ci: set up autofix.ci for Prettier on pull requests

[BigSimmo]

Summary

• Add .github/workflows/autofix.yml named exactly autofix.ci so the autofix.ci GitHub App can securely identify and update PRs.
• Run the repo’s existing Prettier path (npm run format via setup-node-cached) then autofix-ci/action@c5b2d67… (v1.3.4).
• Allowlist that immutable action SHA in scripts/github-action-pins.mjs and cover it in the pin unit tests.

Operator step required after merge: install the autofix.ci GitHub App on BigSimmo/Database. Until that app is installed, the workflow will run but cannot push format commits.

Verification

• npm run check:github-actions — passed
• npm run test — Test Files 451 passed (451) / Tests 4715 passed | 4 skipped (4719)
• npx prettier --check on changed files — clean
• Verification not run: full npm run verify:pr-local (no build/UI/RAG surface in this diff; pin guard + full unit suite cover the change)
• UI verification not run: no UI/routing/styling changes

Risk and rollout

• Risk: New workflow can push bot commits that reformat PR heads. Scoped to Prettier only; contents: read in-workflow; write capability comes only from the autofix.ci app after install. Bot-authored heads may still hit environment approval / required-check quirks (same class of issue as other bot pushes).
• Rollback: Delete or disable .github/workflows/autofix.yml and uninstall the autofix.ci app; revert the pin allowlist entry if unused.
• Provider or production effects: None (GitHub Actions + optional autofix.ci app only; no OpenAI/Supabase/Railway)

Notes

• Workflow uses ubuntu-24.04, pinned actions/checkout@v7.0.1, and the reviewed autofix action SHA per repository supply-chain policy (not the mutable @v7 / unannotated stub from the setup page).
• fail-fast left at the action default (true) so a pending format fix cancels sibling workflows on the unformatted SHA.

Summary by CodeRabbit

• Chores
  • Automated code formatting is now applied and verified on pull requests and main branch commits.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 0f26b0b5-d2a0-4a80-9729-c00ad9342cd9

📥 Commits

Reviewing files that changed from the base of the PR and between 86d7991 and 7e4ba14.

📒 Files selected for processing (3)

• .github/workflows/autofix.yml
• scripts/github-action-pins.mjs
• tests/github-action-pins.test.ts

---

📝 Walkthrough

Walkthrough

This PR adds a GitHub Actions workflow named autofix.ci that runs Prettier on pull requests and pushes to main, applying formatting patches automatically. It registers the pinned autofix-ci/action commit SHA in the reviewed action allowlist and adds a test to verify the pin.

Changes

Autofix Workflow and Pin Registration

Layer / File(s)	Summary
Autofix workflow definition .github/workflows/autofix.yml	Adds the autofix.ci workflow. It triggers on pull requests and pushes to main. It sets read-only content permissions, concurrency cancellation, and pinned checkout and autofix actions. It runs Node setup, Prettier formatting, and commits the resulting patch.
Action pin registration and test scripts/github-action-pins.mjs, tests/github-action-pins.test.ts	Adds the autofix-ci/action commit SHA to the reviewed action allowlist, with release annotation v1.3.4. Adds a test that confirms this pin passes validation.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Possibly related PRs

• BigSimmo/Database#452: The retrieved PR's pin-checking workflow validates the autofix-ci/action pin added in this PR.
• BigSimmo/Database#687: Both PRs extend the same GitHub Action pin allowlist and its tests.
• BigSimmo/Database#946: Both PRs modify the reviewedActionPins allowlist in scripts/github-action-pins.mjs.

Suggested labels:github_actions

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title accurately summarizes the main change: setting up autofix.ci for Prettier on pull requests, which matches the workflow addition and action pinning in the changeset.
Description check	✅ Passed	The description covers the Summary section and provides Verification results, Risk and rollout details, and Notes. Required clinical governance sections are appropriately omitted because the changes affect only GitHub Actions and build infrastructure, not clinical workflows.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

---

_{Comment @coderabbitai help to get the list of available commands.}

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, add credits to your account and enable them for code reviews in your settings.

