Skip to content

Commit 6df3c7c

Browse files
poadpoad
committed
リポジトリ初期セットアップ: 各種設定ファイル・ドキュメント・exampleおよびpackageディレクトリの追加
0 parents  commit 6df3c7c

37 files changed

Lines changed: 6413 additions & 0 deletions

‎.amazonq/rules/review-rules.md‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
# Review Rules
2+
3+
- Comments should be provided in Japanese by default, while maintaining English-based technical analysis to ensure review quality.
4+
- When you find a problem, suggest a solution.
5+
- If you find a problem that is not in the code, point it out.
6+
7+
## Security review
8+
9+
- Always evaluate security implications of code changes.
10+
- Check for potential vulnerabilities and secure coding practices.
11+
- Verify no hardcoded credentials or secrets.
12+
- Ensure proper input validation and sanitization.
13+
- Check dependencies for known vulnerabilities.
14+
- Use GitHub Dependabot alerts and `pnpm audit`.
15+
16+
## Coding Style
17+
18+
- Please refer to the eslint.config.ts in the same directory or in the nearest parent directory.
19+
- Use TypeScript/Node import resolution; use internal paths like `^~/` or `@/*`.
20+
- Use eslint and editorconfig for automatic code formatting.
21+
- Follow markdownlint-cli2 for Markdown files.
22+
- Always run `pnpm run -r lint-fix` to conform to code style and conventions.
23+
- No destructive reassignment of variables.

‎.github/PULL_REQUEST_TEMPLATE.md‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
## 概要
2+
3+
概要を記述。
4+
5+
## 変更点
6+
7+
| 追加・変更・削除したファイル (リポジトリルートからの相対パス) | 変更内容 | 事由 |
8+
|-----------------------------------------------------|---------|-----|
9+
| 変更したファイルのリポジトリルートからの相対パス | どんな変更を行なったのか？ | 何故、変更が必要だったのか？ |
10+
11+
## 関連Issue
12+
13+
-
14+
15+
## 確認事項
16+
17+
- [ ] (Typescriptの場合) `pnpm audit --fix` で脆弱性を修正済みか？
18+
- [ ] (Typescriptの場合) `pnpm lint-fix` でコードスタイルは修正済みか？
19+
- [ ] (Markdownの場合)`markdownlint-2` で Markdown の lint は修正済みか？
20+
21+
## 特記事項

‎.github/SECURITY.md‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
# Security Policy
2+
3+
## Supported Versions
4+
5+
This project is currently in active development (version 0.x.x). Security updates are provided for the latest version only. As this is an AWS Bedrock application, we prioritize security issues related to AWS credentials, data handling, and API interactions.
6+
7+
| Version | Supported |
8+
| ------- | ------------------ |
9+
| 0.x.x | :white_check_mark: |
10+
11+
## Reporting a Vulnerability
12+
13+
Please report security vulnerabilities through GitHub's Security Advisories feature:
14+
15+
1. Go to the Security tab of this repository
16+
2. Click "Report a vulnerability"
17+
3. Fill out the private vulnerability report form
18+
19+
We will respond to security reports within 48 hours and provide regular updates on the remediation process.

‎.github/dependabot.yml‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
version: 2
2+
updates:
3+
- package-ecosystem: github-actions
4+
directory: /
5+
schedule:
6+
interval: daily
7+
allow:
8+
- dependency-type: all
9+
rebase-strategy: auto
10+
assignees:
11+
- poad
12+
groups:
13+
actions:
14+
patterns:
15+
- '*'
16+
17+
- package-ecosystem: npm
18+
directories:
19+
- '/'
20+
- '/package/'
21+
- '/example/'
22+
schedule:
23+
interval: daily
24+
timezone: Asia/Tokyo
25+
allow:
26+
- dependency-type: all
27+
rebase-strategy: auto
28+
assignees:
29+
- poad
30+
groups:
31+
npm:
32+
patterns:
33+
- '*'

‎.github/workflows/auto-merge.yml‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
name: auto-merge
2+
3+
on: pull_request
4+
5+
permissions:
6+
contents: write
7+
pull-requests: write
8+
9+
jobs:
10+
auto-merge:
11+
runs-on: ubuntu-latest
12+
13+
# リポジトリオーナーの Pull Request はドラフト以外は自動マージを有効にする
14+
if: ${{ github.event.pull_request.draft == false && (github.actor == 'dependabot[bot]' || github.repository_owner == github.actor) }}
15+
16+
steps:
17+
- name: Enable auto-merge for Pull Request
18+
run: |
19+
gh pr review --approve "$PR_URL"
20+
gh pr merge --auto --squash "$PR_URL"
21+
env:
22+
PR_URL: ${{github.event.pull_request.html_url}}
23+
GITHUB_TOKEN: ${{secrets.GITHUB_TOKEN}}

