test(ci): add container compatibility test (#32 / #243) - #453

.github/workflows/container-test.yml (1)

41-48: ⚡ Quick win

コンテナイメージのタグが固定されていません。

ruby:latest、elixir:slim、node:slim、debian:stable-slim などの可変タグを使用すると、テストの再現性が失われます（同じコミットでも、実行時期により異なるベースイメージでテストされる可能性があります）。

互換性テストとして「現時点の最新イメージ」を検証する意図であれば現状のままでも許容できますが、再現性を重視する場合は具体的なバージョンタグまたはダイジェストでピン留めすることを推奨します。

例: ruby:3.2.2 → ruby:3.2.2-bookworm、ruby:latest → ruby:3.3.0 など。

As per coding guidelines での静的解析ツール（zizmor）も unpinned-images として指摘しています。

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/container-test.yml around lines 41 - 48, The workflow uses
unpinned container images in the matrix (entries like "ruby:latest",
"elixir:slim", "node:slim", "debian:stable-slim") which breaks reproducibility;
update the matrix image list so each entry is a specific version tag or an
immutable digest (e.g., replace ruby:latest with a concrete ruby X.Y.Z or
ruby:X.Y.Z-bookworm, and similarly pin elixir, node and debian), then ensure the
container.image that references matrix.image continues to use those pinned
values; optionally add a short comment explaining the chosen pinning strategy
for future maintainers.

README.md (1)

123-128: ワークフローとドキュメント間の一貫性を保つ運用を推奨します。

Google Chrome のインストール手順は .github/workflows/container-test.yml (lines 74-79) と README.md (lines 123-128) の両方に記載されています。現在は一致していますが、将来的にインストール手順を変更する際は、両方を同期して更新する必要があります。

定期的に以下を確認することを推奨します：

#!/bin/bash
# Description: Verify Chrome installation steps are consistent between workflow and README

# Extract Chrome installation steps from workflow
workflow_steps=$(sed -n '/Install Google Chrome/,/apt-get install -y google-chrome-stable/p' .github/workflows/container-test.yml | grep -E '^\s+(wget|echo|apt-get|gpg)' | sed 's/^[[:space:]]*//')

# Extract from README (line numbers may change, use markers)
readme_steps=$(sed -n '/# 2\. Install Google Chrome via the signed-by keyring scheme/,/apt-get install -y google-chrome-stable/p' README.md | grep -E '^\s+(wget|echo|apt-get)' | sed 's/^[[:space:]]*//')

# Basic comparison (manual review recommended)
echo "=== Workflow steps ==="
echo "$workflow_steps"
echo ""
echo "=== README steps ==="
echo "$readme_steps"

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@README.md` around lines 123 - 128, The README.md Chrome install snippet and
the workflow snippet in .github/workflows/container-test.yml (currently around
lines 74-79) must remain identical; add a small CI verification job (e.g.,
container-test or docs-lint) that compares the README section titled "# 2.
Install Google Chrome via the signed-by keyring scheme" against the workflow
block "Install Google Chrome" and fails if they diverge, or alternatively
centralize the install snippet as a single source of truth (include file or
template) referenced by both README.md and the workflow so updates to the
install steps only happen in one place.

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes