chore(deps): merge open renovate PRs and restore automation (#73)

* chore(deps): update dependency @types/node to v24.10.13

* chore: fix biome formatting issues

* fix(deps): update all non-major dependencies

* chore(ci): update pnpm version to 10.30.3 in composite action

* chore(deps): update github actions

* fix(lint): apply biome formatting fixes

* chore(deps): update github actions

* chore: fix formatting issues

* chore(deps): update oxlint monorepo

* chore: fix formatting for oxfmt 0.40.0 compatibility

* chore(deps): update dependency knip to v6

* chore: fix formatting issues after knip v6 update

* fix: stabilize merged dependency branch

* fix(ci): restore dependency auto-fix flow

* fix(ci): align workflow lint scope

* fix(ci): centralize shellcheck discovery

* fix(paths): respect chezmoi source-state layout

* fix(ci): provision codex validation dependencies

---------

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com>

Author: 3 people

.github/actions/setup-node-pnpm/action.yml

@@ -9,7 +9,7 @@ inputs:
   pnpm-version:
     description: "pnpm version"
     required: false
-    default: "10.27.0"
+    default: "10.30.3"
   install-deps:
     description: "Install dependencies with frozen lockfile"
     required: false
@@ -19,12 +19,12 @@ runs:
   using: composite
   steps:
     - name: Setup pnpm
-      uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061 # v4.2.0
+      uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5.0.0
       with:
         version: ${{ inputs.pnpm-version }}
 
     - name: Setup Node.js
-      uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6
+      uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6
       with:
         node-version: ${{ inputs.node-version }}
         cache: "pnpm"

.github/workflows/auto-fix-dependencies.yml

@@ -3,18 +3,12 @@ name: Auto-fix Dependencies
 on:
   workflow_run:
     workflows:
-      - "Shell Lint (shellcheck)"
-      - "TypeScript CI"
-      - "Secret Detection (gitleaks)"
-      - "Lint GitHub Actions"
-      - "Shell Compatibility Test"
-      - "Validate Codex Config"
-      - "Validate JSON Templates"
+      - "CI Status Check"
     types:
       - completed
 
 concurrency:
-  group: auto-fix-${{ github.event.workflow_run.head_branch }}
+  group: auto-fix-${{ github.event.workflow_run.head_sha }}
   cancel-in-progress: true
 
 jobs:
@@ -35,7 +29,7 @@ jobs:
     steps:
       - name: Get PR information
         id: pr-info
-        uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
         with:
           script: |
             // Get PR from the workflow_run event
@@ -56,7 +50,10 @@ jobs:
 
             // Check if PR is from a dependency bot
             const author = prData.user.login;
-            const isBot = author === 'renovate[bot]' || author === 'dependabot[bot]';
+            const isBot =
+              author === 'renovate[bot]' ||
+              author === 'dependabot[bot]' ||
+              author === 'app/renovate';
 
             if (!isBot) {
               core.info(`Skipping: PR author is ${author}, not a dependency bot`);
@@ -82,12 +79,12 @@ jobs:
       - name: Auto-fix dependencies
         if: steps.pr-info.outputs.skip != 'true'
         id: auto-fix
-        uses: anthropics/claude-code-action@ea36d6abdedc17fc2a671b36060770b208a6f8f1 # v1.0.51
+        uses: anthropics/claude-code-action@26ec041249acb0a944c0a47b6c0c13f05dbc5b44 # v1.0.70
         with:
           claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
           use_bedrock: false
           use_vertex: false
-          allowed_bots: "renovate[bot],dependabot[bot]"
+          allowed_bots: "renovate[bot],dependabot[bot],app/renovate"
           prompt: |
             **CI Failed - Fix Required**
 
@@ -106,7 +103,7 @@ jobs:
             **Important:**
             - Focus only on fixing the CI failures
             - After pushing fixes, verify all checks pass with `gh pr checks`
-            - Do not manually merge - this repository uses auto-merge for dependency PRs
+            - Do not manually merge - this repository uses auto-merge for eligible dependency PRs
             - If the issue cannot be fixed automatically, leave a detailed comment explaining the problem
 
             **Tool constraints (MUST follow):**

.github/workflows/ci-shellcheck.yml

@@ -33,12 +33,8 @@ jobs:
         with:
           persist-credentials: false
 
+      - name: Install shellcheck
+        run: sudo apt-get update && sudo apt-get install -y shellcheck
+
       - name: Run shellcheck
-        uses: ludeeus/action-shellcheck@00cae500b08a931fb5698e11e79bfbd38e612a38 # v2.0.0
-        with:
-          scandir: "."
-          ignore_paths: >-
-            node_modules
-            .git
-            .tmp
-          severity: warning
+        run: ./scripts/lint-shell.sh

.github/workflows/ci-typescript.yml

@@ -53,4 +53,4 @@ jobs:
         run: pnpm test
 
       - name: Lint check
-        run: pnpm run lint
+        run: pnpm run format:check && pnpm run lint:oxlint

.github/workflows/claude.yml

@@ -36,7 +36,7 @@ jobs:
 
