Skip to content

Add bagel security inventory tool and mise tasks #929

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
ryo246912 wants to merge 1 commit into
base: main
Choose a base branch
from
+44 −0
Open

Add bagel security inventory tool and mise tasks #929

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
26 changes: 26 additions & 0 deletions dot_config/bagel/bagel.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,26 @@
version: 1
probes:
git:
enabled: true
ssh:
enabled: true
npm:
enabled: true
env:
enabled: true
shell_history:
enabled: true
cloud:
enabled: true
jetbrains:
enabled: true
gh:
enabled: true
ai_cli:
enabled: true
privacy:
redact_paths: []
exclude_env_prefixes: []
Copy link
Copy Markdown
Contributor

@gemini-code-assist gemini-code-assist Bot May 3, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

security-medium medium

env プロブが有効になっていますが、exclude_env_prefixes が空の設定になっています。環境変数には API トークンなどの機密情報が含まれることが多いため、セキュリティ、秘密情報、プライバシー設定の優先確認方針に基づき、GITHUB_, AWS_, SECRET_, TOKEN_ などの一般的なプレフィックスを除外設定に追加することを推奨します。

  exclude_env_prefixes: ["GITHUB_", "AWS_", "SECRET_", "TOKEN_"]
References
  1. リポジトリスタイルガイドの12行目（セキュリティ、秘密情報、プライバシー設定の優先確認）に基づいています。 (link)

output:
include_file_hashes: false
include_file_content: false
9 changes: 9 additions & 0 deletions dot_config/mise/config.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,6 +15,7 @@ ASDF_FFMPEG_ENABLE = "gpl libx264"
"aqua:astral-sh/uv" = "0.11.7"
"aqua:atuinsh/atuin" = "18.8.0"
"aqua:bitwarden/clients" = "2025.9.0"
"aqua:boostsecurityio/bagel" = "0.6.1"
"aqua:cli/cli" = "2.90.0"
"aqua:dandavison/delta" = "0.19.2"
"aqua:denisidoro/navi" = "2.23.0"
Expand Down Expand Up @@ -211,3 +212,11 @@ run = "prettier --check '**/*.json'"
[tasks.fix-json]
description = "Run fix json files"
run = "prettier --write '**/*.json'"

[tasks.bagel-scan]
description = "Run bagel scan to inventory security-relevant metadata"
run = "bagel scan"

[tasks.bagel-version]
description = "Show bagel version"
run = "bagel version"
9 changes: 9 additions & 0 deletions mise.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -93,8 +93,17 @@ run = [

[tools]
"aqua:rhysd/actionlint" = "1.7.12"
"aqua:boostsecurityio/bagel" = "0.6.1"
Copy link
Copy Markdown
Contributor

@gemini-code-assist gemini-code-assist Bot May 3, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

medium

dot_config/mise/config.toml (グローバル設定) と mise.toml (リポジトリ局所設定) の両方に bagel の定義が追加されています。グローバル設定で共通利用するツールであれば、このファイルでの定義は冗長です。リポジトリ固有の理由がない限り、定義を一方に寄せることで保守性を向上させることを検討してください。

"aqua:suzuki-shunsuke/ghalint" = "1.5.5"
"aqua:suzuki-shunsuke/pinact" = "3.9.2"
"aqua:tamasfe/taplo" = "0.10.0"
"npm:prettier" = "3.8.1"
"pipx:zizmor" = "1.23.1"

[tasks.bagel-scan]
description = "Run bagel scan to inventory security-relevant metadata"
run = "bagel scan"

[tasks.bagel-version]
description = "Show bagel version"
run = "bagel version"
Comment on lines +103 to +109
Copy link
Copy Markdown
Contributor

@gemini-code-assist gemini-code-assist Bot May 3, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

medium

mise.toml 内の他のタスク（lint-* など）のスタイルに合わせ、hide = true を設定して mise tasks 実行時の出力を整理することを推奨します。

Suggested change
[tasks.bagel-scan]
description = "Run bagel scan to inventory security-relevant metadata"
run = "bagel scan"
[tasks.bagel-version]
description = "Show bagel version"
run = "bagel version"
[tasks.bagel-scan]
description = "Run bagel scan to inventory security-relevant metadata"
hide = true
run = "bagel scan"
[tasks.bagel-version]
description = "Show bagel version"
hide = true
run = "bagel version"
References
  1. 既存のタスク定義のスタイル（hide = true）との一貫性を保つための提案です。 (link)