chore: 依存の更新と scoria の導入 (2026-10-18)

.github/workflows/pull_request.yaml

@@ -1,5 +1,5 @@
 # This workflow runs lint / typecheck / build / test across
-# Linux + Windows + macOS on Node 22.x and 24.x.
+# Linux + Windows + macOS on Node 24.x and 26.x (engines: node >=24).
 # Reference: ../mulmoclaude/.github/workflows/pull_request.yaml
 
 name: Node.js CI
@@ -22,10 +22,12 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        node-version: [22.x, 24.x]
+        node-version: [24.x, 26.x]
         os: [ubuntu-latest, windows-latest, macos-latest]
     steps:
     - uses: actions/checkout@v7
+      with:
+        persist-credentials: false
     - name: Use Node.js ${{ matrix.node-version }}
       uses: actions/setup-node@v6
       with:

.github/workflows/scoria.yml

@@ -0,0 +1,22 @@
+name: scoria
+
+on:
+  pull_request:
+  push:
+    branches:
+      - main
+
+permissions:
+  contents: read
+
+jobs:
+  # Measures with scoria, uploads the findings to code scanning and publishes the README badge.
+  # The project's code runs only in the workflow's read-only job; see the workflow for how the
+  # write permissions below are split between its upload and badge jobs.
+  scoria:
+    uses: isamu/lab/.github/workflows/scoria-measure.yml@776e7bf844fbf93545fec617d177e64e58a49a7b
+    permissions:
+      contents: write
+      security-events: write
+    with:
+      scoria: yarn run quality