// GitHub OIDC トークンのペイロード例
{
  "jti": "example-id",
  "sub": "repo:myorg/myrepo:ref:refs/heads/main",
  "aud": "sts.amazonaws.com",
  "ref": "refs/heads/main",
  "sha": "abc123def456",
  "repository": "myorg/myrepo",
  "repository_owner": "myorg",
  "actor": "username",
  "workflow": "deploy",
  "event_name": "push",
  "ref_type": "branch",
  "job_workflow_ref": "myorg/myrepo/.github/workflows/deploy.yml@refs/heads/main",
  "runner_environment": "github-hosted",
  "iss": "https://token.actions.githubusercontent.com",
  "nbf": 1700000000,
  "exp": 1700003600,
  "iat": 1700000000
}

# OIDC を使った AWS 認証
name: Deploy to AWS
on:
  push:
    branches: [main]
 
permissions:
  id-token: write   # OIDC トークン発行に必須
  contents: read
 
jobs:
  deploy:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
 
      - uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: arn:aws:iam::123456789012:role/github-actions-role
          aws-region: ap-northeast-1
          # シークレット不要! OIDC で一時認証情報を取得
 
      - run: aws s3 ls  # 一時認証情報で AWS API を利用

# AWS 側の IAM ロール設定 (Terraform)
resource "aws_iam_openid_connect_provider" "github" {
  url             = "https://token.actions.githubusercontent.com"
  client_id_list  = ["sts.amazonaws.com"]
  thumbprint_list = ["6938fd4d98bab03faadb97b34396831e3780aea1"]
}
 
resource "aws_iam_role" "github_actions" {
  name = "github-actions-role"
 
  assume_role_policy = jsonencode({
    Version = "2012-10-17"
    Statement = [{
      Effect = "Allow"
      Principal = {
        Federated = aws_iam_openid_connect_provider.github.arn
      }
      Action = "sts:AssumeRoleWithWebIdentity"
      Condition = {
        StringEquals = {
          "token.actions.githubusercontent.com:aud" = "sts.amazonaws.com"
        }
        StringLike = {
          # リポジトリとブランチを制限
          "token.actions.githubusercontent.com:sub" = "repo:myorg/myrepo:ref:refs/heads/main"
        }
      }
    }]
  })
}
 
# 必要最小限の権限をポリシーで付与
resource "aws_iam_role_policy" "github_actions_deploy" {
  name = "github-actions-deploy"
  role = aws_iam_role.github_actions.id
 
  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Effect = "Allow"
        Action = [
          "s3:PutObject",
          "s3:GetObject",
          "s3:ListBucket",
          "s3:DeleteObject"
        ]
        Resource = [
          "arn:aws:s3:::my-deploy-bucket",
          "arn:aws:s3:::my-deploy-bucket/*"
        ]
      },
      {
        Effect = "Allow"
        Action = [
          "cloudfront:CreateInvalidation"
        ]
        Resource = [
          "arn:aws:cloudfront::123456789012:distribution/E1234567890"
        ]
      }
    ]
  })
}

# GCP Workload Identity Federation
- uses: google-github-actions/auth@v2
  with:
    workload_identity_provider: 'projects/123456/locations/global/workloadIdentityPools/github/providers/github-actions'
    service_account: 'github-actions@my-project.iam.gserviceaccount.com'

