[codex] refactor security hardening changes #47

	---
	name: Backend CI

	on:
	push:
	branches: [main]
	paths:
	- 'apps/api/**'
	- '.github/workflows/backend-ci.yml'
	pull_request:
	paths:
	- 'apps/api/**'
	- '.github/workflows/backend-ci.yml'

	# 5.5: 最小権限。GITHUB_TOKEN の write-all を取らない（cache poisoning への防御層）。
	permissions:
	contents: read

	jobs:
	backend-ci:
	runs-on: ubuntu-latest
	permissions:
	contents: read
	defaults:
	run:
	working-directory: ./apps/api

	steps:
	- name: Checkout repository
	uses: actions/checkout@v4
	with:
	fetch-depth: 0

	- name: Install uv
	# 5.1: third-party action は full commit SHA で pin する (タグ可変によるサプライチェーン攻撃を回避)。
	uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
	with:
	enable-cache: true
	cache-dependency-glob: apps/api/uv.lock

	- name: Setup Python
	run: uv python install 3.13

	- name: Setup environment file
	# 5.4: 失敗を握り潰さない。.env.example が消えていれば即 fail させて構成漏れを早期検出する。
	run: \|
	set -euo pipefail
	cp src/config/.env.example src/config/.env
	echo "ENV=test" >> src/config/.env

	- name: Install dependencies
	run: uv sync --frozen

	- name: Type check
	run: uv run mypy src --explicit-package-bases

	- name: Run tests (if any)
	if: ${{ hashFiles('tests/**') != '' }}
	run: \|
	uv run pytest \|\| \
	echo "::warning::pytest reported failures. Review the output above; some tests require external services such as Weaviate."

Navigation Menu