‎.github/workflows/ci.yml‎

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
name: CI
2+
3+
on:
4+
pull_request:
5+
branches:
6+
- main
7+
push:
8+
branches:
9+
- main
10+
11+
workflow_dispatch:
12+
13+
permissions:
14+
contents: read
15+
16+
jobs:
17+
build:
18+
name: Build
19+
runs-on: ubuntu-latest
20+
steps:
21+
- name: Checkout
22+
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
23+
24+
- uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061 # v4.2.0
25+
name: Install pnpm
26+
with:
27+
run_install: |
28+
- recursive: true
29+
args: [--no-frozen-lockfile]
30+
31+
- name: Lint
32+
run: pnpm run --if-present --recursive --parallel lint
33+
34+
- name: Test
35+
run: pnpm run --if-present --recursive --parallel test
36+
37+
- name: Build
38+
run: pnpm run --if-present --recursive --parallel build

‎.github/workflows/create-release-pr.yml‎

Lines changed: 119 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,119 @@
1+
name: Create Release Pull Request
2+
description: Create a pull request to release a new version
3+
4+
on:
5+
workflow_dispatch:
6+
inputs:
7+
version:
8+
description: 'Version type'
9+
required: true
10+
type: choice
11+
options:
12+
- patch
13+
- minor
14+
- major
15+
16+
jobs:
17+
create-release-pr:
18+
runs-on: ubuntu-latest
19+
permissions:
20+
contents: write
21+
pull-requests: write
22+
steps:
23+
- name: Checkout
24+
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
25+
with:
26+
persist-credentials: false
27+
28+
- name: Configure Git
29+
run: |
30+
git config user.name "github-actions[bot]"
31+
git config user.email "github-actions[bot]@users.noreply.github.com"
32+
33+
34+
- name: Setup Node.js
35+
uses: actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903 # v6.0.0
36+
with:
37+
node-version: 'lts/*'
38+
check-latest: true
39+
package-manager-cache: false
40+
41+
- uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061 # v4.2.0
42+
with:
43+
run_install: |
44+
- recursive: true
45+
args: [--no-frozen-lockfile]
46+
47+
# No need to install dependencies - npm version works without them
48+
- name: Version bump
49+
id: version
50+
run: |
51+
VERSION=$(pnpm version "$VERSION_TYPE" --no-git-tag-version)
52+
echo "version=$VERSION" >> "$GITHUB_OUTPUT"
53+
pnpm --recursive exec pnpm pkg set version=$(node -p "JSON.parse(fs.readFileSync('package.json', 'utf8')).version")
54+
env:
55+
VERSION_TYPE: ${{ github.event.inputs.version }}
56+
57+
- name: Get release notes
58+
id: release-notes
59+
run: |
60+
# Get the default branch
61+
DEFAULT_BRANCH=$(gh api "repos/$GITHUB_REPOSITORY" --jq '.default_branch')
62+
63+
# Get the latest release tag using GitHub API
64+
# Use the exit code to determine if a release exists
65+
if LAST_TAG=$(gh api "repos/$GITHUB_REPOSITORY/releases/latest" --jq '.tag_name' 2>/dev/null); then
66+
echo "Previous release found: $LAST_TAG"
67+
else
68+
LAST_TAG=""
69+
echo "No previous releases found - this will be the first release"
70+
fi
71+
72+
# Generate release notes - only include previous_tag_name if we have a valid previous tag
73+
echo "Generating release notes for tag: $VERSION"
74+
if [ -n "$LAST_TAG" ]; then
75+
echo "Using previous tag: $LAST_TAG"
76+
RELEASE_NOTES=$(gh api \
77+
--method POST \
78+
-H "Accept: application/vnd.github+json" \
79+
"/repos/$GITHUB_REPOSITORY/releases/generate-notes" \
80+
-f "tag_name=$VERSION" \
81+
-f "target_commitish=$DEFAULT_BRANCH" \
82+
-f "previous_tag_name=$LAST_TAG" \
83+
--jq '.body')
84+
else
85+
echo "Generating notes from all commits"
86+
RELEASE_NOTES=$(gh api \
87+
--method POST \
88+
-H "Accept: application/vnd.github+json" \
89+
"/repos/$GITHUB_REPOSITORY/releases/generate-notes" \
90+
-f "tag_name=$VERSION" \
91+
-f "target_commitish=$DEFAULT_BRANCH" \
92+
--jq '.body')
93+
fi
94+
95+
# Set release notes as environment variable
96+
echo "RELEASE_NOTES<<EOF" >> "$GITHUB_OUTPUT"
97+
echo "$RELEASE_NOTES" >> "$GITHUB_OUTPUT"
98+
echo "EOF" >> "$GITHUB_OUTPUT"
99+
env:
100+
GH_TOKEN: ${{ github.token }}
101+
VERSION: ${{ steps.version.outputs.version }}
102+
GITHUB_REPOSITORY: ${{ github.repository }}
103+
104+
- name: Create Pull Request
105+
uses: peter-evans/create-pull-request@271a8d0340265f705b14b6d32b9829c1cb33d45e # v7.0.8
106+
env:
107+
RELEASE_NOTES: ${{ steps.release-notes.outputs.RELEASE_NOTES }}
108+
VERSION: ${{ steps.version.outputs.version }}
109+
with:
110+
branch: release/${{ steps.version.outputs.version }}
111+
delete-branch: true
112+
title: "Release ${{ steps.version.outputs.version }}"
113+
body: |
114+
${{ env.RELEASE_NOTES }}
115+
commit-message: "chore: release ${{ steps.version.outputs.version }}"
116+
labels: |
117+
Type: Release
118+
assignees: ${{ github.actor }}
119+
draft: true

