[shenxianpeng]

Problem

On events that carry no pull request (issue_comment, workflow_run, schedule, workflow_dispatch), the auto-fix step pushes HEAD to GITHUB_REF_NAME, which is usually the default branch. It only compared HEAD with the expected commit when the event had a pull request.

So a workflow like "comment /format on a PR" that checks out the pull request's head and runs the action with auto-fix: true pushes that pull request's commits, plus the formatting commit, straight to the default branch (when the token is allowed to push there).

Change

When the event has no pull request, auto-fix only commits if HEAD is GITHUB_SHA, the commit that triggered the workflow. Otherwise it is skipped with a warning, like the existing check for the pull request head:

HEAD is c656c49…, not fed9662…, the commit that triggered this workflow, so no formatting commit was made. Pushing it would add the checked out commits to <branch>.

push and pull_request workflows are not affected: there the checked out commit is already the expected one. A scheduled or manually started run that formats the branch it runs for keeps working too.

One behavior change to be aware of: if an earlier step of the job makes its own commit before this action runs, auto-fix is now skipped (before, both commits were pushed).

The auto-fix input description and the auto-fix section of the permissions page say the same.

Testing

Run on real runners in cpp-linter/test-cpp-linter-action (branch claude/project-thread-y4qppu, temporary workflow). The stand-in for "a pull request's head is checked out" is an extra empty commit made after actions/checkout, so HEAD is one commit ahead of GITHUB_SHA.

Case	Action	Result
HEAD ahead of GITHUB_SHA	v2.24.1	the stand-in commit and the formatting commit were pushed to the branch (run)
HEAD ahead of GITHUB_SHA	this branch	skipped with the warning, branch not moved (run)
HEAD is GITHUB_SHA (plain push)	this branch	formatting commit pushed as before (run)

The v3.0.0-rc0 branch has the same lines; #530 is the same change for it.

[github-actions]

Cpp-Linter Report ⚠️

Some files did not pass the configured checks!

clang-format (v16.0.6) reports: 2 file(s) not formatted

• docs/examples/demo/demo.cpp
• docs/examples/demo/demo.hpp

clang-tidy (v16.0.6) reports: 7 concern(s)

• docs/examples/demo/demo.cpp:3:10: warning: [modernize-deprecated-headers]

  inclusion of deprecated C++ header 'stdio.h'; consider using 'cstdio' instead

  #include <stdio.h>
           ^~~~~~~~~
           <cstdio>

• docs/examples/demo/demo.cpp:8:5: warning: [modernize-use-trailing-return-type]

  use a trailing return type for this function

  int main(){
  ~~~ ^
  auto       -> int

• docs/examples/demo/demo.cpp:10:13: warning: [readability-braces-around-statements]

  statement should be inside braces

      for (;;) break;
              ^
               {

• docs/examples/demo/demo.cpp:13:5: warning: [cppcoreguidelines-pro-type-vararg]

  do not call c-style vararg functions

      printf("Hello world!\n");
      ^

• docs/examples/demo/demo.hpp:6:11: warning: [modernize-use-default-member-init]

  use default member initializer for 'useless'

      char* useless;
            ^
                   {"\0"}

• docs/examples/demo/demo.hpp:7:9: warning: [modernize-use-default-member-init]

  use default member initializer for 'numb'

      int numb;
          ^
              {0}

• docs/examples/demo/demo.hpp:11:11: warning: [modernize-use-trailing-return-type]

  use a trailing return type for this function

      void *not_useful(char *str){useless = str;}
      ~~~~~~^
      auto                        -> void *

---

_{✨ Powered by cpp-linter -- ⭐ Star • ❤️ Sponsor • 💬 Feedback}

[coderabbitai]

No actionable comments were generated in the recent review.

Walkthrough

The auto-commit step now checks HEAD against the pull-request head SHA or, for events without a pull-request head SHA, GITHUB_SHA. Documentation describes when auto-fix is skipped.

Changes

Auto-fix Commit Validation

Layer / File(s)	Summary
Commit SHA validation action.yml, docs/permissions.md	The auto-commit step checks HEAD against the applicable SHA and skips committing with a warning on mismatch. The documentation also states that pull requests from forks are skipped.

Estimated code review effort: 2 (Simple) | ~10 minutes

Merge Risk: Minimal · up to 6a379

Auto-fix now skips with a warning when the checked-out commit is not the one that triggered the workflow. This prevents unintended pushes of other commits to the branch. No actionable merge-blocking risk remains.

Pre-merge checks: 4

Check name	Status	Explanation
Title check		The title names the main change: auto-fix is skipped when HEAD is not the commit that triggered the workflow. The raw summary shows action.yml and docs/permissions.md changes that add a HEAD-versus-GI…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.

Full details: Title check

Explanation

The title names the main change: auto-fix is skipped when HEAD is not the commit that triggered the workflow. The raw summary shows action.yml and docs/permissions.md changes that add a HEAD-versus-GITHUB_SHA guard for non-pull-request events, which matches the title. The title is 74 characters, which is within a reasonable length for a single-sentence title, and it uses a conventional commit prefix with specific wording.

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

Recent review info

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: f4287cde-9ea1-49d2-b73e-76756a40a39e

Commits

Reviewing files that changed from the base of the PR and between 536a397 and 6a379b1.

Files selected for processing: 2

• action.yml
• docs/permissions.md

Included review availability: This review used your included allowance. Your plan provides up to 2 included reviews per hour; 1 remain after this review.