refactor(ci): test と deploy を再利用可能ワークフローへ分離

[yusuke0610]

概要

.github/workflows/ci.yml に同居していた テスト/品質ゲート と デプロイ を、workflow_call の再利用可能ワークフローへ分離する。デプロイ 6 ジョブ（web/backend × dev/stg/prod）の重複も environment パラメータ化で解消する。

変更内容

ファイル	役割
ci.yml	オーケストレーターへ縮小（detect-changes + tests/deploy-* の呼び出しのみ）。約 660 行 → 約 175 行
test.yml（新規）	workflow_call。test-web/test-e2e/test-backend/codegen-drift/smoke-backend/detect-duplication を集約。deploy-gate ジョブが deploy_gate 出力を公開
deploy.yml（新規）	workflow_call。deploy-web/deploy-backend を environment でパラメータ化（dev/stg/prod の 6 ジョブ相当を 1 定義 × 3 呼び出しへ集約）

設計上のポイント

• デプロイのゲート条件は現行と等価。test.yml の deploy-gate ジョブが test-web/test-backend/codegen-drift の結果のみ（success または skipped）を集約して deploy_gate=pass/fail を出力する。test-e2e/smoke-backend は従来通りゲート対象外（フレーキーな e2e が deploy をブロックしないため）。
• ci.yml の deploy caller は if: always() && … && needs.tests.outputs.deploy_gate == 'pass'。always() は tests 内のフレーキージョブで result が success にならなくても gate 出力で判定するため。
• environment 差分（vars/secrets のフォールバック）は ci.yml の呼び出し側で解決し、deploy.yml は env 非依存に保つ。
• action の SHA pin は全て踏襲（サプライチェーン保護）。
• detect-changes の app filter に test.yml/deploy.yml を追加。

⚠️ マージ前の確認（GitHub 設定 / PR では変更不可）

再利用可能ワークフロー化により status check 名が tests / test-backend のようにネストする。ブランチ保護の required status checks を設定している場合は、名称の更新が必要。

検証

• actionlint: 再利用ワークフローの配線（inputs/secrets/outputs/uses: ./）に構造エラーなし。残る指摘は元 ci.yml から移設したコード由来の既存 shellcheck 警告（CI 非対象）。
• 本変更は .github/workflows/ のみで app コードに影響しないため make ci は対象外。

🤖 Generated with Claude Code

Summary by CodeRabbit

• New Features
  • Streamlined CI/CD into reusable test and deployment workflows for more consistent releases.
  • Added automated checks for app changes, duplication, build quality, and backend health before deployment.
  • Expanded deployment support across dev, staging, and production environments.
• Bug Fixes
  • Improved change detection so workflow updates now trigger CI runs reliably.
  • Added stricter deployment gating to prevent releases when key checks fail.

[coderabbitai]

Warning

Review limit reached

@yusuke0610, we couldn't start this review because you've reached your PR review rate limit.

More reviews will be available in 48 minutes and 5 seconds. Learn how PR review limits work.

Your organization has used up its prepaid credits, and credit purchases are no longer available. Enable the review add-on in the billing tab to keep reviews running — you're only billed for reviews past your plan's rate limits ($0.25/file).

⌛ How to resolve this issue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based credits.

🚦 How do rate limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please see our Fair Usage Limits Policy for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 129c67f8-8a39-4591-bad3-3d6682dbe937

📥 Commits

Reviewing files that changed from the base of the PR and between d55552e and 657195c.

📒 Files selected for processing (2)

• .github/workflows/deploy.yml
• .github/workflows/test.yml

📝 Walkthrough

Walkthrough

CI now delegates validation and deployments to reusable workflows. The new test workflow runs duplication, web, backend, codegen, and smoke checks, and publishes a deploy gate. The new deploy workflow handles web and backend deployments for the target environments.