# GCP 側の設定 (Terraform)
resource "google_iam_workload_identity_pool" "github" {
  workload_identity_pool_id = "github"
  display_name              = "GitHub Actions"
}
 
resource "google_iam_workload_identity_pool_provider" "github" {
  workload_identity_pool_id          = google_iam_workload_identity_pool.github.workload_identity_pool_id
  workload_identity_pool_provider_id = "github-actions"
  display_name                       = "GitHub Actions"
 
  attribute_mapping = {
    "google.subject"       = "assertion.sub"
    "attribute.actor"      = "assertion.actor"
    "attribute.repository" = "assertion.repository"
  }
 
  attribute_condition = "assertion.repository == 'myorg/myrepo'"
 
  oidc {
    issuer_uri = "https://token.actions.githubusercontent.com"
  }
}
 
resource "google_service_account_iam_binding" "github_actions" {
  service_account_id = google_service_account.github_actions.name
  role               = "roles/iam.workloadIdentityUser"
 
  members = [
    "principalSet://iam.googleapis.com/${google_iam_workload_identity_pool.github.name}/attribute.repository/myorg/myrepo"
  ]
}

# Azure OIDC 認証
- uses: azure/login@v2
  with:
    client-id: ${{ secrets.AZURE_CLIENT_ID }}
    tenant-id: ${{ secrets.AZURE_TENANT_ID }}
    subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
    # client-secret は不要! Federated Credential で認証

# Azure CLI でフェデレーテッド認証情報を設定
az ad app federated-credential create \
  --id <application-object-id> \
  --parameters '{
    "name": "github-actions-main",
    "issuer": "https://token.actions.githubusercontent.com",
    "subject": "repo:myorg/myrepo:ref:refs/heads/main",
    "audiences": ["api://AzureADTokenExchange"]
  }'

# OIDC トークンのデバッグ
- name: Debug OIDC token
  run: |
    # トークンを取得
    TOKEN=$(curl -s -H "Authorization: bearer $ACTIONS_ID_TOKEN_REQUEST_TOKEN" \
      "$ACTIONS_ID_TOKEN_REQUEST_URL&audience=sts.amazonaws.com" | jq -r '.value')
 
    # ペイロードを確認（トークン自体はログに出さない）
    echo "$TOKEN" | cut -d '.' -f 2 | base64 -d 2>/dev/null | jq .
 
    # sub クレームの確認
    SUB=$(echo "$TOKEN" | cut -d '.' -f 2 | base64 -d 2>/dev/null | jq -r '.sub')
    echo "Subject claim: $SUB"

# ワークフローレベルで全権限を無効化し、ジョブレベルで必要最小限を付与
permissions: {}  # デフォルト全無効
 
jobs:
  test:
    runs-on: ubuntu-latest
    permissions:
      contents: read  # チェックアウトに必要
    steps:
      - uses: actions/checkout@v4
      - run: npm test
 
  deploy:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      id-token: write     # OIDC
      packages: write     # コンテナレジストリ
    steps:
      - uses: actions/checkout@v4
      # ...

# リポジトリ全体のデフォルト設定
# Settings → Actions → General → Workflow permissions
# → "Read repository contents and packages permissions" を選択
 
# ワークフローごとのオーバーライド
name: Minimal Permissions Example
on: [push]
 
# ワークフローレベルで全無効化
permissions: {}
 
jobs:
  # ジョブごとに必要な権限のみ付与
  lint-and-test:
    permissions:
      contents: read
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - run: npm ci && npm test
 
  comment-pr:
    if: github.event_name == 'pull_request'
    permissions:
      contents: read
      pull-requests: write
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: peter-evans/create-or-update-comment@v4
        with:
          issue-number: ${{ github.event.pull_request.number }}
          body: "CI passed!"
 
  publish-package:
    permissions:
      contents: read
      packages: write
      id-token: write
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      # ...

