Skip to content

fix: skip auto-fix when HEAD is not the commit that triggered the workflow #529

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
2bndy5 merged 1 commit into from
Nov 13, 2026
Merged

fix: skip auto-fix when HEAD is not the commit that triggered the workflow #529

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
18 changes: 16 additions & 2 deletions action.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -232,6 +232,11 @@ inputs:
committed on it would carry that merge into the branch. Pull requests from
forks are skipped.

On other events the fix is committed only when the checked out commit is
the one that triggered the workflow (`GITHUB_SHA`). If the workflow checked
out another commit, for example a pull request's head on an
`issue_comment` event, auto-fix is skipped with a warning.

This option has no effect on clang-tidy issues.
default: 'false'
required: false
Expand Down Expand Up @@ -717,14 +722,23 @@ runs:
exit 0
}

# Only commit on the pull request head (see the checkout step above).
# Only commit on the commit that the destination branch points at: the
# pull request head (see the checkout step above), or else the commit
# that triggered the workflow. Events without a pull request
# (issue_comment, workflow_run, schedule, ...) run for the default
# branch. If the workflow checked out something else there, such as a
# pull request's head, the push below would put those commits on the
# default branch.
cd $env.INPUT_REPO_ROOT # where the repository is checked out
let current = (^git rev-parse HEAD | str trim)
if ($head_sha | is-not-empty) {
let current = (^git rev-parse HEAD | str trim)
if $current != $head_sha {
print $"::warning title=Auto-fix skipped::HEAD is ($current), not the pull request head ($head_sha), so no formatting commit was made. auto-fix runs on `push` and `pull_request` events; see https://cpp-linter.github.io/cpp-linter-action/permissions/#auto-fix"
exit 0
}
} else if $current != $env.GITHUB_SHA {
print $"::warning title=Auto-fix skipped::HEAD is ($current), not ($env.GITHUB_SHA), the commit that triggered this workflow, so no formatting commit was made. Pushing it would add the checked out commits to ($branch). auto-fix runs on `push` and `pull_request` events; see https://cpp-linter.github.io/cpp-linter-action/permissions/#auto-fix"
exit 0
}

# Stage only source files (the configured extensions), so anything else an
Expand Down
8 changes: 8 additions & 0 deletions docs/permissions.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -144,6 +144,14 @@ in addition to any other permissions needed for other features:
`pull_request_target` as well, where the token could push, but only to this
repository.

On events that carry no pull request (`issue_comment`, `workflow_run`,
`schedule`, `workflow_dispatch`), the fix is pushed to the branch the
workflow runs for, which is usually the default branch. So it is only
committed when the checked out commit is the one that triggered the
workflow (`GITHUB_SHA`). If the workflow checked out another commit, for
example a pull request's head, auto-fix is skipped with a warning.
Otherwise that pull request's commits would land on the default branch.

## GitHub App token

A token minted from a GitHub App you own replaces the default `GITHUB_TOKEN`
Expand Down
Loading