fix(security): resolve code scanning & Dependabot alerts (workflow permissions + uuid override)

[YasunoriMATSUOKA]

概要

GitHub セキュリティ機能の検出結果 6 件 に対応します。

A. Code scanning — 4 件（actions/missing-workflow-permissions, medium）

トップレベル permissions: が無い 4 ワークフローに最小権限 contents: read を追加。いずれも checkout/build（+ FIREBASE_TOKEN での deploy）のみで GITHUB_TOKEN の書き込み・packages・id-token 権限は不要。既存 pinact.yml のパターンに揃えています。

• ci-react.yml / ci-functions.yml / cd-firebase-mainnet.yml / cd-firebase-testnet.yml

B. Dependabot — 2 件（GHSA-w5hq-g745-h8pq: uuid <11.1.1, moderate）

脆弱な uuid は推移的依存:

• root: firebase-tools → gaxios@6 → uuid@9.0.1
• functions: firebase-admin → @google-cloud/* → gaxios/teeny-request/google-gax → uuid@8.3.2/9.0.1

親パッケージ更新案は無効（比較検証済み）: firebase-tools は既に最新で今も gaxios@6 を固定、firebase-admin@14 は破壊的メジャーかつ依然脆弱な uuid を引く。よって npm overrides で patched 版を強制します。脆弱な連鎖のみを最小限に置き換える方針で、各パッケージは宣言された semver 範囲内に保ちます:

• root: gaxios → uuid のみ 11.1.1 にスコープ。root で脆弱なのは gaxios → uuid@9.0.1 の連鎖だけで、firebase-tools 直下の uuid@11.1.1 と universal-analytics の uuid@14.0.0 は既にパッチ済みのため据え置き（範囲外への major jump を回避）。

  "overrides": { "gaxios": { "uuid": "11.1.1" } }

• functions: uuid を 11.1.1 に固定（フラット）。functions 側は全 uuid 実体（8.3.2/9.0.1）が脆弱で、11.1.1 が advisory のパッチ最小版のため。

補足: 当該バグは uuid v3/v5/v6 に buf を渡した場合のみ発火し、これら Google 系ライブラリは v4 のみ使用するため実害可能性はほぼゼロですが、アラート解消とサプライチェーン衛生のため対応します。

検証

• npm ci … root / functions ともに exit 0（lockfile 同期確認）
• npm ls uuid … 脆弱版が消え exit 0（clean tree、ELSPROBLEMS なし）
• npm audit … 両パッケージで 0 vulnerabilities
• root npm run typecheck & npm run build、functions npm run build … すべて成功
• prettier --check … 変更ファイルすべて適合

🤖 Generated with Claude Code

[coderabbitai]

📝 Walkthrough

Walkthrough

Four GitHub Actions workflows now declare read-only repository permissions at the top level, and both root and functions package.json files explicitly pin the uuid dependency to specific versions through override configuration.

Changes

System Configuration Hardening

Layer / File(s)	Summary
GitHub Actions Workflow Permissions .github/workflows/cd-firebase-mainnet.yml, .github/workflows/cd-firebase-testnet.yml, .github/workflows/ci-functions.yml, .github/workflows/ci-react.yml	Four GitHub Actions workflows now declare explicit top-level permissions blocks limiting repository access to read-only (contents: read) for security hardening.
UUID Dependency Version Overrides package.json, functions/package.json	Root package.json pins UUID to version 14.0.0, and functions/package.json pins UUID to version 11.1.1, both via dependency override configuration.

---

🎯 1 (Trivial) | ⏱️ ~3 minutes

---

🐰 These workflows now lock their GitHub token tight,
With read-only permissions, a security delight,
And UUIDs are pinned without any fuss,
Configuration hardened just for us! ✨

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and specifically describes the main changes: security fixes addressing code scanning and Dependabot alerts through workflow permission additions and uuid version overrides.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/security-alerts-permissions-uuid

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[Copilot]

Pull request overview

This PR addresses GitHub security findings by (1) tightening GitHub Actions workflow token permissions to least-privilege and (2) remediating uuid vulnerability alerts via npm overrides in both the root app and functions/.

Changes:

• Add top-level permissions: contents: read to 4 workflows flagged by code scanning.
• Add npm overrides to force patched uuid versions (root: 14.0.0, functions: 11.1.1).
• Regenerate/update both package-lock.json files to reflect the overridden dependency trees.

Reviewed changes

Copilot reviewed 6 out of 8 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
package.json	Adds a root overrides entry to force uuid@14.0.0.
package-lock.json	Updates root lockfile to remove vulnerable uuid resolutions and use uuid@14.0.0.
functions/package.json	Extends existing overrides to pin uuid@11.1.1 in Functions workspace.
functions/package-lock.json	Updates Functions lockfile to remove vulnerable uuid resolutions and use uuid@11.1.1.
.github/workflows/ci-react.yml	Sets minimal workflow token permissions (contents: read).
.github/workflows/ci-functions.yml	Sets minimal workflow token permissions (contents: read).
.github/workflows/cd-firebase-testnet.yml	Sets minimal workflow token permissions (contents: read).
.github/workflows/cd-firebase-mainnet.yml	Sets minimal workflow token permissions (contents: read).

Files not reviewed (1)

• functions/package-lock.json: Language not supported

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.