refactor(ci): consolidate GitHub Actions with Composite Actions#36
Merged
Conversation
## Changes
### Scripts
- **format-codex-config.sh**: Auto-format dot_codex/config.toml
- Normalizes TOML via JSON (sorted keys, consistent style)
- Validates non-empty content
- Detects invalid TOML (dasel empty output workaround)
- **check-codex-config.sh**: CI-friendly format checker
- Exit 0 if properly formatted
- Exit 1 with diff if formatting needed
- Same validation as formatter
- **test-codex-config-scripts.sh**: Comprehensive test suite
- 8 test cases covering all scenarios
- Safe isolated testing with CODEX_CONFIG_FILE env var
- All tests passing ✅
### Automation
- **run_onchange_update-codex-config.sh.tmpl**: Merge template changes
- Preserves local [projects] section
- Updates core config from dot_codex/config.toml
- Hash-based change detection
- **GitHub Actions**: validate-codex-config.yml
- Runs check-codex-config.sh on PR/push
- Ensures format consistency in CI
- **Git pre-commit hook**: Auto-format on commit
- Detects dot_codex/config.toml changes
- Auto-formats and re-stages
- Verifies formatting before commit
## Technical Details
### dasel Bug Workaround
dasel v3.2.1 returns empty JSON `{}` for invalid TOML without error.
Root cause: go-toml/v2 unstable.Parser requires explicit Error() check.
Workaround: Detect `{}`, `null`, or empty output as parse failure.
### Benefits
- ✅ Developers never think about formatting
- ✅ Consistent format in git history
- ✅ CI prevents format violations
- ✅ Local+remote config separation maintained
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
Add moon toolchain binary directory to the common PATH configuration. This enables moon CLI commands to be available in all shell sessions. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com>
Create reusable Composite Actions to eliminate code duplication: - setup-node-pnpm: Node.js + pnpm setup with dependency installation - install-chezmoi: chezmoi installation with configurable directory Convert 4 workflows to use Composite Actions: - ci-typescript.yml: use setup-node-pnpm (-17 lines) - validate-json.yml: use install-chezmoi, remove jq install (-10 lines) - test-shell-compatibility.yml: use install-chezmoi with params (-6 lines) - validate-codex-config.yml: remove jq install (-7 lines) Benefits: - Centralized version management - Improved maintainability - 13 lines net reduction (30% duplication eliminated) - Enhanced CI trigger precision with composite action paths 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
Ensure dasel is available in PATH after installation by running mise reshim. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
Use 'mise use -g dasel@latest' to ensure dasel is properly added to PATH. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
Enable mise-action reshim option to ensure installed tools are added to PATH. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
| persist-credentials: false | ||
|
|
||
| - name: Install mise | ||
| uses: jdx/mise-action@v2 |
Check failure
Code scanning / zizmor
unpinned action reference Error
Prevent template injection by using environment variables instead of
direct template expansion in shell commands.
- Use env section to assign inputs.install-dir to INSTALL_DIR
- Reference in shell commands instead of ${{ inputs.install-dir }}
- Applies to both install step and PATH addition step
Fixes zizmor template-injection warnings.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
| shell: bash | ||
| env: | ||
| INSTALL_DIR: ${{ inputs.install-dir }} | ||
| run: echo "${INSTALL_DIR}" >> "$GITHUB_PATH" |
Check failure
Code scanning / zizmor
dangerous use of environment file: write to GITHUB_PATH may allow code execution Error
berlysia
added a commit
that referenced
this pull request
May 7, 2026
* feat(codex): add config formatter with automation
## Changes
### Scripts
- **format-codex-config.sh**: Auto-format dot_codex/config.toml
- Normalizes TOML via JSON (sorted keys, consistent style)
- Validates non-empty content
- Detects invalid TOML (dasel empty output workaround)
- **check-codex-config.sh**: CI-friendly format checker
- Exit 0 if properly formatted
- Exit 1 with diff if formatting needed
- Same validation as formatter
- **test-codex-config-scripts.sh**: Comprehensive test suite
- 8 test cases covering all scenarios
- Safe isolated testing with CODEX_CONFIG_FILE env var
- All tests passing ✅
### Automation
- **run_onchange_update-codex-config.sh.tmpl**: Merge template changes
- Preserves local [projects] section
- Updates core config from dot_codex/config.toml
- Hash-based change detection
- **GitHub Actions**: validate-codex-config.yml
- Runs check-codex-config.sh on PR/push
- Ensures format consistency in CI
- **Git pre-commit hook**: Auto-format on commit
- Detects dot_codex/config.toml changes
- Auto-formats and re-stages
- Verifies formatting before commit
## Technical Details
### dasel Bug Workaround
dasel v3.2.1 returns empty JSON `{}` for invalid TOML without error.
Root cause: go-toml/v2 unstable.Parser requires explicit Error() check.
Workaround: Detect `{}`, `null`, or empty output as parse failure.
### Benefits
- ✅ Developers never think about formatting
- ✅ Consistent format in git history
- ✅ CI prevents format violations
- ✅ Local+remote config separation maintained
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
* feat(shell): add moon bin to PATH
Add moon toolchain binary directory to the common PATH configuration.
This enables moon CLI commands to be available in all shell sessions.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
* refactor(ci): consolidate GitHub Actions with Composite Actions
Create reusable Composite Actions to eliminate code duplication:
- setup-node-pnpm: Node.js + pnpm setup with dependency installation
- install-chezmoi: chezmoi installation with configurable directory
Convert 4 workflows to use Composite Actions:
- ci-typescript.yml: use setup-node-pnpm (-17 lines)
- validate-json.yml: use install-chezmoi, remove jq install (-10 lines)
- test-shell-compatibility.yml: use install-chezmoi with params (-6 lines)
- validate-codex-config.yml: remove jq install (-7 lines)
Benefits:
- Centralized version management
- Improved maintainability
- 13 lines net reduction (30% duplication eliminated)
- Enhanced CI trigger precision with composite action paths
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
* fix(ci): add mise reshim after dasel installation
Ensure dasel is available in PATH after installation by running mise reshim.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
* fix(ci): use mise use instead of mise install for dasel
Use 'mise use -g dasel@latest' to ensure dasel is properly added to PATH.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
* fix(ci): enable mise reshim option
Enable mise-action reshim option to ensure installed tools are added to PATH.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
* security(ci): fix template injection vulnerability in install-chezmoi
Prevent template injection by using environment variables instead of
direct template expansion in shell commands.
- Use env section to assign inputs.install-dir to INSTALL_DIR
- Reference in shell commands instead of ${{ inputs.install-dir }}
- Applies to both install step and PATH addition step
Fixes zizmor template-injection warnings.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Sonnet 4.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
GitHub Actionsワークフローを共通化し、保守性と効率性を向上させました。
作成したComposite Actions
setup-node-pnpm (
.github/actions/setup-node-pnpm/)install-chezmoi (
.github/actions/install-chezmoi/)変換したワークフロー
成果
Test plan
🤖 Generated with Claude Code