Skip to content

ci: auto-format and commit on same-repo PRs - #2641

Open
davidberenstein1957 wants to merge 8 commits into
mainfrom
ci/auto-format-pr-commits
Open

ci: auto-format and commit on same-repo PRs#2641
davidberenstein1957 wants to merge 8 commits into
mainfrom
ci/auto-format-pr-commits

Conversation

@davidberenstein1957

Copy link
Copy Markdown
Member

Summary

  • On same-repo PRs, the lint job runs make format and, if anything changed, commits style: auto-format and pushes to the PR branch.
  • Fork PRs, pushes to main, and workflow_dispatch stay check-only (make check) with no auto-commit.
  • After a format push, downstream test jobs are skipped on that run; the new CI run from the format commit runs the full suite.

Test plan

  • Open a same-repo PR with intentionally unformatted Python and confirm CI pushes a style: auto-format commit, then a follow-up run passes make check.
  • Open (or use) a same-repo PR that is already formatted and confirm no extra commit; make check runs as today.
  • Confirm fork PRs still fail on format drift without attempting a push (check-only path).
  • Confirm zizmor / Actions security analysis is clean with contents: write on lint.

Fork PRs and main keep check-only; same-repo PRs run make format and
push a style commit when needed so contributors are not blocked on ruff.
@davidberenstein1957
davidberenstein1957 requested a review from a team as a code owner July 29, 2026 13:32
Comment thread .github/workflows/ci.yml Fixed
Comment thread .github/workflows/ci.yml Fixed
Inline the contents:write rationale, keep persist-credentials false on
checkout, and inject the token only for push (same pattern as release.yml).
Also stage only *.py so format commits stay limited to ruff output.
GITHUB_TOKEN pushes leave the new pull_request run in action_required
and never auto-execute, so skipping check/tests after a format push left
a hollow green lint job. Match release.yml: commit locally, always run
make check on the formatted tree, then push with the Release App token.

Co-authored-by: Kevin Messiaen <kevinmessiaen@users.noreply.github.com>
Comment thread .github/workflows/ci.yml Fixed
kevinmessiaen and others added 2 commits August 3, 2026 12:11
Limit create-github-app-token to this repository and contents:write
so the format push does not inherit blanket installation permissions.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Development

Successfully merging this pull request may close these issues.

4 participants