{"id":1608,"date":"2026-09-04T16:19:36","date_gmt":"2026-09-04T07:19:36","guid":{"rendered":"https:\/\/race-ss.co.jp\/blog\/?p=1608"},"modified":"2026-09-04T16:19:38","modified_gmt":"2026-09-04T07:19:38","slug":"%e3%82%b5%e3%83%97%e3%83%a9%e3%82%a4%e3%83%81%e3%82%a7%e3%83%bc%e3%83%b3%e6%94%bb%e6%92%83%e3%81%8b%e3%82%89%e3%82%b7%e3%82%b9%e3%83%86%e3%83%a0%e3%82%92%e5%ae%88%e3%82%8b%e3%80%82pnpm-uv-composer","status":"publish","type":"post","link":"https:\/\/race-ss.co.jp\/blog\/?p=1608","title":{"rendered":"\u30b5\u30d7\u30e9\u30a4\u30c1\u30a7\u30fc\u30f3\u653b\u6483\u304b\u3089\u30b7\u30b9\u30c6\u30e0\u3092\u5b88\u308b\u3002pnpm \/ uv \/ Composer\u3092\u524d\u63d0\u3068\u3057\u305f\u5b9f\u8df5\u7684\u9632\u5fa1\u3068\u5c0e\u5165\u30d7\u30ed\u30bb\u30b9"},"content":{"rendered":"\n<h2 class=\"wp-block-heading\"><strong>\u306f\u3058\u3081\u306b<\/strong><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">\u3053\u3093\u306b\u3061\u306f\u3002RSS\u3067\u30af\u30e9\u30a6\u30c9\u57fa\u76e4\u30a2\u30fc\u30ad\u30c6\u30af\u30c8\u3092\u3057\u3066\u3044\u308bS.R.\u3067\u3059\u3002<br>OSS\u30d1\u30c3\u30b1\u30fc\u30b8\u306f\u73fe\u4ee3\u306e\u958b\u767a\u306b\u6b20\u304b\u305b\u306a\u3044\u30a4\u30f3\u30d5\u30e9\u3067\u3059\u304c\u3001JavaScript \/ TypeScript \u3067\u306f npm registry\u3001Python \u3067\u306f PyPI\u3001PHP \u3067\u306f Packagist \u304b\u3089\u3001\u591a\u304f\u306e\u4f9d\u5b58\u30d1\u30c3\u30b1\u30fc\u30b8\u3092\u65e5\u5e38\u7684\u306b\u53d6\u308a\u8fbc\u3093\u3067\u3044\u307e\u3059\u3002<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u4e00\u65b9\u3067\u3001\u3053\u306e\u4fbf\u5229\u3055\u306f\u305d\u306e\u307e\u307e\u653b\u6483\u9762\u306b\u3082\u306a\u308a\u307e\u3059\u3002\u653b\u6483\u8005\u306b\u3068\u3063\u3066\u3001\u4eba\u6c17\u30d1\u30c3\u30b1\u30fc\u30b8\u3084\u305d\u306e\u4f9d\u5b58\u95a2\u4fc2\u3092\u4fb5\u5bb3\u3067\u304d\u308c\u3070\u3001\u958b\u767a\u8005\u306e\u30ed\u30fc\u30ab\u30eb\u74b0\u5883\u3001CI\/CD\u3001\u5834\u5408\u306b\u3088\u3063\u3066\u306f\u672c\u756a\u74b0\u5883\u306b\u307e\u3067\u5230\u9054\u3067\u304d\u307e\u3059\u3002<strong>\u3042\u306a\u305f\u304c\u30ed\u30fc\u30ab\u30ebPC\u3067\u4f55\u6c17\u306a\u304f <\/strong><strong>npm install<\/strong><strong> \u3084 <\/strong><strong>uv sync<\/strong><strong> \u3092\u5b9f\u884c\u3057\u305f\u77ac\u9593\u3001\u3042\u306a\u305f\u306ePC\u5185\u306b\u3042\u308b <\/strong><strong>~\/.aws\/credentials<\/strong><strong> \u3084 <\/strong><strong>.env<\/strong><strong> \u306e\u4e2d\u8eab\u304c\u5bc6\u304b\u306b\u653b\u6483\u8005\u306e\u30b5\u30fc\u30d0\u30fc\u3078\u9001\u4fe1\u3055\u308c\u308b\u3001\u3068\u3044\u3063\u305f\u4e8b\u614b\u304c\u5b9f\u969b\u306b\u8d77\u3053\u308a\u5f97\u308b\u306e\u3067\u3059\u3002<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u8fd1\u5e74\u76ee\u7acb\u3064\u306e\u306f\u3001\u5358\u306a\u308b\u30bf\u30a4\u30dd\u30b9\u30af\u30ef\u30c3\u30c6\u30a3\u30f3\u30b0\u3060\u3051\u3067\u306f\u3042\u308a\u307e\u305b\u3093\u3002\u6b63\u898f\u30d1\u30c3\u30b1\u30fc\u30b8\u306e\u516cCI\u74b0\u5883\u3067\u30d3\u30eb\u30c9\u30a8\u30e9\u30fc\u304c\u7d9a\u51fa\u3057\u305f\u958b\u6a29\u9650\u3092\u596a\u3046\u3001\u30e1\u30f3\u30c6\u30ca\u30fc\u30a2\u30ab\u30a6\u30f3\u30c8\u3092\u4fb5\u5bb3\u3059\u308b\u3001\u60aa\u6027\u4f9d\u5b58\u3092\u5dee\u3057\u8fbc\u3080\u3001preinstall \/ postinstall \u306a\u3069\u306e lifecycle script \uff08\u203b\u30d1\u30c3\u30b1\u30fc\u30b8\u306e\u30a4\u30f3\u30b9\u30c8\u30fc\u30eb\u524d\u5f8c\u306b\u81ea\u52d5\u5b9f\u884c\u3055\u308c\u308b\u30b9\u30af\u30ea\u30d7\u30c8\uff09\u3067\u30a4\u30f3\u30b9\u30c8\u30fc\u30eb\u6642\u306b\u30b3\u30fc\u30c9\u3092\u5b9f\u884c\u3059\u308b\u3001\u3068\u3044\u3063\u305f\u653b\u6483\u304c\u5897\u3048\u3066\u3044\u307e\u3059\u3002<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u305f\u3068\u3048\u3070 Shai-Hulud \u3067\u306f\u3001\u4fb5\u5bb3\u3055\u308c\u305f npm \u30e1\u30f3\u30c6\u30ca\u30fc\u30a2\u30ab\u30a6\u30f3\u30c8\u7d4c\u7531\u3067\u4eba\u6c17 JavaScript \u30d1\u30c3\u30b1\u30fc\u30b8\u306b\u60aa\u6027 post-install script \u304c\u6ce8\u5165\u3055\u308c\u3001\u30b7\u30fc\u30af\u30ec\u30c3\u30c8\u7a83\u53d6\u3068\u81ea\u5df1\u5897\u6b96\u3092\u7d44\u307f\u5408\u308f\u305b\u305f\u653b\u6483\u304c\u767a\u751f\u3057\u307e\u3057\u305f\u3002<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u307e\u305f\u3001Bitwarden CLI \u306e\u4e8b\u6848\u3067\u306f\u3001@bitwarden\/cli@2026.4.0 \u306b\u60aa\u610f\u3042\u308b preinstall \u30d5\u30c3\u30af\u304c\u8ffd\u52a0\u3055\u308c\u3001npm install \u6642\u306b\u60c5\u5831\u7a83\u53d6\u30de\u30eb\u30a6\u30a7\u30a2\u304c\u5b9f\u884c\u3055\u308c\u5f97\u308b\u72b6\u614b\u3060\u3063\u305f\u3068\u5831\u544a\u3055\u308c\u3066\u3044\u307e\u3059\u3002&#8211;ignore-scripts \u76f8\u5f53\u306e\u8a2d\u5b9a\u306a\u3057\u3067 install \u3057\u3066\u3044\u305f\u5834\u5408\u3001\u30a4\u30f3\u30b9\u30c8\u30fc\u30eb\u6642\u70b9\u3067\u30da\u30a4\u30ed\u30fc\u30c9\u304c\u767a\u706b\u3057\u5f97\u308b\u70b9\u304c\u554f\u984c\u3067\u3057\u305f\u3002<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Axios \u306e\u4e8b\u6848\u3067\u306f\u3001\u60aa\u6027\u30d0\u30fc\u30b8\u30e7\u30f3 axios@1.14.1 \u3068 axios@0.30.4 \u304c npm registry \u306b\u516c\u958b\u3055\u308c\u3001\u60aa\u6027\u4f9d\u5b58 plain-crypto-js@4.2.1 \u3092\u901a\u3058\u3066 multi-stage payload \u3084 remote access trojan \u3092\u5c55\u958b\u3059\u308b\u653b\u6483\u304c\u78ba\u8a8d\u3055\u308c\u3066\u3044\u307e\u3059\u3002<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u3053\u306e\u8a18\u4e8b\u3067\u306f\u3001JavaScript \/ TypeScript \u306f pnpm v10 \/ v11\u3001Python \u306f uv\u3001PHP \u306f Composer \u3092\u524d\u63d0\u306b\u3001\u30d1\u30c3\u30b1\u30fc\u30b8\u30de\u30cd\u30fc\u30b8\u30e3\u30fc\u7d4c\u7531\u306e\u30b5\u30d7\u30e9\u30a4\u30c1\u30a7\u30fc\u30f3\u653b\u6483\u306b\u5bfe\u3059\u308b\u5b9f\u8df5\u7684\u306a\u9632\u5fa1\u7b56\u3092\u6574\u7406\u3057\u307e\u3059\u3002<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>\u3010\u524d\u63d0\u74b0\u5883\u30fb\u52d5\u4f5c\u78ba\u8a8d\u30d0\u30fc\u30b8\u30e7\u30f3\u3011<\/strong> <strong>\u672c\u8a18\u4e8b\u3067\u89e3\u8aac\u3059\u308b\u8a2d\u5b9a\u3084\u30b3\u30de\u30f3\u30c9\u306f\u3001\u4ee5\u4e0b\u306e\u74b0\u5883\u30fb\u30d0\u30fc\u30b8\u30e7\u30f3\u3067\u306e\u691c\u8a3c\u3092\u524d\u63d0\u3068\u3057\u3066\u3044\u307e\u3059\u3002\u30d1\u30c3\u30b1\u30fc\u30b8\u30de\u30cd\u30fc\u30b8\u30e3\u30fc\u306e\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u6a5f\u80fd\u306f\u30d0\u30fc\u30b8\u30e7\u30f3\u306b\u3088\u3063\u3066\u30c7\u30d5\u30a9\u30eb\u30c8\u306e\u6319\u52d5\u304c\u7570\u306a\u308b\u5834\u5408\u304c\u3042\u308b\u305f\u3081\u3001\u304a\u4f7f\u3044\u306e\u74b0\u5883\u306b\u5408\u308f\u305b\u3066\u3054\u78ba\u8a8d\u304f\u3060\u3055\u3044\u3002<\/strong><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>pnpm\uff1av10.26.0 \u4ee5\u964d\u3001\u304a\u3088\u3073 v11<\/strong><\/li>\n\n\n\n<li><strong>uv\uff1a0.11.7<\/strong><\/li>\n\n\n\n<li><strong>Composer\uff1a2.9.7<\/strong><\/li>\n\n\n\n<li><strong>CI\u74b0\u5883\uff1aUbuntu 24.04\uff08GitHub Actions <\/strong><strong>ubuntu-latest<\/strong><strong> \u306a\u3069\uff09<\/strong><\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">\u307e\u305a\u62bc\u3055\u3048\u308b\u3079\u304d\u653b\u6483\u30d1\u30bf\u30fc\u30f3<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">\u30d1\u30c3\u30b1\u30fc\u30b8\u30de\u30cd\u30fc\u30b8\u30e3\u30fc\u7d4c\u7531\u306e\u653b\u6483\u306f\u3001\u3056\u3063\u304f\u308a\u6b21\u306e\u3088\u3046\u306b\u5206\u89e3\u3067\u304d\u307e\u3059\u3002<\/p>\n\n\n\n<figure class=\"wp-block-table\"><table class=\"has-fixed-layout\"><tbody><tr><td><strong>\u653b\u6483\u30d1\u30bf\u30fc\u30f3<\/strong><\/td><td><strong>\u5185\u5bb9<\/strong><\/td><td><strong>\u4e3b\u306a\u5bfe\u7b56<\/strong><\/td><\/tr><tr><td>\u30bf\u30a4\u30dd\u30b9\u30af\u30ef\u30c3\u30c6\u30a3\u30f3\u30b0<\/td><td>\u4f3c\u305f\u540d\u524d\u306e\u60aa\u6027\u30d1\u30c3\u30b1\u30fc\u30b8\u3092\u516c\u958b\u3059\u308b<\/td><td>\u4f9d\u5b58\u8ffd\u52a0\u30ec\u30d3\u30e5\u30fc\u3001\u8a31\u53ef\u30ea\u30b9\u30c8\u3001\u30d7\u30e9\u30a4\u30d9\u30fc\u30c8\u30ec\u30b8\u30b9\u30c8\u30ea \/ \u793e\u5185\u30d7\u30ed\u30ad\u30b7<\/td><\/tr><tr><td>\u6b63\u898f\u30d1\u30c3\u30b1\u30fc\u30b8\u306e\u4e57\u3063\u53d6\u308a<\/td><td>\u30e1\u30f3\u30c6\u30ca\u30fc\u30a2\u30ab\u30a6\u30f3\u30c8\u3084 publish token \u3092\u4fb5\u5bb3\u3059\u308b<\/td><td>\u6709\u540d\u30d1\u30c3\u30b1\u30fc\u30b8\u3067\u3082 blind trust \u3057\u306a\u3044<\/td><\/tr><tr><td>\u60aa\u6027\u4f9d\u5b58\u306e\u5dee\u3057\u8fbc\u307f<\/td><td>\u6b63\u898f\u30d1\u30c3\u30b1\u30fc\u30b8\u306b\u60aa\u6027\u4f9d\u5b58\u3092\u8ffd\u52a0\u3059\u308b<\/td><td>lockfile \u30ec\u30d3\u30e5\u30fc\u3001\u4f9d\u5b58\u5dee\u5206\u30c1\u30a7\u30c3\u30af<\/td><\/tr><tr><td>lifecycle script \u60aa\u7528<\/td><td>preinstall \/ install \/ postinstall \u3067\u30b3\u30fc\u30c9\u5b9f\u884c\u3059\u308b<\/td><td>script \u7121\u52b9\u5316\u3001allowlist\u3001CI \u9694\u96e2<\/td><\/tr><tr><td>CI\/CD \u7d4c\u8def\u306e\u60aa\u7528<\/td><td>build \/ release workflow \u3084 secret \u3092\u60aa\u7528\u3059\u308b<\/td><td>secret \u6700\u5c0f\u5316\u3001\u74b0\u5883\u5206\u96e2\u3001\u6a29\u9650\u5206\u96e2<\/td><\/tr><tr><td>exotic dependency \u60aa\u7528<\/td><td>git URL \u3084 tarball URL \u304b\u3089\u76f4\u63a5\u30b3\u30fc\u30c9\u3092\u53d6\u5f97\u3059\u308b\uff08\u203b\u30d1\u30c3\u30b1\u30fc\u30b8\u30de\u30cd\u30fc\u30b8\u30e3\u30fc\u306e\u6b63\u898f\u30ec\u30b8\u30b9\u30c8\u30ea\u3092\u7d4c\u7531\u3057\u306a\u3044\u4f9d\u5b58\uff09<\/td><td>\u63a8\u79fb\u7684\u4f9d\u5b58\u306e exotic source \u7981\u6b62<\/td><\/tr><tr><td>\u30a2\u30ab\u30a6\u30f3\u30c8\u56de\u5fa9\u7d4c\u8def\u306e\u60aa\u7528<\/td><td>\u5931\u52b9\u30c9\u30e1\u30a4\u30f3\u3084\u53e4\u3044\u30e1\u30fc\u30eb\u7d4c\u7531\u3067\u30a2\u30ab\u30a6\u30f3\u30c8\u3092\u596a\u3046<\/td><td>\u4f9d\u5b58\u5143\u306e\u5065\u5168\u6027\u78ba\u8a8d\u3001\u91cd\u8981\u4f9d\u5b58\u306e\u68da\u5378\u3057<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">\u91cd\u8981\u306a\u306e\u306f\u3001\u3053\u308c\u3089\u306e\u653b\u6483\u304c\u300c\u4f9d\u5b58\u30d1\u30c3\u30b1\u30fc\u30b8\u3092\u8ffd\u52a0\u3057\u305f\u77ac\u9593\u300d\u3060\u3051\u3067\u6210\u7acb\u3059\u308b\u308f\u3051\u3067\u306f\u306a\u3044\u3001\u3068\u3044\u3046\u70b9\u3067\u3059\u3002<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>CI\/CD \u3067 install \u3057\u305f\u77ac\u9593\u3001lockfile \u3092\u66f4\u65b0\u3057\u305f\u77ac\u9593\u3001\u60aa\u6027 CLI \u3092\u5b9f\u884c\u3057\u305f\u77ac\u9593<\/strong>\u306b\u3082\u88ab\u5bb3\u306f\u767a\u751f\u3057\u307e\u3059\u3002<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u307e\u305f\u3001\u88ab\u5bb3\u306f secret \u306e\u7a83\u53d6\u306b\u9650\u3089\u308c\u307e\u305b\u3093\u3002\u30b5\u30d7\u30e9\u30a4\u30c1\u30a7\u30fc\u30f3\u653b\u6483\u306e\u672c\u8cea\u306f\u3001\u4fe1\u983c\u3057\u3066 install \u3057\u305f\u51e6\u7406\u306e\u4e2d\u3067<strong>\u4efb\u610f\u30b3\u30fc\u30c9\u304c\u5b9f\u884c\u3055\u308c\u308b\u3053\u3068<\/strong>\u3067\u3059\u3002\u305d\u306e\u305f\u3081\u3001RAT\uff08Remote Access Trojan: \u9060\u9694\u64cd\u4f5c\u30de\u30eb\u30a6\u30a7\u30a2\uff09\u3001\u30d0\u30c3\u30af\u30c9\u30a2\u3001\u30af\u30ea\u30d7\u30c8\u30de\u30a4\u30ca\u30fc\u3001\u8ffd\u52a0\u30da\u30a4\u30ed\u30fc\u30c9\u306e\u53d6\u5f97\u3001\u7aef\u672b\u5185\u30d5\u30a1\u30a4\u30eb\u306e\u6539\u3056\u3093\u30fb\u524a\u9664\u3001\u6a2a\u5c55\u958b\u306a\u3069\u3082\u8d77\u3053\u308a\u5f97\u307e\u3059\u3002<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">\u57fa\u672c\u65b9\u91dd<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">\u30d1\u30c3\u30b1\u30fc\u30b8\u30de\u30cd\u30fc\u30b8\u30e3\u30fc\u7d4c\u7531\u306e\u30b5\u30d7\u30e9\u30a4\u30c1\u30a7\u30fc\u30f3\u653b\u6483\u306b\u5bfe\u3057\u3066\u3001\u300c\u3053\u306e\u8a2d\u5b9a\u3092\u5165\u308c\u308c\u3070\u5b89\u5168\u300d\u3068\u3044\u3046\u5358\u4e00\u306e\u5bfe\u7b56\u306f\u3042\u308a\u307e\u305b\u3093\u3002<br>\u6a19\u6e96\u30dd\u30ea\u30b7\u30fc\u3068\u3057\u3066\u306f\u3001\u6b21\u306e4\u3064\u3092\u91cd\u306d\u308b\u306e\u304c\u73fe\u5b9f\u7684\u3067\u3059\u3002<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li><strong>lockfile \u3092\u5fc5\u305a\u4f7f\u3044\u3001CI\/CD \u3067\u306f lockfile \u3092\u66f4\u65b0\u3055\u305b\u306a\u3044<\/strong><\/li>\n\n\n\n<li><strong>install \u6642\u306b\u4efb\u610f\u30b3\u30fc\u30c9\u3092\u5b9f\u884c\u3055\u305b\u306a\u3044<\/strong><\/li>\n\n\n\n<li><strong>\u516c\u958b\u76f4\u5f8c\u306e\u30d1\u30c3\u30b1\u30fc\u30b8\u3092\u3059\u3050\u306b\u53d6\u308a\u8fbc\u307e\u306a\u3044<\/strong><\/li>\n\n\n\n<li><strong>\u516c\u958b\u7d4c\u8def\u3084 trust level \u304c\u4e0b\u304c\u3063\u305f\u66f4\u65b0\u3092\u691c\u77e5\u3059\u308b<\/strong><\/li>\n<\/ol>\n\n\n\n<p class=\"wp-block-paragraph\">\u3053\u306e\u3046\u3061\u3001\u7279\u306b\u91cd\u8981\u306a\u306e\u304c <strong>lifecycle script \u306e\u5236\u5fa1<\/strong>\u3068 Dependency Cooldown \u3067\u3059\u3002<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">npm \/ pnpm \u7cfb\u3067\u306f\u3001preinstall\u3001install\u3001postinstall \u306a\u3069\u306e lifecycle script \u304c\u653b\u6483\u306e\u767a\u706b\u70b9\u306b\u306a\u308a\u304c\u3061\u3067\u3059\u3002pnpm \u306f supply chain attack \u5bfe\u7b56\u3068\u3057\u3066\u3001\u516c\u958b\u76f4\u5f8c\u306e\u30d0\u30fc\u30b8\u30e7\u30f3\u3092\u9045\u5ef6\u3055\u305b\u308b minimumReleaseAge \u3084\u3001\u4fe1\u983c\u5ea6\u306e\u4f4e\u4e0b\u3092\u691c\u77e5\u3059\u308b trustPolicy \u3092\u63d0\u4f9b\u3057\u3066\u3044\u307e\u3059\u3002<br>\u307e\u305f\u3001pnpm \u306e minimumReleaseAge \u306f\u3001\u516c\u958b\u304b\u3089\u4e00\u5b9a\u6642\u9593\u304c\u7d4c\u904e\u3059\u308b\u307e\u3067 install \u5bfe\u8c61\u304b\u3089\u5916\u3059\u3053\u3068\u3067\u3001\u516c\u958b\u76f4\u5f8c\u306e\u60aa\u6027\u30d0\u30fc\u30b8\u30e7\u30f3\u3092\u8e0f\u3080\u30ea\u30b9\u30af\u3092\u4e0b\u3052\u308b\u305f\u3081\u306e\u8a2d\u5b9a\u3067\u3059\u3002<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"735\" height=\"746\" src=\"https:\/\/race-ss.co.jp\/blog\/wp-content\/uploads\/2026\/09\/\u9ece\u304f\u3093\u8a18\u4e8b\u30b5\u30d7\u30e9\u30a4\u30c1\u30a7\u30fc\u30f3\u653b\u6483.jpg\" alt=\"\" class=\"wp-image-1620\"\/><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\">\u653b\u6483\u3068\u9632\u5fa1\u306e\u30e2\u30c7\u30eb\u56f3<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">\u30d1\u30c3\u30b1\u30fc\u30b8\u30de\u30cd\u30fc\u30b8\u30e3\u30fc\u7d4c\u7531\u306e\u30b5\u30d7\u30e9\u30a4\u30c1\u30a7\u30fc\u30f3\u653b\u6483\u306f\u3001\u300c\u60aa\u6027\u30d1\u30c3\u30b1\u30fc\u30b8\u304c\u5b58\u5728\u3059\u308b\u3053\u3068\u300d\u3060\u3051\u3067\u6210\u7acb\u3059\u308b\u308f\u3051\u3067\u306f\u3042\u308a\u307e\u305b\u3093\u3002<br>\u5b9f\u969b\u306b\u306f\u3001<strong>\u516c\u958b\u76f4\u5f8c\u306e\u30d0\u30fc\u30b8\u30e7\u30f3\u3092\u3059\u3050\u306b\u53d6\u308a\u8fbc\u3093\u3067\u3057\u307e\u3046\u3053\u3068\u3001install \u6642\u306b lifecycle script \u3092\u5b9f\u884c\u3057\u3066\u3057\u307e\u3046\u3053\u3068\u3001\u305d\u306e\u74b0\u5883\u306b secret \u3084\u6a29\u9650\u304c\u5b58\u5728\u3059\u308b\u3053\u3068<\/strong>\u304c\u91cd\u306a\u3063\u3066\u88ab\u5bb3\u306b\u306a\u308a\u307e\u3059\u3002<br>\u4ee5\u4e0b\u306f\u3001Dependency Cooldown \u3068 script \u5b9f\u884c\u5236\u5fa1\u304c\u3001\u3069\u306e\u3088\u3046\u306b\u653b\u6483\u3092\u6b62\u3081\u308b\u304b\u3092\u8868\u3057\u305f\u56f3\u3067\u3059\u3002<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Dependency Cooldown \u306f\u300c\u516c\u958b\u76f4\u5f8c\u306e\u60aa\u6027\u30d0\u30fc\u30b8\u30e7\u30f3\u3092\u305d\u3082\u305d\u3082\u53d6\u308a\u8fbc\u307e\u306a\u3044\u300d\u305f\u3081\u306e\u9632\u5fa1\u3067\u3059\u3002<br>lifecycle script \u306e\u5236\u5fa1\u306f\u300c\u4e07\u4e00\u60aa\u6027\u30d1\u30c3\u30b1\u30fc\u30b8\u3092\u53d6\u5f97\u3057\u3066\u3082\u3001install \u6642\u306e\u767a\u706b\u3092\u6b62\u3081\u308b\u300d\u305f\u3081\u306e\u9632\u5fa1\u3067\u3059\u3002<br>\u4e21\u8005\u306f\u5f79\u5272\u304c\u7570\u306a\u308b\u305f\u3081\u3001\u7247\u65b9\u3060\u3051\u3067\u306f\u306a\u304f\u7d44\u307f\u5408\u308f\u305b\u3066\u4f7f\u3046\u5fc5\u8981\u304c\u3042\u308a\u307e\u3059\u3002<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">npm \u306e &#8211;ignore-scripts \u306f\u5f37\u529b\u3060\u304c\u3001pnpm \u3067\u306f allowlist \u5316\u3092\u6a19\u6e96\u306b\u3059\u308b<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">npm \u3092\u4f7f\u3046\u5834\u5408\u3001CI\/CD \u3067\u306f\u6b21\u306e\u3088\u3046\u306b lifecycle script \u3092\u7121\u52b9\u5316\u3067\u304d\u307e\u3059\u3002<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>npm ci --ignore-scripts<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">npm \u306e ignore-scripts \u306f\u3001package.json \u306b\u5b9a\u7fa9\u3055\u308c\u305f scripts \u3092\u5b9f\u884c\u3057\u306a\u3044\u8a2d\u5b9a\u3067\u3059\u3002\u305f\u3060\u3057\u3001npm start\u3001npm test\u3001npm run \u306e\u3088\u3046\u306b\u660e\u793a\u7684\u306b script \u3092\u5b9f\u884c\u3059\u308b\u30b3\u30de\u30f3\u30c9\u306f\u3001\u305d\u306e\u5bfe\u8c61 script \u81ea\u4f53\u3092\u5b9f\u884c\u3057\u307e\u3059\u3002<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u4e00\u65b9\u3001pnpm \u3092\u6a19\u6e96\u306b\u3059\u308b\u306a\u3089\u3001npm \u306e &#8211;ignore-scripts \u3092\u305d\u306e\u307e\u307e\u4e2d\u5fc3\u306b\u7f6e\u304f\u3088\u308a\u3082\u3001<strong>\u5fc5\u8981\u306a build script \u3060\u3051\u3092 allowlist \u5316\u3059\u308b<\/strong>\u65b9\u91dd\u304c\u9069\u3057\u3066\u3044\u307e\u3059\u3002<\/p>\n\n\n\n<pre class=\"wp-block-verse\">Tip!<br><br>CI\/CD \u3067\u306f\u3001\u4f9d\u5b58\u30d1\u30c3\u30b1\u30fc\u30b8\u306e lifecycle script \u3092\u539f\u5247\u5b9f\u884c\u3057\u306a\u3044\u3002<br>\u305f\u3060\u3057\u3001@prisma\/client\u3001esbuild\u3001sharp \u306a\u3069\u3001\u6b63\u5f53\u306a\u7406\u7531\u3067 build script \u304c\u5fc5\u8981\u306a\u3082\u306e\u3060\u3051\u3092\u30ec\u30d3\u30e5\u30fc\u3057\u305f\u3046\u3048\u3067\u660e\u793a\u7684\u306b\u8a31\u53ef\u3057\u307e\u3059\u3002<\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">pnpm v10 \u306e\u63a8\u5968\u8a2d\u5b9a<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">pnpm v10 \u3092\u4f7f\u3046\u5834\u5408\u306f\u3001\u3067\u304d\u308c\u3070 v10.26.0 \u4ee5\u964d \u3092\u524d\u63d0\u306b\u3057\u307e\u3059<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u7406\u7531\u306f\u3001minimumReleaseAge \u306f v10.16.0\u3001trustPolicy \u306f v10.21.0\u3001blockExoticSubdeps \u306f v10.26.0 \u3067\u8ffd\u52a0\u3055\u308c\u3066\u3044\u308b\u305f\u3081\u3067\u3059\u3002<br>\u63a8\u5968\u3059\u308b pnpm-workspace.yaml \u306f\u6b21\u306e\u3068\u304a\u308a\u3067\u3059\u3002<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>minimumReleaseAge: 10080 # 7 days\n\nstrictDepBuilds: true\ndangerouslyAllowAllBuilds: false\n\nallowBuilds:\n  esbuild: true\n  \"@prisma\/client\": true\n  sharp: true\n\ntrustPolicy: no-downgrade\nblockExoticSubdeps: true<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">minimumReleaseAge \u306f\u3001\u30d1\u30c3\u30b1\u30fc\u30b8\u516c\u958b\u304b\u3089\u6307\u5b9a\u3057\u305f\u5206\u6570\u304c\u7d4c\u904e\u3059\u308b\u307e\u3067\u3001\u305d\u306e\u30d0\u30fc\u30b8\u30e7\u30f3\u3092 install \u5bfe\u8c61\u306b\u3057\u306a\u3044\u8a2d\u5b9a\u3067\u3059\u3002<br>pnpm \u3067\u306f\u5358\u4f4d\u304c \u5206 \u306a\u306e\u3067\u30011\u65e5\u306f 1440\u30017\u65e5\u306f 10080 \u3067\u3059\u3002v11 \u3067\u306f\u30c7\u30d5\u30a9\u30eb\u30c8\u304c 1440\u3001v11 \u3088\u308a\u524d\u3067\u306f 0 \u3068\u3055\u308c\u3066\u3044\u307e\u3059\u3002<br>strictDepBuilds: true \u306f\u3001\u672a\u30ec\u30d3\u30e5\u30fc\u306e build script \u3092\u6301\u3064\u4f9d\u5b58\u304c\u3042\u308b\u5834\u5408\u306b install \u3092\u5931\u6557\u3055\u305b\u308b\u305f\u3081\u306e\u8a2d\u5b9a\u3067\u3059\u3002pnpm v10 \u3067\u306f\u6a19\u6e96\u52d5\u4f5c\u304c v11 \u3068\u7570\u306a\u308b\u305f\u3081\u3001CI\/CD \u3067\u306f\u660e\u793a\u7684\u306b true \u3092\u6307\u5b9a\u3057\u3066\u304a\u304f\u306e\u304c\u5b89\u5168\u3067\u3059\u3002<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">pnpm v11 \u306e\u63a8\u5968\u8a2d\u5b9a<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">pnpm v11 \u3067\u306f\u3001\u30b5\u30d7\u30e9\u30a4\u30c1\u30a7\u30fc\u30f3\u5bfe\u7b56\u304c\u3088\u308a\u6a19\u6e96\u5bc4\u308a\u306b\u306a\u308a\u307e\u3059\u3002<br>\u7279\u306b\u5927\u304d\u3044\u306e\u306f\u3001minimumReleaseAge \u306e\u30c7\u30d5\u30a9\u30eb\u30c8\u304c 1440\u3001\u3064\u307e\u308a1\u65e5\u306b\u306a\u308b\u70b9\u3067\u3059\u3002<br>v11 \u5411\u3051\u306e\u63a8\u5968\u8a2d\u5b9a\u306f\u6b21\u306e\u3068\u304a\u308a\u3067\u3059\u3002<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>minimumReleaseAge: 