‎.github/workflows/dependency-review.yml‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
# Dependency Review Action
2+
#
3+
# This Action will scan dependency manifest files that change as part of a Pull Request,
4+
# surfacing known-vulnerable versions of the packages declared or updated in the PR.
5+
# Once installed, if the workflow run is marked as required, PRs introducing known-vulnerable
6+
# packages will be blocked from merging.
7+
#
8+
# Source repository: https://github.com/actions/dependency-review-action
9+
# Public documentation: https://docs.github.com/en/code-security/supply-chain-security/understanding-your-software-supply-chain/about-dependency-review#dependency-review-enforcement
10+
name: 'Dependency review'
11+
on:
12+
pull_request:
13+
branches: [ "main" ]
14+
workflow_dispatch:
15+
16+
# If using a dependency submission action in this workflow this permission will need to be set to:
17+
#
18+
# permissions:
19+
# contents: write
20+
#
21+
# https://docs.github.com/en/enterprise-cloud@latest/code-security/supply-chain-security/understanding-your-software-supply-chain/using-the-dependency-submission-api
22+
permissions:
23+
contents: read
24+
# Write permissions for pull-requests are required for using the `comment-summary-in-pr` option, comment out if you aren't using this option
25+
pull-requests: write
26+
27+
jobs:
28+
dependency-review:
29+
runs-on: ubuntu-latest
30+
steps:
31+
- name: 'Checkout repository'
32+
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
33+
- name: 'Dependency Review'
34+
uses: actions/dependency-review-action@40c09b7dc99638e5ddb0bfd91c1673effc064d8a # v4.8.1
35+
# Commonly enabled options, see https://github.com/actions/dependency-review-action#configuration-options for all available options.
36+
with:
37+
comment-summary-in-pr: always
38+
# fail-on-severity: moderate
39+
# deny-licenses: GPL-1.0-or-later, LGPL-2.0-or-later
40+
# retry-on-snapshot-warnings: true

‎.github/workflows/deploy.yml‎

Lines changed: 68 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,68 @@
1+
name: Deploy
2+
3+
on:
4+
pull_request:
5+
branches:
6+
- main
7+
push:
8+
branches:
9+
- main
10+
11+
workflow_dispatch:
12+
13+
env:
14+
OIDC_IAM_ROLE_ARN: ${{ secrets.OIDC_IAM_ROLE_ARN }}
15+
AWS_REGION: us-west-2
16+
17+
permissions:
18+
id-token: write
19+
contents: read
20+
21+
jobs:
22+
deploy-basic-example:
23+
# 同時実行すると CREATE_IN_PROGRESS や UPDATE_IN_PROGRESS 状態で cdk deploy を行う可能性があるため抑止する
24+
concurrency:
25+
group: "cloudformation-llm-basic"
26+
cancel-in-progress: false
27+
28+
runs-on: ubuntu-latest
29+
steps:
30+
- name: Configure AWS Credentials
31+
uses: aws-actions/configure-aws-credentials@00943011d9042930efac3dcd3a170e4273319bc8 # v5.1.0
32+
with:
33+
role-to-assume: ${{ env.OIDC_IAM_ROLE_ARN }}
34+
role-session-name: GitHubActions
35+
aws-region: ${{ env.AWS_REGION }}
36+
37+
- uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
38+
39+
- name: Use Node.js
40+
uses: actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903 # v6.0.0
41+
with:
42+
node-version: 'lts/*'
43+
check-latest: true
44+
package-manager-cache: false
45+
46+
- uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061 # v4.2.0
47+
name: Install pnpm
48+
with:
49+
run_install: |
50+
- recursive: true
51+
args: [--no-frozen-lockfile]
52+
- args: [--global, aws-cdk, esbuild]
53+
54+
- uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061 # v4.2.0
55+
name: Install pnpm
56+
with:
57+
run_install: |
58+
- recursive: true
59+
args: [--no-frozen-lockfile]
60+
- args: [--global, esbuild]
61+
62+
- name: build
63+
run: pnpm build
64+
65+
- name: deploy
66+
working-directory: ./example
67+
run: |
68+
pnpm dlx aws-cdk@latest deploy --require-approval=never

0 commit comments

Comments
 (0)