feat(ci): セキュリティチェックとpinact自動修正を追加

- gitleaks: シークレット検出
- zizmor: GitHub Actions脆弱性スキャン
- actionlint: ワークフロー構文チェック
- pinact: アクションSHA自動固定
- GitHub App bot経由でpinactが自動修正

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

Author: nkoji21

.github/actions/setup-git-bot/action.yaml

@@ -0,0 +1,35 @@
+name: 'Setup Git Bot'
+description: 'Configure git with bot identity for automated commits'
+
+inputs:
+  app-id:
+    description: 'GitHub App ID'
+    required: true
+  private-key:
+    description: 'GitHub App private key'
+    required: true
+
+outputs:
+  token:
+    description: 'GitHub App token for subsequent steps'
+    value: ${{ steps.app-token.outputs.token }}
+
+runs:
+  using: 'composite'
+  steps:
+    - name: Generate GitHub App Token
+      id: app-token
+      uses: actions/create-github-app-token@29824e69f54612133e76f7eaac726eef6c875baf # v2.2.1
+      with:
+        app-id: ${{ inputs.app-id }}
+        private-key: ${{ inputs.private-key }}
+
+    - name: Configure git bot identity
+      shell: bash
+      env:
+        GH_TOKEN: ${{ steps.app-token.outputs.token }}
+        APP_SLUG: ${{ steps.app-token.outputs.app-slug }}
+      run: |
+        bot_id=$(gh api "users/${APP_SLUG}[bot]" --jq '.id')
+        git config user.name "${APP_SLUG}[bot]"
+        git config user.email "${bot_id}+${APP_SLUG}[bot]@users.noreply.github.com"

.github/workflows/ci.yaml

@@ -0,0 +1,78 @@
+name: CI
+
+on:
+  push:
+    branches:
+      - main
+  pull_request:
+
+permissions:
+  contents: read
+
+jobs:
+  security:
+    name: Security Checks
+    runs-on: ubuntu-slim
+    permissions:
+      contents: read
+    steps:
+      - name: Checkout
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        with:
+          fetch-depth: 0
+
+      - name: Run Gitleaks
+        uses: gitleaks/gitleaks-action@ff98106e4c7b2bc287b24eaf42907196329070c7 # v2.3.9
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Run Zizmor
+        uses: zizmorcore/zizmor@a5e304f536f1ba836aba0b966eb459f99f1658c1 # v1.19.0
+        with:
+          input: .github/workflows/
+
+  actions-quality:
+    name: Actions Quality Checks
+    runs-on: ubuntu-slim
+    permissions:
+      contents: write
+      pull-requests: write
+    steps:
+      - name: Checkout
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        with:
+          fetch-depth: 0
+
+      - name: Setup Git Bot
+        id: bot
+        uses: ./.github/actions/setup-git-bot
+        with:
+          app-id: ${{ secrets.BOT_APP_ID }}
+          private-key: ${{ secrets.BOT_PRIVATE_KEY }}
+
+      - name: Run actionlint
+        uses: reviewdog/action-actionlint@0b89ab5ea641e80701bca20b11cb99b7fdf8c1ea # v1.59.0
+        with:
+          github_token: ${{ steps.bot.outputs.token }}
+
+      - name: Setup aqua
+        uses: aquaproj/aqua-installer@6ce1f8848ec8e61f14d57bd5d7597057a6dd187c # v3.0.1
+        with:
+          aqua_version: v2.40.3
+
+      - name: Install pinact
+        run: aqua g -i suzuki-shunsuke/pinact
+
+      - name: Run pinact and auto-fix
+        env:
+          GH_TOKEN: ${{ steps.bot.outputs.token }}
+        run: |
+          pinact run .github/workflows/
+          if git diff --quiet; then
+            echo "No changes needed"
+            exit 0
+          fi
+
+          git add .github/workflows/
+          git commit -m "chore(ci): pin GitHub Actions to commit SHA"
+          git push