Changes

Reusable CI workflow delegation

Layer / File(s)	Summary
Reusable test workflow .github/workflows/test.yml	workflow_call adds app and dupe inputs plus a deploy_gate output, and the workflow runs duplication, web, E2E, backend, codegen-drift, smoke, and gate jobs.
Reusable deploy workflow .github/workflows/deploy.yml	workflow_call adds the deploy inputs and secrets, and the workflow runs web deployment to Cloudflare Pages and backend deployment to Cloud Run.
CI routing and environment deploy calls .github/workflows/ci.yml	detect-changes now watches the new workflow files, tests calls the reusable test workflow, and deploy-dev/deploy-stg/deploy-prod call the reusable deploy workflow when the branch and gate conditions match.

Sequence Diagram(s)

sequenceDiagram
  participant "ci.yml" as CI
  participant "test.yml" as Tests
  participant "deploy.yml" as Deploy
  CI->>Tests: workflow_call(app, dupe)
  Tests-->>CI: deploy_gate
  CI->>Deploy: deploy-dev on dev when deploy_gate == pass
  CI->>Deploy: deploy-stg on stg when deploy_gate == pass
  CI->>Deploy: deploy-prod on main when deploy_gate == pass

Loading

Estimated code review effort

🎯 4 (Complex) | ⏱️ ~60 minutes

Poem

A bunny hopped through pipelines bright,
With carrots, checks, and green delight.
Test gate passed with a cheerful thump,
Then deploys went pitter-pat and plump.
🐇✨

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly matches the main change: splitting CI test and deploy logic into reusable workflows.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch refactor/ci-split-test-deploy

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[yusuke0610]

@coderabbitai RVして

[coderabbitai]

@yusuke0610 レビューします。

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[coderabbitai]

🧹 Nitpick comments (2)

.github/workflows/test.yml (1)

34-37: 🔒 Security & Privacy | 🔵 Trivial | ⚡ Quick win

Disable persisted checkout credentials in the remaining read-only test jobs.

Add persist-credentials: false to the checkout steps in detect-duplication, test-web, test-e2e, and test-backend (.github/workflows/test.yml:34-37, 63-64, 99-100, 140-141).

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/test.yml around lines 34 - 37, The remaining read-only
test jobs still use checkout with persisted credentials, so update each Checkout
step in detect-duplication, test-web, test-e2e, and test-backend to set
persist-credentials to false. Apply this consistently in the workflow’s
actions/checkout usages so these jobs do not retain GitHub credentials during
test execution.

Source: Linters/SAST tools

.github/workflows/deploy.yml (1)

55-58: 🔒 Security & Privacy | 🔵 Trivial | ⚡ Quick win

Disable checkout credential persistence in both deploy jobs.

Neither job pushes back to git, so actions/checkout should not leave credentials on disk. Add persist-credentials: false to both checkout steps.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/deploy.yml around lines 55 - 58, The Checkout step in both
deploy jobs still leaves git credentials on disk even though neither job pushes
changes. Update the actions/checkout usage in each deploy job to explicitly set
persist-credentials to false, keeping the change localized to the Checkout step
so both job definitions are covered.

Source: Linters/SAST tools

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In @.github/workflows/deploy.yml:
- Around line 55-58: The Checkout step in both deploy jobs still leaves git
credentials on disk even though neither job pushes changes. Update the
actions/checkout usage in each deploy job to explicitly set persist-credentials
to false, keeping the change localized to the Checkout step so both job
definitions are covered.

In @.github/workflows/test.yml:
- Around line 34-37: The remaining read-only test jobs still use checkout with
persisted credentials, so update each Checkout step in detect-duplication,
test-web, test-e2e, and test-backend to set persist-credentials to false. Apply
this consistently in the workflow’s actions/checkout usages so these jobs do not
retain GitHub credentials during test execution.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 69a32580-b73e-41dc-a53f-2be56eb91d6f

📥 Commits

Reviewing files that changed from the base of the PR and between 550b0f1 and d55552e.

📒 Files selected for processing (3)

• .github/workflows/ci.yml
• .github/workflows/deploy.yml
• .github/workflows/test.yml