# GITHUB_TOKEN の代わりに GitHub App トークンを使用
# → より細かい権限制御と、他リポジトリへのアクセスが可能
 
name: Cross-repo operations
on: [push]
 
jobs:
  update-other-repo:
    runs-on: ubuntu-latest
    steps:
      - name: Generate GitHub App token
        id: app-token
        uses: actions/create-github-app-token@v1
        with:
          app-id: ${{ vars.APP_ID }}
          private-key: ${{ secrets.APP_PRIVATE_KEY }}
          owner: ${{ github.repository_owner }}
          repositories: "other-repo"
 
      - uses: actions/checkout@v4
        with:
          repository: myorg/other-repo
          token: ${{ steps.app-token.outputs.token }}
 
      - run: |
          git config user.name "github-actions[bot]"
          git config user.email "github-actions[bot]@users.noreply.github.com"
          echo "Updated at $(date)" >> updates.log
          git add . && git commit -m "Auto update" && git push

# 悪い例: タグ参照 → タグが上書きされるリスク
- uses: actions/checkout@v4          # v4 タグが悪意あるコードに書き換え可能
 
# 良い例: コミットSHAで完全固定
- uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11  # v4.1.1
  # SHA は改ざん不可能
 
# Dependabot でSHA参照も自動更新可能
# .github/dependabot.yml
version: 2
updates:
  - package-ecosystem: "github-actions"
    directory: "/"
    schedule:
      interval: "weekly"
    # SHA 参照の場合もバージョンコメントがあれば自動更新される

# 組織レベルで許可するアクションを制限
# GitHub Organization Settings → Actions → General
 
# allowed-actions.txt (ドキュメントとして管理)
# 公式アクション:
#   actions/checkout
#   actions/setup-node
#   actions/cache
#   actions/upload-artifact
#   actions/download-artifact
#   actions/create-github-app-token
#
# 信頼済みサードパーティ:
#   docker/build-push-action
#   docker/login-action
#   docker/metadata-action
#   docker/setup-buildx-action
#   aws-actions/configure-aws-credentials
#   google-github-actions/auth
#   azure/login
#   softprops/action-gh-release
#   peter-evans/create-or-update-comment

# .github/dependabot.yml
version: 2
updates:
  # GitHub Actions の依存関係
  - package-ecosystem: "github-actions"
    directory: "/"
    schedule:
      interval: "weekly"
      day: "monday"
      time: "09:00"
      timezone: "Asia/Tokyo"
    # セキュリティアップデートは即座に
    open-pull-requests-limit: 10
    reviewers:
      - "devops-team"
    labels:
      - "dependencies"
      - "github-actions"
 
  # npm の依存関係
  - package-ecosystem: "npm"
    directory: "/"
    schedule:
      interval: "weekly"
    groups:
      # マイナー/パッチ更新をグループ化
      minor-and-patch:
        patterns:
          - "*"
        update-types:
          - "minor"
          - "patch"
    ignore:
      # メジャーバージョンアップは手動対応
      - dependency-name: "*"
        update-types: ["version-update:semver-major"]
 
  # Docker イメージの依存関係
  - package-ecosystem: "docker"
    directory: "/"
    schedule:
      interval: "weekly"

// renovate.json
{
  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
  "extends": [
    "config:recommended",
    ":pinAllExceptPeerDependencies",
    "group:allNonMajor"
  ],
  "github-actions": {
    "enabled": true,
    "pinDigests": true
  },
  "packageRules": [
    {
      "description": "Auto-merge non-major updates",
      "matchUpdateTypes": ["minor", "patch", "pin", "digest"],
      "automerge": true,
      "automergeType": "pr",
      "platformAutomerge": true
    },
    {
      "description": "Group GitHub Actions updates",
      "matchManagers": ["github-actions"],
      "groupName": "GitHub Actions",
      "schedule": ["before 9am on Monday"]
    }
  ]
}

# SLSA Level 3 準拠の例
name: Build with Provenance
on:
  push:
    tags: ['v*']
 
permissions:
  contents: read
  id-token: write
  packages: write
  attestations: write
 
jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11
 
      - uses: docker/build-push-action@v5
        id: build
        with:
          push: true
          tags: ghcr.io/${{ github.repository }}:${{ github.ref_name }}
 
      # ビルドのアテステーション(証明書)を生成
      - uses: actions/attest-build-provenance@v1
        with:
          subject-name: ghcr.io/${{ github.repository }}
          subject-digest: ${{ steps.build.outputs.digest }}

# SBOM を生成してアテステーションとして添付
name: SBOM Generation
on:
  push:
    tags: ['v*']
 
permissions:
  contents: read
  packages: write
  id-token: write
  attestations: write
 
jobs:
  sbom:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
 
      - name: Build Docker image
        run: docker build -t myapp:latest .
 
