【GitHub】Actions完全ガイド｜4階層モデル・OIDCパスワードレスデプロイ・最小権限・モノレポ最適化・セキュリティhardening

# .github/workflows/ci.yml
name: CI

on:
  push:
    branches: [main]
  pull_request:

jobs:
  test:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: '20'
          cache: npm
      - run: npm ci
      - run: npm test

# プッシュ
on:
  push:
    branches: [main, "release/**"]
    tags: ["v*.*.*"]
    paths: ["src/**", "package.json"]
    paths-ignore: ["docs/**"]

# Pull Request
on:
  pull_request:
    branches: [main]
    types: [opened, synchronize, reopened]
    paths: ["src/**"]

# スケジュール（UTC時間）
on:
  schedule:
    - cron: '0 3 * * *'   # 毎日12:00 JST（UTC+9）
    - cron: '0 0 * * 1'   # 毎週月曜 09:00 JST

# 手動実行（パラメータ付き）
on:
  workflow_dispatch:
    inputs:
      environment:
        description: Deploy target
        required: true
        type: choice
        options: [staging, production]
      force:
        description: Force deploy
        type: boolean
        default: false

# 他ワークフロー完了で起動
on:
  workflow_run:
    workflows: ["CI"]
    types: [completed]
    branches: [main]

# Issue/PRコメント
on:
  issue_comment:
    types: [created]

# ラベル付与
on:
  pull_request:
    types: [labeled]

# 複数イベント混在
on:
  push:
    branches: [main]
  pull_request:
  schedule: [{cron: '0 * * * *'}]
  workflow_dispatch:

env:
  # ワークフロー全体で共通の非機密（全体公開される）
  NODE_OPTIONS: "--max-old-space-size=4096"

jobs:
  deploy:
    runs-on: ubuntu-latest
    environment: production   # Environmentを指定
    env:
      # Variables：Settings → Secrets and variables → Variables
      AWS_REGION: ${{ vars.AWS_REGION }}
      APP_URL: ${{ vars.APP_URL }}
    steps:
      - run: echo "Region is $AWS_REGION"   # 非機密なので表示OK
      - run: ./deploy.sh
        env:
          # Secrets：自動マスクされる
          DEPLOY_TOKEN: ${{ secrets.DEPLOY_TOKEN }}
          DB_PASSWORD: ${{ secrets.DB_PASSWORD }}

# ワークフロー全体のデフォルトを最小化
permissions:
  contents: read       # リポジトリ読み取りのみ

jobs:
  test:
    runs-on: ubuntu-latest
    # testジョブは追加権限不要
    steps:
      - uses: actions/checkout@v4

  release:
    runs-on: ubuntu-latest
    # このジョブだけ権限拡張
    permissions:
      contents: write  # リリース作成
      id-token: write  # OIDC用
      packages: write  # GHCRプッシュ
    steps:
      - uses: actions/checkout@v4
      - run: gh release create ...

jobs:
  test:
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false          # 1つ失敗しても他は続行
      max-parallel: 4           # 同時実行上限
      matrix:
        os: [ubuntu-latest, windows-latest, macos-latest]
        node: ['18', '20', '22']
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: ${{ matrix.node }}
      - run: npm ci && npm test

# → 3 × 3 = 9 パターン並列

strategy:
  matrix:
    os: [ubuntu-latest, windows-latest]
    node: ['18', '20']
    include:
      # Ubuntu + Node 22 だけ追加（特殊テスト含む）
      - os: ubuntu-latest
        node: '22'
        experimental: true
    exclude:
      # Windows + Node 18 は不要
      - os: windows-latest
        node: '18'

# experimentalフラグで条件分岐
steps:
  - if: matrix.experimental == true
    run: npm test -- --experimental-features

# npm系はsetup-nodeのcacheオプションで十分
- uses: actions/setup-node@v4
  with:
    node-version: '20'
    cache: npm

# 複雑なキャッシュ（Docker buildkit／gradle等）
- uses: actions/cache@v4
  with:
    path: |
      ~/.gradle/caches
      ~/.gradle/wrapper
    key: ${{ runner.os }}-gradle-${{ hashFiles('**/*.gradle*') }}
    restore-keys: |
      ${{ runner.os }}-gradle-

# ビルドジョブで生成物アップロード
build:
  runs-on: ubuntu-latest
  steps:
    - uses: actions/checkout@v4
    - run: npm ci && npm run build
    - uses: actions/upload-artifact@v4
      with:
        name: web-dist
        path: dist/
        retention-days: 7

# デプロイジョブでダウンロード
deploy:
  needs: build
  runs-on: ubuntu-latest
  steps:
    - uses: actions/download-artifact@v4
      with:
        name: web-dist
        path: dist/
    - run: ./deploy.sh

jobs:
  prepare:
    runs-on: ubuntu-latest
    outputs:
      version: ${{ steps.ver.outputs.version }}
      should_deploy: ${{ steps.check.outputs.should_deploy }}
    steps:
      - uses: actions/checkout@v4
      - id: ver
        run: echo "version=$(git describe --tags)" >> $GITHUB_OUTPUT
      - id: check
        run: |
          if [[ "${{ github.ref }}" == "refs/heads/main" ]]; then
            echo "should_deploy=true" >> $GITHUB_OUTPUT
          else
            echo "should_deploy=false" >> $GITHUB_OUTPUT
          fi

  deploy:
    needs: prepare
    if: needs.prepare.outputs.should_deploy == 'true'
    runs-on: ubuntu-latest
    steps:
      - run: echo "Deploying version ${{ needs.prepare.outputs.version }}"

