CIのテスト構成整理とnpm公開ワークフローのOIDC移行

.github/workflows/github-pages.yml

@@ -3,29 +3,28 @@ name: Deploy typedoc to Pages
 on:
   push:
     branches: [main, master]
+  pull_request:
+    branches: [main, master, develop]
 
   workflow_dispatch:
 
 permissions:
   contents: read
-  pages: write
-  id-token: write
 
 concurrency:
-  group: "pages"
-  cancel-in-progress: true
+  group: pages-${{ github.event.pull_request.number || 'deploy' }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
 jobs:
-  deploy:
-    environment:
-      name: github-pages
-      url: ${{ steps.deployment.outputs.page_url }}
-
+  build:
     runs-on: ubuntu-latest
+    timeout-minutes: 15
 
     steps:
       - name: Checkout
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
         name: Install pnpm
@@ -35,23 +34,36 @@ jobs:
       - name: Install Node.js
         uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
-          node-version: "lts/*"
-          cache: 'pnpm'
+          node-version: "26"
+          cache: "pnpm"
 
       - name: Install dependencies
         run: pnpm install --frozen-lockfile
 
       - name: Build Pages
         run: pnpm run docs
 
-      - name: Setup Pages
-        uses: actions/configure-pages@45bfe0192ca1faeb007ade9deae92b16b8254a0d # v6.0.0
-
       - name: Upload artifact
+        if: github.event_name != 'pull_request'
         uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5.0.0
         with:
           path: "docs/"
 
+  deploy:
+    if: github.event_name != 'pull_request'
+    needs: build
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    permissions:
+      pages: write
+      id-token: write
+    environment:
+      name: github-pages
+      url: ${{ steps.deployment.outputs.page_url }}
+    steps:
+      - name: Setup Pages
+        uses: actions/configure-pages@45bfe0192ca1faeb007ade9deae92b16b8254a0d # v6.0.0
+
       - name: Deploy to GitHub Pages
         id: deployment
         uses: actions/deploy-pages@368f82528645a54fb793d4d04e342629a3f51346 # v5.0.1

.github/workflows/nodejs-test.yml

@@ -7,13 +7,25 @@ on:
     branches: [main, master, develop]
   pull_request:
     branches: [main, master, develop]
+  workflow_dispatch:
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
 
 jobs:
   build:
     runs-on: ubuntu-latest
+    timeout-minutes: 15
+    strategy:
+      fail-fast: false
+      matrix:
+        node-version: ["24", "26"]
 
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
         name: Install pnpm
@@ -23,21 +35,60 @@ jobs:
       - name: Install Node.js
         uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
-          node-version: "lts/*"
-          cache: 'pnpm'
+          node-version: ${{ matrix.node-version }}
+          cache: "pnpm"
 
       - name: Install dependencies
         run: pnpm install --frozen-lockfile
 
-      - run: pnpm run build
+      - name: Lint
+        run: pnpm run check:lint
+
+      - name: Type check
+        run: pnpm run check:build
 
       - name: Test with coverage
+        if: matrix.node-version == '26'
         run: pnpm run test:coverage
 
+      - name: Unit tests
+        if: matrix.node-version != '26'
+        run: pnpm run test:unit
+
+      - name: Build
+        run: pnpm run build:tsc
+
       - name: Upload coverage reports
-        if: always()
+        if: ${{ !cancelled() && matrix.node-version == '26' }}
         uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
-          name: coverage-reports
+          name: coverage-reports-node-${{ matrix.node-version }}
           path: coverage/
           if-no-files-found: warn
+          retention-days: 7
+
+  integration:
+    name: Live API tests
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Install pnpm
+        uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
+        with:
+          run_install: false
+
+      - name: Install Node.js
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
+        with:
+          node-version: "26"
+          cache: "pnpm"
+
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+
+      - name: Live API tests
+        run: pnpm run test:integration

