Skip to content

feat: add autofix action and reusable workflow - #1736

Open
nolag wants to merge 4 commits into
mainfrom
rtinianov_doAndCommit
Open

nolag wants to merge 4 commits into
mainfrom
rtinianov_doAndCommit

Conversation

@nolag

@nolag nolag commented Oct 30, 2026

Copy link
Copy Markdown
Contributor

Runs fixer commands on a pull request and commits any changes back to the branch as a signed commit (createCommitOnBranch), so contributors don't have to run generators and formatters locally.

Typical installation (including a one-time pre-fix) could look like this

In action here, it fixes a go file, a proto file, and ran the proto genration that was missed. The action took three minutes to run.

  • setup commands, then the Go fixers (go mod tidy, go fix, go fmt, go generate, go mod tidy) across every module in paths, then run commands, so one pass fixes everything
  • paths scopes what a job owns: which modules it fixes, which changes it commits, and which pull requests it skips, so a repo can have several autofix jobs with different rules
  • requires a GitHub App token to commit, since commits pushed with GITHUB_TOKEN don't trigger checks; fails when changes can't be pushed (forks, the default branch, merge queue) instead
  • stacks on other autofix jobs' commits, and refuses to commit again on top of an autofix commit that changed the same files

Runs fixer commands on a pull request and commits any changes back to the
branch as a signed commit (createCommitOnBranch), so contributors don't
have to run generators and formatters locally.

- setup commands, then the Go fixers (go mod tidy, go fix, go fmt,
  go generate, go mod tidy) across every module in paths, then run
  commands, so one pass fixes everything
- paths scopes what a job owns: which modules it fixes, which changes it
  commits, and which pull requests it skips, so a repo can have several
  autofix jobs with different rules
- requires a GitHub App token to commit, since commits pushed with
  GITHUB_TOKEN don't trigger checks; fails when changes can't be pushed
  (forks, the default branch, merge queue) instead
- stacks on other autofix jobs' commits, and refuses to commit again on
  top of an autofix commit that changed the same files

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@nolag
nolag requested a review from a team as a code owner October 30, 2026 17:08
@github-actions

github-actions Bot commented Oct 30, 2026 •

Copy link
Copy Markdown
Contributor

🦋 Changeset is good to go

Latest commit: c81dda0

We got this.

Not sure what this means? Click here to learn what changesets are.

Comment on lines +143 to +149
- name: Checkout
uses: actions/checkout@v7
with:
ref: ${{ github.event.pull_request.head.sha || github.sha }}
persist-credentials: false

- name: Autofix

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I asked for this to be fixed, how do I get the bot to verify?

Comment thread actions/autofix/action.yml Fixed
Comment thread actions/autofix/action.yml Fixed
Comment on lines +143 to +149
- name: Checkout
uses: actions/checkout@v7
with:
ref: ${{ github.event.pull_request.head.sha || github.sha }}
persist-credentials: false

- name: Autofix

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I asked for this to be fixed, how do I get the bot to verify?

Comment thread actions/autofix/action.yml Fixed
Comment thread actions/autofix/action.yml Fixed
Comment thread actions/autofix/scripts/commit.sh Resolved
Comment thread actions/autofix/action.yml Resolved
Comment thread actions/autofix/action.yml Resolved
Comment thread .github/workflows/reusable-autofix.yml Resolved
@nolag
nolag enabled auto-merge (squash) October 30, 2026 20:00
Address review:

- autofix runs pull request code (setup, run, go generate), so it now runs
  with read-only permissions and uploads its changes as an artifact. The
  new autofix/commit action gets the GitHub App token and pushes them,
  running nothing from the pull request and checking out nothing. It
  refuses changes outside paths, under .github, or to non-regular files.
- fail when files in paths are dirty before autofix runs
- pass action paths through GITHUB_ACTION_PATH rather than interpolating
  github.action_path into scripts
- reusable workflow: require gati-profile, drop the GATI v1 secrets
- document multi-line inputs with examples

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@nolag
nolag force-pushed the rtinianov_doAndCommit branch from 16bd413 to 563319a Compare November 2, 2026 14:08
@nolag
nolag requested a review from chainchad November 2, 2026 14:25
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants