Skip to content

Commit d54323a

Browse files
nkoji21claude
nkoji21
and
claude
authored
fix(ci): aqua経由でCLIツールを実行 (#4)
* fix(ci): aqua経由でCLIツールを実行するよう修正 - Dockerコンテナアクション → aqua CLI実行 - ubuntu-slimのまま使用可能（docker不要） - 必要なツールだけインストール - より高速なCI実行 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com> * feat(aqua): CI用ツールを追加 - actionlint: GitHub Actions構文チェック - gitleaks: シークレット検出 - pinact: アクションSHA固定 - zizmor: Actions脆弱性スキャン 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com> * fix(ci): aquaバージョンをv2.56.1に修正 v2.40.3は存在しないため、最新のv2.56.1に変更 * fix(ci): aqua-installerをv4.0.4に更新 SLSA検証エラーを解消するためv4に更新 aqua_versionはデフォルト使用（bootstrap v2.55.1） * fix(ci): aqua_versionを追加 v4ではaqua_versionが必須 * chore(aqua): チェックサムを追加 actionlint, gitleaks, pinact, zizmor のチェックサムを生成 * fix(ci): zizmor警告を修正 - persist-credentials: false を追加 - 明示的な権限設定を追加 * fix(ci): pinactコマンドを修正 引数なしで実行すると自動的に.github/workflowsを検索 --------- Co-authored-by: Claude Sonnet 4.5 <noreply@anthropic.com>
1 parent 24b55e2 commit d54323a

7 files changed

Lines changed: 146 additions & 20 deletions

File tree

‎.github/workflows/ci.yaml‎

Lines changed: 24 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -20,16 +20,21 @@ jobs:
2020
uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
2121
with:
2222
fetch-depth: 0
23+
persist-credentials: false
24+
25+
- name: Setup aqua
26+
uses: aquaproj/aqua-installer@11dd79b4e498d471a9385aa9fb7f62bb5f52a73c # v4.0.4
27+
with:
28+
aqua_version: v2.56.1
29+
30+
- name: Install security tools
31+
run: aqua i -l gitleaks zizmor
2332

2433
- name: Run Gitleaks
25-
uses: gitleaks/gitleaks-action@ff98106e4c7b2bc287b24eaf42907196329070c7 # v2.3.9
26-
env:
27-
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
34+
run: gitleaks detect --source . --verbose
2835

2936
- name: Run Zizmor
30-
uses: zizmorcore/zizmor@a5e304f536f1ba836aba0b966eb459f99f1658c1 # v1.19.0
31-
with:
32-
input: .github/workflows/
37+
run: zizmor .github/workflows/
3338

3439
actions-quality:
3540
name: Actions Quality Checks
@@ -42,6 +47,18 @@ jobs:
4247
uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
4348
with:
4449
fetch-depth: 0
50+
persist-credentials: false
51+
52+
- name: Setup aqua
53+
uses: aquaproj/aqua-installer@11dd79b4e498d471a9385aa9fb7f62bb5f52a73c # v4.0.4
54+
with:
55+
aqua_version: v2.56.1
56+
57+
- name: Install actions tools
58+
run: aqua i -l actionlint pinact
59+
60+
- name: Run actionlint
61+
run: actionlint
4562

4663
- name: Setup Git Bot
4764
id: bot
@@ -50,24 +67,11 @@ jobs:
5067
app-id: ${{ secrets.BOT_APP_ID }}
5168
private-key: ${{ secrets.BOT_PRIVATE_KEY }}
5269

53-
- name: Run actionlint
54-
uses: reviewdog/action-actionlint@0b89ab5ea641e80701bca20b11cb99b7fdf8c1ea # v1.59.0
55-
with:
56-
github_token: ${{ steps.bot.outputs.token }}
57-
58-
- name: Setup aqua
59-
uses: aquaproj/aqua-installer@6ce1f8848ec8e61f14d57bd5d7597057a6dd187c # v3.0.1
60-
with:
61-
aqua_version: v2.40.3
62-
63-
- name: Install pinact
64-
run: aqua g -i suzuki-shunsuke/pinact
65-
6670
- name: Run pinact and auto-fix
6771
env:
6872
GH_TOKEN: ${{ steps.bot.outputs.token }}
6973
run: |
70-
pinact run .github/workflows/
74+
pinact run
7175
if git diff --quiet; then
7276
echo "No changes needed"
7377
exit 0

‎.github/workflows/renovate-config-validator.yaml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,10 @@ on:
1212
jobs:
1313
validate:
1414
runs-on: ubuntu-slim
15+
permissions:
16+
contents: read
1517
steps:
1618
- uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
19+
with:
20+
persist-credentials: false
1721
- uses: rinchsan/renovate-config-validator@a12a2b98cd4db923c33d1ce407c57afb43f3ff59 # v0.2.0

