diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS index defe0d3..1330e60 100644 --- a/.github/CODEOWNERS +++ b/.github/CODEOWNERS @@ -1,3 +1 @@ -# >>> repository-fanout managed >>> * @kukv -# <<< repository-fanout managed <<< diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml index 3d32b25..bcc5c52 100644 --- a/.github/workflows/security.yml +++ b/.github/workflows/security.yml @@ -1,11 +1,5 @@ name: security -# fanout(bright-room/canonical-files)が配布する共通セキュリティ検査(層1・言語非依存)。 -# このファイルは fanout 管理(replaced)。直接編集しても次回同期で差し戻される。 -# 変更は canonical-files の templates/security-workflow.liquid へ。 -# policy ジョブのルール本体は bright-room/repo-policies(main 参照)で一元管理。 -# 設計: repository-fanout docs/superpowers/specs/2026-07-14-security-fanout-design.md - on: pull_request: push: @@ -20,47 +14,6 @@ concurrency: cancel-in-progress: ${{ github.event_name == 'pull_request' }} jobs: - # 不可視 Unicode / Trojan Source(全テキストファイル・言語非依存) - hidden-unicode: - runs-on: ubuntu-latest - permissions: - contents: read - steps: - - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - with: - persist-credentials: false - - name: scan source files - run: | - npx --yes anti-trojan-source@1.12.0 --verbose \ - --files='**/*.{go,java,kt,kts,rs,ts,tsx,js,jsx,mjs,cjs,py,rb,php,c,h,cpp,sh,tf,toml,yml,yaml,json,md}' - npx --yes anti-trojan-source@1.12.0 --verbose \ - --files='.github/**/*.{yml,yaml,md,json}' - - name: scan AI rules files - run: | - npx --yes anti-trojan-source@1.12.0 --verbose \ - --files='**/{CLAUDE.md,AGENTS.md,.cursorrules,.clinerules,.windsurfrules,*.mdc,copilot-instructions.md}' - npx --yes anti-trojan-source@1.12.0 --verbose \ - --files='.github/copilot-instructions.md' - npx --yes anti-trojan-source@1.12.0 --verbose \ - --files='.cursor/rules/*.mdc' - npx --yes anti-trojan-source@1.12.0 --verbose \ - --files='.claude/**/*.md' - - # シークレット検知(全履歴) - secrets: - runs-on: ubuntu-latest - permissions: - contents: read - steps: - - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - with: - fetch-depth: 0 - persist-credentials: false - - name: gitleaks - run: | - docker run --rm -v "$PWD:/repo" ghcr.io/gitleaks/gitleaks:v8.30.1 \ - git /repo --redact --verbose --exit-code 1 - # 多エコシステム SCA(lockfile を再帰自動検出。リポ直下の osv-scanner.toml は自動適用) sca: runs-on: ubuntu-latest @@ -76,39 +29,3 @@ jobs: --recursive --include-git-root ./ - - # workflow YAML 自体の静的解析(オフライン。findings で exit 非ゼロ) - workflow-audit: - runs-on: ubuntu-latest - permissions: - contents: read - steps: - - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - with: - persist-credentials: false - - name: zizmor - run: pipx run zizmor==1.26.1 --offline . - - # プロジェクト設定のセキュリティ前提検査(ルールは bright-room/repo-policies で一元管理) - policy: - runs-on: ubuntu-latest - permissions: - contents: read - steps: - - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - with: - persist-credentials: false - - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - with: - repository: bright-room/repo-policies - ref: main - path: .repo-policies - persist-credentials: false - - name: collect facts - run: .repo-policies/scripts/collect-facts.sh . | tee /tmp/facts.json - - name: conftest - run: | - docker run --rm \ - -v "$PWD/.repo-policies/policy:/policy:ro" \ - -v /tmp/facts.json:/facts.json:ro \ - openpolicyagent/conftest:v0.68.2 test --policy /policy /facts.json diff --git a/.gitignore b/.gitignore index 9150b7b..bf82082 100644 --- a/.gitignore +++ b/.gitignore @@ -1,4 +1,3 @@ -# >>> repository-fanout managed >>> ### JetBrains IDEs ### .fleet/ .idea/ @@ -43,7 +42,6 @@ HELP.md ### go ### coverage.out *.exe -# <<< repository-fanout managed <<< bin/ ### Test / coverage artifacts ### diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml deleted file mode 100644 index 638f0a6..0000000 --- a/.pre-commit-config.yaml +++ /dev/null @@ -1,9 +0,0 @@ -repos: - - repo: https://github.com/gitleaks/gitleaks - rev: v8.30.1 - hooks: - - id: gitleaks - - repo: https://github.com/sirosen/texthooks - rev: 0.7.1 - hooks: - - id: forbid-bidi-controls