chore: pre-commit 配布の廃止・oss profile 削除・cron を sca 限定化(RFS-002) - #22
Conversation
- pre-commit 配布(.pre-commit-config.yaml / .config/mise/conf.d/pre-commit.toml / mise-precommit-hook.toml.liquid)を廃止。hooks は gitleaks + forbid-bidi-controls の 2 つで CI の secrets / hidden-unicode job と完全重複しており、防止の役割は GitHub push protection(全 fanout リポ public で無料)が担う。ローカル環境 (mise 非利用・Windows)依存の検証コストも解消 - oss profile と関連テンプレ 4 つを削除(利用 mindstock 1 リポのみ。配布済み 実ファイルは fanout の削除未対応のため mindstock 側に残置) - security.yml の週次 cron を sca job のみに限定(他 4 job は schedule 時スキップ)。 cron の根拠(脆弱性 DB の事後更新)が当てはまるのは sca のみ - python profile に renovate.json 寄与を追加(renovate-config:python preset 前提) - scripts/check-renovate-pins.mjs + validate.yml step を追加。customManager の regex が切れてピン追従が黙って止まる問題を CI で検知(25 箇所を検証) - pre-commit rev 追従の customManager を削除(対象ファイル廃止のため) 検証: fanout engine validate OK / renovate-config-validator OK / check-renovate-pins 正常系 25 箇所 ok・故意破壊で exit 1 を確認 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
|
Warning Review limit reached
Next review available in: 47 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (2)
📝 WalkthroughWalkthroughOSS文書とpre-commit関連テンプレートを削除し、PythonプロファイルとRenovate設定を更新しました。Renovateピン検証スクリプトを追加してvalidateワークフローから実行し、定期セキュリティ実行時はSCA以外のジョブをスキップします。 Changesテンプレートとプロファイルの整理
Renovate設定とピン検証
定期セキュリティワークフロー
Estimated code review effort: 3 (Moderate) | ~20 minutes Possibly related PRs
Sequence Diagram(s)sequenceDiagram
participant ValidateWorkflow
participant CheckRenovatePins
participant RenovateConfig
participant RepositoryFiles
ValidateWorkflow->>CheckRenovatePins: スクリプトを実行
CheckRenovatePins->>RenovateConfig: customManagersを読み込む
CheckRenovatePins->>RepositoryFiles: git ls-filesで対象ファイルを取得
CheckRenovatePins-->>ValidateWorkflow: 検証結果と終了コードを返す
Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@profiles/base/contributes.json`:
- Line 2: README.md の該当する pre-commit 配布方針の記述を更新し、RFS-002
により新規配布を廃止した現状と整合させてください。既存配布先への移行・互換性説明として残す場合は、その対象と位置付けが明確になるよう記載し、単に現在も配布するよう読める説明は削除してください。
In `@scripts/check-renovate-pins.mjs`:
- Around line 34-46: Update the validation loop around targets and
manager.matchStrings to verify expected matches per file (or individual pin),
rather than only comparing the aggregate count across all files. Ensure a
missing match in one template cannot be offset by extra matches elsewhere, while
preserving the existing EXPECTED lookup and failure reporting behavior.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro Plus
Run ID: da5db759-7dd2-42e4-8d8a-bab09bebef3e
📒 Files selected for processing (13)
.github/workflows/validate.ymlcatalog.jsonprofiles/base/contributes.jsonprofiles/oss/contributes.jsonprofiles/python/contributes.jsonrenovate.jsonscripts/check-renovate-pins.mjstemplates/code-of-conduct.liquidtemplates/contributing.liquidtemplates/license.liquidtemplates/mise-precommit-hook.toml.liquidtemplates/security-workflow.liquidtemplates/security.liquid
💤 Files with no reviewable changes (8)
- templates/contributing.liquid
- profiles/oss/contributes.json
- templates/code-of-conduct.liquid
- templates/mise-precommit-hook.toml.liquid
- templates/security.liquid
- templates/license.liquid
- renovate.json
- catalog.json
CodeRabbit レビュー対応(#22): - 合計値比較では、あるテンプレートの regex 切れが別テンプレートのピン追加で 相殺されて素通りする(EXPECTED が最小値のため追加の度に検知余裕も溜まる)。 ファイル単位の完全一致に変更し、相殺シナリオ(gitleaks 破壊 + jvm へ digest 追加)で NG 2 件 / exit 1 になることを確認 - README の pre-commit 配布前提の記述 2 箇所(repo local 運用ルール・triage の 対象ファイル)を配布廃止後の現状に同期 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
1 participant
概要
RFS-002(配布ファイル/プロファイルの見直し)の実装。
変更内容
pre-commit 配布の廃止
.pre-commit-config.yaml/.config/mise/conf.d/pre-commit.toml/mise-precommit-hook.toml.liquidを catalog・base profile から削除oss profile の削除
profiles/oss/と contributing / security / code-of-conduct / license テンプレート 4 つを削除(利用は mindstock 1 リポのみだった)週次 cron を sca のみに限定
if: github.event_name != 'schedule'を追加python profile の renovate 寄与
renovate-config:pythonpreset の extends を追加(preset 本体は bright-room/renovate-config 側で追加予定。そちらの merge を先行させること)customManager マッチ検証 CI
scripts/check-renovate-pins.mjsを追加し validate.yml に step 追加検証
validate→ validation OKrenovate-config-validator renovate.json→ validated successfullycheck-renovate-pins.mjs→ 正常系 25 箇所 ok / gitleaks 行を故意に改変して exit 1(NG 検知)を確認🤖 Generated with Claude Code
Summary by CodeRabbit
改善
変更