From 5eb29ad689be42a36a6ab907c085c3dfeceb7cdf Mon Sep 17 00:00:00 2001 From: UdjinM6 Date: Wed, 1 Apr 2026 00:09:05 +0300 Subject: [PATCH 1/2] ci: use pull_request_target for clang-format comment permissions Switch from pull_request to pull_request_target so the workflow gets a write-capable GITHUB_TOKEN for posting PR comments, including on fork PRs. The base branch is checked out (keeping clang-format-diff.py trusted) and only the PR head SHA is fetched for diffing. Co-Authored-By: Claude Opus 4.6 --- .github/workflows/clang-diff-format.yml | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/.github/workflows/clang-diff-format.yml b/.github/workflows/clang-diff-format.yml index 0c9087c3d898..24a370ab3674 100644 --- a/.github/workflows/clang-diff-format.yml +++ b/.github/workflows/clang-diff-format.yml @@ -1,7 +1,7 @@ name: Clang Diff Format Check on: - pull_request: + pull_request_target: branches: - develop jobs: @@ -10,14 +10,14 @@ jobs: permissions: pull-requests: write steps: - - name: Checkout + - name: Checkout base branch uses: actions/checkout@v6 - - name: Fetch git - run: git fetch --no-tags -fu origin develop:develop + - name: Fetch PR head + run: git fetch --no-tags -f origin ${{ github.event.pull_request.head.sha }} - name: Run Clang-Format-Diff.py id: clang-format run: | - git diff -U0 origin/develop -- $(git ls-files -- $(cat test/util/data/non-backported.txt)) | ./contrib/devtools/clang-format-diff.py -p1 > diff_output.txt + git diff -U0 HEAD...${{ github.event.pull_request.head.sha }} -- $(git ls-files -- $(cat test/util/data/non-backported.txt)) | ./contrib/devtools/clang-format-diff.py -p1 > diff_output.txt if [ -s diff_output.txt ]; then echo "::warning::Clang format differences found. See PR comment for details." echo "has_diff=true" >> "$GITHUB_OUTPUT" From 86d94ee3cb78f2c9b302e753a06933888c74790e Mon Sep 17 00:00:00 2001 From: UdjinM6 Date: Wed, 1 Apr 2026 00:43:10 +0300 Subject: [PATCH 2/2] ci: fix permissions, shallow clone depth, and new file coverage Add contents: read permission so checkout and git fetch work when job-level permissions are specified. Use fetch-depth: 50 consistent with other workflows. Pass non-backported.txt patterns directly to git diff so PR-added files matching existing globs are included. Co-Authored-By: Claude Opus 4.6 --- .github/workflows/clang-diff-format.yml | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/.github/workflows/clang-diff-format.yml b/.github/workflows/clang-diff-format.yml index 24a370ab3674..7bfdb33ada45 100644 --- a/.github/workflows/clang-diff-format.yml +++ b/.github/workflows/clang-diff-format.yml @@ -8,16 +8,19 @@ jobs: ClangFormat: runs-on: ubuntu-latest permissions: + contents: read pull-requests: write steps: - name: Checkout base branch uses: actions/checkout@v6 + with: + fetch-depth: 50 - name: Fetch PR head run: git fetch --no-tags -f origin ${{ github.event.pull_request.head.sha }} - name: Run Clang-Format-Diff.py id: clang-format run: | - git diff -U0 HEAD...${{ github.event.pull_request.head.sha }} -- $(git ls-files -- $(cat test/util/data/non-backported.txt)) | ./contrib/devtools/clang-format-diff.py -p1 > diff_output.txt + git diff -U0 HEAD...${{ github.event.pull_request.head.sha }} -- $(cat test/util/data/non-backported.txt) | ./contrib/devtools/clang-format-diff.py -p1 > diff_output.txt if [ -s diff_output.txt ]; then echo "::warning::Clang format differences found. See PR comment for details." echo "has_diff=true" >> "$GITHUB_OUTPUT"