ci: GitHub Actions で test / lint を実行

.github/workflows/ci.yml

@@ -0,0 +1,61 @@
+name: CI
+
+on:
+  push:
+    branches: [master]
+  pull_request:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ci-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  lint:
+    name: Lint (Brakeman / bundler-audit)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: ruby/setup-ruby@v1
+        with:
+          ruby-version: .ruby-version
+          bundler-cache: true
+      - name: Brakeman
+        run: bundle exec brakeman --no-pager --quiet -w3
+      - name: bundler-audit
+        run: bundle exec bundle-audit check --update
+
+  test:
+    name: Test
+    runs-on: ubuntu-latest
+    services:
+      mysql:
+        image: mysql:8.0
+        env:
+          MYSQL_ROOT_PASSWORD: password
+        ports:
+          - 3306:3306
+        options: >-
+          --health-cmd="mysqladmin ping -h 127.0.0.1 -ppassword"
+          --health-interval=10s
+          --health-timeout=5s
+          --health-retries=10
+    env:
+      RAILS_ENV: test
+      DATABASE_HOST: 127.0.0.1
+      DATABASE_USER: root
+      DATABASE_PASSWORD: password
+    steps:
+      - uses: actions/checkout@v4
+      - name: Install MySQL client library
+        run: sudo apt-get update && sudo apt-get install -y libmysqlclient-dev
+      - uses: ruby/setup-ruby@v1
+        with:
+          ruby-version: .ruby-version
+          bundler-cache: true
+      - name: Set up database
+        run: bin/rails db:create db:schema:load
+      - name: Run tests
+        run: bin/rails test

Gemfile

@@ -29,6 +29,9 @@ gem 'bootsnap', '>= 1.4.2', require: false
 
 group :development, :test do
   gem 'debug', platforms: [:mri, :mingw, :x64_mingw]
+  # 静的解析 / 脆弱性チェック (CI で実行)
+  gem 'brakeman', require: false
+  gem 'bundler-audit', require: false
 end
 
 # Windows does not include zoneinfo files, so bundle the tzinfo-data gem

Gemfile.lock

@@ -91,7 +91,12 @@ GEM
       blueprinter (~> 1.0)
     bootsnap (1.26.0)
       msgpack (~> 1.5)
+    brakeman (8.1.0)
+      racc
     builder (3.3.0)
+    bundler-audit (0.9.3)
+      bundler (>= 1.2.0)
+      thor (~> 1.0)
     case_transform (0.2)
       activesupport
     concurrent-ruby (1.3.8)
@@ -347,6 +352,8 @@ DEPENDENCIES
   blueprinter (~> 1.1)
   blueprinter-activerecord (~> 1.3)
   bootsnap (>= 1.4.2)
+  brakeman
+  bundler-audit
   concurrent-ruby (~> 1.3)
   debug
   devise (~> 5.0)
@@ -371,4 +378,4 @@ RUBY VERSION
   ruby 4.0.6
 
 BUNDLED WITH
-  4.0.20
+  4.0.16

test/test_helper.rb

@@ -2,6 +2,14 @@
 require_relative '../config/environment'
 require 'rails/test_help'
 
+# GCS の credentials を持たない環境 (CI など) では実クライアントの読み込みが
+# 失敗するため、テスト用のスタブモジュールで代替する。
+unless Rails.application.credentials.gcs
+  Utils.const_set(:GoogleCloudStorageClient, Module.new do
+    def self.get_source(_path) = raise NotImplementedError, 'stub in tests'
+  end)
+end
+
 # Load support files
 Dir[Rails.root.join('test/support/**/*.rb')].each { |f| require f }