feat: GitHub Actions で静的チェックを実行する - #8
Conversation
- push (main) / PR 時に make check を実行 (validate / lint / 図生成の検証) - AWS credentials は使用しない (permissions: contents: read のみ) - ツールは mise.toml (バージョン固定に変更) + setup-sam + brew/apt で導入 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
📝 WalkthroughWalkthrough
Changes検証環境とCI
Estimated code review effort: 2 (Simple) | ~10 minutes Possibly related PRs
Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
Comment |
mise の npm backend が provenance 無しを理由に cfn-diagram の依存 fast-xml-parser@4.5.7 を拒否して CI が失敗するため、以下を検証して この 1 バージョンのみ除外: - npm tarball と GitHub v4.5.7 タグのソースが完全一致 - 公開者は 4.x 系全リリースと同一のメンテナ本人アカウント - 5.x 系のみ GitHub Actions の trusted publishing を使う運用によるもの Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
ubuntu-24.04 ランナーには Homebrew が搭載されていないため、 バイナリ配布の無い InfraMap は Go でソースからインストールする Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/validate.yml:
- Line 21: Update the actions/checkout@v4 step in the workflow to set
persist-credentials to false, ensuring the checkout does not retain the
GITHUB_TOKEN while leaving the existing checkout behavior unchanged.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: a2f4a708-4f88-44be-a4fc-a5a19ccdcdc7
📒 Files selected for processing (2)
.github/workflows/validate.ymlmise.toml
- --directory を複数同時に渡すと SAM 側が CloudFormation として スキャンされない挙動があるため、ディレクトリごとに checkov を実行 - プレースホルダ関数への CKV_AWS_115/116/117 は、各設定の意味を コメントで説明した上で Metadata の checkov.skip で明示的に抑制 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@sam/template.yaml`:
- Around line 30-40: Update the Checkov skip comments in the Metadata for both
HelloFunction and HelloRustFunction, covering all six CKV_AWS_115, CKV_AWS_116,
and CKV_AWS_117 entries. Replace the generic “learning placeholder” text with
specific comments describing the relevant control and the action required before
production: reserved concurrency limits, a dead-letter queue, and VPC placement
evaluation. Ensure Checkov 3.3.9 reports six skipped checks with those
descriptive Suppress comments.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: ac9f57d7-0335-4530-8fe9-2ebe1d95d4b1
📒 Files selected for processing (3)
.github/workflows/validate.ymlMakefilesam/template.yaml
🚧 Files skipped from review as they are similar to previous changes (1)
- .github/workflows/validate.yml
| Metadata: | ||
| # checkov が指摘する下記 3 点は本来設計すべき項目だが、学習用プレースホルダの | ||
| # ため理由を明記した上でスキップする。本実装では各項目を設計判断すること | ||
| checkov: | ||
| skip: | ||
| - id: CKV_AWS_115 # 同時実行数制限: 暴走や下流サービス保護のための上限設定 | ||
| comment: "learning placeholder" | ||
| - id: CKV_AWS_116 # DLQ: 失敗イベントを退避して調査・再処理できるようにする | ||
| comment: "learning placeholder" | ||
| - id: CKV_AWS_117 # VPC 配置: プライベートリソースへ安全にアクセスするため | ||
| comment: "learning placeholder" |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
tmp="$(mktemp)"
trap 'rm -f "$tmp"' EXIT
set +e
mise exec -- checkov \
--directory sam \
--check CKV_AWS_115,CKV_AWS_116,CKV_AWS_117 \
--compact >"$tmp" 2>&1
status=$?
set -e
cat "$tmp"
test "$status" -eq 0
grep -q 'Suppressed Checks: 6' "$tmp"
! grep -q 'Suppress comment: learning placeholder' "$tmp"Repository: kenshin-morioka/aws-learning
Length of output: 204
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
printf '%s\n' '--- candidate files ---'
git ls-files | rg '(^|/)(template\.yaml|Makefile|mise\.toml|pyproject\.toml|requirements.*|\.checkov\.yaml|README)' || true
printf '%s\n' '--- template locations ---'
rg -n -C 5 'CKV_AWS_11[567]|learning placeholder|Hello(Function|RustFunction)|Metadata:' sam/template.yaml
printf '%s\n' '--- Checkov references ---'
rg -n -i -C 3 'checkov|CKV_AWS_11[567]|Suppressed Checks' . --glob '!node_modules/**' --glob '!dist/**' --glob '!build/**' || trueRepository: kenshin-morioka/aws-learning
Length of output: 7543
🌐 Web query:
Checkov 3.3.9 CloudFormation SAM metadata checkov skip comment Suppressed Checks output CKV_AWS_115 CKV_AWS_116 CKV_AWS_117
💡 Result:
In Checkov, you can suppress specific policy checks like CKV_AWS_115, CKV_AWS_116, and CKV_AWS_117 in AWS CloudFormation and SAM templates using either inline comments or the resource Metadata section [1][2]. Inline Comments To suppress a check for a specific resource, add a comment directly above the resource definition using the following pattern [1][3]: # checkov:skip=<check_id>:<suppression_comment> Example: Resources: MyLambdaFunction: # checkov:skip=CKV_AWS_115:Function-level concurrent execution limit is not required # checkov:skip=CKV_AWS_116:Dead Letter Queue is not required # checkov:skip=CKV_AWS_117:Function is not inside a VPC Type: AWS::Serverless::Function Properties: Handler: index.handler Runtime: nodejs18.x Metadata Section Alternatively, you can use the Metadata section within the resource. This is often cleaner for multiple suppressions [1][2]. Example: Resources: MyLambdaFunction: Type: AWS::Serverless::Function Metadata: checkov: skip: - id: CKV_AWS_115 comment: Function-level concurrent execution limit is not required - id: CKV_AWS_116 comment: Dead Letter Queue is not required - id: CKV_AWS_117 comment: Function is not inside a VPC Properties: Handler: index.handler Runtime: nodejs18.x Global Suppression If you prefer to skip these checks across your entire project, you can use a.checkov.yml configuration file [3][4]: skip-check: - CKV_AWS_115 - CKV_AWS_116 - CKV_AWS_117 Note that AWS SAM templates are scanned using the same underlying logic as CloudFormation [5]. The Metadata approach is particularly effective when working with generated templates (such as those from AWS CDK or Serverless Framework) [6][7].
