Fix lint errors #76
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: AI Auto-Fix | |
| on: | |
| pull_request_review: | |
| types: [submitted] | |
| issue_comment: | |
| types: [created] | |
| # Only one auto-fix at a time per PR — don't cancel in progress (let the fix finish) | |
| concurrency: | |
| group: pr-fix-${{ github.event.pull_request.number || github.event.issue.number }} | |
| cancel-in-progress: false | |
| jobs: | |
| auto-fix: | |
| # Trigger on: (1) changes_requested review, or (2) /fix comment on a PR from repo members. | |
| # Keep the member guard only on /fix comments: review-triggered auto-fix must not be skipped | |
| # before the runner starts when the review comes from the dedicated review account. | |
| if: >- | |
| (github.event_name == 'pull_request_review' && github.event.review.state == 'changes_requested') || | |
| (github.event_name == 'issue_comment' && github.event.issue.pull_request && contains(github.event.comment.body, '/fix') && | |
| contains(fromJSON('["OWNER","MEMBER","COLLABORATOR"]'), github.event.comment.author_association)) | |
| runs-on: [self-hosted, builder] | |
| steps: | |
| - name: Get PR info for comment trigger | |
| id: pr-info | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| EVENT_NAME: ${{ github.event_name }} | |
| ISSUE_NUMBER: ${{ github.event.issue.number }} | |
| COMMENT_USER: ${{ github.event.comment.user.login }} | |
| PR_HEAD_REF: ${{ github.event.pull_request.head.ref }} | |
| PR_NUMBER_EVENT: ${{ github.event.pull_request.number }} | |
| REVIEW_USER: ${{ github.event.review.user.login }} | |
| run: | | |
| if [ "$EVENT_NAME" = "issue_comment" ]; then | |
| PR_DATA=$(gh pr view "$ISSUE_NUMBER" --json headRefName -q '.headRefName') | |
| echo "branch=$PR_DATA" >> $GITHUB_OUTPUT | |
| echo "pr_number=$ISSUE_NUMBER" >> $GITHUB_OUTPUT | |
| echo "reviewer=$COMMENT_USER" >> $GITHUB_OUTPUT | |
| else | |
| echo "branch=$PR_HEAD_REF" >> $GITHUB_OUTPUT | |
| echo "pr_number=$PR_NUMBER_EVENT" >> $GITHUB_OUTPUT | |
| echo "reviewer=$REVIEW_USER" >> $GITHUB_OUTPUT | |
| fi | |
| - uses: actions/checkout@v4 | |
| with: | |
| ref: ${{ steps.pr-info.outputs.branch }} | |
| fetch-depth: 0 | |
| clean: false | |
| token: ${{ secrets.PAT_TOKEN }} | |
| - name: Rebase on dev if behind | |
| run: | | |
| git fetch origin dev | |
| if ! git merge-base --is-ancestor origin/dev HEAD; then | |
| echo "Branch is behind dev, rebasing..." | |
| if git rebase origin/dev; then | |
| git push --force-with-lease | |
| echo "Rebase successful" | |
| else | |
| git rebase --abort | |
| gh pr comment ${{ steps.pr-info.outputs.pr_number }} \ | |
| --body "Merge conflict with dev requires manual resolution." | |
| exit 1 | |
| fi | |
| fi | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| # Security: the PR tree is attacker-controlled. Remove any Claude/MCP config | |
| # it carries before running `claude` — these files would otherwise execute | |
| # SessionStart hooks / spawn MCP servers as the runner user. Placed AFTER | |
| # rebase so deleting a PR-tracked file does not dirty the tree and break it. | |
| - name: Strip attacker-controlled Claude/MCP config | |
| run: | | |
| rm -f .claude/settings.json .claude/settings.local.json .mcp.json .claude/.mcp.json | |
| - name: Check iteration limit | |
| id: check | |
| run: | | |
| PR_NUMBER="${{ steps.pr-info.outputs.pr_number }}" | |