[qodo-code-review]

PR Summary by Qodo

CI: add autofix.ci workflow to auto-commit Prettier fixes on PRs

⚙️ Configuration changes✨ Enhancement🧪 Tests🕐 10-20 Minutes

AI Description

• Add an "autofix.ci" GitHub Actions workflow to run Prettier on PRs and main.
• Apply formatting patches via the autofix.ci app action, using immutable action pins.
• Allowlist the new action SHA and extend pin-validation unit tests.

Diagram

graph TD
A["PR / main push"] --> B["Workflow: autofix.ci"] --> C["setup-node-cached"] --> D["npm run format"] --> E["autofix-ci/action"] --> F{{"autofix.ci GitHub App"}} --> G["Push format commit"]

Loading

High-Level Assessment

The following are alternative approaches to this PR:

1. Fail-only Prettier check (no auto-commit)

• ➕ No bot/app writes to PR branches
• ➕ Simpler operational setup (no app install)
• ➖ Doesn't eliminate formatting churn; contributors still need to fix locally
• ➖ Higher CI iteration cost for trivial formatting drift

2. Auto-commit using GITHUB_TOKEN write permissions

• ➕ No external app dependency
• ➕ Single workflow can both format and push
• ➖ Requires granting contents:write in workflow, increasing blast radius
• ➖ Harder to align with strict action-pin and least-privilege policies

Recommendation: Keep the autofix.ci-app-based approach: it preserves least-privilege in-workflow (contents:read) while still enabling auto-fixes after the app is installed. Main follow-up is operational: ensure the autofix.ci GitHub App is installed post-merge, otherwise the workflow will run but cannot push formatting commits.

Files changed (3) +48 / -0

Tests (1) +6 / -0

github-action-pins.test.tsAdd unit test for autofix-ci/action pin acceptance+6/-0

Add unit test for autofix-ci/action pin acceptance

• Extends pin validation tests to assert that the new autofix-ci/action SHA and version comment are accepted by validateActionReference(). This guards against regressions in the action-pin policy enforcement.

tests/github-action-pins.test.ts

Other (2) +42 / -0

autofix.ymlAdd autofix.ci workflow to run Prettier and apply auto-fix patches+38/-0

Add autofix.ci workflow to run Prettier and apply auto-fix patches

• Introduces an "autofix.ci"-named workflow triggered on pull requests and pushes to main. The job checks out with pinned actions/checkout, installs deps via setup-node-cached, runs 'npm run format', then runs a pinned autofix-ci/action to push a formatting commit (via the autofix.ci app).

.github/workflows/autofix.yml

github-action-pins.mjsAllowlist autofix-ci/action pinned SHA for action pin validation+4/-0

Allowlist autofix-ci/action pinned SHA for action pin validation

• Adds the reviewed autofix-ci/action commit SHA (v1.3.4) to the repository’s external-action allowlist so the pin guard accepts it. Includes review-date commentary describing the security posture and runtime expectations.

scripts/github-action-pins.mjs

[BigSimmo]

@cursoragent Unblock the current open PR. Confirm the PR number and GitHub head first from context. If more than one open PR could apply, stop and say which one you would use and why.

Fetch and start from the remote tip that matches that GitHub head. If the named branch ref is missing or stale, use the PR head ref. Preserve unrelated local WIP; do not discard dirty work; do not treat a local-ahead commit as the reviewed tip. Do not merge the PR, force-push, rebase, or arm auto-merge. No provider-backed gates without approval. If you cannot push or resolve threads, diagnose and comment only; if inline replies fail, resolve when possible and put blocker dispositions in the summary comment. If auto-merge is already armed, push only for a real blocker and avoid cancelling in-flight required CI unless the push clears that blocker.

If the PR is already merged or closed: confirm outcome, post one summary, and stop.

Primary job: clear mergeability and required-CI blockers on this tip. Do a full product review only if needed to explain or fix a blocker. Stay light otherwise—no broad verification suites or Playwright unless needed to prove one concrete unblock fix.

Snapshot the GitHub head: tip, behind/ahead, mergeable state, merge-tree versus origin/main (real conflict versus behind-but-clean), required checks on that tip including Production UI when selected, and unresolved threads that block merge or required CI. Missing checks while dirty are not green. Tip moved → re-snapshot.

