[codex] refactor security hardening changes #46
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| --- | |
| name: Backend CI | |
| on: | |
| push: | |
| branches: [main] | |
| paths: | |
| - 'apps/api/**' | |
| - '.github/workflows/backend-ci.yml' | |
| pull_request: | |
| paths: | |
| - 'apps/api/**' | |
| - '.github/workflows/backend-ci.yml' | |
| # 5.5: 最小権限。GITHUB_TOKEN の write-all を取らない（cache poisoning への防御層）。 | |
| permissions: | |
| contents: read | |
| jobs: | |
| backend-ci: | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| defaults: | |
| run: | |
| working-directory: ./apps/api | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@v4 | |
| with: | |
| fetch-depth: 0 | |
| - name: Setup Python | |
| uses: actions/setup-python@v5 | |
| with: | |
| python-version: '3.13' | |
| - name: Install Poetry | |
| # 5.1: third-party action は full commit SHA で pin する (タグ可変によるサプライチェーン攻撃を回避)。 | |
| uses: snok/install-poetry@76e04a911780d5b312d89783f7b1cd627778900a # v1.4.1 | |
| with: | |
| virtualenvs-create: true | |
| virtualenvs-in-project: true | |
| - name: Setup Poetry cache | |
| uses: actions/cache@v4 | |
| with: | |
| path: | | |
| apps/api/.venv | |
| ~/.cache/pypoetry | |
| key: ${{ runner.os }}-poetry-${{ hashFiles('apps/api/pyproject.toml', 'apps/api/poetry.lock') }} | |
| restore-keys: | | |
| ${{ runner.os }}-poetry- | |
| - name: Setup pre-commit cache | |
| uses: actions/cache@v4 | |
| with: | |
| path: ~/.cache/pre-commit | |
| key: ${{ runner.os }}-pre-commit-${{ hashFiles('apps/api/.pre-commit-config.yaml') }} | |
| restore-keys: | | |
| ${{ runner.os }}-pre-commit- | |
| - name: Setup environment file | |
| # 5.4: 失敗を握り潰さない。.env.example が消えていれば即 fail させて構成漏れを早期検出する。 | |
| run: | | |
| set -euo pipefail | |
| cp src/config/.env.example src/config/.env | |
| echo "ENV=test" >> src/config/.env | |
| - name: Install dependencies | |
| run: make configure | |
| - name: Lint & Type check | |
| run: make lint | |
| - name: Run tests (if any) | |
| if: ${{ hashFiles('tests/**') != '' }} | |
| run: poetry run pytest |