[ootakazuhiko]

Summary

Closes #253

active Book QA の itdojp/book-formatter immutable ref を、監査済みの cff9fcf8bae31140f07b358d314fc64173cb7013（fix(deps): update js-yaml security patches (#117)）へ更新します。

Scope

最終的な origin/main...HEAD の committed diff は .github/workflows/book-qa.yml の checkout ref 一行だけです。

• old: 69eb5c12f5a750b65614bc9bbbc3d7abd5aa6f6c
• new: cff9fcf8bae31140f07b358d314fc64173cb7013

本文、consumer dependency/lockfile、build contract、Pages設定、workflow behaviorは変更していません。先行dependency PR #255の通常squash mergeを、このbranchへ通常merge commitで取り込みました（rebase / force pushなし）。

Exact head

• 1c4b0c0efdd4cc60cdbb251e78970b7173290d3d

Verification

• consumer dependency remediation: PR deps: consumer の high severity npm audit を解消 #255、merge 66b8d84ca7ad47dc7b4a78852a80f5c28945a29a
• root npm ci --ignore-scripts: success
• root npm audit --audit-level=high: 0 vulnerabilities
• npm run test:light: success
  • install-script policy: 21 surfaces / 63 negative mutations
  • Puppeteer 25 consumer contract
  • Chapter 8 / 13 / Issue feat: 独立チェックリスト集と図表索引を追加する #240 contracts
  • markdownlint
  • Jekyll build
• target formatter exact checkout: npm ci --ignore-scripts / high audit 0
• target formatter static QA: Unicode 0、Textlint 0、links 133 valid、layout-risk errors 0（既存warning 2）、Markdown structure 0
• git diff --check: success
• final diff: formatter pin 一行のみ

CI / review gate

• Book QA: run 32721370213（exact head; completion待ち）
• Docs Forbidden: run 32721370241（success）
• PRはCI成功、review completeness 0/0/0、exact-head Codex/Copilot review完了後にReady化します。

[ootakazuhiko]

@codex review

[Copilot]

Pull request overview

Book QA ワークフローが参照する itdojp/book-formatter の immutable ref（commit SHA）を、監査済みの cff9fcf8bae31140f07b358d314fc64173cb7013 へ更新し、formatter 側の依存関係セキュリティパッチ（js-yaml）を取り込むための変更です。Issue #253 の受入基準どおり、差分は checkout の ref 1 行のみになっています。

Changes:

• .github/workflows/book-qa.yml の itdojp/book-formatter checkout ref を 69eb5c1... → cff9fcf... に更新

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Keep it up!

Reviewed commit: 1c4b0c0efd

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".