# npm ci と同じ。CI では必須。
uv sync --frozen

# 中略
dependencies = [
    "requests>=2.32.0",
]
[dependency-groups]
dev = [
    "pre-commit>=4.0.0",
    "pip-audit>=2.7.0",
    "ruff>=0.8.0",
    "mypy>=1.13.0",
    "pytest>=8.3.0",
]
# ...

# プロジェクト依存関係 (wheel のみ)
uv sync --no-build
uv add httpx --no-build

# グローバルツール (wheel のみ)
uv tool install ruff --no-build
uvx --no-build ruff check .

# 全コマンドでビルドを禁止
export UV_NO_BUILD=1

# 特定パッケージのみ禁止
export UV_NO_BUILD_PACKAGE="pkg1 pkg2"

# Taskfile.yml
version: '3'

vars:
  # 2-day delay (security verification window)
  EXCLUDE_NEWER_DAYS: 2
  EXCLUDE_NEWER: "{{.EXCLUDE_NEWER_DAYS}} days"

tasks:
  uv:add:
    desc: "Add package (with {{.EXCLUDE_NEWER_DAYS}}-day delay)"
    cmds:
      - echo "Excluding packages newer than {{.EXCLUDE_NEWER}}"
      - uv add --exclude-newer "{{.EXCLUDE_NEWER}}" --no-build --no-install-project {{.CLI_ARGS}}
      - task: uv:export-requirements

  uv:lock:
    desc: "Lock dependencies (with {{.EXCLUDE_NEWER_DAYS}}-day delay)"
    cmds:
      - echo "Excluding packages newer than {{.EXCLUDE_NEWER}}"
      - uv lock --exclude-newer "{{.EXCLUDE_NEWER}}" --no-build
      - task: uv:export-requirements

  uv:lock:upgrade:
    desc: "Upgrade all dependencies (with {{.EXCLUDE_NEWER_DAYS}}-day delay)"
    cmds:
      - echo "Excluding packages newer than {{.EXCLUDE_NEWER}}"
      - uv lock --upgrade --exclude-newer "{{.EXCLUDE_NEWER}}" --no-build
      - task: uv:export-requirements

  uv:export-requirements:
    desc: "Export uv.lock to requirements-txt for scanners"
    cmds:
      - echo "Excluding packages newer than {{.EXCLUDE_NEWER}}"
      - uv export --format requirements.txt --all-groups --locked --exclude-newer "{{.EXCLUDE_NEWER}}" -o requirements.txt

  uv:sync:
    desc: "Sync environment without building sdists"
    cmds:
      - uv sync --frozen --all-groups --no-build --no-install-project

  uv:run:
    desc: "Run command via uv with locked, time-delayed dependencies (e.g., task uv:run -- python app.py)"
    cmds:
      - uv run --no-sync {{.CLI_ARGS}}

  uv:tool:install:
    desc: "Install a uv tool without building sdists (e.g., task uv:tool:install -- ruff)"
    cmds:
      - uv tool install --no-build {{.CLI_ARGS}}

task uv:add            # x日間の遅延付き & wheel オンリーで依存ライブラリを追加
task uv:lock           # x日間の遅延付き & wheel オンリーで依存関係を更新・ロック
task uv:lock:upgrade   # x日間の遅延付き & wheel オンリーで依存関係をアップグレード
task uv:sync           # uv.lock固定 (--frozen) & wheel オンリーでインストール
task uv:run            # uv.lock固定 (--no-sync) & wheel オンリーで実行

    - name: Install Aikido Safe Chain (Linux)
      if: matrix.platform == 'ubuntu-latest' && matrix.python-version == env.PRIMARY_PYTHON_VERSION
      run: curl -fsSL https://github.com/AikidoSec/safe-chain/releases/download/1.3.3/install-safe-chain.sh | sh -s -- --ci
    - name: Install Aikido Safe Chain (Windows)
      if: matrix.platform == 'windows-latest' && matrix.python-version == env.PRIMARY_PYTHON_VERSION
      run: iex "& { $(iwr 'https://github.com/AikidoSec/safe-chain/releases/download/1.3.3/install-safe-chain.ps1' -UseBasicParsing) } -ci"
      shell: pwsh

repos:
  - repo: https://github.com/pre-commit/pre-commit-hooks
    rev: v6.0.0
    hooks:
      - id: detect-private-key      # 秘密鍵の検出 (tests、docsは除く)
        exclude: |
          (?x)^(
            tests/.*|
            docs/.*|
            README\.md
          )$
      # - id: detect-aws-credentials
      # ...
  # Ruff (リンティング、フォーマッティング)
  # 設定は後述
  - repo: https://github.com/astral-sh/ruff-pre-commit
    rev: v0.8.4
    hooks:
      - id: ruff
        args: [--fix, --exit-non-zero-on-fix]
      - id: ruff-format
  # mypy (型チェック)
  # 設定は後述
  - repo: https://github.com/pre-commit/mirrors-mypy
    rev: v1.19.1
    hooks:
      - id: mypy
        args: [--config-file=pyproject.toml]