      # Syft で SBOM を生成
      - name: Generate SBOM
        uses: anchore/sbom-action@v0
        with:
          image: myapp:latest
          format: spdx-json
          output-file: sbom.spdx.json
 
      - name: Upload SBOM
        uses: actions/upload-artifact@v4
        with:
          name: sbom
          path: sbom.spdx.json
 
      # SBOM をアテステーションとして添付
      - uses: actions/attest-sbom@v1
        with:
          subject-name: ghcr.io/${{ github.repository }}
          subject-digest: ${{ steps.build.outputs.digest }}
          sbom-path: sbom.spdx.json

name: CodeQL Analysis
on:
  push:
    branches: [main]
  pull_request:
  schedule:
    - cron: '0 6 * * 1'  # 週次スキャン
 
permissions:
  security-events: write
  contents: read
 
jobs:
  analyze:
    runs-on: ubuntu-latest
    strategy:
      matrix:
        language: ['javascript', 'python']
    steps:
      - uses: actions/checkout@v4
 
      - uses: github/codeql-action/init@v3
        with:
          languages: ${{ matrix.language }}
          # カスタムクエリパックの使用
          queries: +security-and-quality
 
      - uses: github/codeql-action/analyze@v3
        with:
          category: "/language:${{ matrix.language }}"

# cosign を使ったイメージ署名
name: Sign Container Image
on:
  push:
    tags: ['v*']
 
permissions:
  contents: read
  packages: write
  id-token: write
 
jobs:
  sign:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
 
      - uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
 
      - uses: docker/build-push-action@v5
        id: build
        with:
          push: true
          tags: ghcr.io/${{ github.repository }}:${{ github.ref_name }}
 
      - name: Install cosign
        uses: sigstore/cosign-installer@v3
 
      - name: Sign image with cosign (keyless)
        run: |
          cosign sign --yes \
            ghcr.io/${{ github.repository }}@${{ steps.build.outputs.digest }}
        env:
          COSIGN_EXPERIMENTAL: 1
 
      # 検証コマンド（デプロイ時に実行）
      # cosign verify ghcr.io/myorg/myapp@sha256:... \
      #   --certificate-identity-regexp='https://github.com/myorg/myrepo/' \
      #   --certificate-oidc-issuer='https://token.actions.githubusercontent.com'

# セルフホステッドランナーのネットワーク制限
jobs:
  build:
    runs-on: self-hosted
    steps:
      - uses: actions/checkout@v4
 
      # ネットワークアクセスを必要最小限に
      - name: Build (ネットワーク不要)
        run: |
          # キャッシュ済み依存関係でオフラインビルド
          npm ci --prefer-offline
          npm run build

# エフェメラル(使い捨て)ランナーの使用
# 各ジョブ実行後にランナーをクリーンアップ
jobs:
  build:
    runs-on: ubuntu-latest  # GitHub ホステッド = 毎回クリーンなVM
    # セルフホステッドの場合:
    # runs-on: [self-hosted, ephemeral]
    steps:
      - uses: actions/checkout@v4
      - run: npm ci && npm test
      # ジョブ終了後、VMは破棄される → 残留データのリスクなし

# StepSecurity の Harden Runner でランナーの活動を監視・制限
name: Hardened Build
on: [push]
 
permissions:
  contents: read
 
jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - uses: step-security/harden-runner@v2
        with:
          egress-policy: audit
          # 本番運用時は block に切り替え
          # egress-policy: block
          allowed-endpoints: >
            github.com:443
            api.github.com:443
            registry.npmjs.org:443
            objects.githubusercontent.com:443
 
