From 95a4e9ad74b4e4044122e2ba31aa8c0333d1212d Mon Sep 17 00:00:00 2001
From: Xianpeng Shen <3353385+shenxianpeng@users.noreply.github.com>
Date: Fri, 13 Nov 2026 06:02:13 +0000
Subject: [PATCH] fix: skip auto-fix when HEAD is not the commit that triggered
 the workflow

On events without a pull request (issue_comment, workflow_run, schedule,
workflow_dispatch) the auto-fix commit is pushed to GITHUB_REF_NAME, which
is usually the default branch. If the workflow checked out another commit
there, such as a pull request's head, the push put that commit and its
ancestors on the default branch along with the formatting commit.

Only commit when HEAD is GITHUB_SHA on those events, and skip with a
warning otherwise.
---
 action.yml          | 18 ++++++++++++++++--
 docs/permissions.md |  8 ++++++++
 2 files changed, 24 insertions(+), 2 deletions(-)

diff --git a/action.yml b/action.yml
index 152c745f..84b4b533 100644
--- a/action.yml
+++ b/action.yml
@@ -228,6 +228,11 @@ inputs:
       committed on it would carry that merge into the branch. Pull requests from
       forks are skipped.
 
+      On other events the fix is committed only when the checked out commit is
+      the one that triggered the workflow (`GITHUB_SHA`). If the workflow checked
+      out another commit, for example a pull request's head on an
+      `issue_comment` event, auto-fix is skipped with a warning.
+
       This option has no effect on clang-tidy issues.
     default: 'false'
     required: false
@@ -592,14 +597,23 @@ runs:
           exit 0
         }
 
-        # Only commit on the pull request head (see the checkout step above).
+        # Only commit on the commit that the destination branch points at: the
+        # pull request head (see the checkout step above), or else the commit
+        # that triggered the workflow. Events without a pull request
+        # (issue_comment, workflow_run, schedule, ...) run for the default
+        # branch. If the workflow checked out something else there, such as a
+        # pull request's head, the push below would put those commits on the
+        # default branch.
         cd $env.INPUT_REPO_ROOT  # where the repository is checked out
+        let current = (^git rev-parse HEAD | str trim)
         if ($head_sha | is-not-empty) {
-          let current = (^git rev-parse HEAD | str trim)
           if $current != $head_sha {
             print $"::warning title=Auto-fix skipped::HEAD is ($current), not the pull request head ($head_sha), so no formatting commit was made. auto-fix runs on `push` and `pull_request` events; see https://cpp-linter.github.io/cpp-linter-action/permissions/#auto-fix"
             exit 0
           }
+        } else if $current != $env.GITHUB_SHA {
+          print $"::warning title=Auto-fix skipped::HEAD is ($current), not ($env.GITHUB_SHA), the commit that triggered this workflow, so no formatting commit was made. Pushing it would add the checked out commits to ($branch). auto-fix runs on `push` and `pull_request` events; see https://cpp-linter.github.io/cpp-linter-action/permissions/#auto-fix"
+          exit 0
         }
 
         # Stage only source files (the configured extensions), so anything else an
diff --git a/docs/permissions.md b/docs/permissions.md
index 8e8e9acc..9fe5d073 100644
--- a/docs/permissions.md
+++ b/docs/permissions.md
@@ -144,6 +144,14 @@ in addition to any other permissions needed for other features:
     `pull_request_target` as well, where the token could push, but only to this
     repository.
 
+    On events that carry no pull request (`issue_comment`, `workflow_run`,
+    `schedule`, `workflow_dispatch`), the fix is pushed to the branch the
+    workflow runs for, which is usually the default branch. So it is only
+    committed when the checked out commit is the one that triggered the
+    workflow (`GITHUB_SHA`). If the workflow checked out another commit, for
+    example a pull request's head, auto-fix is skipped with a warning.
+    Otherwise that pull request's commits would land on the default branch.
+
 ## GitHub App token
 
 A token minted from a GitHub App you own replaces the default `GITHUB_TOKEN`