From 99951b2dd8fe5bf7c245a41aff1c80a7035900aa Mon Sep 17 00:00:00 2001 From: Claude Date: Mon, 22 Jun 2026 16:35:25 +0000 Subject: [PATCH 1/3] =?UTF-8?q?ci:=20zizmor=E3=82=92PR=E6=99=82=E3=81=AE?= =?UTF-8?q?=E3=81=BF=E5=AE=9F=E8=A1=8C=E3=81=97SARIF=E3=82=A2=E3=83=83?= =?UTF-8?q?=E3=83=97=E3=83=AD=E3=83=BC=E3=83=89=E3=82=92=E7=84=A1=E5=8A=B9?= =?UTF-8?q?=E5=8C=96?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit actions-lintジョブがpush時にCode Scanningへ SARIFをアップロードしようとしてsecurity-events: write権限が なく失敗していた問題を修正。 - actions-lintジョブをpull_requestイベント時のみ実行 - zizmorのadvanced-securityをfalseにしSARIFアップロードを無効化 Co-Authored-By: Claude Opus 4.8 Claude-Session: https://claude.ai/code/session_01DN6h2VoLhQM3BvEvCAHWQu --- .github/workflows/ci.yml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 4510385..cdbacfe 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -10,6 +10,8 @@ permissions: {} jobs: actions-lint: + # zizmorはセキュリティ観点のチェックのため、PR時のみ実行する + if: github.event_name == 'pull_request' runs-on: ubuntu-latest permissions: contents: read @@ -26,6 +28,8 @@ jobs: uses: zizmorcore/zizmor-action@71321a20a9ded102f6e9ce5718a2fcec2c4f70d8 # v0.5.2 with: min-severity: informational + # SARIFをCode Scanningへアップロードしない（security-events: write権限が不要になる） + advanced-security: false lint: runs-on: ubuntu-latest permissions: From e196efcdc9b68dfba7abe4917a9225e2a17d04d5 Mon Sep 17 00:00:00 2001 From: Claude Date: Mon, 22 Jun 2026 16:45:18 +0000 Subject: [PATCH 2/3] =?UTF-8?q?ci:=20zizmor=E3=81=AEfindings=E3=82=92?= =?UTF-8?q?=E8=A7=A3=E6=B6=88=E3=81=97=E3=81=A6actions-lint=E3=82=92?= =?UTF-8?q?=E3=83=91=E3=82=B9=E3=81=95=E3=81=9B=E3=82=8B?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit advanced-securityを無効化したことでzizmorが検出結果ありで exitするようになったため、既存のfindingsを修正: - ref-version-mismatch: setup-bunのバージョンコメントを実タグ v2.1.2に修正（SHAはv2.1.2を指すがコメントはv2だった） - cache-poisoning: publish.ymlのsetup-bunにno-cache: trueを追加。 setup-nodeはcache未設定で実害がないため抑制コメントを付与 Co-Authored-By: Claude Opus 4.8 Claude-Session: https://claude.ai/code/session_01DN6h2VoLhQM3BvEvCAHWQu --- .github/workflows/ci.yml | 10 +++++----- .github/workflows/publish.yml | 11 ++++++++--- 2 files changed, 13 insertions(+), 8 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index cdbacfe..e116fa8 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -39,7 +39,7 @@ jobs: with: persist-credentials: false - - uses: oven-sh/setup-bun@3d267786b128fe76c2f16a390aa2448b815359f3 # v2 + - uses: oven-sh/setup-bun@3d267786b128fe76c2f16a390aa2448b815359f3 # v2.1.2 with: bun-version: "1.3.9" @@ -61,7 +61,7 @@ jobs: with: persist-credentials: false - - uses: oven-sh/setup-bun@3d267786b128fe76c2f16a390aa2448b815359f3 # v2 + - uses: oven-sh/setup-bun@3d267786b128fe76c2f16a390aa2448b815359f3 # v2.1.2 with: bun-version: "1.3.9" @@ -80,7 +80,7 @@ jobs: with: persist-credentials: false - - uses: oven-sh/setup-bun@3d267786b128fe76c2f16a390aa2448b815359f3 # v2 + - uses: oven-sh/setup-bun@3d267786b128fe76c2f16a390aa2448b815359f3 # v2.1.2 with: bun-version: "1.3.9" @@ -102,7 +102,7 @@ jobs: with: persist-credentials: false - - uses: oven-sh/setup-bun@3d267786b128fe76c2f16a390aa2448b815359f3 # v2 + - uses: oven-sh/setup-bun@3d267786b128fe76c2f16a390aa2448b815359f3 # v2.1.2 with: bun-version: "1.3.9" @@ -121,7 +121,7 @@ jobs: with: persist-credentials: false - - uses: oven-sh/setup-bun@3d267786b128fe76c2f16a390aa2448b815359f3 # v2 + - uses: oven-sh/setup-bun@3d267786b128fe76c2f16a390aa2448b815359f3 # v2.1.2 with: bun-version: "1.3.9" diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index 70845ca..85fcf4b 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -48,9 +48,11 @@ jobs: with: persist-credentials: false - - uses: oven-sh/setup-bun@3d267786b128fe76c2f16a390aa2448b815359f3 # v2 + - uses: oven-sh/setup-bun@3d267786b128fe76c2f16a390aa2448b815359f3 # v2.1.2 with: bun-version: "1.3.9" + # リリースワークフローではキャッシュ汚染を避けるためキャッシュを無効化する + no-cache: true - name: Install dependencies run: bun install --frozen-lockfile @@ -72,9 +74,11 @@ jobs: with: persist-credentials: false - - uses: oven-sh/setup-bun@3d267786b128fe76c2f16a390aa2448b815359f3 # v2 + - uses: oven-sh/setup-bun@3d267786b128fe76c2f16a390aa2448b815359f3 # v2.1.2 with: bun-version: "1.3.9" + # リリースワークフローではキャッシュ汚染を避けるためキャッシュを無効化する + no-cache: true - name: Install dependencies run: bun install --frozen-lockfile @@ -82,7 +86,8 @@ jobs: - name: Build run: bun run build - - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0 + # cacheを設定しておらず実際のキャッシュ復元は行わないため抑制する + - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0 # zizmor: ignore[cache-poisoning] with: node-version: '24' registry-url: 'https://registry.npmjs.org' From d2e7537775fa6119482a6173c217f3497869c2d3 Mon Sep 17 00:00:00 2001 From: Claude Date: Mon, 22 Jun 2026 16:53:52 +0000 Subject: [PATCH 3/3] ci: re-trigger CI for zizmor findings fix Co-Authored-By: Claude Opus 4.8 Claude-Session: https://claude.ai/code/session_01DN6h2VoLhQM3BvEvCAHWQu