From 275ca012cb005c288e192e4b3399e949b9d8fa72 Mon Sep 17 00:00:00 2001
From: Takayuki Ueno <mail@kichi2004.jp>
Date: Fri, 2 Oct 2026 17:20:01 +0900
Subject: [PATCH] =?UTF-8?q?ci:=20GitHub=20Actions=20=E3=81=A7=20test=20/?=
 =?UTF-8?q?=20lint=20(Brakeman,=20bundler-audit)=20=E3=82=92=E5=AE=9F?=
 =?UTF-8?q?=E8=A1=8C?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
---
 .github/workflows/ci.yml | 61 ++++++++++++++++++++++++++++++++++++++++
 Gemfile                  |  3 ++
 Gemfile.lock             |  9 +++++-
 test/test_helper.rb      |  8 ++++++
 4 files changed, 80 insertions(+), 1 deletion(-)
 create mode 100644 .github/workflows/ci.yml

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
new file mode 100644
index 0000000..1223438
--- /dev/null
+++ b/.github/workflows/ci.yml
@@ -0,0 +1,61 @@
+name: CI
+
+on:
+  push:
+    branches: [master]
+  pull_request:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ci-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  lint:
+    name: Lint (Brakeman / bundler-audit)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: ruby/setup-ruby@v1
+        with:
+          ruby-version: .ruby-version
+          bundler-cache: true
+      - name: Brakeman
+        run: bundle exec brakeman --no-pager --quiet -w3
+      - name: bundler-audit
+        run: bundle exec bundle-audit check --update
+
+  test:
+    name: Test
+    runs-on: ubuntu-latest
+    services:
+      mysql:
+        image: mysql:8.0
+        env:
+          MYSQL_ROOT_PASSWORD: password
+        ports:
+          - 3306:3306
+        options: >-
+          --health-cmd="mysqladmin ping -h 127.0.0.1 -ppassword"
+          --health-interval=10s
+          --health-timeout=5s
+          --health-retries=10
+    env:
+      RAILS_ENV: test
+      DATABASE_HOST: 127.0.0.1
+      DATABASE_USER: root
+      DATABASE_PASSWORD: password
+    steps:
+      - uses: actions/checkout@v4
+      - name: Install MySQL client library
+        run: sudo apt-get update && sudo apt-get install -y libmysqlclient-dev
+      - uses: ruby/setup-ruby@v1
+        with:
+          ruby-version: .ruby-version
+          bundler-cache: true
+      - name: Set up database
+        run: bin/rails db:create db:schema:load
+      - name: Run tests
+        run: bin/rails test
diff --git a/Gemfile b/Gemfile
index 14d8af3..7f67452 100644
--- a/Gemfile
+++ b/Gemfile
@@ -29,6 +29,9 @@ gem 'bootsnap', '>= 1.4.2', require: false
 
 group :development, :test do
   gem 'debug', platforms: [:mri, :mingw, :x64_mingw]
+  # 静的解析 / 脆弱性チェック (CI で実行)
+  gem 'brakeman', require: false
+  gem 'bundler-audit', require: false
 end
 
 # Windows does not include zoneinfo files, so bundle the tzinfo-data gem
diff --git a/Gemfile.lock b/Gemfile.lock
index 4c0ea17..b89d537 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -91,7 +91,12 @@ GEM
       blueprinter (~> 1.0)
     bootsnap (1.26.0)
       msgpack (~> 1.5)
+    brakeman (8.1.0)
+      racc
     builder (3.3.0)
+    bundler-audit (0.9.3)
+      bundler (>= 1.2.0)
+      thor (~> 1.0)
     case_transform (0.2)
       activesupport
     concurrent-ruby (1.3.8)
@@ -347,6 +352,8 @@ DEPENDENCIES
   blueprinter (~> 1.1)
   blueprinter-activerecord (~> 1.3)
   bootsnap (>= 1.4.2)
+  brakeman
+  bundler-audit
   concurrent-ruby (~> 1.3)
   debug
   devise (~> 5.0)
@@ -371,4 +378,4 @@ RUBY VERSION
   ruby 4.0.6
 
 BUNDLED WITH
-  4.0.20
+  4.0.16
diff --git a/test/test_helper.rb b/test/test_helper.rb
index 66797df..5c55f92 100644
--- a/test/test_helper.rb
+++ b/test/test_helper.rb
@@ -2,6 +2,14 @@
 require_relative '../config/environment'
 require 'rails/test_help'
 
+# GCS の credentials を持たない環境 (CI など) では実クライアントの読み込みが
+# 失敗するため、テスト用のスタブモジュールで代替する。
+unless Rails.application.credentials.gcs
+  Utils.const_set(:GoogleCloudStorageClient, Module.new do
+    def self.get_source(_path) = raise NotImplementedError, 'stub in tests'
+  end)
+end
+
 # Load support files
 Dir[Rails.root.join('test/support/**/*.rb')].each { |f| require f }