      - uses: actions/checkout@v4
      - run: npm ci
      - run: npm test

# 定期的なセキュリティ監査
name: Security Audit
on:
  schedule:
    - cron: '0 9 * * 1'  # 毎週月曜 9:00 UTC
  workflow_dispatch:
 
permissions:
  contents: read
  security-events: write
  issues: write
 
jobs:
  dependency-audit:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
 
      - uses: actions/setup-node@v4
        with:
          node-version: '20'
 
      - name: npm audit
        run: |
          npm ci
          npm audit --json > audit-report.json || true
 
          # Critical/High の脆弱性があれば Issue を作成
          CRITICAL=$(jq '.metadata.vulnerabilities.critical' audit-report.json)
          HIGH=$(jq '.metadata.vulnerabilities.high' audit-report.json)
 
          if [ "$CRITICAL" -gt 0 ] || [ "$HIGH" -gt 0 ]; then
            echo "::warning::Critical: $CRITICAL, High: $HIGH vulnerabilities found"
          fi
 
      - name: Upload audit report
        uses: actions/upload-artifact@v4
        with:
          name: security-audit
          path: audit-report.json
 
  actions-audit:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
 
      - name: Audit GitHub Actions versions
        run: |
          echo "## GitHub Actions バージョン監査" > actions-audit.md
          echo "" >> actions-audit.md
          echo "| ファイル | アクション | 参照方法 | 状態 |" >> actions-audit.md
          echo "|---------|---------|---------|------|" >> actions-audit.md
 
          # SHA 参照でないアクションを検出
          for file in .github/workflows/*.yml; do
            grep -n 'uses:' "$file" | while read -r line; do
              if echo "$line" | grep -qP '@[a-f0-9]{40}'; then
                echo "| $file | $(echo $line | grep -oP 'uses: \K[^@]+') | SHA | OK |" >> actions-audit.md
              elif echo "$line" | grep -qP '@v\d+'; then
                echo "| $file | $(echo $line | grep -oP 'uses: \K[^@]+') | Tag | 要改善 |" >> actions-audit.md
              fi
            done
          done
 
          cat actions-audit.md
 
      - name: Upload audit report
        uses: actions/upload-artifact@v4
        with:
          name: actions-audit
          path: actions-audit.md

# サードパーティアクションの改ざん検知
name: Action Integrity Check
on:
  pull_request:
    paths:
      - '.github/workflows/**'
 
jobs:
  check-actions:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
 
      - name: Check for non-pinned actions
        run: |
          ISSUES=0
          for file in .github/workflows/*.yml; do
            while IFS= read -r line; do
              if echo "$line" | grep -qP 'uses:\s+\S+@(?!([a-f0-9]{40}|[a-f0-9]{7}))'; then
                echo "::warning file=$file::Non-SHA pinned action: $line"
                ISSUES=$((ISSUES + 1))
              fi
            done < <(grep 'uses:' "$file" | grep -v '#' | grep -v './')
          done
 
          if [ "$ISSUES" -gt 0 ]; then
            echo "::error::Found $ISSUES non-SHA-pinned actions. Pin all actions to SHA."
            exit 1
          fi

# リポジトリ設定で Secret Scanning を有効化
# Settings → Code security and analysis → Secret scanning → Enable
 
# カスタムパターンの追加例
# Settings → Code security → Secret scanning → Custom patterns
 
# .github/secret_scanning.yml
# シークレットスキャンの除外設定
paths-ignore:
  - "tests/fixtures/**"
  - "docs/examples/**"

# CI での gitleaks チェック
name: Secret Detection
on:
  pull_request:
 
jobs:
  gitleaks:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
 
      - uses: gitleaks/gitleaks-action@v2
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