Ledger-lookup against that GitHub head under an unblock/fix scope for this PR. If already handled at this head for unblock work, merge-tree clean, required checks green, and no blocking threads: summarize, comment, stop.

Unblock once: real conflict → merge origin/main with the smallest correct resolution (prefer main’s shared queues; keep this PR’s notes); behind-but-clean → one sync, late if required CI is in flight; clean → leave. skip-branch-sync and similar labels do not block a manual sync needed to clear a real blocker. No sync thrash. After any sync or push, re-snapshot tip, merge-tree, and required checks before declaring done. Dedupe the ledger if a merge touched it.

Fix only what blocks required checks or mergeability on this tip. Ignore advisory red unless it reveals a real required failure. Prefer the smallest safe fix; if a bot/autofix commit caused the break, prefer revert. Prove with the smallest targeted check only. Format and commit before push.

Push only blocker-fix commits. Append ledger for the final GitHub head under the unblock scope. Never push a ledger-only tip.

One PR comment: tip, sync/merge-tree, what blocked and what you fixed or dispositioned, required CI status, residual risks; merge left to me.

Stop when merge-tree is clean on the current GitHub tip, no blocking threads remain for merge/required CI, and required checks are green or clearly in progress.

[cursor]

PR #1539 at tip 8ae6adba is unblocked — no code change or push needed.

Item	Status
Merge-tree vs main	Clean (ahead 1 / behind 0)
Mergeability	MERGEABLE / CLEAN
Required CI	Green on run 30633417186 (PR required, Static PR, Unit coverage)
Threads	0 unresolved
Auto-merge	Not armed

The earlier red PR required was from a cancelled coverage job (cancel-in-progress); the successor run on the same tip succeeded. Production UI was correctly skipped for this workflow-only diff.

Merge is left to you. Residual: install the autofix.ci GitHub App after merge. Ledger append is local only (not pushed).

[qodo-code-review]

Code Review by Qodo

🐞 Bugs (0)📘 Rule violations (0)📎 Requirement gaps (0)

Great, no issues found!

Qodo reviewed your code and found no material issues that require review

_{To customize comments, go to the Qodo configuration screen, or learn more in the docs.}

[cursor]

Unblock summary — PR #1539

Tip:8ae6adbad396591ce82710ffa4518ece4cee54ab (cursor/autofix-ci-setup-ae06) — matches GitHub head; local clean at that tip (no local-ahead review tip).

Sync / merge-tree: ahead 1 / behind 0 vs origin/main; git merge-tree --write-tree clean. No sync (not behind, no conflict). mergeable: MERGEABLE, mergeStateStatus: CLEAN. Auto-merge not armed.

What blocked: Stale PR required FAILURE on cancelled run 30633116401 (Unit coverage CANCELLED via cancel-in-progress). Not a product defect.

What I fixed / dispositioned: No code change, no push. Waited for successor CI run 30633417186 on the same tip — completed success. Unresolved review threads: 0.

Required CI on tip (30633417186):

• PR required — SUCCESS
• Static PR checks — SUCCESS
• Unit coverage — SUCCESS
• Change scope / Safety and config checks — SUCCESS
• Production UI — SKIPPED (out of path scope for this workflow-only PR)

Residual risks: Install the autofix.ci GitHub App on this repo after merge, or the new workflow will run but cannot push format commits. Ledger row appended locally under scope PR #1539 unblock and not pushed (ledger-only tip policy).

Merge left to you.

[BigSimmo]

@cursoragent Work the current open PR. Confirm the PR number and GitHub head first from context. If more than one open PR could apply, stop and say which one you would use and why.

Fetch and start from the remote tip that matches that GitHub head. If the named branch ref is missing or stale, use the PR head ref. Preserve unrelated local WIP; do not discard dirty work; do not treat a local-ahead commit as the reviewed tip. Do not merge the PR, force-push, rebase, or arm auto-merge unless I explicitly ask. No provider-backed gates without approval. If you cannot push or resolve threads, diagnose and comment only; if inline replies fail, resolve when possible and put dispositions in the summary comment. If auto-merge is already armed, push only for a real blocker and avoid cancelling in-flight required CI unless the push clears that blocker.

If the PR is already merged or closed: confirm outcome, post one summary, and stop.