Citations:
- 1: https://www.checkov.io/2.Basics/Suppressing%20and%20Skipping%20Policies.html
- 2: https://github.com/bridgecrewio/checkov/blob/aa609aa41ffba241ce7d309d3cd4623e7f9c1bea/docs/2.Basics/Suppressing%20and%20Skipping%20Policies.md
- 3: https://towardsthecloud.com/docs/aws-cloudformation-starter-kit/reference/checkov
- 4: https://towardsthecloud.com/docs/aws-cloudformation-starter-kit/configuration/linting-code-analysis
- 5: https://www.checkov.io/7.Scan%20Examples/AWS%20SAM.html
- 6: Not able to supress check for cloud formation file (In JSON format) bridgecrewio/checkov#3170
- 7: Skip AWS automated resources (not skip entire check) bridgecrewio/checkov#4198
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
printf '%s\n' '--- pinned tool configuration ---'
cat -n mise.toml | sed -n '1,12p'
printf '%s\n' '--- relevant template ---'
cat -n sam/template.yaml | sed -n '20,70p'
printf '%s\n' '--- local Checkov availability ---'
command -v checkov || true
python3 - <<'PY'
try:
import checkov
print("python checkov import: available")
except Exception as exc:
print(f"python checkov import: unavailable ({type(exc).__name__}: {exc})")
PY
printf '%s\n' '--- structured skip-entry count from template text ---'
python3 - <<'PY'
from pathlib import Path
text = Path("sam/template.yaml").read_text()
ids = ["CKV_AWS_115", "CKV_AWS_116", "CKV_AWS_117"]
for function in ("HelloFunction", "HelloRustFunction"):
start = text.index(f" {function}:")
end = text.find("\n ", start + 3)
block = text[start:] if end == -1 else text[start:end]
print(function)
for check_id in ids:
occurrences = block.count(f"id: {check_id}")
comments = []
for line in block.splitlines():
if f"id: {check_id}" in line:
comments.append(line)
print(f" {check_id}: entries={occurrences}, {comments}")
PYRepository: kenshin-morioka/aws-learning
Length of output: 3200
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
printf '%s\n' '--- installed Checkov wrapper/version ---'
head -n 5 /usr/local/bin/checkov 2>/dev/null || true
checkov --version
printf '%s\n' '--- targeted Checkov scan ---'
tmp="$(mktemp)"
trap 'rm -f "$tmp"' EXIT
set +e
checkov --directory sam \
--check CKV_AWS_115,CKV_AWS_116,CKV_AWS_117 \
--compact >"$tmp" 2>&1
status=$?
set -e
cat "$tmp"
printf 'checkov_exit=%s\n' "$status"
printf '%s\n' '--- corrected six-entry check ---'
python3 - <<'PY'
from pathlib import Path
text = Path("sam/template.yaml").read_text()
for function in ("HelloFunction", "HelloRustFunction"):
start = text.index(f" {function}:")
next_function = text.find("\n ", start + len(function) + 4)
block = text[start:] if next_function < 0 else text[start:next_function]
print(function)
for check_id in ("CKV_AWS_115", "CKV_AWS_116", "CKV_AWS_117"):
lines = [line.strip() for line in block.splitlines() if f"- id: {check_id}" in line]
comments = [
line.strip() for line in block.splitlines()
if line.strip().startswith("comment:")
]
print(f" {check_id}: {len(lines)} entry, comments={comments}")
PYRepository: kenshin-morioka/aws-learning
Length of output: 5062
Checkov の抑制理由をチェックごとに具体化してください。
HelloFunction と HelloRustFunction の6件について、comment を対象制御と本番化前の対応を示す内容に変更してください。
CKV_AWS_115: 予約同時実行数を本番化前に設定する理由CKV_AWS_116: DLQを本番化前に設定する理由CKV_AWS_117: VPC配置を本番化前に評価する理由
Checkov 3.3.9で Skipped checks: 6 となり、各結果に具体的な Suppress comment が表示される状態にしてください。
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@sam/template.yaml` around lines 30 - 40, Update the Checkov skip comments in
the Metadata for both HelloFunction and HelloRustFunction, covering all six
CKV_AWS_115, CKV_AWS_116, and CKV_AWS_117 entries. Replace the generic “learning
placeholder” text with specific comments describing the relevant control and the
action required before production: reserved concurrency limits, a dead-letter
queue, and VPC placement evaluation. Ensure Checkov 3.3.9 reports six skipped
checks with those descriptive Suppress comments.
1 participant
概要
push (main) / PR 時にローカルと同じ
make checkを CI で実行 (docs/specification.md のステップ7)。内容
.github/workflows/validate.ymlmake checkで fmt-check / validate / lint / 構成図生成まで一気通貫permissions: contents: readのみmise.toml: CI の再現性のため "latest" からバージョン固定に変更動作確認
mise install(固定バージョン) +make check✅🤖 Generated with Claude Code
Summary by CodeRabbit