Repository navigation
autofix.ci #21358
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: autofix.ci | |
| on: | |
| pull_request: | |
| push: | |
| branches: | |
| - main | |
| - next | |
| merge_group: | |
| branches: | |
| - main | |
| - next | |
| # Read-only: autofix.ci pushes the fix commit server-side via its GitHub App, | |
| # so the workflow itself never needs write access or a secret. This is what makes | |
| # running a formatter over untrusted fork code safe. | |
| permissions: | |
| contents: read | |
| concurrency: | |
| group: lint-${{ github.event.pull_request.number || github.run_id }} | |
| cancel-in-progress: true | |
| jobs: | |
| lint: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v7 | |
| with: | |
| clean: 'false' | |
| fetch-depth: '0' | |
| - name: 🛠️ Setup mise | |
| uses: jdx/mise-action@v5 | |
| with: | |
| install: true | |
| cache: true | |
| # Restore only: build.yml is the single cache writer, so the saved cache always includes the npm cache. | |
| cache_save: false | |
| cache_key_prefix: mise-v2 | |
| experimental: true | |
| github_token: ${{ secrets.GITHUB_TOKEN }} | |
| # merge_group: hard gate only — no autofix in the merge queue. | |
| - name: 🧹 Lint (hk check) — merge_group | |
| if: github.event_name == 'merge_group' | |
| run: | | |
| hk check --from-ref "$DEFAULT_BRANCH" --to-ref "$HEAD" | |
| env: | |
| DEFAULT_BRANCH: ${{ github.event.merge_group.base_sha }} | |
| HEAD: ${{ github.event.merge_group.head_sha }} | |
| # pull_request (same-repo AND fork): apply fixes into the working tree. | |
| # autofix.ci uploads the diff and commits it back to the PR (incl. forks). | |
| - name: 🧹 Lint (hk fix) | |
| if: github.event_name == 'pull_request' | |
| run: | | |
| hk fix --from-ref "$DEFAULT_BRANCH" --to-ref "$HEAD" | |
| env: | |
| DEFAULT_BRANCH: ${{ github.event.pull_request.base.sha }} | |
| HEAD: ${{ github.event.pull_request.head.sha }} | |
| # Must be the LAST step: pushes the working-tree changes back as a | |
| # verified commit (and fails the check when a fix was needed). | |
| - name: ✍️ Apply fixes (autofix.ci) | |
| if: github.event_name == 'pull_request' | |
| uses: autofix-ci/action@v1.3.4 | |
| with: | |
| commit-message: Automatically linting code |