github-settings-as-code/.github/workflows/auto-format.yml at main · Vivswan/github-settings-as-code · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
# Repo-owned auto-format: label a pull request `fix-lint` (the label ships
# with the template's settings.yml) and this workflow pushes a formatting
# commit to the PR branch, then removes the label. Generated once by
# the fleet sync and never overwritten by a later
# sync: adjust the format commands to this repository's tooling.
#
# Formatting runs PR-controlled code (the locked biome, the lint:fix script), so it happens in a job without a write
# token and crosses to the push job as a git patch; applying a patch executes nothing, as in auto-fix.yml.

name: Auto Format

on:
  pull_request:
    types: [labeled]

permissions:
  contents: read

# One run per PR at a time: the label removed and re-applied while a run is pushing would start a second run against
# the same branch, and two formatting pushes race. The later run queues and formats the pushed head instead.
concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number }}
  cancel-in-progress: false

jobs:
  format:
    # Same-repo PRs only: GITHUB_TOKEN cannot push to a fork's branch.
    if: github.event.label.name == 'fix-lint' && github.event.pull_request.head.repo.full_name == github.repository
    runs-on: ubuntu-latest
    timeout-minutes: 15
    outputs:
      changed: ${{ steps.format.outputs.changed }}
      head: ${{ steps.format.outputs.head }}
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          ref: ${{ github.event.pull_request.head.ref }}
          persist-credentials: false
      # The install puts the locked biome in node_modules, so the format runs the gate's biome, not the newest one.
      - uses: ./.github/actions/setup
      - name: Format (biome) and stage the patch
        id: format
        run: bun .github/scripts/auto-format-steps.ts format
      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        if: steps.format.outputs.changed == 'true'
        with:
          name: format-patch
          path: ${{ runner.temp }}/format.patch
          if-no-files-found: error

  # Runs whenever the format job ran, so the label comes off even after a failed format: the label is a one-shot
  # request, and a broken run must not loop.
  push:
    needs: format
    if: always() && needs.format.result != 'skipped'
    runs-on: ubuntu-latest
    timeout-minutes: 10
    permissions:
      contents: write
      pull-requests: write
    steps:
      # The script that holds the write token comes from the default branch, so nothing checked out from the PR
      # branch is executed here; that branch is checked out beside it, as the tree the patch applies to.
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        if: needs.format.outputs.changed == 'true'
        with:
          ref: ${{ github.event.repository.default_branch }}
          path: trusted
          persist-credentials: false
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        if: needs.format.outputs.changed == 'true'
        with:
          ref: ${{ github.event.pull_request.head.ref }}
          path: branch
          persist-credentials: false
      # The patch lands OUTSIDE both checkouts so nothing in a work tree can shadow or stage it.
      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
        if: needs.format.outputs.changed == 'true'
        with:
          name: format-patch
          path: ${{ runner.temp }}/format
      # bun alone, no install: no git hook or lifecycle script exists where the write token is. It starts in the
      # trusted checkout, so the bunfig.toml and .env it reads at startup are main's, never the PR branch's.
      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
        if: needs.format.outputs.changed == 'true'
        with:
          bun-version-file: trusted/.bun-version
      - name: Commit and push the formatting
        if: needs.format.outputs.changed == 'true'
        env:
          GH_TOKEN: ${{ github.token }}
          HEAD_REF: ${{ github.event.pull_request.head.ref }}
          HEAD_SHA: ${{ needs.format.outputs.head }}
          PR_CHECKOUT: ${{ github.workspace }}/branch
        working-directory: trusted
        run: bun .github/scripts/auto-format-steps.ts push
      - name: Remove the fix-lint label
        if: always()
        env:
          GH_TOKEN: ${{ github.token }}
          PR_URL: ${{ github.event.pull_request.html_url }}
        run: gh pr edit "$PR_URL" --remove-label fix-lint