ci: ツールチェーンを Node 24 へ統一 / audit ゲート厳格化 - #44
Conversation
- Bump all workflows (CI React/Functions, CD testnet/mainnet) to Node 24.x. Functions build on Node 24 while deploying to the nodejs22 runtime (set via functions engines.node); Node 24 is Gen2-only so the Gen1 runtime stays 22. - Add .nvmrc (root 24) and functions/.nvmrc (22) for local/runtime parity. - Drop the temporary `|| true` from the CI audit step so high/critical advisories now fail CI (both projects currently pass at --audit-level=high). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
|
Important Review skippedAuto reviews are disabled on base/target branches other than the default branch. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
There was a problem hiding this comment.
Pull request overview
CI/CD のツールチェーンを Node 24 に統一し、CI の脆弱性監査ゲート（high/critical）を厳格化して、検出時に確実に失敗させることを目的とした PR です。Functions はビルドを Node 24、デプロイ先ランタイムは engines.node=22 を維持する構成に寄せています。
Changes:
- GitHub Actions の各 workflow の
setup-node対象を Node 24.x に更新 - CI の
npm audit --audit-level=highから暫定の|| trueを削除してゲートを有効化 - ローカル整合用に
.nvmrc（root=24 / functions=22）を追加
Reviewed changes
Copilot reviewed 6 out of 6 changed files in this pull request and generated 3 comments.
Show a summary per file
| File | Description |
|---|---|
functions/.nvmrc |
Functions のローカル Node バージョンを 22 に固定（ランタイム整合） |
.nvmrc |
root のローカル Node バージョンを 24 に固定（CI/CD 整合） |
.github/workflows/ci-react.yml |
React CI を Node 24 + audit ゲート厳格化へ |
.github/workflows/ci-functions.yml |
Functions CI を Node 24 + audit ゲート厳格化へ |
.github/workflows/cd-firebase-testnet.yml |
testnet CD の Node を 24 へ |
.github/workflows/cd-firebase-mainnet.yml |
mainnet CD の Node を 24 へ |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| strategy: | ||
| matrix: | ||
| node: ['18.x'] | ||
| node: ['24.x'] |
| strategy: | ||
| matrix: | ||
| node: ['18.x'] | ||
| node: ['24.x'] |
| strategy: | ||
| matrix: | ||
| node: ['18.x'] | ||
| node: ['24.x'] |
Auditing after `npm ci` means packages are already fetched and unpacked (and install scripts could run) before the gate fires. `npm audit` only needs the lockfile, so move it ahead of `npm ci` in both CI workflows to reject known high/critical advisories before any dependency code is downloaded or executed. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Add npm audit (root + functions, --audit-level=high) at the very start of both CD workflows, before secrets are written to .env files and before `npm ci`. A high/critical advisory now stops the deploy before any secret handling or dependency download/execution happens. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
概要
メンテナンス再生作業の PR4/4(最終)。CI/CD のツールチェーンを Node 24 に統一し、脆弱性ゲートを有効化します。
変更内容
setup-nodeを Node 24.x へfunctionsのengines.node)。Node 24 は Gen2 専用のため Gen1 ランタイムは 22 を維持.nvmrc(root=24) とfunctions/.nvmrc(22) を追加(ローカル/ランタイム整合)|| trueを除去し、high/critical でCIを失敗させるゲートを有効化(現状は両プロジェクトとも--audit-level=highを通過)これで完了する全体像
🤖 Generated with Claude Code