Chapter 35: CI/CD と AI

# .github/workflows/ci.yml
name: CI Pipeline

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

jobs:
  test:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: "22"
          cache: "npm"

      - name: Install dependencies
        run: npm ci

      - name: Type check
        run: npx tsc --noEmit

      - name: Lint
        run: npx eslint src/ --max-warnings 0

      - name: Test
        run: npx vitest run --coverage

      - name: Coverage check
        run: |
          COVERAGE=$(cat coverage/coverage-summary.json | jq '.total.lines.pct')
          if (( $(echo "$COVERAGE < 80" | bc -l) )); then
            echo "❌ Coverage ${COVERAGE}% is below 80%"
            exit 1
          fi

# .github/workflows/ai-review.yml
name: AI Code Review

on:
  pull_request:
    types: [opened, synchronize]

jobs:
  ai-review:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      pull-requests: write

    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Install Claude Code
        run: npm install -g @anthropic-ai/claude-code

      - name: Run AI Review
        env:
          ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          # 変更されたファイルを取得
          CHANGED_FILES=$(git diff --name-only origin/main...HEAD | grep -E '\.(ts|tsx)$' | head -20)

          if [ -z "$CHANGED_FILES" ]; then
            echo "No TypeScript files changed"
            exit 0
          fi

          # AI レビューを実行
          REVIEW=$(env -u CLAUDECODE claude -p "
            以下のファイルをレビューしてください:
            ${CHANGED_FILES}

            確認項目:
            1. 型安全性（any型の使用）
            2. エラーハンドリングの漏れ
            3. セキュリティの問題（SQL インジェクション・XSS 等）
            4. パフォーマンスの問題

            出力: GitHub PR コメント形式の Markdown
          " --output-format text)

          # PR にコメントを投稿
          gh pr comment ${{ github.event.pull_request.number }} --body "$REVIEW"

# .github/workflows/test-generation.yml
name: AI Test Generation

on:
  pull_request:
    types: [opened]

jobs:
  generate-tests:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Check test coverage
        id: coverage
        run: |
          npm ci && npx vitest run --coverage --reporter json
          LOW_COVERAGE=$(cat coverage/coverage-summary.json | \
            jq -r '[to_entries[] | select(.value.lines.pct < 80) | .key] | join("\n")')
          echo "files=$LOW_COVERAGE" >> $GITHUB_OUTPUT

      - name: Generate missing tests
        if: steps.coverage.outputs.files != ''
        env:
          ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
        run: |
          env -u CLAUDECODE claude -p "
            以下のファイルのテストカバレッジが 80% 未満です。
            不足しているテストを Vitest で書いてください:

            ${{ steps.coverage.outputs.files }}

            既存のテストファイルを参考にして、同じスタイルで書くこと。
          "
          git add -A && git commit -m "test: add missing tests (auto-generated)"
          git push

# .github/branch-protection-rules の設定（GitHub API経由）
# Required status checks:
# - Type Check (tsc)
# - Lint (eslint)
# - Test (vitest)
# - Coverage (≥ 80%)
# - AI Review (claude)
# - Security Scan (trivy)

# .github/workflows/quality-gate.yml
name: Quality Gate

on:
  pull_request:
    branches: [main]

jobs:
  type-check:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - run: npm ci && npx tsc --noEmit

  lint:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - run: npm ci && npx eslint src/ --max-warnings 0

  test-and-coverage:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - run: npm ci
      - run: npx vitest run --coverage
      - name: Enforce 80% coverage
        run: |
          LINES=$(jq '.total.lines.pct' coverage/coverage-summary.json)
          [ "$(echo "$LINES >= 80" | bc)" = "1" ] || (echo "Coverage: $LINES%" && exit 1)

  security-scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Run Trivy vulnerability scanner
        uses: aquasecurity/trivy-action@master
        with:
          scan-type: "fs"
          severity: "CRITICAL,HIGH"
          exit-code: "1"

# .github/workflows/deploy.yml（抜粋）
  smoke-test:
    runs-on: ubuntu-latest
    needs: deploy-staging
    steps:
      - name: AI Smoke Test
        env:
          ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
          STAGING_URL: ${{ vars.STAGING_URL }}
        run: |
          env -u CLAUDECODE claude -p "
            ${STAGING_URL} にデプロイされたアプリのスモークテストを実施してください。

            確認項目:
            1. トップページが 200 を返すか
            2. API の /health エンドポイントが OK を返すか
            3. 認証フローが正常に動くか（テストユーザーで確認）
            4. 主要な API エンドポイント 5 つが正常に応答するか

            問題があれば 'SMOKE_TEST_FAILED' と出力してください。
          " | grep -q 'SMOKE_TEST_FAILED' && exit 1 || exit 0