       - name: Run Claude Code
         id: claude
-        uses: anthropics/claude-code-action@ea36d6abdedc17fc2a671b36060770b208a6f8f1 # v1.0.51
+        uses: anthropics/claude-code-action@26ec041249acb0a944c0a47b6c0c13f05dbc5b44 # v1.0.70
         with:
           claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
 

.github/workflows/lint-actions.yml

@@ -30,7 +30,7 @@ jobs:
           persist-credentials: false
 
       - name: Run actionlint
-        uses: reviewdog/action-actionlint@e58ee9d111489c31395fbe4857b0be6e7635dbda # v1.70.0
+        uses: reviewdog/action-actionlint@0d952c597ef8459f634d7145b0b044a9699e5e43 # v1.71.0
         with:
           reporter: github-pr-review
           fail_level: error
@@ -49,4 +49,4 @@ jobs:
           persist-credentials: false
 
       - name: Run zizmor
-        uses: zizmorcore/zizmor-action@0dce2577a4760a2749d8cfb7a84b7d5585ebcb7d # v0.5.0
+        uses: zizmorcore/zizmor-action@71321a20a9ded102f6e9ce5718a2fcec2c4f70d8 # v0.5.2

.github/workflows/status-check.yml

@@ -21,7 +21,7 @@ jobs:
       statuses: write
     steps:
       - name: Check all required workflows passed
-        uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
         with:
           script: |
             const workflowRun = context.payload.workflow_run;

.github/workflows/validate-codex-config.yml

@@ -6,13 +6,13 @@ on:
       - master
       - main
     paths:
-      - "dot_codex/config.toml"
+      - "home/dot_codex/.config.toml"
       - "scripts/check-codex-config.sh"
       - "scripts/format-codex-config.sh"
       - ".github/workflows/validate-codex-config.yml"
   pull_request:
     paths:
-      - "dot_codex/config.toml"
+      - "home/dot_codex/.config.toml"
       - "scripts/check-codex-config.sh"
       - "scripts/format-codex-config.sh"
       - ".github/workflows/validate-codex-config.yml"
@@ -28,8 +28,11 @@ jobs:
         with:
           persist-credentials: false
 
+      - name: Setup Node.js with pnpm
+        uses: ./.github/actions/setup-node-pnpm
+
       - name: Install mise
-        uses: jdx/mise-action@6d1e696aa24c1aa1bcc1adea0212707c71ab78a8 # v3.6.1
+        uses: jdx/mise-action@c1ecc8f748cd28cdeabf76dab3cccde4ce692fe4 # v4.0.0
         with:
           experimental: true
           reshim: true
@@ -41,4 +44,4 @@ jobs:
       - name: Validate Codex config formatting
         run: ./scripts/check-codex-config.sh
         env:
-          CODEX_CONFIG_FILE: dot_codex/config.toml
+          CODEX_CONFIG_FILE: home/dot_codex/.config.toml

.skills/apply-harness-practices/SKILL.md

@@ -85,6 +85,7 @@ context: inherit
 MVH Checklist の各項目について、Phase 1 の結果（ユーザーレベル・プロジェクトレベル両方）と照合する。
 
 分類基準:
+
 - **ユーザーレベルで実装済み** = `~/.claude/settings.json` に該当 hook/設定が存在する
 - **プロジェクトレベルで実装済み** = `.claude/settings.json` に該当設定が存在する
 - **未実装** = どちらにも存在しない

.skills/commit-conventions/SKILL.md

@@ -127,13 +127,13 @@ git log --oneline -50 | grep -oP '(?<=\()[^)]+(?=\))' | sort | uniq -c | sort -r
 
 ### action line 早見表
 
-| type | 用途 | 例 |
-|---|---|---|
-| `intent(scope)` | ユーザーの意図・目的 | `intent(auth): social login starting with Google` |
-| `decision(scope)` | 選択した方針と理由 | `decision(queue): SQS over RabbitMQ for managed scaling` |
-| `rejected(scope)` | 却下した選択肢と理由（必須） | `rejected(queue): RabbitMQ — requires self-managed infra` |
-| `constraint(scope)` | 実装を制約した条件 | `constraint(api): max 5MB payload, 30s timeout` |
-| `learned(scope)` | 発見した非自明な事実 | `learned(stripe): presentment ≠ settlement currency` |
+| type                | 用途                         | 例                                                        |
+| ------------------- | ---------------------------- | --------------------------------------------------------- |
+| `intent(scope)`     | ユーザーの意図・目的         | `intent(auth): social login starting with Google`         |
+| `decision(scope)`   | 選択した方針と理由           | `decision(queue): SQS over RabbitMQ for managed scaling`  |
+| `rejected(scope)`   | 却下した選択肢と理由（必須） | `rejected(queue): RabbitMQ — requires self-managed infra` |
+| `constraint(scope)` | 実装を制約した条件           | `constraint(api): max 5MB payload, 30s timeout`           |
+| `learned(scope)`    | 発見した非自明な事実         | `learned(stripe): presentment ≠ settlement currency`      |
 
 ### Breaking Changes