# .gitleaks.toml — gitleaks 設定
title = "Custom Gitleaks Configuration"
 
# カスタムルール
description = "Internal API Key"
regex = '''INTERNAL_API_KEY_[A-Za-z0-9]{32}'''
tags = ["key", "internal"]
 
# 除外パス
[allowlist]
paths = [
  '''tests/fixtures/''',
  '''\.github/workflows/''',
]
 
# 除外パターン
regexes = [
  '''EXAMPLE_KEY_[A-Za-z0-9]+''',
]

# 悪い例: Fork PR で secrets が利用可能
on:
  pull_request_target:  # ← 危険! Fork PR でも secrets が利用可能
jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          ref: ${{ github.event.pull_request.head.sha }}  # Fork のコードを実行
      - run: echo "${{ secrets.DEPLOY_KEY }}"  # 漏洩!
 
# 改善: pull_request イベントを使い、Fork PR では secrets を使わない
on:
  pull_request:  # Fork PR では secrets は空になる(安全)
jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - run: npm test  # secrets 不要の処理のみ

# 悪い例: ユーザー入力を直接実行
steps:
  - run: echo "PR title: ${{ github.event.pull_request.title }}"
    # PRタイトルに "; rm -rf /" を含めるとコマンド注入
 
# 改善: 環境変数経由で渡す
steps:
  - run: echo "PR title: $PR_TITLE"
    env:
      PR_TITLE: ${{ github.event.pull_request.title }}
    # 環境変数として渡せばシェルインジェクションを防止

# 悪い例: 全権限を付与
permissions: write-all
# → 不要な権限まで付与され、侵害時の影響範囲が最大化
 
# 改善: 必要最小限の権限のみ
permissions:
  contents: read
  packages: write

# 悪い例: デバッグ時にシークレットを出力
- run: |
    echo "Debug: ${{ secrets.API_KEY }}"
    curl -v -H "Authorization: Bearer ${{ secrets.API_KEY }}" $URL
    # -v オプションでヘッダーが表示される → シークレット露出
 
# 改善: 環境変数を使い、デバッグ出力を制限
- run: |
    curl -s -o response.json -w "%{http_code}" \
      -H "Authorization: Bearer $API_KEY" "$URL"
    echo "HTTP Status: $(cat response.json | jq -r '.status')"
  env:
    API_KEY: ${{ secrets.API_KEY }}
    URL: ${{ vars.API_URL }}

# 演習1: 基本実装のテンプレート
class Exercise1:
    """基本的な実装パターンの演習"""
 
    def __init__(self):
        self.data = []
 
    def validate_input(self, value):
        """入力値の検証"""
        if value is None:
            raise ValueError("入力値がNoneです")
        return True
 
    def process(self, value):
        """データ処理のメインロジック"""
        self.validate_input(value)
        self.data.append(value)
        return self.data
 
    def get_results(self):
        """処理結果の取得"""
        return {
            'count': len(self.data),
            'data': self.data
        }
 
# テスト
def test_exercise1():
    ex = Exercise1()
    assert ex.process(1) == [1]
    assert ex.process(2) == [1, 2]
    assert ex.get_results()['count'] == 2
 
    try:
        ex.process(None)
        assert False, "例外が発生するべき"
    except ValueError:
        pass
 
    print("全テスト合格!")
 
test_exercise1()

# 演習2: 応用パターン
from typing import List, Dict, Optional
from datetime import datetime
 
class AdvancedExercise:
    """応用パターンの演習"""
 
    def __init__(self, max_size: int = 100):
        self._items: List[Dict] = []
        self._max_size = max_size
        self._created_at = datetime.now()
 
    def add(self, key: str, value: any) -> bool:
        """アイテムの追加（サイズ制限付き）"""
        if len(self._items) >= self._max_size:
            return False
        self._items.append({
            'key': key,
            'value': value,
            'timestamp': datetime.now().isoformat()
        })
        return True
 
    def find(self, key: str) -> Optional[Dict]:
        """キーによる検索"""
        for item in reversed(self._items):
            if item['key'] == key:
                return item
        return None
 
    def remove(self, key: str) -> bool:
        """キーによる削除"""
        for i, item in enumerate(self._items):
            if item['key'] == key:
                self._items.pop(i)
                return True
        return False
 
    def stats(self) -> Dict:
        """統計情報"""
        return {
            'total_items': len(self._items),
            'max_size': self._max_size,
            'usage_percent': len(self._items) / self._max_size * 100,
            'uptime': str(datetime.now() - self._created_at)
        }
 
