Antigravity × GitHub Actions 上級CI/CDパイプライン構築 — マトリクスビルド・セキュリティスキャン・自動リリースの実践設計

# .github/workflows/ci-matrix.yml
name: CI Matrix Build
 
on:
  push:
    branches: [main, develop]
  pull_request:
    branches: [main]
 
jobs:
  test:
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false  # 1つ失敗しても他を継続
      matrix:
        os: [ubuntu-latest, macos-latest]
        node-version: [18, 20, 22]
        exclude:
          - os: macos-latest
            node-version: 18  # macOS + Node 18 は不要
        include:
          - os: ubuntu-latest
            node-version: 22
            coverage: true  # 最新環境でのみカバレッジ取得
 
    steps:
      - uses: actions/checkout@v4
 
      - name: Setup Node.js ${{ matrix.node-version }}
        uses: actions/setup-node@v4
        with:
          node-version: ${{ matrix.node-version }}
          cache: 'npm'
 
      - name: Install dependencies
        run: npm ci
 
      - name: Run tests
        run: npm test
 
      - name: Upload coverage
        if: matrix.coverage
        uses: codecov/codecov-action@v4
        with:
          token: ${{ secrets.CODECOV_TOKEN }}

# 高度なキャッシュ設定
- name: Cache build artifacts
  uses: actions/cache@v4
  with:
    path: |
      ~/.npm
      .next/cache
      node_modules/.cache
    key: ${{ runner.os }}-build-${{ hashFiles('**/package-lock.json') }}-${{ hashFiles('src/**') }}
    restore-keys: |
      ${{ runner.os }}-build-${{ hashFiles('**/package-lock.json') }}-
      ${{ runner.os }}-build-

# .github/workflows/security.yml
name: Security Gate
 
on:
  pull_request:
    branches: [main]
  schedule:
    - cron: '0 9 * * 1'  # 毎週月曜9:00 UTC
 
jobs:
  dependency-audit:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
 
      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: 22
 
      - name: Install dependencies
        run: npm ci
 
      - name: Run npm audit
        run: |
          # critical と high のみブロック（medium/low は警告のみ）
          npm audit --audit-level=high --omit=dev 2>&1 | tee audit-report.txt
          if [ $? -ne 0 ]; then
            echo "::error::High/Critical vulnerabilities found. See audit report."
            exit 1
          fi
 
      - name: Upload audit report
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: npm-audit-report
          path: audit-report.txt

  codeql-analysis:
    runs-on: ubuntu-latest
    permissions:
      security-events: write
    steps:
      - uses: actions/checkout@v4
 
      - name: Initialize CodeQL
        uses: github/codeql-action/init@v3
        with:
          languages: javascript-typescript
          queries: +security-and-quality  # セキュリティ+品質ルール
 
      - name: Autobuild
        uses: github/codeql-action/autobuild@v3
 
      - name: Perform CodeQL Analysis
        uses: github/codeql-action/analyze@v3
        with:
          category: "/language:javascript-typescript"

  secret-scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0  # 全履歴が必要
 
      - name: Detect secrets with Gitleaks
        uses: gitleaks/gitleaks-action@v2
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

# GitHub CLI でブランチ保護ルールを設定
gh api repos/{owner}/{repo}/branches/main/protection \
  --method PUT \
  --field required_status_checks='{"strict":true,"contexts":["dependency-audit","codeql-analysis","secret-scan"]}'

# .github/workflows/commitlint.yml
name: Commitlint
 
on:
  pull_request:
    branches: [main]
 
jobs:
  commitlint:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
 
      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: 22
 
      - name: Install commitlint
        run: npm install -g @commitlint/cli @commitlint/config-conventional
 
      - name: Validate commits
        run: npx commitlint --from ${{ github.event.pull_request.base.sha }} --to ${{ github.event.pull_request.head.sha }} --verbose

# .github/workflows/release.yml
name: Release
 
on:
  push:
    branches: [main]
 
permissions:
  contents: write
  issues: write
  pull-requests: write
 
jobs:
  release:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
          persist-credentials: false
 
      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: 22
 
      - name: Install dependencies
        run: npm ci
 
      - name: Run tests
        run: npm test
 
      - name: Semantic Release
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
        run: npx semantic-release

{
  "branches": ["main"],
  "plugins": [
    "@semantic-release/commit-analyzer",
    "@semantic-release/release-notes-generator",
    [
      "@semantic-release/changelog",
      {
        "changelogFile": "CHANGELOG.md"
      }
    ],
    [
      "@semantic-release/git",
      {
        "assets": ["CHANGELOG.md", "package.json"],
        "message": "chore(release): ${nextRelease.version} [skip ci]\n\n${nextRelease.notes}"
      }
    ],
    "@semantic-release/github"
  ]
}

<!-- .antigravity/agents.md -->
 
## CI/CD Architect Agent
 
You are a CI/CD pipeline architect specializing in GitHub Actions.
 
### Responsibilities
- Design and optimize GitHub Actions workflows
- Implement security scanning pipelines
- Configure caching strategies for build performance
- Set up automated release processes
 
### Guidelines
- Always use pinned action versions (e.g., @v4, not @main)
- Implement fail-fast: false for matrix builds
- Include artifact uploads for debugging failed runs
- Use OIDC for cloud provider authentication instead of long-lived secrets

# .github/workflows/pipeline.yml — 統合パイプライン
name: Production Pipeline
 
on:
  push:
    branches: [main]
  pull_request:
    branches: [main]
 
concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true  # 同一ブランチの古い実行をキャンセル
 
jobs:
  # Phase 1: 品質ゲート（並列実行）
  lint:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with: { node-version: 22, cache: 'npm' }
      - run: npm ci
      - run: npm run lint
      - run: npx tsc --noEmit  # 型チェック
 
  test:
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        shard: [1, 2, 3, 4]  # テストを4分割して並列実行
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with: { node-version: 22, cache: 'npm' }
      - run: npm ci
      - run: npx vitest --shard=${{ matrix.shard }}/4
 
  security:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with: { fetch-depth: 0 }
      - run: npm ci && npm audit --audit-level=high --omit=dev
      - uses: gitleaks/gitleaks-action@v2
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
  # Phase 2: ビルド（Phase 1 完了後）
  build:
    needs: [lint, test, security]
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with: { node-version: 22, cache: 'npm' }
      - run: npm ci
      - run: npm run build
      - uses: actions/upload-artifact@v4
        with:
          name: build-output
          path: .next/
          retention-days: 7
 
  # Phase 3: デプロイ（main ブランチのみ）
  deploy:
    if: github.ref == 'refs/heads/main' && github.event_name == 'push'
    needs: [build]
    runs-on: ubuntu-latest
    environment: production
    steps:
      - uses: actions/checkout@v4
      - uses: actions/download-artifact@v4
        with: { name: build-output, path: .next/ }
      - name: Deploy to Cloudflare Workers
        uses: cloudflare/wrangler-action@v3
        with:
          apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }}
          command: deploy