supabase/.github/workflows/autofix_linters.yml

name: Autofix Linting Checks

on:
  pull_request:
    types:
      - labeled

permissions:
  contents: read

# Cancel old builds on new commit for same workflow + branch/PR
concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: true

jobs:
  format:
    name: Format PR without write credentials
    runs-on: blacksmith-2vcpu-ubuntu-2404
    if: ${{ github.event_name == 'pull_request' && (github.event.label.name == 'autofix') }}
    outputs:
      changed: ${{ steps.create-patch.outputs.changed }}

    steps:
      - name: Calculate number of commits
        run: echo "PR_FETCH_DEPTH=$(( ${{ github.event.pull_request.commits }} + 1 ))" >> "${GITHUB_ENV}"

      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
        with:
          repository: ${{ github.event.pull_request.head.repo.full_name }}
          ref: ${{ github.event.pull_request.head.sha }}
          persist-credentials: false
          fetch-depth: ${{ env.PR_FETCH_DEPTH }}
          sparse-checkout: |
            packages
            apps
            patches

      - uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061 # v4.2.0
        name: Install pnpm

      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
        with:
          node-version-file: '.nvmrc'
          cache: pnpm

      - name: Install required dependencies
        run: pnpm install --frozen-lockfile

      - name: Run Prettier in fix mode
        run: pnpm run format

      - name: Create autofix patch
        id: create-patch
        run: |
          if git diff --quiet; then
            echo "changed=false" >> "$GITHUB_OUTPUT"
            exit 0
          fi

          echo "changed=true" >> "$GITHUB_OUTPUT"
          git diff --binary > autofix.patch

      - name: Upload autofix patch
        if: steps.create-patch.outputs.changed == 'true'
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
        with:
          name: autofix-linters-patch
          path: autofix.patch
          retention-days: 1

  push:
    name: Commit autofix updates
    needs: format
    runs-on: blacksmith-2vcpu-ubuntu-2404
    if: >-
      ${{
        needs.format.outputs.changed == 'true' &&
        github.event.pull_request.head.repo.full_name == github.repository
      }}
    steps:
      - name: Generate token
        id: app-token
        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
        with:
          client-id: ${{ vars.GH_AUTOFIX_APP_CLIENT_ID }}
          private-key: ${{ secrets.GH_AUTOFIX_PRIVATE_KEY }}
          permission-contents: write

      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
        with:
          ref: ${{ github.event.pull_request.head.sha }}
          persist-credentials: false
          sparse-checkout: |
            packages
            apps
            patches

      - name: Download autofix patch
        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
        with:
          name: autofix-linters-patch

      - name: Commit changes and push to existing branch
        env:
          APP_TOKEN: ${{ steps.app-token.outputs.token }}
          TARGET_BRANCH: ${{ github.head_ref }}
        run: |
          git apply --index autofix.patch

          if git diff --cached --quiet; then
            exit 0
          fi

          git config --local user.name "supabase-autofix-bot"
          git config --local user.email "noreply@supabase.com"
          git commit -m "ci: Autofix updates from GitHub workflow"
          git -c credential.helper= push "https://x-access-token:${APP_TOKEN}@github.com/${GITHUB_REPOSITORY}.git" "HEAD:${TARGET_BRANCH}"