# .github/workflows/security.yml
name: Security Scans

on:
  push:
    branches: [ main ]
  pull_request:
    branches: [ main ]
  workflow_dispatch: {}

permissions: {}

jobs:
  pip-audit:
    name: pip-audit (PyPA Advisory)
    runs-on: ubuntu-latest
    env:
      PRIMARY_PYTHON_VERSION: "3.13"
    permissions:
      contents: read
    steps:
      - name: Checkout repository
        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
        with:
          persist-credentials: false
      - name: Install uv
        uses: astral-sh/setup-uv@681c641aba71e4a1c380be3ab5e12ad51f415867 # v7.1.6
        with:
          python-version: ${{ env.PRIMARY_PYTHON_VERSION }}
      - name: Run pip-audit (PyPA Advisory)
        run: uv run --with pip-audit pip-audit -r requirements.txt --vulnerability-service pypi

  trivy:
    name: Trivy Security Scan
    runs-on: ubuntu-latest
    permissions:
      contents: read
      security-events: write
    steps:
      - name: Checkout repository
        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
        with:
          persist-credentials: false
      - name: Run Trivy vulnerability scanner in fs mode (SARIF)
        uses: aquasecurity/trivy-action@b6643a29fecd7f34b3597bc6acb0a98b03d33ff8 # v0.33.1
        with:
          scan-type: 'fs'
          scan-ref: '.'
          format: 'sarif'
          output: 'trivy-results.sarif'
          severity: 'CRITICAL,HIGH,MEDIUM'
          scanners: 'vuln,secret'
          exit-code: '0'

# pyproject.toml
[tool.ruff.lint]
select = [
    "B", # flake8-bugbear: バグになりやすいパターン検知ルール
    "E",
    "F",
    "W",
    "I",
    "S", # flake8-bandit: セキュリティルール
    "T10",
    "C4",
    "UP",
    "ARG",
    "SIM",
]
ignore = ["E203", "E501"]
per-file-ignores = { "tests/**" = ["S101", "S106"] }

# pyproject.toml
[tool.mypy]
python_version = "3.10"
strict = true
# warn_return_any = true
# no_implicit_optional = true
# strict_equality = true
# warn_unused_ignores = true
disallow_any_unimported = true
warn_unreachable = true
ignore_missing_imports = false
pretty = true

# .github/workflows/workflow-security.yml
name: Workflow Security Check

on:
  pull_request:
    paths:
      - '.github/workflows/**'
  push:
    branches: [main]

jobs:
  zizmor:
    runs-on: ubuntu-latest
    permissions:
      # zizmor の結果を Code Scanning（Security タブ）へアップロード
      security-events: write
      # 以下、private リポジトリ + advanced-security のときのみ必要
      # contents: read
      # actions: read

    steps:
      - name: Checkout repository
        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
        with:
          persist-credentials: false
      - name: Run zizmor 🌈
        uses: zizmorcore/zizmor-action@e639db99335bc9038abc0e066dfcd72e23d26fb4 # v0.3.0
        with:
          inputs: |
            .github/workflows

# 悪い例: タグは上書き可能
- uses: actions/checkout@v6

# 良い例: SHA は不変
- uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1

pinact run

# ワークフローレベルではデフォルトを無効化
permissions: {}

jobs:
  # ...
  package:
    name: Build package
    runs-on: ${{ matrix.os }}

    strategy:
      matrix:
        os: [ubuntu-latest, windows-latest, macos-latest]
    permissions:
      # 個別ジョブで必要最小限の設定を行う
      id-token: write
      contents: read
    steps:
    - name: Checkout repository
      uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
      with:
        persist-credentials: false
    - name: Install uv
      uses: astral-sh/setup-uv@681c641aba71e4a1c380be3ab5e12ad51f415867 # v7.1.6
      with:
        python-version: "3.13"

    steps:
    - name: Checkout repository
      uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
      with:
        persist-credentials: false

