@ryusenkei/conventions 0.2.1 → 0.3.1

package/README.md

@@ -59,7 +59,7 @@ The PreToolUse hook blocks the call and tells Claude why, so Claude can fix it a
 | Secrets | `permissions.deny` blocks reading `.env` and `.dev.vars` with Claude's file tools (not Bash) |
 | Definition of done (`--stop`) | The Stop hook runs `pnpm lint` and `pnpm test` when the working tree has changes, and sends Claude back once on failure |
 
-Commit messages are checked by `.githooks/commit-msg`, and edited files by prose-lint's PostToolUse hook. `.githooks/pre-push` runs `pnpm run --if-present check`, so a repository that defines a `check` script cannot push until it passes. It applies to people as well as Claude.
+Commit messages are checked by `.githooks/commit-msg`, and edited files by prose-lint's PostToolUse hook. `.githooks/pre-push` runs `pnpm run --if-present check`, so a repository that defines a `check` script cannot push until it passes. It applies to people as well as Claude. When [jobgate](https://github.com/ryusenkei-inc/jobgate) is on the `PATH` and the repository has a `check` script, the check runs through `jobgate run`, so pushes from parallel agents and repositories wait for free memory instead of exhausting it.
 
 ### Epic flow
 
@@ -82,6 +82,7 @@ Opt in per repository in the root `package.json`:
 `sync` writes these files and `check` compares them, ignoring line endings:
 
 - `.editorconfig`, `.gitattributes`, `.gitignore`, `.gitleaks.toml`, `mise.toml`, `.github/dependabot.yaml`, `.githooks/commit-msg`, `.githooks/pre-push`
+- `.github/dependabot.yaml` updates npm and GitHub Actions. When the repository has a `go.mod` at the root, a `gomod` entry is appended (same schedule, rebase strategy and cooldown, minor and patch grouped). Without one it is left out, because Dependabot fails on a missing `go.mod`
 - `.claude/settings.json`: only the hooks, `attribution`, and `permissions.deny` are managed. Other settings and hooks are kept
 - `pnpm-workspace.yaml`: `minimumReleaseAge` and `minimumReleaseAgeExclude`, matching the Dependabot `cooldown`
 

package/dist/files.js

@@ -1,6 +1,7 @@
 // 利用側のリポにある共通ファイルの同期・検査
 // - マスタ: パッケージの `files/`（npm は `.gitignore` を同梱しない → 先頭の `.` を除いた名前で格納）
 // - 比較は改行コードを LF に正規化（Windows の作業ツリーは CRLF になりうる）
+// - `append`: 条件のファイルがあるリポのみ末尾に追加（例: go.mod のないリポで gomod の更新はエラー）
 import { chmodSync, existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
 import { dirname, join } from 'node:path';
 import { hasStop, managedSettings } from "./settings.js";
@@ -10,7 +11,7 @@ const FILES = [
     { from: 'gitignore', to: '.gitignore' },
     { from: 'gitleaks.toml', to: '.gitleaks.toml' },
     { from: 'mise.toml', to: 'mise.toml' },
-    { from: 'dependabot.yaml', to: '.github/dependabot.yaml' },
+    { from: 'dependabot.yaml', to: '.github/dependabot.yaml', append: { from: 'dependabot-gomod.yaml', if: 'go.mod' } },
     { from: 'commit-msg', to: '.githooks/commit-msg', mode: 0o755 },
     { from: 'pre-push', to: '.githooks/pre-push', mode: 0o755 },
 ];
@@ -27,11 +28,12 @@ const RELEASE_AGE = [
 ];
 const lf = (s) => s.replaceAll('\r\n', '\n');
 const read = (path) => (existsSync(path) ? lf(readFileSync(path, 'utf8')) : undefined);
+const master = (name) => lf(readFileSync(new URL(`../files/${name}`, import.meta.url), 'utf8'));
 /** マスタとの差分 */
 export function drifts(root, options = {}) {
     const out = [];
     for (const f of FILES) {
-        const expected = lf(readFileSync(new URL(`../files/${f.from}`, import.meta.url), 'utf8'));
+        const expected = master(f.from) + (f.append && existsSync(join(root, f.append.if)) ? master(f.append.from) : '');
         if (read(join(root, f.to)) !== expected)
             out.push({ path: f.to, expected, message: 'マスタと不一致' });
     }

package/files/dependabot-gomod.yaml

@@ -0,0 +1,19 @@
+
+  # Go のモジュール（ルートに go.mod があるリポのみ `sync` が追加）
+  - package-ecosystem: gomod
+    directory: "/"
+    # 頻度・rebase・公開直後のバージョンの回避は npm と同じ
+    schedule:
+      interval: monthly
+    rebase-strategy: disabled
+    cooldown:
+      default-days: 2
+    commit-message:
+      prefix: build
+      include: scope
+    groups:
+      # minor・patch は1つの PR にまとめる（Go の major はモジュールのパスが変わるため Dependabot の対象外）
+      minor-and-patch:
+        update-types:
+          - minor
+          - patch

package/files/pre-push

@@ -1,3 +1,8 @@
 #!/bin/sh
 # push の前の検査（`check` のスクリプトを持つリポのみ。CI の失敗・Actions の消費を手元で防止）
+# jobgate があれば資源の空きを待って実行（並行するエージェント・リポの重い検査によるメモリの枯渇を防止）
+#   `check` のないリポは枠を待たない
+if command -v jobgate >/dev/null 2>&1 && grep -q '"check":' package.json 2>/dev/null; then
+  exec jobgate run --weight 2 -- pnpm run check
+fi
 exec pnpm run --if-present check

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ryusenkei/conventions",
-  "version": "0.2.1",
+  "version": "0.3.1",
   "description": "RYUSENKEI のモノリポの共通の規約（Claude Code の規約・hook、共通ファイルの同期）",
   "license": "MIT",
   "author": "RYUSENKEI",