcheting, and repository health scanning (tracked artifacts, submodules, stale PRs). Summary output and related-commands reference are updated to surface all new checkpoints. ChangesRepository Maintenance Command Extension
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes Possibly related PRs
Suggested labels
Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
Claude finished @keito4's task in 3m 20s —— View job PR #820 コードレビュータスクリスト
全体評価横断監査の知見を的確にチェックリストへ反映した、実用性の高い変更です。追加された 9 チェックはどれも背景・ロジック・結果パターンが整理されており、読み手にとって意図が明確です。セクション番号の整合も PR 説明通り確認できました。 以下に気になる点を severity 別に列挙します。 指摘事項
|
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 8bbd9fc1ed
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| /setup-team-protection の実行有無に関わらず、現在の実態を API で直接検証する： | ||
|
|
||
| ```bash | ||
| PROTECTION=$(gh api "repos/$REPO/branches/main/protection" 2>/dev/null) |
There was a problem hiding this comment.
When main has no branch protection, gh api repos/$REPO/branches/main/protection returns a 404 and PROTECTION is empty; the following jq commands then leave REVIEWS/CHECKS empty, so the numeric -lt tests emit integer expression expected and do not add the intended missing-review / missing-status-check issues. This is the exact case the new check needs to catch, so default the failed API call to {} or explicitly flag a missing protection response before these comparisons.
Useful? React with 👍 / 👎.
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.claude/commands/repo-maintenance.md:
- Around line 1210-1215: The grep pattern interpolates $script_name directly (in
the for loop and the grep -rqE line), which can be broken by regex
metacharacters; fix it by escaping regex metacharacters in $script_name before
using it in grep or by switching to fixed-string matching. For example, compute
an escaped variable (e.g., escaped_script=$(printf '%s' "$script_name" | sed -e
's/[][.*^$(){}+?|\\/]/\\&/g')) and then use grep -rqE "run (-w [^ ]+
)?$escaped_script\b|npx $escaped_script\b" ... or replace grep -E with grep -F
and adjust the patterns to avoid regex constructs; update the grep invocation in
the loop that checks scripts to use the escaped variable (or fixed-string mode)
so names like "format:check" or any with special chars are matched safely.
- Line 2782: The check using bc in the conditional that reads 'elif [ -n
"$ACTUAL" ] && [ "$(echo "$ACTUAL - $THRESHOLD > 10" | bc 2>/dev/null)" = "1" ];
then' can silently fail if bc is not installed; update this to either ensure bc
is available in CI/devcontainer or wrap the numeric gap check with a fallback
that uses awk when bc is missing (detect via command -v bc), keeping the
existing behavior of appending to ISSUES when ACTUAL - THRESHOLD > 10; modify
the conditional around ACTUAL/THRESHOLD to first branch on bc presence and
otherwise compute the boolean with awk and compare to "1" before adding the same
ISSUES entry.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 7e76edf8-d293-486b-89d1-f3c6e2ce9997
📒 Files selected for processing (1)
.claude/commands/repo-maintenance.md
| for script_name in lint typecheck type-check format:check test; do | ||
| jq -e --arg s "$script_name" '.scripts[$s]' package.json >/dev/null 2>&1 || continue | ||
| if ! grep -rqE "run (-w [^ ]+ )?$script_name\b|npx $script_name\b" .github/workflows/*.yml 2>/dev/null; then | ||
| ISSUES+=("品質スクリプト '$script_name' が CI のどのワークフローからも実行されていない（ローカルフックのみ）") | ||
| fi | ||
| done |
There was a problem hiding this comment.
Potential regex injection in script name matching.
The $script_name variable (e.g., format:check, type-check) is interpolated directly into the grep regex pattern without escaping. While colons and hyphens are safe in ERE, this pattern could break or produce false matches if script names contain other regex metacharacters.
