feat: 確認済み公開者による age 例外を追加

[owayo]

公開後の待機期間を維持しながら、指定した GitHub の身元が確認できる版だけを age フィルターから除外できるようにします。グローバル設定の [age_exempt].github で指定でき、本体に特定のアカウント名を埋め込みません。

• crates.io の版ごとの確認済み公開者と Trusted Publishing、Go・Swift の GitHub 取得元を照合します。自己申告の repository URL や他レジストリの同名アカウントは根拠にしません。Swift は現状公開日情報がなく、age はもともと実質適用されません。
• 候補選択、Tauri 同期、インストール後の Cargo.lock 監査で同じ判定を使い、推移依存や差し戻し先にも適用します。
• OSV、ピン留め、範囲、プレリリース、変更レベルの制限は維持します。プロジェクトの明示的な最小公開期間を優先し、不正な例外設定が他の設定を無効化しないようにします。
• 例外を使った更新はテキスト・JSON に判定根拠を表示します。未対応のレジストリは通常の age 制限を維持します。

検証: make ci（単体 2,354 件・結合 75 件・E2E 25 件）、実 Cargo を使うオフライン監査、実 crates.io に対する設定有無のドライラン、インストール済みバイナリの動作確認、Claude レビュー LGTM。

Summary by CodeRabbit

• New Features
  • Configure global release-age exemptions for releases from verified GitHub publishers. Eligible Rust, Go, and Swift releases may pass the age filter, with exemption details shown in text and JSON results.
  • Project-specific minimum release-age settings take precedence over global exemptions.
• Documentation
  • Added configuration guidance covering supported publisher verification, exemption limits, and handling of invalid settings.
• Bug Fixes
  • Invalid exemption settings no longer prevent other global settings from being applied.

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: 9f11642d-0d84-4e72-ad36-ec24d0915298

📥 Commits

Reviewing files that changed from the base of the PR and between 002837d and 0b0b0d9.

📒 Files selected for processing (16)

• AGENTS.md
• README.ja.md
• README.md
• docs/configuration.ja.md
• docs/configuration.md
• src/domain/update_result.rs
• src/global_config.rs
• src/orchestrator.rs
• src/output/json.rs
• src/output/text.rs
• src/registry/crates_io.rs
• src/test_support/fake_crates_io.rs
• src/update/age_policy.rs
• src/update/filter.rs
• src/update/mod.rs
• src/update/version_info.rs

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

The change adds global exemptions for configured GitHub identities with supported verified publisher evidence. It applies the age policy during candidate selection, Tauri synchronization, and Rust lockfile audits. Update results can include exemption evidence in text and JSON output.

Changes

Publisher Age Exemptions

Layer / File(s)	Summary
Publisher evidence and matching policy src/update/age_policy.rs, src/update/version_info.rs, src/registry/crates_io.rs, src/test_support/fake_crates_io.rs	Version records can carry verified publisher evidence. The age policy validates GitHub logins and matches supported Rust, Go, and Swift identities.
Configuration and candidate selection src/global_config.rs, src/update/filter.rs, src/update/mod.rs	Global configuration accepts and validates age exemptions. Candidate selection applies the policy and attaches matching exemption evidence to qualifying update results.
Tauri synchronization and Rust age audits src/orchestrator.rs	Tauri version filtering and Rust lockfile auditing use exemption-aware age checks. Rollback selection and synchronization adjustments use the resolved policy.
Exemption results and documentation src/domain/update_result.rs, src/output/*.rs, docs/configuration*.md, README*.md, AGENTS.md	Update results carry optional exemption details for text and JSON output. Documentation describes the configuration, supported evidence, enforcement points, and output.

Priority: ➖ Normal

Estimated code review effort: 4 (Complex) | ~45 minutes

Change: Feature

Sequence Diagram(s)

sequenceDiagram
  participant CratesIoRegistry
  participant VersionInfo
  participant GlobalConfig
  participant Orchestrator
  participant UpdateJudge
  participant UpdateResult
  CratesIoRegistry->>VersionInfo: Attach publisher evidence to parsed versions
  GlobalConfig->>Orchestrator: Provide age_exempt settings
  Orchestrator->>UpdateJudge: Pass UpdateFilter with exemptions
  UpdateJudge->>UpdateResult: Attach matching exemption evidence to selected update

Loading

Merge Risk: ⚪ Minimal · up to 0b0b0

The rollback helpers apply the current publisher-exemption policy correctly. No actionable blocker remains; merge after normal checks.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: adding age exemptions for verified publishers.
Docstring Coverage	✅ Passed	Docstring coverage is 80.36% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 56 functions across 11 files. (5 skipped: 5…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Autopilot is currently an internal CodeRabbit preview.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}