| # Detect bot vs human by review content marker (no hardcoded usernames) | |
| # Bot reviews contain "## AI Review Summary", human reviews don't | |
| IS_HUMAN="false" | |
| if [ "${{ github.event_name }}" = "issue_comment" ]; then | |
| IS_HUMAN="true" | |
| else | |
| REVIEW_BODY=$(gh api "repos/${{ github.repository }}/pulls/${PR_NUMBER}/reviews" \ | |
| --jq "[.[] | select(.id == ${{ github.event.review.id }})] | .[0].body // \"\"") | |
| if ! echo "$REVIEW_BODY" | grep -q "## AI Review Summary"; then | |
| IS_HUMAN="true" | |
| fi | |
| fi | |
| echo "is_human=$IS_HUMAN" >> $GITHUB_OUTPUT | |
| # Count auto-fix iterations from monitoring DB | |
| COUNT=$(sqlite3 /data/monitoring/monitoring.db \ | |
| "SELECT COUNT(*) FROM agent_runs WHERE agent='pr-fixer' AND run_id LIKE '%fix%' AND issue_number=$PR_NUMBER" 2>/dev/null || echo "0") | |
| # Fallback: count fix commits on the branch | |
| if [ "$COUNT" = "0" ]; then | |
| COUNT=$(git log --oneline --grep="auto-fix iteration" | wc -l | tr -d ' ') | |
| fi | |
| echo "count=$COUNT" >> $GITHUB_OUTPUT | |
| if [ "$IS_HUMAN" = "false" ] && [ "$COUNT" -ge "3" ]; then | |
| gh pr comment "$PR_NUMBER" \ | |
| --body "Auto-fix limit (3) reached for automated reviews. Agent provided explanations for unresolved issues above." | |
| echo "blocked=true" >> $GITHUB_OUTPUT | |
| else | |
| echo "blocked=false" >> $GITHUB_OUTPUT | |
| fi | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Install dependencies and generate Prisma | |
| if: steps.check.outputs.blocked != 'true' | |
| timeout-minutes: 30 | |
| run: | | |
| rm -rf .next | |
| if [ -f node_modules/.yarn-integrity ]; then | |
| echo "node_modules cached, skipping install" | |
| else | |
| yarn install --frozen-lockfile || yarn install | |
| fi | |
| npx prisma generate 2>/dev/null || true | |
| npx prisma generate --schema=prisma/events/schema.prisma 2>/dev/null || true | |
| - name: Fix | |
| if: steps.check.outputs.blocked != 'true' | |
| run: | | |
| PR_NUMBER="${{ steps.pr-info.outputs.pr_number }}" | |
| DB="/data/monitoring/monitoring.db" | |
| ITERATION=$(( ${{ steps.check.outputs.count }} + 1 )) | |
| RUN_ID="${GITHUB_RUN_ID}-fix-${ITERATION}" | |
| START_MS=$(date +%s%3N) | |
| # Log start | |
| sqlite3 "$DB" "INSERT INTO agent_runs | |
| (run_id, agent, role, trigger, issue_number, started_at) | |
| VALUES ('$RUN_ID', 'pr-fixer', 'builder', 'review', $PR_NUMBER, datetime('now'))" 2>/dev/null || true | |
| # Collect PR history for context | |
| FIX_COMMITS=$(git log --oneline --grep="auto-fix iteration" \ | |
| origin/dev..HEAD 2>/dev/null || echo "No previous fix commits") | |
| PR_COMMENTS=$(gh pr view "$PR_NUMBER" \ | |
| --json comments \ | |
| -q '[.comments[]] | map(.body) | join("\n---\n")') | |
| # Separate human and bot reviews by content marker (no hardcoded usernames) | |
| HUMAN_COMMENTS=$(gh pr view "$PR_NUMBER" \ | |
| --json reviews \ | |
| -q '[.reviews[] | select(.body | contains("## AI Review Summary") | not)] | map(.body) | join("\n---\n")') | |
| BOT_COMMENTS=$(gh pr view "$PR_NUMBER" \ | |
| --json reviews \ | |
| -q '[.reviews[] | select(.body | contains("## AI Review Summary"))] | map(.body) | join("\n---\n")') | |
| # Build prompt file (avoids shell injection from review text containing quotes) | |
| PROMPT_FILE="/tmp/fix-prompt-${ITERATION}.txt" | |
| cat > "$PROMPT_FILE" <<FIXPROMPTEOF | |