# テスト
def test_advanced():
    ex = AdvancedExercise(max_size=3)
    assert ex.add("a", 1) == True
    assert ex.add("b", 2) == True
    assert ex.add("c", 3) == True
    assert ex.add("d", 4) == False  # サイズ制限
    assert ex.find("b")['value'] == 2
    assert ex.remove("b") == True
    assert ex.find("b") is None
    stats = ex.stats()
    assert stats['total_items'] == 2
    print("応用テスト全合格!")
 
test_advanced()

# 演習3: パフォーマンス最適化
import time
from functools import lru_cache
 
# 最適化前（O(n^2)）
def slow_search(data: list, target: int) -> int:
    """非効率な検索"""
    for i in range(len(data)):
        for j in range(i + 1, len(data)):
            if data[i] + data[j] == target:
                return (i, j)
    return (-1, -1)
 
# 最適化後（O(n)）
def fast_search(data: list, target: int) -> tuple:
    """ハッシュマップを使った効率的な検索"""
    seen = {}
    for i, num in enumerate(data):
        complement = target - num
        if complement in seen:
            return (seen[complement], i)
        seen[num] = i
    return (-1, -1)
 
# ベンチマーク
def benchmark():
    import random
    data = list(range(5000))
    random.shuffle(data)
    target = data[100] + data[4000]
 
    start = time.time()
    result1 = slow_search(data, target)
    slow_time = time.time() - start
 
    start = time.time()
    result2 = fast_search(data, target)
    fast_time = time.time() - start
 
    print(f"非効率版: {slow_time:.4f}秒")
    print(f"効率版:   {fast_time:.6f}秒")
    print(f"高速化率: {slow_time/fast_time:.0f}倍")
 
benchmark()

# デバッグ用ユーティリティ
import logging
import traceback
from functools import wraps
 
# ロガーの設定
logging.basicConfig(
    level=logging.DEBUG,
    format='%(asctime)s [%(levelname)s] %(name)s: %(message)s'
)
logger = logging.getLogger(__name__)
 
def debug_decorator(func):
    """関数の入出力をログ出力するデコレータ"""
    @wraps(func)
    def wrapper(*args, **kwargs):
        logger.debug(f"呼び出し: {func.__name__}(args={args}, kwargs={kwargs})")
        try:
            result = func(*args, **kwargs)
            logger.debug(f"戻り値: {func.__name__} -> {result}")
            return result
        except Exception as e:
            logger.error(f"例外発生: {func.__name__}: {e}")
            logger.error(traceback.format_exc())
            raise
    return wrapper
 
@debug_decorator
def process_data(items):
    """データ処理（デバッグ対象）"""
    if not items:
        raise ValueError("空のデータ")
    return [item * 2 for item in items]

# 設計判断の記録テンプレート
class ArchitectureDecisionRecord:
    """ADR (Architecture Decision Record) の作成"""
 
    def __init__(self, title: str):
        self.title = title
        self.context = ""
        self.decision = ""
        self.consequences = []
        self.alternatives = []
 
    def set_context(self, context: str):
        """背景と課題の記述"""
        self.context = context
        return self
 
    def set_decision(self, decision: str):
        """決定内容の記述"""
        self.decision = decision
        return self
 
    def add_consequence(self, consequence: str, positive: bool = True):
        """結果の追加"""
        self.consequences.append({
            'description': consequence,
            'type': 'positive' if positive else 'negative'
        })
        return self
 