‎aqua/aqua-checksums.json‎

Lines changed: 110 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -45,6 +45,31 @@
4545
"checksum": "D231BB3EE33B08C76279B5888845DCEB7034D055C42BB9BE46DBE0DAE39394DF",
4646
"algorithm": "sha256"
4747
},
48+
{
49+
"id": "github_release/github.com/gitleaks/gitleaks/v8.30.0/gitleaks_8.30.0_darwin_arm64.tar.gz",
50+
"checksum": "B251AB2BCD4CD8BA9E56FF37698C033EBF38582B477D21EBD86586D927CF87E7",
51+
"algorithm": "sha256"
52+
},
53+
{
54+
"id": "github_release/github.com/gitleaks/gitleaks/v8.30.0/gitleaks_8.30.0_darwin_x64.tar.gz",
55+
"checksum": "CA221D012D247080C2F6F61F4B7A83BFFA2453806B0C195C795BBE9A8C775ED5",
56+
"algorithm": "sha256"
57+
},
58+
{
59+
"id": "github_release/github.com/gitleaks/gitleaks/v8.30.0/gitleaks_8.30.0_linux_arm64.tar.gz",
60+
"checksum": "B4CBBB6DDF7D1B2A603088CD03A4E3F7CE48EE7FD449B51F7DE6EE2906F5FA2F",
61+
"algorithm": "sha256"
62+
},
63+
{
64+
"id": "github_release/github.com/gitleaks/gitleaks/v8.30.0/gitleaks_8.30.0_linux_x64.tar.gz",
65+
"checksum": "79A3AB579B53F71EFD634F3AAF7E04A0FA0CF206B7ED434638D1547A2470A66E",
66+
"algorithm": "sha256"
67+
},
68+
{
69+
"id": "github_release/github.com/gitleaks/gitleaks/v8.30.0/gitleaks_8.30.0_windows_x64.zip",
70+
"checksum": "54FE94F644B832DD08E8C3A5915EFB3BFA862386D59FB27CA0792CB687A83573",
71+
"algorithm": "sha256"
72+
},
4873
{
4974
"id": "github_release/github.com/junegunn/fzf/v0.67.0/fzf-0.67.0-darwin_amd64.tar.gz",
5075
"checksum": "88DC853E0914793A2E7BE0D1ACFE6C922D9CCAD08E3302DF092399775B0279FF",
@@ -105,6 +130,36 @@
105130
"checksum": "3E80345061EF4BFBB5A96DA7A18F71578A0847B25A29AB0DC5F7E846EBB5A108",
106131
"algorithm": "sha256"
107132
},
133+
{
134+
"id": "github_release/github.com/rhysd/actionlint/v1.7.9/actionlint_1.7.9_darwin_amd64.tar.gz",
135+
"checksum": "F89A910E90E536F60DF7C504160247DB01DD67CAB6F08C064C1C397B76C91A79",
136+
"algorithm": "sha256"
137+
},
138+
{
139+
"id": "github_release/github.com/rhysd/actionlint/v1.7.9/actionlint_1.7.9_darwin_arm64.tar.gz",
140+
"checksum": "855E49E823FC68C6371FD6967E359CDE11912D8D44FED343283C8E6E943BD789",
141+
"algorithm": "sha256"
142+
},
143+
{
144+
"id": "github_release/github.com/rhysd/actionlint/v1.7.9/actionlint_1.7.9_linux_amd64.tar.gz",
145+
"checksum": "233B280D05E100837F4AF1433C7B40A5DCB306E3AA68FB4F17F8A7F45A7DF7B4",
146+
"algorithm": "sha256"
147+
},
148+
{
149+
"id": "github_release/github.com/rhysd/actionlint/v1.7.9/actionlint_1.7.9_linux_arm64.tar.gz",
150+
"checksum": "6B82A3B8C808BF1BCD39A95ACED22FC1A026EEF08EDE410F81E274AF8DEADBBC",
151+
"algorithm": "sha256"
152+
},
153+
{
154+
"id": "github_release/github.com/rhysd/actionlint/v1.7.9/actionlint_1.7.9_windows_amd64.zip",
155+
"checksum": "7C8B10A93723838BC3533F6E1886D868FDBB109B81606EBE6D1A533D11D8E978",
156+
"algorithm": "sha256"
157+
},
158+
{
159+
"id": "github_release/github.com/rhysd/actionlint/v1.7.9/actionlint_1.7.9_windows_arm64.zip",
160+
"checksum": "7ACA9BF09EEDF0A743E08C7CB9F1712467A7324A9342A029AE4536FB4BE95C25",
161+
"algorithm": "sha256"
162+
},
108163
{
109164
"id": "github_release/github.com/rossmacarthur/sheldon/0.8.5/sheldon-0.8.5-aarch64-apple-darwin.tar.gz",
110165
"checksum": "6E47F10A25F165B095EB2BDE1AB617D4D34AD6F3FF2CA984167CA94FADD52730",
@@ -145,6 +200,36 @@
145200
"checksum": "0DCD8AC79732C0D5B136F11F4EE00E581440E16A44EAB5B3105B611BBF2CF191",
146201
"algorithm": "sha256"
147202
},
203+
{
204+
"id": "github_release/github.com/suzuki-shunsuke/pinact/v3.7.4/pinact_darwin_amd64.tar.gz",
