hermes-agent/.github/workflows/js-autofix.yml

name: auto-fix lint issues & formatting

# On push to main (or manual trigger), run `npm run fix` on each workspace
# package and commit any changes.

# Fixable lint issues (import sorting, unused imports, curly braces, etc.) are
# auto-corrected on merge so PRs aren't blocked by them. The PR-time eslint
# check in typecheck.yml fails only when un-fixable errors remain.
#
# Pushes made by GITHUB_TOKEN don't trigger further workflow runs, so there's
# no infinite loop.
#
# ── Security model: two-job split ───────────────────────────────────────────
#
# The eslint process executes repo code (eslint.config.mjs, package.json
# scripts, installed plugins). To prevent a malicious PR from getting arbitrary
# code execution on a runner with push access, the work is split:
#
#   1. generate-patch (unprivileged, contents: read only)
#      Checks out, installs deps, runs eslint --fix, produces a .patch artifact.
#      Worst case: malicious code runs here on an ephemeral runner with zero
#      push permissions.
#
#   2. apply-patch (privileged, contents: write)
#      Checks out, downloads the patch artifact, applies it,
#      then pushes with --force-with-lease. This job never runs npm, never
#      installs anything, never executes any repo code. The only input it
#      trusts is the patch artifact.

on:
  push:
    branches: [main]
    paths:
      - '**/*.js'
      - '**/*.cjs'
      - '**/*.mjs'
      - '**/*.ts'
      - '**/*.tsx'
      - 'package.json'
      - 'package-lock.json'
  workflow_dispatch:

permissions:
  contents: read # default; apply-patch job overrides to write

concurrency:
  group: ts-autofix-${{ github.ref }}
  cancel-in-progress: true

jobs:
  generate-patch:
    name: Generate eslint --fix patch
    runs-on: ubuntu-latest
    timeout-minutes: 5
    # No permissions override → inherits workflow-level contents: read.
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
        with:
          node-version: 22
          cache: npm

      # --ignore-scripts: eslint only needs TS sources + eslint packages.
      - uses: ./.github/actions/retry
        with:
          command: npm ci --ignore-scripts

      - name: npm run fix in all workspaces
        # continue-on-error: if un-fixable errors exist on main, we still want
        # to commit whatever fixes were applied. The PR-time check in
        # typecheck.yml is what blocks un-fixable errors from landing.
        continue-on-error: true
        run: npm run fix

      - name: Produce patch
        run: |
          if git diff --quiet; then
            echo "No fixes needed."
            # Empty patch signals "nothing to do" to apply-patch.
            : > js-fix.patch
          else
            git diff > js-fix.patch
            echo "Patch size: $(wc -c < js-fix.patch) bytes"

            # Reject patches that touch anything outside JS/TS/JSON sources.
            # `npm run fix` should only ever modify those; anything else means
            # eslint/prettier or a plugin went rogue and we refuse to ship it.
            BAD=$(git diff --name-only | grep -vE '\.(js|cjs|mjs|ts|tsx|json)$' || true)
            if [ -n "$BAD" ]; then
              echo "::error::Refusing to upload patch — touches disallowed files:"
              echo "$BAD"
              exit 1
            fi
          fi

      - name: Upload patch artifact
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
        with:
          name: js-fix-patch
          path: js-fix.patch
          retention-days: 1
          include-hidden-files: true

  apply-patch:
    name: Apply patch
    needs: generate-patch
    runs-on: ubuntu-latest
    timeout-minutes: 3
    permissions:
      contents: write # needed to push
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - name: Download patch
        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
        with:
          name: js-fix-patch
          # ${{ runner.temp }} expands in with: params (shell-style $VAR does not).
          # download-artifact's path is a *directory* — the artifact's js-fix.patch
          # file lands inside it, so $RUNNER_TEMP/js-fix.patch resolves correctly
          # in the run step below.
          path: ${{ runner.temp }}

      - name: Apply patch and push
        env:
          START_SHA: ${{ github.sha }}
          BRANCH: ${{ github.ref_name }}
        run: |
          set -euo pipefail

          # Empty patch = nothing to do.
          if [ ! -s "$RUNNER_TEMP/js-fix.patch" ]; then
            echo "Patch is empty. No fixes to apply."
            exit 0
          fi

          # Apply the patch produced by the unprivileged job.
          git apply --check "$RUNNER_TEMP/js-fix.patch" || {
            echo "::error::Patch does not apply cleanly. Branch may have moved."
            exit 1
          }
          git apply "$RUNNER_TEMP/js-fix.patch"

          git config user.name "github-actions[bot]"
          git config user.email "github-actions[bot]@users.noreply.github.com"
          git add -A
          git commit -m "fmt(js): \`npm run fix\` on merge"

          # --force-with-lease=<ref>:<sha> makes the precondition check atomic
          # on the server side: the push only succeeds if origin/<branch> still
          # points at START_SHA when the server processes it. If the branch moved
          # since checkout (another push landed), the server rejects it and
          # the next run will re-apply on the current state.
          if git push --force-with-lease="$BRANCH":"$START_SHA" origin HEAD:"$BRANCH"; then
            echo "Pushed fixes."
          else
            echo "::error::$BRANCH moved since checkout ($START_SHA). Push rejected."
            echo "Next run will re-apply on the current state."
            exit 1
          fi