.github/workflows/publish-npm.yml

@@ -4,11 +4,19 @@ permissions:
 on:
   release:
     types: [published]
+
+concurrency:
+  group: npm-publish
+  cancel-in-progress: false
+
 jobs:
   build:
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
         name: Install pnpm
@@ -18,16 +26,60 @@ jobs:
       - name: Install Node.js
         uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
-          node-version: "lts/*"
-          cache: "pnpm"
-          registry-url: https://registry.npmjs.org/
+          node-version: "26"
+          package-manager-cache: false
+
+      - name: Verify release version
+        env:
+          RELEASE_TAG: ${{ github.event.release.tag_name }}
+          IS_PRERELEASE: ${{ github.event.release.prerelease }}
+        run: |
+          node --input-type=module <<'NODE'
+          import { readFileSync } from 'node:fs';
+          const { version } = JSON.parse(readFileSync('package.json', 'utf8'));
+          if (![version, `v${version}`].includes(process.env.RELEASE_TAG)) {
+            throw new Error('Release tag must match package.json version');
+          }
+          if (version.includes('-') !== (process.env.IS_PRERELEASE === 'true')) {
+            throw new Error('Release prerelease flag must match package.json version');
+          }
+          NODE
 
       - name: Install dependencies
         run: pnpm install --frozen-lockfile
 
-      - name: Build
-        run: pnpm run build
+      # prepack runs lint, type checks, unit tests and the build without credentials.
+      - name: Pack
+        run: pnpm pack --out package.tgz
 
-      - uses: simenandre/publish-with-pnpm@d1c054e288970d151b70e430a316cc7d62cf08c5 # v2.0.0
+      - name: Upload package
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
-          npm-auth-token: ${{ secrets.NPM_TOKEN }}
+          name: npm-package
+          path: package.tgz
+          if-no-files-found: error
+          retention-days: 7
+
+  publish:
+    needs: build
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    permissions:
+      id-token: write
+    steps:
+      - name: Download package
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
+        with:
+          name: npm-package
+
+      - name: Install Node.js
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
+        with:
+          node-version: "26"
+          package-manager-cache: false
+          registry-url: https://registry.npmjs.org/
+
+      - name: Publish to npm
+        run: npm publish ./package.tgz --ignore-scripts --provenance --access public --tag "$NPM_DIST_TAG"
+        env:
+          NPM_DIST_TAG: ${{ github.event.release.prerelease && 'next' || 'latest' }}

README.md

@@ -174,10 +174,16 @@ pnpm run build
 # テスト実行
 pnpm run test
 
-# カバレッジ計測
+# 単体テスト（外部通信なし）
+pnpm run test:unit
+
+# 実APIテスト（外部通信あり）
+pnpm run test:integration
+
+# 単体テストのカバレッジ計測
 pnpm run test:coverage
 
-# 型チェック
+# Lint・型チェック・単体テスト
 pnpm run check
 
 # ドキュメント生成（TypeDoc + llms.txt）

package.json

@@ -41,18 +41,20 @@
   "scripts": {
     "build": "pnpm run check && pnpm run build:tsc",
     "build:tsc": "tsdown",
-    "check": "pnpm run check:lint && pnpm run check:build && pnpm run test",
+    "check": "pnpm run check:lint && pnpm run check:build && pnpm run test:unit",
     "check:lint": "oxlint --type-aware --deny-warnings src test",
     "check:build": "tsc --noEmit",
     "prepack": "pnpm run build",
     "format": "oxlint --type-aware --fix src test && oxfmt src test scripts *.ts *.json .oxlintrc.json .oxfmtrc.json tools/docs/package.json",
     "test": "vitest run",
+    "test:unit": "vitest run --exclude test/narou.test.ts",
+    "test:integration": "vitest run test/narou.test.ts",
     "docs": "pnpm run docs:clean && pnpm run docs:typedoc && pnpm run docs:json && pnpm run docs:llms",
     "docs:clean": "node -e \"require('node:fs').rmSync('docs', { recursive: true, force: true })\"",
     "docs:typedoc": "pnpm --dir tools/docs exec typedoc --tsconfig ../../tsconfig.json --out ../../docs ../../src/index.ts",
     "docs:json": "pnpm --dir tools/docs exec typedoc --tsconfig ../../tsconfig.json --json ../../docs/api.json ../../src/index.ts",
     "docs:llms": "node scripts/generate-llms-txt.js",
-    "test:coverage": "vitest run --coverage.enabled true"
+    "test:coverage": "vitest run --coverage.enabled true --exclude test/narou.test.ts"
   },
   "devDependencies": {
     "@types/node": "^26.6.6",