    def add_alternative(self, name: str, reason_rejected: str):
        """却下した代替案の追加"""
        self.alternatives.append({
            'name': name,
            'reason_rejected': reason_rejected
        })
        return self
 
    def to_markdown(self) -> str:
        """Markdown形式で出力"""
        md = f"# ADR: {self.title}\n\n"
        md += f"## 背景\n{self.context}\n\n"
        md += f"## 決定\n{self.decision}\n\n"
        md += "## 結果\n"
        for c in self.consequences:
            icon = "✅" if c['type'] == 'positive' else "⚠️"
            md += f"- {icon} {c['description']}\n"
        md += "\n## 却下した代替案\n"
        for a in self.alternatives:
            md += f"- **{a['name']}**: {a['reason_rejected']}\n"
        return md

# .github/workflows/compliance-check.yml
name: Compliance Check
 
on:
  push:
    branches: [main]
  schedule:
    - cron: '0 0 * * 1'  # 毎週月曜日
 
jobs:
  license-check:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
 
      - name: Check OSS Licenses
        run: |
          npx license-checker --production --onlyAllow \
            'MIT;BSD-2-Clause;BSD-3-Clause;Apache-2.0;ISC;0BSD;CC0-1.0;Unlicense' \
            --excludePackages 'some-internal-pkg@1.0.0'
 
      - name: Generate License Report
        run: |
          npx license-checker --production --csv > licenses.csv
 
      - name: Upload License Report
        uses: actions/upload-artifact@v4
        with:
          name: license-report
          path: licenses.csv
 
  vulnerability-audit:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - run: npm ci
 
      - name: Full Vulnerability Audit
        run: |
          npm audit --audit-level=critical --json > audit-report.json || true
          CRITICAL=$(jq '.metadata.vulnerabilities.critical' audit-report.json)
          HIGH=$(jq '.metadata.vulnerabilities.high' audit-report.json)
          echo "Critical: $CRITICAL, High: $HIGH"
          if [ "$CRITICAL" -gt 0 ]; then
            echo "Critical vulnerabilities found!"
            exit 1
          fi
 
      - name: Upload Audit Report
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: audit-report
          path: audit-report.json

#!/bin/bash
# scripts/audit-workflow-permissions.sh
# ワークフローファイルの権限設定を監査する
 
echo "=== GitHub Actions Workflow Permission Audit ==="
echo ""
 
WORKFLOWS_DIR=".github/workflows"
ISSUES_FOUND=0
 
for workflow in "$WORKFLOWS_DIR"/*.yml "$WORKFLOWS_DIR"/*.yaml; do
  [ -f "$workflow" ] || continue
  echo "Checking: $workflow"
 
  # トップレベル permissions の確認
  if ! grep -q "^permissions:" "$workflow"; then
    echo "  WARNING: No top-level permissions block"
    ISSUES_FOUND=$((ISSUES_FOUND + 1))
  fi
 
  # write-all の検出
  if grep -q "permissions: write-all" "$workflow"; then
    echo "  CRITICAL: write-all permissions detected"
    ISSUES_FOUND=$((ISSUES_FOUND + 1))
  fi
 
  # ピン留めされていないアクションの検出
  if grep -E "uses: [a-zA-Z].*@v[0-9]" "$workflow" | grep -v "@[0-9a-f]\{40\}" > /dev/null; then
    echo "  WARNING: Actions not pinned to commit SHA"
    grep -n -E "uses: [a-zA-Z].*@v[0-9]" "$workflow" | while read -r line; do
      echo "    $line"
    done
    ISSUES_FOUND=$((ISSUES_FOUND + 1))
  fi
 
  echo ""
done
 
echo "=== Audit Complete ==="
echo "Issues found: $ISSUES_FOUND"
exit $ISSUES_FOUND