ci: 公開workflowをローカル化して監査依存を修復

.github/workflows/ci.yml

@@ -1,7 +1,7 @@
 name: CI
 
-# Org reusable CI caller — opinionated baseline (lint + typecheck + test + build + audit).
-# Logic lives in agiletec-inc/.github reusables. Required checks: "secret-scan / scan", "ci / ci".
+# Public repositories cannot call a private reusable workflow. Keep this local
+# copy aligned with the central baseline while preserving the required checks.
 on:
   pull_request:
   merge_group:
@@ -12,8 +12,134 @@ concurrency:
 
 jobs:
   secret-scan:
-    uses: agiletec-inc/github-actions/.github/workflows/secret-scan.yml@main
+    name: scan
+    runs-on: ubuntu-latest
+    container:
+      image: node:26-bookworm
+    timeout-minutes: 10
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 0
+      - name: Run gitleaks
+        shell: bash
+        env:
+          GITLEAKS_VERSION: '8.30.1'
+        run: |
+          set -euo pipefail
+          case "$(uname -m)" in
+            x86_64|amd64) arch=x64 ;;
+            aarch64|arm64) arch=arm64 ;;
+            *) echo "::error::unsupported arch $(uname -m)"; exit 1 ;;
+          esac
+          os=$(uname -s | tr '[:upper:]' '[:lower:]')
+          asset="gitleaks_${GITLEAKS_VERSION}_${os}_${arch}.tar.gz"
+          base_url="https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}"
+          curl -fsSLO "${base_url}/${asset}"
+          curl -fsSLo checksums.txt "${base_url}/gitleaks_${GITLEAKS_VERSION}_checksums.txt"
+          grep "  ${asset}$" checksums.txt | sha256sum -c -
+          tar -xzf "${asset}" gitleaks
+          ./gitleaks version
+          config_args=()
+          if [ -f .gitleaks.toml ]; then config_args=(--config .gitleaks.toml); fi
+          case "$GITHUB_EVENT_NAME" in
+            pull_request)
+              ./gitleaks git "${config_args[@]}" --redact --no-banner --exit-code 1 --verbose \
+                --log-opts "${{ github.event.pull_request.base.sha }}..HEAD" .
+              ;;
+            merge_group)
+              ./gitleaks git "${config_args[@]}" --redact --no-banner --exit-code 1 --verbose \
+                --log-opts "${{ github.event.merge_group.base_sha }}..HEAD" .
+              ;;
+            push)
+              if [[ "${{ github.event.before }}" =~ ^0+$ ]]; then
+                ./gitleaks dir . "${config_args[@]}" --redact --no-banner --exit-code 1 --verbose
+              else
+                ./gitleaks git "${config_args[@]}" --redact --no-banner --exit-code 1 --verbose \
+                  --log-opts "${{ github.event.before }}..${{ github.sha }}" .
+              fi
+              ;;
+            *) ./gitleaks dir . "${config_args[@]}" --redact --no-banner --exit-code 1 --verbose ;;
+          esac
   ci:
-    uses: agiletec-inc/github-actions/.github/workflows/node-pnpm-ci.yml@main
-    with:
-      node-version: '20'
+    name: ci
+    runs-on: ubuntu-latest
+    container:
+      image: node:20-bookworm
+    timeout-minutes: 15
+    permissions:
+      contents: read
+    defaults:
+      run:
+        shell: bash
+    env:
+      PM: ''
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 0
+      - uses: denoland/setup-deno@22d081ff2d3a40755e97629de92e3bcbfa7cf2ed # v2.0.5
+      - uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
+      - name: Allow Git to operate on the workspace
+        run: git config --global --add safe.directory "$GITHUB_WORKSPACE"
+      - name: Detect package manager
+        id: pm
+        env:
+          PM_INPUT: auto
+        run: |
+          set -euo pipefail
+          pm="$PM_INPUT"
+          if [ "$pm" = auto ]; then
+            if [ -f pnpm-lock.yaml ]; then pm=pnpm
+            elif [ -f yarn.lock ]; then pm=yarn
+            else pm=npm
+            fi
+          fi
+          echo "pm=$pm" >> "$GITHUB_OUTPUT"
+          echo "PM=$pm" >> "$GITHUB_ENV"
+      - if: steps.pm.outputs.pm == 'pnpm'
+        uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
+      - name: Install dependencies
+        env:
+          FROZEN_INPUT: true
+          PNPM_FETCH_RETRIES: "5"
+        run: |
+          set -euo pipefail
+          install_flag=""
+          [ "$FROZEN_INPUT" = true ] && install_flag="--frozen-lockfile"
+          case "$PM" in
+            pnpm) pnpm install $install_flag ;;
+            yarn) yarn install $install_flag ;;
+            npm)
+              if [ "$FROZEN_INPUT" = true ] && { [ -f package-lock.json ] || [ -f npm-shrinkwrap.json ]; }; then npm ci
+              else npm install
+              fi
+              ;;
+          esac
+      - name: Detect declared quality scripts
+        id: scripts
+        run: |
+          node <<'NODE'
+          const fs = require('node:fs');
+          const scripts = require('./package.json').scripts ?? {};
+          const output = process.env.GITHUB_OUTPUT;
+          for (const name of ['lint', 'typecheck', 'test', 'build']) {
+            fs.appendFileSync(output, `${name}=${Object.hasOwn(scripts, name)}\n`);
+          }
+          NODE
+      - name: Lint
+        if: steps.scripts.outputs.lint == 'true'
+        run: $PM run lint
+      - name: Typecheck
+        if: steps.scripts.outputs.typecheck == 'true'
+        run: $PM run typecheck
+      - name: Test
+        if: steps.scripts.outputs.test == 'true'
+        run: $PM test
+      - name: Build
+        if: steps.scripts.outputs.build == 'true'
+        run: $PM run build
+      - name: Audit
+        run: $PM audit --audit-level=high