Files
supabase/.github
Stephen Morgan 1e28e6ac01 fix: run format step in separate low-privilege job (#46090)
Out of an abundance of caution, running the format step in a strictly
read-only context.
Added explicit validations on pushes instead of relying on an implicit
lack of pull_request_target

Resolves PRODSEC-118

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Chores**
* Reworked automated autofix workflow into a two-step format-and-apply
flow, reduced top-level permissions, and moved from an auto-commit
action to a manual apply/commit/push process for more controlled
automated fixes.
  * No user-facing features or functionality changed.

<!-- review_stack_entry_start -->

[![Review Change
Stack](https://storage.googleapis.com/coderabbit_public_assets/review-stack-in-coderabbit-ui.svg)](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/46090?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)

<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
2026-05-19 17:54:12 +12:00
..
2020-04-29 21:09:54 +08:00