🛡️ Recommended fix to escape regex metacharacters
jq -e --arg s "$script_name" '.scripts[$s]' package.json >/dev/null 2>&1 || continue
- if ! grep -rqE "run (-w [^ ]+ )?$script_name\b|npx $script_name\b" .github/workflows/*.yml 2>/dev/null; then
+ # Escape special regex characters in script name
+ escaped_name=$(printf '%s' "$script_name" | sed 's/[.[\*^$]/\\&/g')
+ if ! grep -rqE "run (-w [^ ]+ )?$escaped_name\b|npx $escaped_name\b" .github/workflows/*.yml 2>/dev/null; then
ISSUES+=("品質スクリプト '$script_name' が CI のどのワークフローからも実行されていない（ローカルフックのみ）")
fi🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.claude/commands/repo-maintenance.md around lines 1210 - 1215, The grep
pattern interpolates $script_name directly (in the for loop and the grep -rqE
line), which can be broken by regex metacharacters; fix it by escaping regex
metacharacters in $script_name before using it in grep or by switching to
fixed-string matching. For example, compute an escaped variable (e.g.,
escaped_script=$(printf '%s' "$script_name" | sed -e
's/[][.*^$(){}+?|\\/]/\\&/g')) and then use grep -rqE "run (-w [^ ]+
)?$escaped_script\b|npx $escaped_script\b" ... or replace grep -E with grep -F
and adjust the patterns to avoid regex constructs; update the grep invocation in
the loop that checks scripts to use the escaped variable (or fixed-string mode)
so names like "format:check" or any with special chars are matched safely.
| ISSUES+=("coverage 閾値が未設定（テストがあるのにゲートがない）") | ||
| elif [ "${THRESHOLD%%.*}" -eq 0 ]; then | ||
| ISSUES+=("coverage 閾値が 0%（ゲート実質無効）→ 実測値直下へのラチェット設定を推奨") | ||
| elif [ -n "$ACTUAL" ] && [ "$(echo "$ACTUAL - $THRESHOLD > 10" | bc 2>/dev/null)" = "1" ]; then |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Description: Check if bc is available in common execution environments
# Check local environment
echo "=== Local environment ==="
which bc && bc --version || echo "bc not found"
# Check if bc is listed in DevContainer features or installed packages
echo ""
echo "=== DevContainer configuration ==="
if [ -f ".devcontainer/devcontainer.json" ]; then
jq -r '.features // {} | keys[]' .devcontainer/devcontainer.json 2>/dev/null
fi
# Check GitHub Actions workflow for bc installation
echo ""
echo "=== GitHub Actions workflows ==="
grep -rn "apt-get install.*bc\|apk add.*bc" .github/workflows/ 2>/dev/null || echo "No explicit bc installation found in workflows"Repository: keito4/config
Length of output: 915
🏁 Script executed:
#!/bin/bash
set -euo pipefail
# Locate bc usage in the cited script file and show surrounding lines
echo "=== bc usage in repo-maintenance.md ==="
rg -n '\bbc\b' .claude/commands/repo-maintenance.md || true
echo "--- context around first match (if any) ---"
rg -n '\bbc\b' .claude/commands/repo-maintenance.md | head -n 5 | cut -d: -f1 | head -n 1 | \
awk -v file=".claude/commands/repo-maintenance.md" '{start=$1-5; if(start<1)start=1; end=$1+5; print "----- lines " start "-" end " -----"; system("sed -n \"" start "," end "p\" " file)}'
# Show the exact line/snippet around the provided line number (2782)
echo
echo "=== Exact snippet around line 2782 ==="
sed -n '2775,2790p' .claude/commands/repo-maintenance.md
# Check for any bc installation hints in DevContainer / workflows (more targeted)
echo
echo "=== DevContainer files mentioning bc ==="
fd -a devcontainer.json .devcontainer 2>/dev/null || true
rg -n '\bbc\b' .devcontainer 2>/dev/null || true
echo
echo "=== Workflow files mentioning bc installation ==="
rg -n 'apt-get.*bc|apk.*bc|brew.*bc|Install.*bc' .github/workflows 2>/dev/null || trueRepository: keito4/config
Length of output: 1624
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "=== DevContainer config files ==="
ls -la .devcontainer || true
echo
for f in .devcontainer/devcontainer.json .devcontainer/codespaces/devcontainer.json; do
if [ -f "$f" ]; then
echo "----- $f -----"
sed -n '1,200p' "$f"
echo
fi
done
echo "=== Any bc mentions in .devcontainer/ ==="
rg -n '\bbc\b' .devcontainer || true
echo
echo "=== Any package-manager installs in .devcontainer/ (bc-related patterns) ==="
rg -n 'apt-get.*(install|update)|apk add|yum install|dnf install|brew install' .devcontainer || true
echo
echo "=== Any bc mentions in workflow / scripts ==="
rg -n '\bbc\b' .github/workflows .github/scripts . || trueRepository: keito4/config
Length of output: 7241
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "=== Search for bc installation hints in the repo ==="
rg -n '\bapt-get\b.*\bbc\b|\bapk\b.*\bbc\b|\bbrew\b.*\bbc\b|\binstall\b.*\bbc\b|\bc\+.*\bbc\b' . || true
echo
echo "=== Search for any use of 'bc' (wide scan) ==="
rg -n '\bbc\b' . | head -n 80
echo
echo "=== Inspect .devcontainer/Dockerfile apt-get install section ==="
sed -n '1,120p' .devcontainer/Dockerfile
echo
sed -n '120,240p' .devcontainer/DockerfileRepository: keito4/config
Length of output: 12168
Ensure bc is installed or guard with an awk fallback for float gap checks
.claude/commands/repo-maintenance.md:2782 relies on bc for the "$ACTUAL - $THRESHOLD > 10" comparison, but .devcontainer/Dockerfile doesn’t install bc and there’s no explicit bc install found in workflows—if bc is missing, the check silently won’t fire because stderr is suppressed and the comparison becomes false.
Fix by either installing bc in the DevContainer/CI image, or falling back when it’s unavailable:
if ! command -v bc >/dev/null 2>&1; then
gap=$(awk -v a="$ACTUAL" -v t="$THRESHOLD" 'BEGIN {print (a - t > 10) ? "1" : "0"}')
[ "$gap" = "1" ] && ISSUES+=("coverage 実測 ${ACTUAL}% に対し閾値 ${THRESHOLD}%（乖離 10pt 超）→ ラチェット引き上げを推奨")
else
if [ "$(echo "$ACTUAL - $THRESHOLD > 10" | bc 2>/dev/null)" = "1" ]; then
ISSUES+=("coverage 実測 ${ACTUAL}% に対し閾値 ${THRESHOLD}%（乖離 10pt 超）→ ラチェット引き上げを推奨")
fi
fi🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.claude/commands/repo-maintenance.md at line 2782, The check using bc in the
conditional that reads 'elif [ -n "$ACTUAL" ] && [ "$(echo "$ACTUAL - $THRESHOLD
> 10" | bc 2>/dev/null)" = "1" ]; then' can silently fail if bc is not
installed; update this to either ensure bc is available in CI/devcontainer or
wrap the numeric gap check with a fallback that uses awk when bc is missing
(detect via command -v bc), keeping the existing behavior of appending to ISSUES
when ACTUAL - THRESHOLD > 10; modify the conditional around ACTUAL/THRESHOLD to
first branch on bc presence and otherwise compute the boolean with awk and
compare to "1" before adding the same ISSUES entry.
|
🎉 This PR is included in version 1.116.0 🎉 The release is available on GitHub release Your semantic-release bot 📦🚀 |
1 participant
Summary
Elu-co-jp 配下 10 リポジトリの横断監査で頻出した運用課題（ブランチ保護の片輪設定、CI 非ブロッキング品質チェック、カバレッジ閾値の形骸化など）を
/repo-maintenanceで機械的に検出・修正できるよう、9 つのチェックを追加・強化する。Why
横断監査の結果、リポジトリごとに以下のパターンが繰り返し発生していた：
continue-on-error: trueで実質非ブロッキング個別リポジトリの手直しではなく、定期メンテナンスのチェックリスト側に組み込むことで再発を防ぐ。
What
delete_branch_on_mergeの確認・full mode 自動修正continue-on-error検出How to test
npx prettier --check .claude/commands/repo-maintenance.mdが通る（コミット時の pre-commit で確認済み）/repo-maintenance --mode check-onlyを実行し、新チェックが読み取り専用で動作することを確認Checklist
Related
Elu-co-jp 配下 10 リポジトリの横断監査（2026-06-11 実施）の知見を反映
🤖 Generated with Claude Code
Summary by CodeRabbit