# .github/workflows/cd.yml
name: Python CD

on:
  release:
    types: [created]

permissions: {}

jobs:
  build:
    name: Build package
    runs-on: ubuntu-latest
    steps:
    - name: Checkout repository
      uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
      with:
        persist-credentials: false
    - name: Install uv
      uses: astral-sh/setup-uv@681c641aba71e4a1c380be3ab5e12ad51f415867 # v7.1.6
      with:
        python-version: "3.13"
        enable-cache: false
    - name: Build the project
      run: uv build
    - name: Show result
      run: ls -l dist
    - name: Upload package distributions
      uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
      with:
        name: dist
        path: dist

  deploy:
    name: Publish package
    runs-on: ubuntu-latest
    needs: build
    environment:
      name: pypi
      url: https://pypi.org/p/pyseto
    permissions:
      id-token: write
    steps:
    - name: Download package distributions
      uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
      with:
        name: dist
        path: dist
    - name: Show result
      run: ls -l dist
    # シークレット無しでパッケージ公開
    - name: Publish package distributions to PyPI
      uses: pypa/gh-action-pypi-publish@ed0c53931b1dc9bd32cbe73a98c7f6766f8a527e # v1.13.0

version: 2

updates:
  # Python dependencies (uv)
  - package-ecosystem: "uv"
    directory: "/"
    schedule:
      interval: "daily"
      time: "04:00"
    open-pull-requests-limit: 10
    commit-message:
      prefix: "deps"
      include: "scope"
    labels:
      - "dependencies"
      - "python"
    # Wait 2 days after release for supply chain security
    cooldown:
      default-days: 2

  # GitHub Actions dependencies
  - package-ecosystem: "github-actions"
    directory: "/"
    schedule:
      interval: "daily"
      time: "04:00"
    open-pull-requests-limit: 10
    commit-message:
      prefix: "ci"
      include: "scope"
    labels:
      - "dependencies"
      - "ci/cd"
      - "github-actions"
    # Wait 2 days after release for supply chain security
    cooldown:
      default-days: 2
    # Group minor and patch updates together for actions
    groups:
      github-actions-minor-patch:
        patterns:
          - "*"
        update-types:
          - "minor"
          - "patch"

  # pre-commit hooks
  - package-ecosystem: "pre-commit"
    directory: "/"
    schedule:
      interval: "daily"
      time: "04:00"
    open-pull-requests-limit: 10
    commit-message:
      prefix: "deps"
      include: "scope"
    labels:
      - "dependencies"
      - "pre-commit"
    # Wait 2 days after release for supply chain security
    cooldown:
      default-days: 2
    # Group minor and patch updates together for hooks
    groups:
      pre-commit-minor-patch:
        patterns:
          - "*"
        update-types:
          - "minor"
          - "patch"

trivy:
    name: Trivy Security Scan
    runs-on: ubuntu-latest
    permissions:
      contents: read
      security-events: write
    steps:
      # ...
      - name: Generate Trivy SBOM (CycloneDX)
        uses: aquasecurity/trivy-action@b6643a29fecd7f34b3597bc6acb0a98b03d33ff8 # v0.33.1
        with:
          scan-type: 'fs'
          scan-ref: '.'
          format: 'cyclonedx'
          output: 'trivy-sbom.cdx.json'
          severity: 'CRITICAL,HIGH,MEDIUM'
          scanners: 'vuln,secret'
          exit-code: '0'
      - name: Generate Trivy SBOM (SPDX)
        uses: aquasecurity/trivy-action@b6643a29fecd7f34b3597bc6acb0a98b03d33ff8 # v0.33.1
        with:
          scan-type: 'fs'
          scan-ref: '.'
          format: 'spdx-json'
          output: 'trivy-sbom.spdx.json'
          severity: 'CRITICAL,HIGH,MEDIUM'
          scanners: 'vuln,secret'
          exit-code: '0'
      - name: Upload Trivy results to GitHub Security
        uses: github/codeql-action/upload-sarif@5d4e8d1aca955e8d8589aabd499c5cae939e33c7 # v4.31.9
        if: always()
        with:
          sarif_file: 'trivy-results.sarif'
      - name: Upload Trivy SBOM artifacts
        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
        if: always()
        with:
          name: trivy-sbom
          path: |
            trivy-sbom.cdx.json
            trivy-sbom.spdx.json

# Task で依存関係をアップグレード実行
task lock:upgrade

# pre-commit フックの更新
task uv:run -- pre-commit autoupdate