10080 # 7 days\n\nstrictDepBuilds: true\n\ndangerouslyAllowAllBuilds: false\n\nallowBuilds:\n\n&nbsp;&nbsp;esbuild: true\n\n&nbsp;&nbsp;\"@prisma\/client\": true\n\n&nbsp;&nbsp;sharp: true\n\ntrustPolicy: no-downgrade\n\nblockExoticSubdeps: true\n\n# private registry \/ mirror \u304c time field \u3092\u8fd4\u3055\u306a\u3044\u5834\u5408\u306f\u8981\u691c\u8a3c\n\nminimumReleaseAgeIgnoreMissingTime: false<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">blockExoticSubdeps: true \u306f\u3001\u63a8\u79fb\u7684\u4f9d\u5b58\u304c git URL \u3084 tarball URL \u306e\u3088\u3046\u306a exotic source \u3092\u4f7f\u3046\u3053\u3068\u3092\u9632\u3050\u8a2d\u5b9a\u3067\u3059\u3002<br>minimumReleaseAgeIgnoreMissingTime: false \u306f\u3001registry metadata \u306b time field \u304c\u306a\u3044\u30d1\u30c3\u30b1\u30fc\u30b8\u3092\u3069\u3046\u6271\u3046\u304b\u306e\u8a2d\u5b9a\u3067\u3059\u3002\u3088\u308a\u53b3\u683c\u306b\u3059\u308b\u306a\u3089 false \u306b\u3067\u304d\u307e\u3059\u304c\u3001private registry \u3084 mirror \u304c time field \u3092\u8fd4\u3055\u306a\u3044\u5834\u5408\u306f\u89e3\u6c7a\u306b\u5931\u6557\u3059\u308b\u53ef\u80fd\u6027\u304c\u3042\u308b\u305f\u3081\u3001\u5c0e\u5165\u524d\u306b\u691c\u8a3c\u304c\u5fc5\u8981\u3067\u3059\u3002<\/p>\n\n\n\n<pre class=\"wp-block-verse\">Warning!<br><br>minimumReleaseAgeIgnoreMissingTime: false \u306f\u53b3\u683c\u306a\u8a2d\u5b9a\u3067\u3059\u304c\u3001\u793e\u5185 registry \/ mirror \u306e\u5b9f\u88c5\u306b\u3088\u3063\u3066\u306f install \u304c\u5931\u6557\u3059\u308b\u53ef\u80fd\u6027\u304c\u3042\u308a\u307e\u3059\u3002<br>\u5c0e\u5165\u524d\u306b\u4ee3\u8868\u7684\u306a\u30ea\u30dd\u30b8\u30c8\u30ea\u3067\u691c\u8a3c\u3057\u3066\u304f\u3060\u3055\u3044\u3002<\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">Dependency Cooldown\uff1anpm \u3068 pnpm \u3068 uv \u3067\u5358\u4f4d\u304c\u9055\u3046<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">npm v11 \u4ee5\u964d\u306b\u306f min-release-age \u304c\u3042\u308a\u307e\u3059\u3002\u3053\u308c\u306f\u3001\u6307\u5b9a\u3057\u305f\u65e5\u6570\u3088\u308a\u65b0\u3057\u3044\u30d0\u30fc\u30b8\u30e7\u30f3\u3092 install \u5bfe\u8c61\u304b\u3089\u5916\u3059\u8a2d\u5b9a\u3067\u3059\u3002npm \u3067\u306f\u5358\u4f4d\u304c \u65e5 \u3067\u3059\u3002<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>min-release-age=7<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">pnpm \u306e minimumReleaseAge \u306f \u5206 \u5358\u4f4d\u3067\u3059\u3002<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>minimumReleaseAge: 10080 # 7 days<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">uv \u306e exclude-newer \u306f\u3001\u6307\u5b9a\u3057\u305f timestamp \u307e\u305f\u306f &#8220;24 hours&#8221;\u3001&#8221;1 week&#8221; \u306e\u3088\u3046\u306a duration \u3088\u308a\u65b0\u3057\u3044 distribution artifact \u3092\u4f9d\u5b58\u89e3\u6c7a\u5bfe\u8c61\u304b\u3089\u9664\u5916\u3057\u307e\u3059\u3002<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>&#91;tool.uv]\n\nexclude-newer = \"1 week\"<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u6574\u7406\u3059\u308b\u3068\u6b21\u306e\u3088\u3046\u306b\u306a\u308a\u307e\u3059\u3002<\/p>\n\n\n\n<figure class=\"wp-block-table\"><table class=\"has-fixed-layout\"><tbody><tr><td><strong>\u30c4\u30fc\u30eb<\/strong><\/td><td><strong>\u8a2d\u5b9a<\/strong><\/td><td><strong>\u5358\u4f4d<\/strong><\/td><td><strong>7\u65e5\u76f8\u5f53<\/strong><\/td><\/tr><tr><td>npm v11<\/td><td>min-release-age<\/td><td>\u65e5<\/td><td>7<\/td><\/tr><tr><td>pnpm v10 \/ v11<\/td><td>minimumReleaseAge<\/td><td>\u5206<\/td><td>10080<\/td><\/tr><tr><td>uv<\/td><td>exclude-newer<\/td><td>timestamp \/ duration<\/td><td>&#8220;1 week&#8221;<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">\u30b5\u30d7\u30e9\u30a4\u30c1\u30a7\u30fc\u30f3\u653b\u6483\u304c\u6d3b\u767a\u306a\u72b6\u6cc1\u3067\u306f\u3001\u6a19\u6e96\u5024\u306f7\u65e5\u3001\u6025\u304e\u306e\u66f4\u65b0\u304c\u591a\u3044\u30d7\u30ed\u30b8\u30a7\u30af\u30c8\u3067\u3082\u6700\u4f4e3\u65e5\u7a0b\u5ea6\u3092\u63a8\u5968\u5024\u306b\u3059\u308b\u3068\u9069\u5207\u3067\u3059\u3002<br>\u3082\u3061\u308d\u3093\u3001cooldown \u306f\u4e07\u80fd\u3067\u306f\u3042\u308a\u307e\u305b\u3093\u3002\u3059\u3067\u306b lockfile \u306b\u60aa\u6027\u30d0\u30fc\u30b8\u30e7\u30f3\u304c\u5165\u3063\u3066\u3044\u308b\u5834\u5408\u3084\u3001\u653b\u6483\u304c\u9577\u671f\u9593\u691c\u77e5\u3055\u308c\u306a\u3044\u5834\u5408\u306f\u9632\u3052\u307e\u305b\u3093\u3002\u305d\u308c\u3067\u3082\u3001\u516c\u958b\u304b\u3089\u6570\u6642\u9593\u3067\u30c6\u30a4\u30af\u30c0\u30a6\u30f3\u3055\u308c\u308b\u3088\u3046\u306a\u653b\u6483\u306b\u306f\u6709\u52b9\u3067\u3059\u3002<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">trustPolicy: no-downgrade \u306f\u6709\u52b9\u3060\u304c\u3001\u4e07\u80fd\u3067\u306f\u306a\u3044<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">pnpm \u306e trustPolicy: no-downgrade \u306f\u3001\u904e\u53bb\u306e\u30ea\u30ea\u30fc\u30b9\u3088\u308a trust level \u304c\u4e0b\u304c\u3063\u305f\u30d1\u30c3\u30b1\u30fc\u30b8\u306e install \u3092\u5931\u6557\u3055\u305b\u308b\u8a2d\u5b9a\u3067\u3059\u3002<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>trustPolicy: no-downgrade<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u3053\u3053\u3067\u3044\u3046 trust level \u306f\u3001\u5229\u7528\u8005\u5074\u304c\u300c\u305d\u306e\u30d1\u30c3\u30b1\u30fc\u30b8\u304c\u3069\u306e\u3088\u3046\u306a\u7d4c\u8def\u3067 publish \u3055\u308c\u305f\u304b\u300d\u3092\u5224\u65ad\u3059\u308b\u305f\u3081\u306e\u6750\u6599\u3067\u3059\u3002\u3064\u307e\u308a\u3001\u516c\u958b\u8005\u5074\u306e\u904b\u7528\u3092\u7d30\u304b\u304f\u8aac\u660e\u3059\u308b\u305f\u3081\u3067\u306f\u306a\u304f\u3001<strong>\u5229\u7528\u8005\u5074\u3067\u602a\u3057\u3044\u66f4\u65b0\u3092\u691c\u77e5\u3059\u308b\u305f\u3081\u306e\u30b7\u30b0\u30ca\u30eb<\/strong>\u3068\u3057\u3066\u6271\u3044\u307e\u3059\u3002<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u4e00\u65b9\u3067\u3001\u9650\u754c\u3082\u3042\u308a\u307e\u3059\u3002Bitwarden CLI \u306e\u4e8b\u6848\u306e\u3088\u3046\u306b\u3001Trusted Publishing \u7d4c\u8def\u305d\u306e\u3082\u306e\u304c\u60aa\u7528\u3055\u308c\u305f\u5834\u5408\u306f trust level \u304c\u4e0b\u304c\u3089\u306a\u3044\u305f\u3081\u3001trustPolicy: no-downgrade \u3060\u3051\u3067\u306f\u691c\u77e5\u3067\u304d\u307e\u305b\u3093\u3002<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u3064\u307e\u308a\u3001trustPolicy \u306f\u5f37\u529b\u306a\u88dc\u52a9\u7dda\u3067\u3059\u304c\u3001\u5358\u72ec\u3067\u306f\u306a\u304f\u3001\u6b21\u306e\u5bfe\u7b56\u3068\u7d44\u307f\u5408\u308f\u305b\u308b\u5fc5\u8981\u304c\u3042\u308a\u307e\u3059\u3002<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>lifecycle script \u306e allowlist \u5316<\/li>\n\n\n\n<li>minimumReleaseAge \u306b\u3088\u308b cooldown<\/li>\n\n\n\n<li>lockfile \u306e\u56fa\u5b9a<\/li>\n\n\n\n<li>CI\/CD secret \u306e\u5206\u96e2<\/li>\n\n\n\n<li>install \u6642\u30fb\u5b9f\u884c\u6642\u306e\u5916\u5411\u304d\u901a\u4fe1\u76e3\u8996<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">Python \u306f uv \u3092\u6a19\u6e96\u306b\u3059\u308b<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Python \u5074\u3067\u306f uv \u3092\u524d\u63d0\u306b\u3057\u307e\u3059\u3002<br>CI\/CD \u3067\u306f uv.lock \u3092\u30b3\u30df\u30c3\u30c8\u3057\u3001lockfile \u304c\u66f4\u65b0\u3055\u308c\u306a\u3044\u3053\u3068\u3092\u524d\u63d0\u306b\u74b0\u5883\u3092\u540c\u671f\u3057\u307e\u3059\u3002<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>uv lock --check\n\nuv sync --locked --no-dev<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">uv \u3067\u306f locking \u3068 syncing \u304c\u81ea\u52d5\u3067\u884c\u308f\u308c\u307e\u3059\u304c\u3001&#8211;locked \u3092\u4f7f\u3046\u3068 lockfile \u304c\u53e4\u3044\u5834\u5408\u306b\u66f4\u65b0\u305b\u305a\u30a8\u30e9\u30fc\u306b\u3067\u304d\u307e\u3059\u3002\u307e\u305f\u3001uv lock &#8211;check \u306f lockfile \u304c project metadata \u3068\u4e00\u81f4\u3057\u3066\u3044\u308b\u304b\u3092\u78ba\u8a8d\u3059\u308b\u305f\u3081\u306e\u30b3\u30de\u30f3\u30c9\u3067\u3059\u3002<br>uv \u5074\u3067\u3082\u3001\u516c\u958b\u76f4\u5f8c\u306e artifact \u3092\u907f\u3051\u308b\u8a2d\u5b9a\u304c\u3067\u304d\u307e\u3059\u3002<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>exclude-newer = \"1 week\"\n\nno-build = true<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">exclude-newer \u306f\u3001\u6307\u5b9a\u3057\u305f\u6642\u70b9\u3088\u308a\u65b0\u3057\u3044 distribution artifact \u3092\u4f9d\u5b58\u89e3\u6c7a\u5bfe\u8c61\u304b\u3089\u9664\u5916\u3059\u308b\u8a2d\u5b9a\u3067\u3059\u3002&#8221;24 hours&#8221; \u3084 &#8220;1 week&#8221; \u306e\u3088\u3046\u306a duration \u3082\u6307\u5b9a\u3067\u304d\u307e\u3059\u3002<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">no-build = true \u306f source distribution \u306e build \u3092\u7981\u6b62\u3059\u308b\u8a2d\u5b9a\u3067\u3059\u3002\u6709\u52b9\u306b\u3059\u308b\u3068\u3001\u89e3\u6c7a\u4e2d\u306b\u4efb\u610f\u306e Python \u30b3\u30fc\u30c9\u3092\u5b9f\u884c\u305b\u305a\u3001build \u304c\u5fc5\u8981\u306a distribution \u306f\u30a8\u30e9\u30fc\u306b\u306a\u308a\u307e\u3059\u3002<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">legacy \u306a requirements.txt \u904b\u7528\u304c\u6b8b\u308b\u5834\u5408\u306f\u3001hash pinning \u3082\u4f75\u7528\u3067\u304d\u307e\u3059\u3002<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>&#91;tool.uv.pip]\n\nrequire-hashes = true\n\nno-build = true<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">require-hashes \u306f\u3001\u3059\u3079\u3066\u306e requirement \u306b hash \u3068 exact pin \u3092\u8981\u6c42\u3059\u308b\u30e2\u30fc\u30c9\u3067\u3059\u3002uv \u306e hash-checking mode \u306f all-or-nothing \u3067\u3001\u3059\u3079\u3066\u306e requirement \u306b hash \u304c\u5fc5\u8981\u306b\u306a\u308a\u307e\u3059\u3002<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">PHP \uff08Composer\u7de8\uff09<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">PHP \u3067\u306f Composer \u3092\u524d\u63d0\u306b\u3057\u307e\u3059\u3002<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Composer \u306f npm \/ pnpm \u3068\u5c11\u3057\u8105\u5a01\u30e2\u30c7\u30eb\u304c\u9055\u3044\u307e\u3059\u3002Composer \u306e scripts \u306f\u3001root package \u306e composer.json \u306b\u5b9a\u7fa9\u3055\u308c\u305f\u3082\u306e\u3060\u3051\u304c\u5b9f\u884c\u3055\u308c\u3001\u4f9d\u5b58\u30d1\u30c3\u30b1\u30fc\u30b8\u5074\u306e scripts \u306f\u5b9f\u884c\u3055\u308c\u307e\u305b\u3093\u3002<br>\u305d\u306e\u305f\u3081\u3001PHP \u3067\u306f\u4f9d\u5b58\u30d1\u30c3\u30b1\u30fc\u30b8\u306e postinstall script \u3088\u308a\u3082\u3001\u6b21\u3092\u91cd\u70b9\u7684\u306b\u7ba1\u7406\u3057\u307e\u3059\u3002<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>composer.lock \u306b\u3088\u308b\u4f9d\u5b58\u56fa\u5b9a<\/li>\n\n\n\n<li>Composer plugin \u306e allowlist \u5316<\/li>\n\n\n\n<li>root package \u306e scripts \u306e\u5236\u5fa1<\/li>\n\n\n\n<li>composer audit \u306b\u3088\u308b\u65e2\u77e5\u8106\u5f31\u6027\u30c1\u30a7\u30c3\u30af<\/li>\n\n\n\n<li>private repository \/ plugin \/ scripts \u306e\u30ec\u30d3\u30e5\u30fc<\/li>\n\n\n\n<li>HTTP \u3084 TLS \u7121\u52b9\u5316\u306e\u7981\u6b62<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">\u30a2\u30d7\u30ea\u30b1\u30fc\u30b7\u30e7\u30f3\u3067\u306f composer.lock \u3092\u5fc5\u305a\u30b3\u30df\u30c3\u30c8\u3057\u307e\u3059\u3002CI\/CD \u3067\u306f\u6b21\u306e\u3088\u3046\u306b\u56fa\u5b9a\u3057\u307e\u3059\u3002<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>composer validate --strict\n\ncomposer install \\\n\n&nbsp;&nbsp;--no-dev \\\n\n&nbsp;&nbsp;--prefer-dist \\\n\n&nbsp;&nbsp;--no-interaction \\\n\n&nbsp;&nbsp;--no-progress \\\n\n&nbsp;&nbsp;--no-scripts \\\n\n&nbsp;&nbsp;--audit\n\ncomposer audit --locked<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">&#8211;no-scripts \u306f composer.json \u306b\u5b9a\u7fa9\u3055\u308c\u305f scripts \u306e\u5b9f\u884c\u3092\u30b9\u30ad\u30c3\u30d7\u3059\u308b\u30aa\u30d7\u30b7\u30e7\u30f3\u3067\u3059\u3002<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">composer audit &#8211;locked \u306f\u3001\u73fe\u5728\u306e vendor\/ \u3067\u306f\u306a\u304f lockfile \u4e0a\u306e\u30d1\u30c3\u30b1\u30fc\u30b8\u3092\u76e3\u67fb\u3057\u307e\u3059\u3002<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">composer.json \u306b\u306f\u3001\u5c11\u306a\u304f\u3068\u3082\u6b21\u306e\u3088\u3046\u306a\u8a2d\u5b9a\u3092\u5165\u308c\u307e\u3059\u3002<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>{\n\n&nbsp;&nbsp;\"config\": {\n\n&nbsp;&nbsp;&nbsp;&nbsp;\"allow-plugins\": {\n\n&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;\"composer\/installers\": true,\n\n&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;\"dealerdirect\/phpcodesniffer-composer-installer\": true,\n\n&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;\"symfony\/flex\": true,\n\n&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;\"*\": false\n\n&nbsp;&nbsp;&nbsp;&nbsp;},\n\n&nbsp;&nbsp;&nbsp;&nbsp;\"preferred-install\": {\n\n&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;\"*\": \"dist\"\n\n&nbsp;&nbsp;&nbsp;&nbsp;},\n\n&nbsp;&nbsp;&nbsp;&nbsp;\"secure-http\": true,\n\n&nbsp;&nbsp;&nbsp;&nbsp;\"disable-tls\": false,\n\n&nbsp;&nbsp;&nbsp;&nbsp;\"audit\": {\n\n&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;\"block-insecure\": true,\n\n&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;\"block-abandoned\": true\n\n&nbsp;&nbsp;&nbsp;&nbsp;},\n\n&nbsp;&nbsp;&nbsp;&nbsp;\"sort-packages\": true\n\n&nbsp;&nbsp;},\n\n&nbsp;&nbsp;\"minimum-stability\": \"stable\",\n\n&nbsp;&nbsp;\"prefer-stable\": true\n\n}<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Composer 2.2.0 \u4ee5\u964d\u306e