feat(intelligence): IaC からインフラリソースを検出（ADR-0016 D10）

[yusuke0610]

Terraform/OpenTofu の .tf から provider（AWS/Google 等）と resource（具体 サービス。aws_s3_bucket 等）を抽出し、kind=infra / signal_source=infra_declared として 3 層モデルへ投入する。当初「検討中/未採用」だった将来課題を機械検出に
限定して採用（D10）。表示名の human-in-the-loop 畳み込みは別 PR。

• skills/infra/: 正規表現ベースの Terraform parser を plugin 型で新設（依存なし）
• skills/types.py: SKILL_KIND_INFRA / InfraResourceDeclaration を追加
• github_collector.py: 同一 tree（1 コール）から .tf を探索、.terraform 除外・ 深さ/件数キャップ・partial 伝播（D9 探索を流用）
• skills/aggregator.py: _collect_infra を追加。provider/resource を別スキルで keep-all し、リポあたり 1 evidence にデデュープ
• schemas/github_skill.py: description を拡張し generated.ts を再生成
• docs/adr/0016: D10 を追記、将来課題を格上げ・改訂履歴を更新

kind/signal_source/ecosystem は既存 String カラムの値域内のため migration 不要。 既存 language/package 検出・unique_skills・API 契約は不変。

Claude-Session: https://claude.ai/code/session_01Ae3B21DsBFV7ev8SozSYt9

変更概要

セルフレビューチェックリスト

必須確認

• make ci が pass している（lint + test + build-web）
• コメント・ドキュメント・エラーメッセージは日本語で記述した

条件付き確認（該当する場合のみ N/A と記入）

• app/schemas/ または app/routers/ を変更した場合: make codegen-types を実行し web/src/api/generated.ts の差分をコミットした
• 新しいページ・認証・ナビゲーション・レイアウトを変更した場合: E2E を実行した（nix develop --command bash -c "cd web && npm run test:e2e"）
• 新規環境変数を追加した場合: env_keys.py / docs/api.md / infra/modules/cloud_run/main.tf / docker-compose.yml の 4 箇所を同期した
• web/src/ で日本語メッセージを web/src/constants/messages.ts の定数経由で参照した（リテラル直書きなし）

破壊的変更

• 破壊的変更なし（API 契約・DB スキーマ・既存の公開インターフェースに変更なし）
• 破壊的変更あり → 概要:

ADR（設計判断を伴う変更の場合のみ）

• 新しいライブラリ採用・アーキテクチャ変更を伴う場合、ADR を作成した（または既存 ADR が対応している）

---

PR タイトル形式: <type>: <内容>（日本語）
type: feat / fix / docs / refactor / test / chore / infra

Summary by CodeRabbit

• New Features

  • Added infrastructure skill detection for Terraform/OpenTofu (.tf) with provider/resource granularity.
  • Infrastructure evidence is now collected and surfaced alongside existing package and source-based signals, including infra-specific metadata.

• Bug Fixes

  • Improved repo scanning to better reflect truncated/capped infrastructure searches and propagate “partial scan” status.

• Documentation

  • Updated API schema descriptions to reflect expanded infra evidence/path semantics and supported infra kinds/evidence sources.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 8352368f-457d-42f0-a61a-b9ab94270738

📥 Commits

Reviewing files that changed from the base of the PR and between 033b01e and c32526e.

📒 Files selected for processing (1)

• backend/tests/test_github_collector_extended.py

🚧 Files skipped from review as they are similar to previous changes (1)

• backend/tests/test_github_collector_extended.py

---

📝 Walkthrough

Walkthrough

This PR adds Terraform/OpenTofu infra resource detection to the GitHub skill pipeline, including new infra types, a parser registry, collector scanning with caps, aggregation into kind=infra skills, and matching schema, docs, and tests.

Changes

Infra skill detection pipeline

Layer / File(s)	Summary
Infra types and parser API backend/app/services/intelligence/skills/types.py, backend/app/services/intelligence/skills/infra/*, backend/tests/test_skill_infra_parsers.py	Adds infra skill kinds and declaration types, the parser protocol, Terraform parsing and registry dispatch, package re-exports, and parser tests.
Infra collection in GitHub collector backend/app/services/intelligence/github_collector.py, backend/tests/test_github_collector_extended.py	Extends repository signal collection to scan .tf files, exclude .terraform, track infra partial scans, and pass infra declarations through RepoData, with supporting tests.
Infra skill aggregation backend/app/services/intelligence/github_link_service.py, backend/app/services/intelligence/skills/aggregator.py, backend/tests/test_skill_aggregator.py	Threads infra declarations into skill aggregation and adds infra-specific evidence collection, deduplication, confidence handling, and partial-scan propagation.
API schema and documentation updates backend/app/schemas/github_skill.py, web/src/api/generated.ts, docs/adr/0016-github-skill-inference.md, backend/tests/test_github_skills_api.py	Updates schema descriptions, generated API docs, ADR guidance, and persistence tests to describe infra skills and infra evidence fields.

Estimated code review effort: 3 (Moderate) | ~30 minutes

Possibly related PRs

• yusuke0610/devforge#281: Also changes backend/app/services/intelligence/github_link_service.py orchestration in the same pipeline.
• yusuke0610/devforge#417: Adds evidence field plumbing that this PR extends for infra declarations.
• yusuke0610/devforge#445: Modifies the shared GitHub→skill pipeline and aggregator logic in a closely related way.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly matches the main change: adding IaC-based infra resource detection for ADR-0016 D10.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch claude/adr16-remaining-tasks-lsr3d2

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

🧹 Nitpick comments (2)

backend/app/services/intelligence/github_collector.py (1)

182-212: 🚀 Performance & Scalability | 🔵 Trivial

IaC fetch loop adds up to 30 more sequential round-trips per repo.