# .github/workflows/reusable-test.yml
name: Reusable Test
on:
  workflow_call:
    inputs:
      node-version:
        required: true
        type: string
    secrets:
      NPM_TOKEN:
        required: false

jobs:
  test:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: ${{ inputs.node-version }}
      - run: npm ci
      - run: npm test

# 呼び出し側
# .github/workflows/ci.yml
jobs:
  test:
    uses: ./.github/workflows/reusable-test.yml
    with:
      node-version: '20'
    secrets:
      NPM_TOKEN: ${{ secrets.NPM_TOKEN }}

# .github/actions/setup-node-env/action.yml
name: 'Setup Node env'
description: 'Setup Node.js with cache + install deps'
inputs:
  node-version:
    required: true
    default: '20'
runs:
  using: 'composite'
  steps:
    - uses: actions/setup-node@v4
      with:
        node-version: ${{ inputs.node-version }}
        cache: npm
    - shell: bash
      run: npm ci

# 呼び出し側
jobs:
  test:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: ./.github/actions/setup-node-env
        with:
          node-version: '20'
      - run: npm test

# 事前準備（AWS IAM側）
# 1. IAM → Identity providers → "Add provider"
#    - Provider type: OpenID Connect
#    - URL: https://token.actions.githubusercontent.com
#    - Audience: sts.amazonaws.com
# 2. IAMロールを作成し、Trust policyで対象リポジトリを許可
#    Condition:
#      token.actions.githubusercontent.com:sub: repo:ORG/REPO:ref:refs/heads/main

# ワークフロー
name: Deploy to AWS
on:
  push:
    branches: [main]

permissions:
  id-token: write    # ← OIDC必須
  contents: read

jobs:
  deploy:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: arn:aws:iam::123456789012:role/github-actions-deploy
          aws-region: ap-northeast-1
      # 以降、AWS CLIコマンドが動く
      - run: aws s3 sync ./dist s3://my-bucket/

# GCP事前準備
# 1. Workload Identity Poolを作成
# 2. Providerで GitHub を許可（audience: sts.googleapis.com）
# 3. Service Accountに iam.workloadIdentityUser を付与

permissions:
  id-token: write
  contents: read

jobs:
  deploy:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - id: auth
        uses: google-github-actions/auth@v2
        with:
          workload_identity_provider: projects/123/locations/global/workloadIdentityPools/gh-pool/providers/gh-prov
          service_account: ci-deploy@project.iam.gserviceaccount.com
      - uses: google-github-actions/setup-gcloud@v2
      - run: gcloud run deploy myapp --source .

permissions:
  id-token: write
  contents: read

jobs:
  deploy:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: azure/login@v2
        with:
          client-id: ${{ vars.AZURE_CLIENT_ID }}
          tenant-id: ${{ vars.AZURE_TENANT_ID }}
          subscription-id: ${{ vars.AZURE_SUBSCRIPTION_ID }}
      - run: az webapp deploy --name myapp --resource-group rg --src-path dist.zip

jobs:
  deploy:
    needs: test
    runs-on: ubuntu-latest
    environment:
      name: production        # ← Environment指定
      url: https://myapp.com  # デプロイ先URL（UI表示）
    steps:
      - run: ./deploy.sh

# ❌ 弱い：タグ参照（書き換えられるリスク）
- uses: actions/checkout@v4

# ⭕ 強い：SHA + バージョンコメント
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2

# Dependabotで自動更新（.github/dependabot.yml）
# version: 2
# updates:
#   - package-ecosystem: "github-actions"
#     directory: "/"
#     schedule:
#       interval: "weekly"

# Secretsを直接echoしない（自動マスクはされるが念のため）
# ❌
run: echo "$TOKEN"

# ⭕ 必要な箇所だけ使う
run: ./deploy.sh
env:
  TOKEN: ${{ secrets.TOKEN }}

# PR由来のworkflowではsecrets露出に注意
# pull_request_target はリポオーナー向けの特権トリガー
# → 信頼済みPRのみで使用

on:
  pull_request:
    paths:
      - 'packages/web/**'
      - '.github/workflows/web-ci.yml'

jobs:
  web-test:
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: packages/web
    steps:
      - uses: actions/checkout@v4
      - run: npm ci && npm test

# ブランチ単位で古い実行をキャンセル
concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

# 本番デプロイはキャンセルさせない（安全優先）
concurrency:
  group: production-deploy
  cancel-in-progress: false

on:
  pull_request:
  merge_group:          # ← merge queue対応

jobs:
  test:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - run: npm ci && npm test

jobs:
  test:
    runs-on: ubuntu-24.04-arm   # ARM64、料金20%オフ
    steps:
      - uses: actions/checkout@v4
      - run: npm test

# SettingsのSecretsに以下を追加
ACTIONS_RUNNER_DEBUG: true       # runner側の詳細
ACTIONS_STEP_DEBUG: true         # step側の詳細

# これだけで普段見えない内部ログが表示される
# デバッグ後は削除（ログが重くなる）

- name: Setup tmate
  if: ${{ failure() }}        # 失敗した時だけ
  uses: mxschmitt/action-tmate@v3
  timeout-minutes: 15

# ログに表示されるSSH接続情報でログイン → 直接調査

# インストール（macOS/Linux）
brew install act

# ローカルで実行
act push
act pull_request
act -j test                    # 特定ジョブだけ
act -s GITHUB_TOKEN=xxx        # Secrets指定

# Dockerイメージサイズで選択
act -P ubuntu-latest=ghcr.io/catthehacker/ubuntu:act-latest