205+
"checksum": "D636D9E295EB26F6FB104ABC0F4A80778E169655EC0CD1457F353272DB446F15",
206+
"algorithm": "sha256"
207+
},
208+
{
209+
"id": "github_release/github.com/suzuki-shunsuke/pinact/v3.7.4/pinact_darwin_arm64.tar.gz",
210+
"checksum": "3C8B9546A44B32A8CBC4E2D573DA28EF99C8D70224B20E4A40E94472EFEF6754",
211+
"algorithm": "sha256"
212+
},
213+
{
214+
"id": "github_release/github.com/suzuki-shunsuke/pinact/v3.7.4/pinact_linux_amd64.tar.gz",
215+
"checksum": "DBBB251A6334BF06110D5365CFC9B1D6213472DF3BE34698ECB1FBEBA9FBCBA0",
216+
"algorithm": "sha256"
217+
},
218+
{
219+
"id": "github_release/github.com/suzuki-shunsuke/pinact/v3.7.4/pinact_linux_arm64.tar.gz",
220+
"checksum": "08F90BC25FA6E136F4269F3DAE1503BC5253AADB78221EE1A02C6CE904FD8C51",
221+
"algorithm": "sha256"
222+
},
223+
{
224+
"id": "github_release/github.com/suzuki-shunsuke/pinact/v3.7.4/pinact_windows_amd64.zip",
225+
"checksum": "801B5B30882DEAF6D342822A131D28752EDAB923DD4279D6B41781DEBB73D9D2",
226+
"algorithm": "sha256"
227+
},
228+
{
229+
"id": "github_release/github.com/suzuki-shunsuke/pinact/v3.7.4/pinact_windows_arm64.zip",
230+
"checksum": "2172D6FC9DF047BA88B36EF86DF10E8D261F5EEB6E739992E1867DF0869DE941",
231+
"algorithm": "sha256"
232+
},
148233
{
149234
"id": "github_release/github.com/x-motemen/ghq/v1.8.0/ghq_darwin_amd64.zip",
150235
"checksum": "F50A794201BAC18DF1AC8D00E863E9635576AA94",
@@ -175,6 +260,31 @@
175260
"checksum": "D7B0E3C9C9A246C580B46D7E0EE47E9E6DEC26D6",
176261
"algorithm": "sha1"
177262
},
263+
{
264+
"id": "github_release/github.com/zizmorcore/zizmor/v1.19.0/zizmor-aarch64-apple-darwin.tar.gz",
265+
"checksum": "845E6CC1D5E38E513A8DF97AEEF2207EEA438008F8E5F27A03FDAA77FCCCF4CA",
266+
"algorithm": "sha256"
267+
},
268+
{
269+
"id": "github_release/github.com/zizmorcore/zizmor/v1.19.0/zizmor-aarch64-unknown-linux-gnu.tar.gz",
270+
"checksum": "605E291EF7D15FA520E536FCDD20C8715F70E63CD448A72ADB2CF190B9DA9042",
271+
"algorithm": "sha256"
272+
},
273+
{
274+
"id": "github_release/github.com/zizmorcore/zizmor/v1.19.0/zizmor-x86_64-apple-darwin.tar.gz",
275+
"checksum": "CAEBFA595FA2DB7538F3CBC1A512D2FF96E0274666EEDA12F6A42D3E59B30043",
276+
"algorithm": "sha256"
277+
},
278+
{
279+
"id": "github_release/github.com/zizmorcore/zizmor/v1.19.0/zizmor-x86_64-pc-windows-msvc.zip",
280+
"checksum": "D3C1A4A88953349A05F4B1CB5106537C26E23ED416CE3B56E1D0FDEDC75B9AAD",
281+
"algorithm": "sha256"
282+
},
283+
{
284+
"id": "github_release/github.com/zizmorcore/zizmor/v1.19.0/zizmor-x86_64-unknown-linux-gnu.tar.gz",
285+
"checksum": "64DD578889F4C2E277B084060EF47FD98F933723399AF9145AE2768AAE76A71C",
286+
"algorithm": "sha256"
287+
},
178288
{
179289
"id": "registries/github_content/github.com/aquaproj/aqua-registry/v4.446.0/registry.yaml",
180290
"checksum": "F89F41662F54892E9E06168596845AA2C84865B6ED9782B527C47622BE3035E3C126C51D80BFFF76B41C4150D41FF1F70F6B521EA52FB6B4933D6170CACEF9F3",

‎aqua/imports/actionlint.yaml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
packages:
2+
- name: rhysd/actionlint@v1.7.9

‎aqua/imports/gitleaks.yaml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
packages:
2+
- name: gitleaks/gitleaks@v8.30.0

‎aqua/imports/pinact.yaml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
packages:
2+
- name: suzuki-shunsuke/pinact@v3.7.4

‎aqua/imports/zizmor.yaml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
packages:
2+
- name: zizmorcore/zizmor@v1.19.0

0 commit comments

Comments
 (0)