The new .tf fetch loop follows the existing manifest/source pattern of awaiting fetch_repo_file one path at a time. Combined with the pre-existing manifest and source loops, a monorepo hitting all three caps could issue dozens of sequential HTTP calls per repo before moving to the next repository, adding to overall GitHub-link pipeline latency.

Consider bounding concurrency (e.g. asyncio.gather with a semaphore) for the fetch loops if link latency becomes a concern, while being mindful of GitHub secondary rate limits.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@backend/app/services/intelligence/github_collector.py` around lines 182 -
212, The new IaC fetch loop in github_collector.py is still doing one await per
path, which can add many sequential GitHub round-trips alongside the existing
manifest and source loops. Update the fetch flow around fetch_repo_file,
parse_infra, and the selected_infra iteration to use bounded concurrency (for
example with asyncio.gather plus a semaphore) so multiple files can be fetched
in parallel without exceeding rate-limit safeguards. Keep the existing selection
caps and partial-tracking behavior intact while applying the same pattern
consistently across the manifest, source, and infra fetch loops.

backend/tests/test_github_collector_extended.py (1)

420-475: 🎯 Functional Correctness | 🔵 Trivial | ⚡ Quick win

Missing test for _INFRA_MAX_DEPTH truncation.

The manifest suite has test_depth_cap_drops_deep_paths_and_marks_partial covering _MANIFEST_MAX_DEPTH, but there's no analogous test for _INFRA_MAX_DEPTH (only the count cap and truncated propagation are exercised for infra). Since the collector intentionally sets a different depth cap for .tf (deeper subtrees), a dedicated test would guard that behavior.

✅ Suggested additional test

def test_infra_depth_cap_drops_deep_paths_and_marks_infra_partial(self, monkeypatch):
    """深さ上限超の .tf は落とし infra_partial=True にすること（D10 / D9 c/d）。"""
    monkeypatch.setattr(github_collector, "_INFRA_MAX_DEPTH", 2)
    _decls, _imported, _partial, infra, infra_partial, fetched = (
        self._patched_collect_full(
            ["main.tf", "a/b/c/main.tf"],
            False,
            file_contents={"main.tf": 'provider "aws" {}\n'},
        )
    )
    assert fetched == ["main.tf"]
    assert infra_partial is True

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@backend/tests/test_github_collector_extended.py` around lines 420 - 475, Add
a dedicated infra depth-cap test alongside the existing collector tests: in
test_github_collector_extended.py, extend the GitHub collector coverage for
_INFRA_MAX_DEPTH by monkeypatching github_collector._INFRA_MAX_DEPTH, calling
_patched_collect_full with one shallow .tf and one deeper .tf path, and
asserting the deep path is dropped from fetched while infra_partial becomes
True. Keep the test aligned with the existing depth-cap style used for
_MANIFEST_MAX_DEPTH so the collector’s .tf-specific depth behavior is guarded.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In `@backend/app/services/intelligence/github_collector.py`:
- Around line 182-212: The new IaC fetch loop in github_collector.py is still
doing one await per path, which can add many sequential GitHub round-trips
alongside the existing manifest and source loops. Update the fetch flow around
fetch_repo_file, parse_infra, and the selected_infra iteration to use bounded
concurrency (for example with asyncio.gather plus a semaphore) so multiple files
can be fetched in parallel without exceeding rate-limit safeguards. Keep the
existing selection caps and partial-tracking behavior intact while applying the
same pattern consistently across the manifest, source, and infra fetch loops.

In `@backend/tests/test_github_collector_extended.py`:
- Around line 420-475: Add a dedicated infra depth-cap test alongside the
existing collector tests: in test_github_collector_extended.py, extend the
GitHub collector coverage for _INFRA_MAX_DEPTH by monkeypatching
github_collector._INFRA_MAX_DEPTH, calling _patched_collect_full with one
shallow .tf and one deeper .tf path, and asserting the deep path is dropped from
fetched while infra_partial becomes True. Keep the test aligned with the
existing depth-cap style used for _MANIFEST_MAX_DEPTH so the collector’s
.tf-specific depth behavior is guarded.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 706919be-3309-4234-bd7e-e4582a0044af

📥 Commits

Reviewing files that changed from the base of the PR and between b4d4242 and 033b01e.

📒 Files selected for processing (16)

• backend/app/schemas/github_skill.py
• backend/app/services/intelligence/github_collector.py
• backend/app/services/intelligence/github_link_service.py
• backend/app/services/intelligence/skills/__init__.py
• backend/app/services/intelligence/skills/aggregator.py
• backend/app/services/intelligence/skills/infra/__init__.py
• backend/app/services/intelligence/skills/infra/base.py
• backend/app/services/intelligence/skills/infra/registry.py
• backend/app/services/intelligence/skills/infra/terraform.py
• backend/app/services/intelligence/skills/types.py
• backend/tests/test_github_collector_extended.py
• backend/tests/test_github_skills_api.py
• backend/tests/test_skill_aggregator.py
• backend/tests/test_skill_infra_parsers.py
• docs/adr/0016-github-skill-inference.md
• web/src/api/generated.ts