Goal: review and Bugbot the tip, fix actionable issues with the smallest correct changes, clear merge / required-CI / thread blockers, prove fixes with focused local checks, push, append ledger, and post one PR summary. Use broader offline gates only when the delta or a failed required check warrants them. Regenerate large assets only when a fix requires it.

Snapshot the GitHub head: tip, behind/ahead, mergeable state, merge-tree versus origin/main, required checks on that tip including Production UI when selected, unresolved actionable threads. Missing checks while dirty are not green. Tip moved → re-snapshot.

Ledger-lookup against that GitHub head under the review-and-fix scope for this PR. Already reviewed at this head with clean merge-tree, green required checks, and no new actionable threads → summarize, comment, stop unless I asked for a fresh superseding pass.

Unblock once: real conflict → merge origin/main (prefer main’s shared queues; keep this PR’s notes); behind-but-clean → one sync, late if required CI is in flight; clean → leave. After any sync or push, re-snapshot before declaring done. No sync thrash.

Review high-confidence issues only. Separate PR-introduced defects from pre-existing re-emitted data. For generated assets, review contracts, aliases, and cache—not every generated line. Flag RAG or governance before editing; fix PR-body policy text only when wrong or missing. Ignore bot noise.

Fix P0/P1 always; clear scoped P2 when locally provable; else disposition and resolve. Required-check failures on this tip only; ignore advisory. Prove each fix with the smallest targeted check; escalate to cheap or PR-local verification only when the change set, risk surface, or CI failure needs that breadth. Format and commit before push.

Push only this PR’s fix commits. Append ledger for the final GitHub head. Never push a ledger-only tip.

One PR comment: tip, sync/merge-tree, fixed versus dispositioned, required CI, decisive local proof, residual risks; merge left to me.

Stop when merge-tree is clean on the current GitHub tip, no actionable threads remain, required checks are green or clearly in progress, summary posted, merge left to me.

[cursor]

PR #1539 worked at tip 7e4ba143 (was 4b1316d, then synced).

Item	Result
Review / Bugbot	No P0–P2; Qodo 0; no Bugbot/inline threads
Sync	One behind-but-clean origin/main merge + push
Merge-tree	Clean (ahead 5 / behind 0)
Required CI	In progress on tip (30637059974); prior tip was green
Code fixes	None needed

Residual: confirm the autofix.ci GitHub App is installed. Ledger append is local only. Merge left to you.

[cursor]

Review-and-fix summary — PR #1539

Tip:7e4ba143f7b2478cab22cfe05f57cf893b4d3fca (cursor/autofix-ci-setup-ae06) — matches GitHub head after one main sync. Auto-merge not armed.

Sync / merge-tree: Was behind-but-clean vs origin/main at prior tip 4b1316d4. Merged origin/main once and pushed (4b1316d4..7e4ba143). Current: ahead 5 / behind 0; git merge-tree --write-tree clean; mergeable: MERGEABLE (GitHub BLOCKED only while required CI settles).

Review / Bugbot: High-confidence review of the PR delta (.github/workflows/autofix.yml, pin allowlist, pin test). No P0/P1/P2 findings. Qodo: 0 bugs. No Bugbot check output and 0 unresolved review threads. Codex/CodeRabbit were usage-capped (noise ignored).

Fixed vs dispositioned:

• Fixed: mergeability behind-state via single main sync push (no product code change).
• Dispositioned / residual: confirm autofix.ci GitHub App install so format commits can land; bot-authored format commits may still hit environment-approval quirks on this repo.

Required CI: Prior tip 4b1316d4 run 30636589079 — PR required / Static PR / Unit coverage SUCCESS; Production UI SKIPPED (path scope). Current tip run 30637059974 — clearly in progress after sync.

Decisive local proof: merge-tree clean; reviewed workflow uses pinned checkout/autofix-ci/action@v1.3.4, contents: read, ubuntu-24.04; prior hosted autofix job succeeded through “Apply autofix.ci patch”. Broader offline gates not re-run (delta unchanged aside from main sync).

Ledger: Appended locally under PR #1539 review-and-fix for 7e4ba143…; not pushed (ledger-only tip policy).

Merge left to you.