From 34b177fd6b8662feb261edf86749c2acc193cfe3 Mon Sep 17 00:00:00 2001 From: pi-kari <79442987+pi-kari@users.noreply.github.com> Date: Fri, 29 May 2026 22:28:58 +0900 Subject: [PATCH 1/5] ci: bump GitHub Actions to latest major versions MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - pnpm/action-setup v4 → v6（version 入力削除、packageManager フィールドに一本化） - actions/setup-node v4 → v6 - actions/upload-pages-artifact v3 → v5（include-hidden-files: true 追加、.nojekyll 維持） - actions/deploy-pages v4 → v5 - dependabot/fetch-metadata v2.5.0 → v3.1.0（SHA 固定更新） Closes #31 #32 #33 #34 #35 Co-Authored-By: Claude Opus 4.8 (1M context) --- .github/workflows/ci.yml | 6 ++---- .github/workflows/dependabot-auto-merge.yml | 2 +- .github/workflows/deploy.yml | 11 +++++------ 3 files changed, 8 insertions(+), 11 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index b1d6e3a..ff7bb0d 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -11,11 +11,9 @@ jobs: steps: - uses: actions/checkout@v4 - - uses: pnpm/action-setup@v4 - with: - version: 11.2.2 + - uses: pnpm/action-setup@v6 - - uses: actions/setup-node@v4 + - uses: actions/setup-node@v6 with: node-version: 22 cache: pnpm diff --git a/.github/workflows/dependabot-auto-merge.yml b/.github/workflows/dependabot-auto-merge.yml index 2298fb6..0271dd9 100644 --- a/.github/workflows/dependabot-auto-merge.yml +++ b/.github/workflows/dependabot-auto-merge.yml @@ -13,7 +13,7 @@ jobs: steps: - name: Fetch Dependabot metadata id: metadata - uses: dependabot/fetch-metadata@21025c705c08248db411dc16f3619e6b5f9ea21a # v2.5.0 + uses: dependabot/fetch-metadata@25dd0e34f4fe68f24cc83900b1fe3fe149efef98 # v3.1.0 with: github-token: ${{ secrets.GITHUB_TOKEN }} diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml index 0b27503..899196b 100644 --- a/.github/workflows/deploy.yml +++ b/.github/workflows/deploy.yml @@ -20,11 +20,9 @@ jobs: steps: - uses: actions/checkout@v4 - - uses: pnpm/action-setup@v4 - with: - version: 11.2.2 + - uses: pnpm/action-setup@v6 - - uses: actions/setup-node@v4 + - uses: actions/setup-node@v6 with: node-version: 22 cache: pnpm @@ -40,9 +38,10 @@ jobs: - name: Add .nojekyll run: touch out/.nojekyll - - uses: actions/upload-pages-artifact@v3 + - uses: actions/upload-pages-artifact@v5 with: path: ./out + include-hidden-files: true deploy: needs: build @@ -53,4 +52,4 @@ jobs: steps: - name: Deploy to GitHub Pages id: deployment - uses: actions/deploy-pages@v4 + uses: actions/deploy-pages@v5 From bf593e21608380bc6a4da7442e84962b191e24d6 Mon Sep 17 00:00:00 2001 From: pi-kari <79442987+pi-kari@users.noreply.github.com> Date: Fri, 29 May 2026 22:45:27 +0900 Subject: [PATCH 2/5] =?UTF-8?q?ci:=20deploy=20=E3=82=92=E9=80=B1=E6=AC=A1?= =?UTF-8?q?=20schedule=20=E3=81=A7=E3=82=82=E5=AE=9F=E8=A1=8C=E3=81=97?= =?UTF-8?q?=E3=82=AA=E3=83=BC=E3=83=88=E3=83=9E=E3=83=BC=E3=82=B8=E5=88=86?= =?UTF-8?q?=E3=82=92=E5=8F=8D=E6=98=A0?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit GITHUB_TOKEN によるオートマージの push は deploy をトリガーしない仕様のため、 オートマージされた依存更新が GitHub Pages へ反映されていなかった。 - deploy.yml: push に加え週次 cron（月曜 00:00 UTC = 09:00 JST）と workflow_dispatch で実行 - dependabot.yml: 週次実行を月曜 06:00 JST に固定し、約3時間後の週次デプロイと連動 Co-Authored-By: Claude Opus 4.8 (1M context) --- .github/dependabot.yml | 6 ++++++ .github/workflows/deploy.yml | 5 +++++ 2 files changed, 11 insertions(+) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 5c3a96a..44279c8 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -5,6 +5,9 @@ updates: directory: "/" schedule: interval: weekly + day: monday + time: "06:00" + timezone: "Asia/Tokyo" open-pull-requests-limit: 10 groups: # Bundle non-major updates into a single PR to reduce noise @@ -18,6 +21,9 @@ updates: directory: "/" schedule: interval: weekly + day: monday + time: "06:00" + timezone: "Asia/Tokyo" groups: github-actions: update-types: diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml index 899196b..5880f9e 100644 --- a/.github/workflows/deploy.yml +++ b/.github/workflows/deploy.yml @@ -3,6 +3,11 @@ name: Deploy to GitHub Pages on: push: branches: [main] + schedule: + # 毎週月曜 00:00 UTC（= 月曜 09:00 JST）。 + # GITHUB_TOKEN によるオートマージの push は deploy をトリガーしないため、 + # Dependabot 週次実行（月曜 06:00 JST）+ オートマージ完了の数時間後にまとめてデプロイする。 + - cron: "0 0 * * 1" workflow_dispatch: permissions: From ddacd375deaefecea465dfbb77cca1f24b635242 Mon Sep 17 00:00:00 2001 From: pi-kari <79442987+pi-kari@users.noreply.github.com> Date: Fri, 29 May 2026 23:00:28 +0900 Subject: [PATCH 3/5] =?UTF-8?q?fix(security):=20postcss=20transitive=20?= =?UTF-8?q?=E8=84=86=E5=BC=B1=E6=80=A7=E3=82=92=20overrides=20=E3=81=A7?= =?UTF-8?q?=E4=BF=AE=E6=AD=A3=20+=20=E8=87=AA=E5=8B=95=E5=8C=96=E3=83=AF?= =?UTF-8?q?=E3=83=BC=E3=82=AF=E3=83=95=E3=83=AD=E3=83=BC=E8=BF=BD=E5=8A=A0?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit ## 即時修正 - pnpm-workspace.yaml に `pnpm audit --fix=override` で生成した overrides を追加 - postcss@<8.5.10 を >=8.5.10 に強制 (next@16.2.6 の transitive @8.4.31 を排除) - pnpm-lock.yaml を更新 (postcss@8.4.31 のエントリが消滅) ## 自動化 - security-auto-fix.yml を追加 (週次月曜 10:00 JST / workflow_dispatch) - pnpm audit --fix=override → pnpm install → pnpm build 検証 → PR 作成まで自動 - Dependabot が直せない transitive 脆弱性への恒久対策 Closes #1 (Dependabot security alert: postcss medium) Co-Authored-By: Claude Opus 4.8 (1M context) --- .github/workflows/security-auto-fix.yml | 78 +++++++++++++++++++++++++ pnpm-lock.yaml | 15 ++--- pnpm-workspace.yaml | 4 ++ 3 files changed, 86 insertions(+), 11 deletions(-) create mode 100644 .github/workflows/security-auto-fix.yml diff --git a/.github/workflows/security-auto-fix.yml b/.github/workflows/security-auto-fix.yml new file mode 100644 index 0000000..1171699 --- /dev/null +++ b/.github/workflows/security-auto-fix.yml @@ -0,0 +1,78 @@ +name: Security auto-fix + +on: + schedule: + # 毎週月曜 01:00 UTC（= 10:00 JST）。 + # Dependabot が直せない transitive 依存の脆弱性を pnpm audit --fix=override で自動修正し PR を作成する。 + - cron: "0 1 * * 1" + workflow_dispatch: + +permissions: + contents: write + pull-requests: write + +jobs: + audit-fix: + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v4 + + - uses: pnpm/action-setup@v6 + + - uses: actions/setup-node@v6 + with: + node-version: 22 + cache: pnpm + + - name: Install dependencies + run: pnpm install --frozen-lockfile + + - name: Apply pnpm audit fixes + run: pnpm audit --fix=override || true + + - name: Sync lockfile + run: pnpm install --no-frozen-lockfile + + - name: Detect changes + id: diff + run: | + if git diff --quiet; then + echo "changed=false" >> "$GITHUB_OUTPUT" + else + echo "changed=true" >> "$GITHUB_OUTPUT" + fi + + - name: Verify build + if: steps.diff.outputs.changed == 'true' + run: pnpm build + + - name: Create or update PR + if: steps.diff.outputs.changed == 'true' + env: + GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} + run: | + BRANCH=security/audit-fix + git config user.name "github-actions[bot]" + git config user.email "41898282+github-actions[bot]@users.noreply.github.com" + git checkout -b "$BRANCH" + git add pnpm-workspace.yaml pnpm-lock.yaml + git commit -m "fix(security): apply pnpm audit --fix=override" + git push -f origin "$BRANCH" + gh pr view "$BRANCH" --json number > /dev/null 2>&1 \ + || gh pr create --base main --head "$BRANCH" \ + --title "fix(security): pnpm audit --fix=override による脆弱性修正" \ + --body "$(cat <<'BODY' +## 概要 + +\`pnpm audit --fix=override\` を実行し、Dependabot が直せない transitive 依存の脆弱性を \`pnpm-workspace.yaml\` の \`overrides\` で修正しました。 + +## 検証済み + +- ワークフロー内で \`pnpm build\` が成功していることを確認済み。 + +## 注意 + +このPRは \`GITHUB_TOKEN\` によって作成されているため、\`CI / build\` チェックが自動実行されません。 +管理者はワークフローの build ログを確認のうえ、手動でマージしてください。 +BODY +)" diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index b4aa370..b7839c6 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -4,6 +4,9 @@ settings: autoInstallPeers: true excludeLinksFromLockfile: false +overrides: + postcss@<8.5.10: ^8.5.10 + importers: .: @@ -580,10 +583,6 @@ packages: picocolors@1.1.1: resolution: {integrity: sha512-xceH2snhtb5M9liqDsmEw56le376mTZkEX/jEb/RxNFyegNul7eNslCXP9FDj/Lcu0X8KEyMceP2ntpaHrDEVA==} - postcss@8.4.31: - resolution: {integrity: sha512-PS08Iboia9mts/2ygV3eLpY5ghnUcfLV/EXTOW1E2qYxJKGGBUtNjN76FYHnMs36RmARn41bC0AZmn+rR0OVpQ==} - engines: {node: ^10 || ^12 || >=14} - postcss@8.5.15: resolution: {integrity: sha512-FfR8sjd4em2T6fb3I2MwAJU7HWVMr9zba+enmQeeWFfCbm+UOC/0X4DS8XtpUTMwWMGbjKYP7xjfNekzyGmB3A==} engines: {node: ^10 || ^12 || >=14} @@ -1004,7 +1003,7 @@ snapshots: '@swc/helpers': 0.5.15 baseline-browser-mapping: 2.10.31 caniuse-lite: 1.0.30001793 - postcss: 8.4.31 + postcss: 8.5.15 react: 19.2.6 react-dom: 19.2.6(react@19.2.6) styled-jsx: 5.1.6(react@19.2.6) @@ -1024,12 +1023,6 @@ snapshots: picocolors@1.1.1: {} - postcss@8.4.31: - dependencies: - nanoid: 3.3.12 - picocolors: 1.1.1 - source-map-js: 1.2.1 - postcss@8.5.15: dependencies: nanoid: 3.3.12 diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml index 520eb9a..2ab611a 100644 --- a/pnpm-workspace.yaml +++ b/pnpm-workspace.yaml @@ -1,2 +1,6 @@ allowBuilds: sharp: true +minimumReleaseAgeExclude: + - postcss@8.5.10 +overrides: + postcss@<8.5.10: ^8.5.10 From ed3c7db86864ab9d4c0effebcb77e005110f6a2d Mon Sep 17 00:00:00 2001 From: pi-kari <79442987+pi-kari@users.noreply.github.com> Date: Fri, 29 May 2026 23:16:44 +0900 Subject: [PATCH 4/5] =?UTF-8?q?fix:=20security-auto-fix.yml=20=E3=81=AE=20?= =?UTF-8?q?YAML=20=E4=B8=8D=E6=AD=A3=E3=81=A8=E3=83=AD=E3=82=B8=E3=83=83?= =?UTF-8?q?=E3=82=AF=E3=83=90=E3=82=B0=E3=82=92=E4=BF=AE=E6=AD=A3?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - heredoc によるYAMLパースエラーを解消（--body を単一行文字列に変更） - gh pr view → gh pr list --state open の件数判定に変更 （マージ済み PR にマッチして PR 作成がスキップされるバグを修正） - git checkout -b → -B（冪等性の改善） Co-Authored-By: Claude Opus 4.8 (1M context) --- .github/workflows/security-auto-fix.yml | 25 ++++++------------------- 1 file changed, 6 insertions(+), 19 deletions(-) diff --git a/.github/workflows/security-auto-fix.yml b/.github/workflows/security-auto-fix.yml index 1171699..ebae925 100644 --- a/.github/workflows/security-auto-fix.yml +++ b/.github/workflows/security-auto-fix.yml @@ -54,25 +54,12 @@ jobs: BRANCH=security/audit-fix git config user.name "github-actions[bot]" git config user.email "41898282+github-actions[bot]@users.noreply.github.com" - git checkout -b "$BRANCH" + git checkout -B "$BRANCH" git add pnpm-workspace.yaml pnpm-lock.yaml git commit -m "fix(security): apply pnpm audit --fix=override" git push -f origin "$BRANCH" - gh pr view "$BRANCH" --json number > /dev/null 2>&1 \ - || gh pr create --base main --head "$BRANCH" \ - --title "fix(security): pnpm audit --fix=override による脆弱性修正" \ - --body "$(cat <<'BODY' -## 概要 - -\`pnpm audit --fix=override\` を実行し、Dependabot が直せない transitive 依存の脆弱性を \`pnpm-workspace.yaml\` の \`overrides\` で修正しました。 - -## 検証済み - -- ワークフロー内で \`pnpm build\` が成功していることを確認済み。 - -## 注意 - -このPRは \`GITHUB_TOKEN\` によって作成されているため、\`CI / build\` チェックが自動実行されません。 -管理者はワークフローの build ログを確認のうえ、手動でマージしてください。 -BODY -)" + if [ "$(gh pr list --head "$BRANCH" --state open --json number --jq 'length')" = "0" ]; then + gh pr create --base main --head "$BRANCH" \ + --title "fix(security): pnpm audit --fix=override による脆弱性修正" \ + --body "pnpm audit --fix=override が overrides を自動追加しました。ワークフロー内で pnpm build 検証済み。GITHUB_TOKEN 作成のため CI/build チェックは自動実行されません。管理者がログを確認のうえ手動マージしてください。" + fi From 19e284562172ba43b01157fbed4e1d1d69909348 Mon Sep 17 00:00:00 2001 From: pi-kari <79442987+pi-kari@users.noreply.github.com> Date: Fri, 29 May 2026 23:57:55 +0900 Subject: [PATCH 5/5] =?UTF-8?q?ci:=20security-auto-fix=20=E3=82=92?= =?UTF-8?q?=E6=9C=AC=E3=83=96=E3=83=A9=E3=83=B3=E3=83=81=E3=81=8B=E3=82=89?= =?UTF-8?q?=E5=88=86=E9=9B=A2=E3=81=97=20dead=20config=20=E3=82=92?= =?UTF-8?q?=E5=89=8A=E9=99=A4?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - security-auto-fix.yml を削除（修正版は別ブランチ/PR で扱う） - pnpm-workspace.yaml: minimumReleaseAge 未設定で no-op の minimumReleaseAgeExclude を削除（postcss overrides は維持） Co-Authored-By: Claude Opus 4.8 (1M context) --- .github/workflows/security-auto-fix.yml | 65 ------------------------- pnpm-workspace.yaml | 2 - 2 files changed, 67 deletions(-) delete mode 100644 .github/workflows/security-auto-fix.yml diff --git a/.github/workflows/security-auto-fix.yml b/.github/workflows/security-auto-fix.yml deleted file mode 100644 index ebae925..0000000 --- a/.github/workflows/security-auto-fix.yml +++ /dev/null @@ -1,65 +0,0 @@ -name: Security auto-fix - -on: - schedule: - # 毎週月曜 01:00 UTC（= 10:00 JST）。 - # Dependabot が直せない transitive 依存の脆弱性を pnpm audit --fix=override で自動修正し PR を作成する。 - - cron: "0 1 * * 1" - workflow_dispatch: - -permissions: - contents: write - pull-requests: write - -jobs: - audit-fix: - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@v4 - - - uses: pnpm/action-setup@v6 - - - uses: actions/setup-node@v6 - with: - node-version: 22 - cache: pnpm - - - name: Install dependencies - run: pnpm install --frozen-lockfile - - - name: Apply pnpm audit fixes - run: pnpm audit --fix=override || true - - - name: Sync lockfile - run: pnpm install --no-frozen-lockfile - - - name: Detect changes - id: diff - run: | - if git diff --quiet; then - echo "changed=false" >> "$GITHUB_OUTPUT" - else - echo "changed=true" >> "$GITHUB_OUTPUT" - fi - - - name: Verify build - if: steps.diff.outputs.changed == 'true' - run: pnpm build - - - name: Create or update PR - if: steps.diff.outputs.changed == 'true' - env: - GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} - run: | - BRANCH=security/audit-fix - git config user.name "github-actions[bot]" - git config user.email "41898282+github-actions[bot]@users.noreply.github.com" - git checkout -B "$BRANCH" - git add pnpm-workspace.yaml pnpm-lock.yaml - git commit -m "fix(security): apply pnpm audit --fix=override" - git push -f origin "$BRANCH" - if [ "$(gh pr list --head "$BRANCH" --state open --json number --jq 'length')" = "0" ]; then - gh pr create --base main --head "$BRANCH" \ - --title "fix(security): pnpm audit --fix=override による脆弱性修正" \ - --body "pnpm audit --fix=override が overrides を自動追加しました。ワークフロー内で pnpm build 検証済み。GITHUB_TOKEN 作成のため CI/build チェックは自動実行されません。管理者がログを確認のうえ手動マージしてください。" - fi diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml index 2ab611a..7438791 100644 --- a/pnpm-workspace.yaml +++ b/pnpm-workspace.yaml @@ -1,6 +1,4 @@ allowBuilds: sharp: true -minimumReleaseAgeExclude: - - postcss@8.5.10 overrides: postcss@<8.5.10: ^8.5.10