allow-plugins \u306f\u3001Composer \u5b9f\u884c\u4e2d\u306b\u30b3\u30fc\u30c9\u3092\u5b9f\u884c\u3067\u304d\u308b plugin \u3092\u5236\u9650\u3059\u308b\u305f\u3081\u306e\u8a2d\u5b9a\u3067\u3059\u3002\u30c7\u30d5\u30a9\u30eb\u30c8\u306f {} \u3067 plugin \u306f\u8a31\u53ef\u3055\u308c\u305a\u3001\u4fe1\u983c\u3057\u305f plugin \u3060\u3051\u3092\u660e\u793a\u7684\u306b\u8a31\u53ef\u3067\u304d\u307e\u3059\u3002true \u3067\u5168 plugin \u3092\u8a31\u53ef\u3059\u308b\u3053\u3068\u3082\u3067\u304d\u307e\u3059\u304c\u3001\u3053\u308c\u306f\u63a8\u5968\u3055\u308c\u307e\u305b\u3093\u3002<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Composer \u306b\u306f pnpm \u306e minimumReleaseAge \u3084 uv \u306e exclude-newer \u306b\u76f8\u5f53\u3059\u308b\u6a19\u6e96\u7684\u306a cooldown \u8a2d\u5b9a\u306f\u3042\u308a\u307e\u305b\u3093\u3002\u305d\u306e\u305f\u3081\u3001PHP \u3067\u306f cooldown \u3092 Composer \u5358\u4f53\u3067\u306f\u306a\u304f\u3001Dependabot \/ Renovate\u3001Private Packagist\u3001artifact proxy\u3001mirror \u5074\u306e\u904b\u7528\u3067\u5b9f\u73fe\u3057\u307e\u3059\u3002<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">\u6a19\u6e96\u30dd\u30ea\u30b7\u30fc\u306e\u5168\u4f53\u50cf<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">\u500b\u5225\u306e\u8a2d\u5b9a\u3060\u3051\u3092\u898b\u308b\u3068\u3001pnpm\u3001uv\u3001Composer \u306f\u305d\u308c\u305e\u308c\u5225\u3005\u306e\u8a71\u306b\u898b\u3048\u307e\u3059\u3002<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u3057\u304b\u3057\u3001\u5b9f\u969b\u306b\u306f\u3069\u308c\u3082\u300clockfile \u56fa\u5b9a\u300d\u300c\u4efb\u610f\u30b3\u30fc\u30c9\u5b9f\u884c\u306e\u6291\u6b62\u300d\u300c\u516c\u958b\u76f4\u5f8c\u30d0\u30fc\u30b8\u30e7\u30f3\u306e\u56de\u907f\u300d\u300cCI\/CD \u3067\u306e\u5f37\u5236\u300d\u3068\u3044\u3046\u540c\u3058\u539f\u5247\u306b\u6cbf\u3063\u3066\u3044\u307e\u3059\u3002<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"846\" height=\"416\" src=\"https:\/\/race-ss.co.jp\/blog\/wp-content\/uploads\/2026\/09\/\u9ece\u304f\u3093\u8a18\u4e8b\u30b5\u30d7\u30e9\u30a4\u30c1\u30a7\u30fc\u30f3\u653b\u64832.jpg\" alt=\"\" class=\"wp-image-1621\"\/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">\u91cd\u8981\u306a\u306e\u306f\u3001\u3053\u308c\u3089\u3092\u300c\u63a8\u5968\u8a2d\u5b9a\u300d\u3068\u3057\u3066 \u793e\u5185\u30c9\u30ad\u30e5\u30e1\u30f3\u30c8\u3084\u30ac\u30a4\u30c9\u30e9\u30a4\u30f3\u306b\u66f8\u304f\u3060\u3051\u3067\u7d42\u308f\u3089\u305b\u305a\u3001CI\/CD \u306e\u6a19\u6e96\u30dd\u30ea\u30b7\u30fc\u3068\u3057\u3066\u5f37\u5236\u3059\u308b\u3053\u3068\u3067\u3059\u3002<br>\u30b5\u30d7\u30e9\u30a4\u30c1\u30a7\u30fc\u30f3\u653b\u6483\u306f\u3001\u500b\u4eba\u306e\u6ce8\u610f\u3067\u306f\u306a\u304f\u3001\u4ed5\u7d44\u307f\u3067\u6b62\u3081\u308b\u5fc5\u8981\u304c\u3042\u308a\u307e\u3059\u3002<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">CI\/CD \u3067\u6a19\u6e96\u5316\u3057\u305f\u3044\u30dd\u30ea\u30b7\u30fc<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">\u6700\u7d42\u7684\u306b\u306f\u3001\u500b\u3005\u306e\u958b\u767a\u8005\u306e\u6ce8\u610f\u306b\u4f9d\u5b58\u305b\u305a\u3001CI\/CD \u3068 repository \u8a2d\u5b9a\u3067\u5f37\u5236\u3057\u307e\u3059\u3002<br>JavaScript \/ TypeScript \u3067\u306f\u3001CI \u306f\u6b21\u306e\u3088\u3046\u306b\u56fa\u5b9a\u3057\u307e\u3059\u3002<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>pnpm install --frozen-lockfile<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">pnpm-workspace.yaml \u306f\u6b21\u3092\u6a19\u6e96\u306b\u3057\u307e\u3059\u3002<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>minimumReleaseAge: 10080\n\nstrictDepBuilds: true\n\ndangerouslyAllowAllBuilds: false\n\ntrustPolicy: no-downgrade\n\nblockExoticSubdeps: true\n\nallowBuilds:\n\n&nbsp;&nbsp;esbuild: true\n\n&nbsp;&nbsp;\"@prisma\/client\": true\n\n&nbsp;&nbsp;sharp: true<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Python \u3067\u306f\u3001CI \u3092\u6b21\u306e\u3088\u3046\u306b\u56fa\u5b9a\u3057\u307e\u3059\u3002<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>uv lock --check\n\nuv sync --locked --no-dev<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">pyproject.toml \u306b\u306f\u6b21\u3092\u5165\u308c\u307e\u3059\u3002<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>&#91;tool.uv]\n\nexclude-newer = \"1 week\"\n\nno-build = true<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">PHP \u3067\u306f\u3001CI \u3092\u6b21\u306e\u3088\u3046\u306b\u56fa\u5b9a\u3057\u307e\u3059\u3002<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>composer validate --strict\n\ncomposer install --no-dev --prefer-dist --no-interaction --no-progress --no-scripts --audit\n\ncomposer audit --locked<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u305f\u3060\u3057\u3001no-build = true \u3084 &#8211;no-scripts \u306f\u3001\u6b63\u5f53\u306a build \/ generate \u51e6\u7406\u3092\u58ca\u3059\u53ef\u80fd\u6027\u304c\u3042\u308a\u307e\u3059\u3002\u4f8b\u5916\u304c\u5fc5\u8981\u306a\u5834\u5408\u306f\u3001\u5bfe\u8c61\u30d1\u30c3\u30b1\u30fc\u30b8\u30fb\u7528\u9014\u30fb\u4ee3\u66ff\u53ef\u5426\u3092\u30ec\u30d3\u30e5\u30fc\u3057\u3001\u4f8b\u5916\u30ea\u30b9\u30c8\u3068\u3057\u3066\u7ba1\u7406\u3057\u307e\u3059\u3002<\/p>\n\n\n\n<pre class=\"wp-block-verse\">Caution!<br><br>no-build = true \u3084 --no-scripts \u3092\u7121\u7406\u306b\u5168\u30d7\u30ed\u30b8\u30a7\u30af\u30c8\u3078\u9069\u7528\u3059\u308b\u3068\u3001\u6b63\u5f53\u306a\u751f\u6210\u51e6\u7406\u307e\u3067\u6b62\u3081\u308b\u53ef\u80fd\u6027\u304c\u3042\u308a\u307e\u3059\u3002<br><br>\u4f8b\u5916\u3092\u8a31\u53ef\u3059\u308b\u5834\u5408\u306f\u3001\u7406\u7531\u30fb\u5bfe\u8c61\u30d1\u30c3\u30b1\u30fc\u30b8\u30fb\u4ee3\u66ff\u53ef\u5426\u3092\u660e\u8a18\u3057\u3066\u30ec\u30d3\u30e5\u30fc\u5bfe\u8c61\u306b\u3057\u3066\u304f\u3060\u3055\u3044\u3002<\/pre>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>\u3010FAQ\u3011\u958b\u767a\u8005\u5411\u3051\u30c8\u30e9\u30d6\u30eb\u30b7\u30e5\u30fc\u30c6\u30a3\u30f3\u30b0<\/strong><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u8a2d\u5b9a\u3092\u53b3\u683c\u5316\u3059\u308b\u3068\u3001\u65e5\u3005\u306e\u958b\u767a\u306b\u304a\u3044\u3066\u30d1\u30c3\u30b1\u30fc\u30b8\u306e\u30a4\u30f3\u30b9\u30c8\u30fc\u30eb\u304c\u30d6\u30ed\u30c3\u30af\u3055\u308c\u308b\u30b1\u30fc\u30b9\u304c\u767a\u751f\u3057\u307e\u3059\u3002\u3088\u304f\u3042\u308b\u3064\u307e\u305a\u304d\u3068\u5bfe\u51e6\u6cd5\u306f\u4ee5\u4e0b\u306e\u901a\u308a\u3067\u3059\u3002<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Q. CI\u3067 strictDepBuilds\uff08\u307e\u305f\u306f no-build\uff09\u30a8\u30e9\u30fc\u304c\u51fa\u3066\u30a4\u30f3\u30b9\u30c8\u30fc\u30eb\u306b\u5931\u6557\u3057\u307e\u3059\u3002<\/strong><br><strong>A. \u8ffd\u52a0\u3057\u305f\u30d1\u30c3\u30b1\u30fc\u30b8\u304cC\u62e1\u5f35\u306e\u30b3\u30f3\u30d1\u30a4\u30eb\u306a\u3069\u6b63\u5f53\u306a\u30d3\u30eb\u30c9\u51e6\u7406\u3092\u884c\u3063\u3066\u3044\u308b\u304b\u78ba\u8a8d\u3057\u3066\u304f\u3060\u3055\u3044\u3002\u554f\u984c\u304c\u306a\u3051\u308c\u3070\u3001pnpm-workspace.yaml \u306e allowBuilds\uff08\u7b49\uff09\u306b\u30d1\u30c3\u30b1\u30fc\u30b8\u3092\u8ffd\u52a0\u3057\u3001\u30a4\u30f3\u30d5\u30e9\u30fb\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u62c5\u5f53\u8005\u3078\u30ec\u30d3\u30e5\u30fc\u3092\u4f9d\u983c\u3057\u3066\u304f\u3060\u3055\u3044\u3002<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Q. minimumReleaseAge\uff08\u307e\u305f\u306f exclude-newer\uff09\u306b\u5f15\u3063\u304b\u304b\u3063\u3066\u6700\u65b0\u7248\u306e\u30d1\u30c3\u30b1\u30fc\u30b8\u304c\u5165\u308c\u3089\u308c\u307e\u305b\u3093\u3002<\/strong><br><strong>A. \u539f\u5247\u3068\u3057\u3066\u6570\u65e5\u9593\u306eCooldown\u671f\u9593\u3092\u5f85\u3064\u306e\u304c\u5b89\u5168\u3067\u3059\u3002\u7dca\u6025\u306e\u30d0\u30b0\u4fee\u6b63\u7248\u306a\u3069\u3067\u4eca\u3059\u3050\u5fc5\u8981\u306a\u5834\u5408\u306b\u9650\u308a\u3001\u8a2d\u5b9a\u671f\u9593\u3092\u4e00\u6642\u7684\u306b\u77ed\u7e2e\u3059\u308b\u3001\u3042\u308b\u3044\u306f\u62c5\u5f53\u30c1\u30fc\u30e0\u3078\u4f8b\u5916\u5bfe\u5fdc\u3092\u76f8\u8ac7\u3057\u3066\u304f\u3060\u3055\u3044\u3002<\/strong><\/p>\n\n\n\n<h2 class=\"wp-block-heading\">\u30a4\u30f3\u30b7\u30c7\u30f3\u30c8\u6642\u306e\u521d\u52d5<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">\u60aa\u6027\u30d1\u30c3\u30b1\u30fc\u30b8\u3092 install \u3057\u305f\u7591\u3044\u304c\u3042\u308b\u5834\u5408\u3001\u4f9d\u5b58\u30d0\u30fc\u30b8\u30e7\u30f3\u3092\u623b\u3059\u3060\u3051\u3067\u306f\u4e0d\u5341\u5206\u3067\u3059\u3002lifecycle script \u304c\u5b9f\u884c\u3055\u308c\u305f\u53ef\u80fd\u6027\u304c\u3042\u308b\u306a\u3089\u3001\u305d\u306e\u74b0\u5883\u306f\u4fb5\u5bb3\u3055\u308c\u305f\u524d\u63d0\u3067\u6271\u3044\u307e\u3059\u3002<br>secret \u306e\u6f0f\u6d29\u3060\u3051\u3067\u306a\u304f\u3001\u30de\u30eb\u30a6\u30a7\u30a2\u611f\u67d3\u3001\u6c38\u7d9a\u5316\u3001\u5916\u90e8\u901a\u4fe1\u3001\u8ffd\u52a0\u30da\u30a4\u30ed\u30fc\u30c9\u306e\u53d6\u5f97\u3001\u7aef\u672b\u5185\u30d5\u30a1\u30a4\u30eb\u306e\u6539\u3056\u3093\u30fb\u524a\u9664\u3001\u6a2a\u5c55\u958b\u306e\u53ef\u80fd\u6027\u3082\u8003\u616e\u3057\u307e\u3059\u3002<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u512a\u5148\u3059\u3079\u304d\u5bfe\u5fdc\u306f\u6b21\u306e\u3068\u304a\u308a\u3067\u3059\u3002<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li>lockfile \u3068 package manager cache \u306b\u60aa\u6027\u30d0\u30fc\u30b8\u30e7\u30f3\u304c\u6b8b\u3063\u3066\u3044\u306a\u3044\u304b\u78ba\u8a8d\u3059\u308b<\/li>\n\n\n\n<li>\u5f71\u97ff\u3092\u53d7\u3051\u305f\u958b\u767a\u7aef\u672b\u30fbCI runner \u3092\u30cd\u30c3\u30c8\u30ef\u30fc\u30af\u304b\u3089\u9694\u96e2\u3059\u308b<\/li>\n\n\n\n<li>EDR \/ AV \/ \u30d5\u30a9\u30ec\u30f3\u30b8\u30c3\u30af\u89b3\u70b9\u3067\u3001\u4e0d\u5be9\u30d7\u30ed\u30bb\u30b9\u3001\u6c38\u7d9a\u5316\u8a2d\u5b9a\u3001\u5916\u90e8\u901a\u4fe1\u3001\u8ffd\u52a0\u30d5\u30a1\u30a4\u30eb\u3092\u78ba\u8a8d\u3059\u308b<\/li>\n\n\n\n<li>GitHub token\u3001npm token\u3001SSH key\u3001cloud credential\u3001.env\u3001CI\/CD secret \u3092\u30ed\u30fc\u30c6\u30fc\u30b7\u30e7\u30f3\u3059\u308b<\/li>\n\n\n\n<li>\u4e0d\u5be9\u306a repository\u3001branch\u3001GitHub Actions workflow\u3001release\u3001package publish \u5c65\u6b74\u3092\u78ba\u8a8d\u3059\u308b<\/li>\n\n\n\n<li>artifact proxy \u3084 registry cache \u304b\u3089\u60aa\u6027 artifact \u3092\u524a\u9664\u3059\u308b<\/li>\n\n\n\n<li>\u5b89\u5168\u306a\u30d0\u30fc\u30b8\u30e7\u30f3\u3078 pinning \u3059\u308b<\/li>\n\n\n\n<li>\u5fc5\u8981\u306b\u5fdc\u3058\u3066\u958b\u767a\u7aef\u672b\u30fbCI runner \u3092\u518d\u30a4\u30e1\u30fc\u30b8\u5316\u3059\u308b<\/li>\n\n\n\n<li>\u518d\u767a\u9632\u6b62\u3068\u3057\u3066 cooldown\u3001script allowlist\u3001lockfile enforcement \u3092\u5c0e\u5165\u3059\u308b<\/li>\n<\/ol>\n\n\n\n<pre class=\"wp-block-verse\">Warning!<br><br>install \u6642\u306b\u4efb\u610f\u30b3\u30fc\u30c9\u304c\u5b9f\u884c\u3055\u308c\u305f\u53ef\u80fd\u6027\u304c\u3042\u308b\u5834\u5408\u3001\u305d\u306e\u74b0\u5883\u306f\u4fb5\u5bb3\u3055\u308c\u305f\u524d\u63d0\u3067\u6271\u3044\u307e\u3059\u3002<br>secret \u6f0f\u6d29\u3060\u3051\u3067\u306a\u304f\u3001\u30de\u30eb\u30a6\u30a7\u30a2\u611f\u67d3\u3001\u6c38\u7d9a\u5316\u3001\u5916\u90e8\u901a\u4fe1\u3001\u8ffd\u52a0\u30da\u30a4\u30ed\u30fc\u30c9\u306e\u53d6\u5f97\u3001\u6a2a\u5c55\u958b\u306e\u53ef\u80fd\u6027\u3082\u8003\u616e\u3057\u307e\u3059\u3002<br>\u300c\u4f9d\u5b58\u30d0\u30fc\u30b8\u30e7\u30f3\u3092\u623b\u3057\u305f\u306e\u3067\u5b8c\u4e86\u300d\u3067\u306f\u306a\u304f\u3001\u7aef\u672b\u30fbrunner \u306e\u9694\u96e2\u3001\u4fb5\u5bb3\u8abf\u67fb\u3001token rotation\u3001cache \u524a\u9664\u3001\u5fc5\u8981\u306b\u5fdc\u3058\u305f\u518d\u30a4\u30e1\u30fc\u30b8\u5316\u307e\u3067\u542b\u3081\u3066\u5bfe\u5fdc\u3057\u307e\u3059\u3002<\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">\u307e\u3068\u3081<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">\u3053\u306e\u8a18\u4e8b\u306e\u5bfe\u8c61\u306f\u3001\u30d1\u30c3\u30b1\u30fc\u30b8\u3092\u516c\u958b\u3059\u308b\u5074\u3067\u306f\u306a\u304f\u3001\u65e5\u3005\u306e\u958b\u767a\u30fbCI\/CD \u3067\u4f9d\u5b58\u30d1\u30c3\u30b1\u30fc\u30b8\u3092\u5229\u7528\u3059\u308b\u5074\u3067\u3059\u3002<br>\u305d\u306e\u305f\u3081\u91cd\u8981\u306a\u306e\u306f\u3001\u300c\u5b89\u5168\u306a\u30d1\u30c3\u30b1\u30fc\u30b8\u3060\u3051\u3092\u4fe1\u3058\u308b\u300d\u3053\u3068\u3067\u306f\u3042\u308a\u307e\u305b\u3093\u3002\u60aa\u6027\u30d1\u30c3\u30b1\u30fc\u30b8\u304c\u6df7\u5165\u3057\u3066\u3082\u3001\u88ab\u5bb3\u3092\u6291\u3048\u308b\u4ed5\u7d44\u307f\u3092\u6a19\u6e96\u5316\u3059\u308b\u3053\u3068\u3067\u3059\u3002<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><br>\u30b5\u30d7\u30e9\u30a4\u30c1\u30a7\u30fc\u30f3\u653b\u6483\u306e\u672c\u8cea\u306f\u3001\u300c\u60aa\u6027\u30d1\u30c3\u30b1\u30fc\u30b8\u304c secret \u3092\u76d7\u3080\u3053\u3068\u300d\u3067\u306f\u306a\u304f\u3001\u300c\u4fe1\u983c\u3057\u3066 install \u3057\u305f\u51e6\u7406\u306e\u4e2d\u3067\u4efb\u610f\u30b3\u30fc\u30c9\u304c\u5b9f\u884c\u3055\u308c\u308b\u3053\u3068\u300d\u3067\u3059\u3002<br>\u305d\u306e\u305f\u3081\u88ab\u5bb3\u306f token \u3084 .env \u306e\u7a83\u53d6\u306b\u9650\u3089\u305a\u3001RAT\u3001\u30d0\u30c3\u30af\u30c9\u30a2\u3001\u30af\u30ea\u30d7\u30c8\u30de\u30a4\u30ca\u30fc\u3001\u8ffd\u52a0\u30da\u30a4\u30ed\u30fc\u30c9\u306e\u53d6\u5f97\u3001\u7aef\u672b\u5185\u30d5\u30a1\u30a4\u30eb\u306e\u6539\u3056\u3093\u30fb\u524a\u9664\u3001\u6a2a\u5c55\u958b\u306a\u3069\u306b\u3082\u5e83\u304c\u308a\u5f97\u307e\u3059\u3002<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u5b9f\u904b\u7528\u3067\u306f\u3001\u6b21\u306e\u72b6\u614b\u3092\u6a19\u6e96\u306b\u3059\u308b\u5fc5\u8981\u304c\u3042\u308a\u307e\u3059\u3002<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>lockfile \u3092\u5fc5\u305a\u30b3\u30df\u30c3\u30c8\u3059\u308b<\/li>\n\n\n\n<li>CI\/CD \u3067\u306f lockfile \u3092\u66f4\u65b0\u3055\u305b\u306a\u3044<\/li>\n\n\n\n<li>lifecycle script \u306f\u539f\u5247\u7121\u52b9\u5316\u3057\u3001\u5fc5\u8981\u306a\u3082\u306e\u3060\u3051\u8a31\u53ef\u3059\u308b<\/li>\n\n\n\n<li>\u516c\u958b\u76f4\u5f8c\u306e\u30d1\u30c3\u30b1\u30fc\u30b8\u306f cooldown \u671f\u9593\u3092\u7f6e\u304f<\/li>\n\n\n\n<li>Trusted Publishing \u3084 provenance \u306e trust level \u4f4e\u4e0b\u3092\u691c\u77e5\u3059\u308b<\/li>\n\n\n\n<li>CI\/CD \u306e secret \u306f\u6700\u5c0f\u6a29\u9650\u30fb\u77ed\u547d\u30fb\u5206\u96e2\u3092\u5fb9\u5e95\u3059\u308b<\/li>\n\n\n\n<li>install \u6642\u306b\u4efb\u610f\u30b3\u30fc\u30c9\u304c\u52d5\u3044\u305f\u5834\u5408\u306f\u3001secret \u6f0f\u6d29\u3060\u3051\u3067\u306a\u304f\u3001\u7aef\u672b\u30fbCI runner \u306e\u4fb5\u5bb3\u524d\u63d0\u3067\u5bfe\u5fdc\u3059\u308b<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">pnpm\u3001uv\u3001Composer \u306f\u3001\u305d\u308c\u305e\u308c\u7570\u306a\u308b\u5f62\u3067\u3053\u308c\u3089\u306e\u5bfe\u7b56\u3092\u5b9f\u73fe\u3067\u304d\u307e\u3059\u3002<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>pnpm \u3067\u306f\u3001minimumReleaseAge\u3001allowBuilds\u3001strictDepBuilds\u3001trustPolicy\u3001blockExoticSubdeps \u3092\u7d44\u307f\u5408\u308f\u305b\u307e\u3059\u3002<\/li>\n\n\n\n<li>uv \u3067\u306f\u3001uv.lock\u3001&#8211;locked\u3001exclude-newer\u3001no-build\u3001\u5fc5\u8981\u306b\u5fdc\u3058\u3066 require-hashes \u3092\u7d44\u307f\u5408\u308f\u305b\u307e\u3059\u3002<\/li>\n\n\n\n<li>Composer \u3067\u306f\u3001composer.lock\u3001allow-plugins\u3001&#8211;no-scripts\u3001composer audit &#8211;locked \u3092\u7d44\u307f\u5408\u308f\u305b\u307e\u3059\u3002<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">\u91cd\u8981\u306a\u306e\u306f\u3001\u3053\u308c\u3089\u3092\u300c\u63a8\u5968\u300d\u3067\u306f\u306a\u304f CI\/CD \u306e\u6a19\u6e96\u30dd\u30ea\u30b7\u30fc\u3068\u3057\u3066\u5f37\u5236\u3059\u308b\u3053\u3068\u3067\u3059\u3002\u30b5\u30d7\u30e9\u30a4\u30c1\u30a7\u30fc\u30f3\u653b\u6483\u306f\u3001\u500b\u4eba\u306e\u6ce8\u610f\u529b\u3067\u306f\u306a\u304f\u3001\u4ed5\u7d44\u307f\u3067\u6b62\u3081\u308b\u5fc5\u8981\u304c\u3042\u308a\u307e\u3059\u3002<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u6700\u5f8c\u307e\u3067\u8aad\u3093\u3067\u304f\u3060\u3055\u308a\u3001\u3042\u308a\u304c\u3068\u3046\u3054\u3056\u3044\u307e\u3057\u305f\u3002\u5b89\u5168\u306a\u30a4\u30f3\u30d5\u30e9\u74b0\u5883\u306e\u69cb\u7bc9\u306b\u5411\u3051\u3001\u5c11\u3057\u3067\u3082\u7686\u69d8\u306e\u53c2\u8003\u306b\u306a\u308c\u3070\u5b09\u3057\u3044\u3067\u3059\u3002<br>\u3053\u308c\u304b\u3089\u3082RSS\u306e\u30e1\u30f3\u30d0\u30fc\u304c\u30d6\u30ed\u30b0\u3092\u6295\u7a3f\u3057\u3066\u3044\u304d\u307e\u3059\u306e\u3067\u3001\u305c\u3072\u30c1\u30a7\u30c3\u30af\u3057\u3066\u304f\u3060\u3055\u3044\uff01<\/p>\n\n\n\n<a href=\"https:\/\/race-ss.co.jp\/\" class=\"corp-link-btn\" target=\"_blank\" rel=\"noopener\">\n  <div class=\"corp-link-img\">\n    <img decoding=\"async\" src=\"https:\/\/race-ss.co.jp\/blog\/wp-content\/uploads\/2025\/11\/\u30a8\u30f3\u30b8\u30cb\u30a2\u52df\u96c6\u753b\u50cf-2.jpg\" alt=\"\u30a8\u30f3\u30b8\u30cb\u30a2\u52df\u96c6\u4e2d\">\n  <\/div>\n  <div class=\"corp-link-text\">\n    <div class=\"corp-link-title\">\u30a8\u30f3\u30b8\u30cb\u30a2\u52df\u96c6\u4e2d\uff01<\/div>\n    <div class=\"corp-link-desc\">\n      \u30ec\u30a4\u30b9\u30b7\u30b9\u30c6\u30e0\u30bd\u30ea\u30e5\u30fc\u30b7\u30e7\u30f3\u30ba\uff08\u30b3\u30fc\u30dd\u30ec\u30fc\u30c8\u30b5\u30a4\u30c8\uff09\n    <\/div>\n  <\/div>\n<\/a>\n\n<div class=\"contact-section-compact\">\n  <p class=\"contact-compact-text\">\n    \u30ec\u30a4\u30b9\u30b7\u30b9\u30c6\u30e0\u30bd\u30ea\u30e5\u30fc\u30b7\u30e7\u30f3\u30ba\u682a\u5f0f\u4f1a\u793e\u306e\u30bd\u30d5\u30c8\u30a6\u30a7\u30a2\u958b\u767a\u3084\u3001<br>\n    \u63a1\u7528\u306b\u95a2\u3059\u308b\u304a\u554f\u3044\u5408\u308f\u305b\u306b\u3064\u3044\u3066\u306f\u3001\u4e0b\u8a18\u306e\u30ea\u30f3\u30af\u306b\u3066\u304a\u554f\u3044\u5408\u308f\u305b\u304f\u3060\u3055\u3044\u3002\n  <\/p>\n  \n  <a href=\"https:\/\/docs.google.com\/forms\/d\/e\/1FAIpQLSdZuEol6gkLjICDDsr9JsYTjmJMOllj7ew4aQZOilqQinCuzw\/viewform\" class=\"contact-compact-btn\" target=\"_blank\" rel=\"noopener\">\n    <svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"18\" height=\"18\" viewBox=\"0 0 24 24\" fill=\"currentColor\" style=\"margin-right:8px; vertical-align:middle;\">\n      <path d=\"M20 4H4c-1.1 0-1.99.9-1.99 2L2 18c0 1.1.9 2 2 2h16c1.1 0 2-.9 2-2V6c0-1.1-.9-2-2-2zm0 4l-8 5-8-5V6l8 5 8-5v2z\"><\/path>\n    <\/svg>\n    \u304a\u554f\u3044\u5408\u308f\u305b\n  <\/a>\n<\/div>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n","protected":false},"excerpt":{"rendered":"<p>\u306f\u3058\u3081\u306b \u3053\u3093\u306b\u3061\u306f\u3002RSS\u3067\u30af\u30e9\u30a6\u30c9\u57fa\u76e4\u30a2\u30fc\u30ad\u30c6\u30af\u30c8\u3092\u3057\u3066\u3044\u308bS.R.\u3067\u3059\u3002OSS\u30d1\u30c3\u30b1\u30fc\u30b8\u306f\u73fe\u4ee3\u306e\u958b\u767a\u306b\u6b20\u304b\u305b\u306a\u3044\u30a4\u30f3\u30d5\u30e9\u3067\u3059\u304c\u3001JavaScript \/ TypeScript \u3067\u306f npm registry\u3001Pyt [&hellip;]<\/p>\n","protected":false},"author":36,"featured_media":1611,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"om_disable_all_campaigns":false,"footnotes":""},"categories":[35,165],"tags":[248,249,250,252,251],"class_list":["post-1608","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-35","category-165","tag-pnpm","tag-uv","tag-250","tag-252","tag-251"],"aioseo_notices":[],"_links":{"self":[{"href":"https:\/\/race-ss.co.jp\/blog\/index.php?rest_route=\/wp\/v2\/posts\/1608","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/race-ss.co.jp\/blog\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/race-ss.co.jp\/blog\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/race-ss.co.jp\/blog\/index.php?rest_route=\/wp\/v2\/users\/36"}],"replies":[{"embeddable":true,"href":"https:\/\/race-ss.co.jp\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1608"}],"version-history":[{"count":7,"href":"https:\/\/race-ss.co.jp\/blog\/index.php?rest_route=\/wp\/v2\/posts\/1608\/revisions"}],"predecessor-version":[{"id":1624,"href":"https:\/\/race-ss.co.jp\/blog\/index.php?rest_route=\/wp\/v2\/posts\/1608\/revisions\/1624"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/race-ss.co.jp\/blog\/index.php?rest_route=\/wp\/v2\/media\/1611"}],"wp:attachment":[{"href":"https:\/\/race-ss.co.jp\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1608"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/race-ss.co.jp\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1608"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/race-ss.co.jp\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1608"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}