| ## TASK: Fix review feedback on PR #${PR_NUMBER} | |
| ITERATION: ${ITERATION} of 3 | |
| ## PR FIX HISTORY (your previous attempts): | |
| ${FIX_COMMITS} | |
| ## PR COMMENTS (conversation history): | |
| ${PR_COMMENTS} | |
| FIXPROMPTEOF | |
| if [ "${{ github.event_name }}" = "issue_comment" ]; then | |
| printf '\n## FIX COMMAND (from PR author — HIGHEST PRIORITY):\n%s\n' "$COMMENT_BODY" >> "$PROMPT_FILE" | |
| fi | |
| printf '\n## HUMAN REVIEW (HIGHEST PRIORITY — always follow):\n%s\n' "$HUMAN_COMMENTS" >> "$PROMPT_FILE" | |
| printf '\n## AUTOMATED REVIEW (lower priority — follow only if no conflict with human):\n%s\n' "$BOT_COMMENTS" >> "$PROMPT_FILE" | |
| cat >> "$PROMPT_FILE" <<FIXRULESEOF | |
| BEFORE fixing anything: | |
| 1. Read the PR FIX HISTORY above. These are your previous fix commits. | |
| 2. Read ALL review comments (human + bot), not just the latest. | |
| 3. Identify which review comments are NEW (first time) vs REPEATED | |
| (appeared in a previous review iteration). | |
| 4. For REPEATED comments: your previous approach did not work. | |
| Analyze WHY by reading your fix commit and the repeated comment. | |
| Try a DIFFERENT approach this time. | |
| 5. For NEW comments: fix normally. | |
| CONFLICT RULE: If human and automated reviews contradict each other, | |
| ALWAYS follow the human review. Human is the final authority. | |
| Before fixing any reported issue, verify it is actually a real problem | |
| by reading the relevant files. If a review comment is wrong | |
| (e.g. claims an import path is invalid but tsconfig.json confirms it exists), | |
| do NOT make that change — skip it. | |
| If this is iteration 3 (final) and you cannot resolve a comment: | |
| - Write a PR comment for EACH unresolved issue: | |
| "Could not fix: [issue summary] | |
| Reason: [why your attempts failed] | |
| Alternative: [proposed different approach]" | |
| - Do NOT force a fix you are not confident about. | |
| Rules: only fix what was requested and verified as real. Follow CLAUDE.md. | |
| Commit message: fix: address review feedback (auto-fix iteration ${ITERATION}) | |
| Do NOT add any Co-Authored-By trailer to commit messages. | |
| FIXRULESEOF | |
| # Load fullstack.md as agent persona (provides Skills, Teams, GitNexus workflow). | |
| # Read from the trusted origin/dev blob, NOT the attacker-controlled PR tree — | |
| # a PR editing this file would otherwise inject into --append-system-prompt. | |
| AGENT_PERSONA=$(git show origin/dev:.claude/agents/fullstack.md 2>/dev/null || echo "") | |
| claude -p "$(cat "$PROMPT_FILE")" --model claude-opus-4-6 \ | |
| --append-system-prompt "$AGENT_PERSONA" \ | |
| --dangerously-skip-permissions \ | |
| --output-format text | |
| EXIT_CODE=$? | |
| END_MS=$(date +%s%3N) | |
| DURATION=$((END_MS - START_MS)) | |
| STATUS=$([ $EXIT_CODE -eq 0 ] && echo "success" || echo "error") | |
| # Log finish | |
| sqlite3 "$DB" "UPDATE agent_runs SET | |
| finished_at = datetime('now'), status = '$STATUS', | |
| exit_code = $EXIT_CODE, duration_ms = $DURATION | |
| WHERE run_id = '$RUN_ID'" 2>/dev/null || true | |
| sqlite3 "$DB" "INSERT INTO workflow_events | |
| (run_id, workflow, event, issue_number, details) | |
| VALUES ('$RUN_ID', 'pr-fix', '$STATUS', | |
| $PR_NUMBER, | |
| '{\"duration_ms\": $DURATION, \"iteration\": $ITERATION, \"is_human\": \"${{ steps.check.outputs.is_human }}\"}')" 2>/dev/null || true | |
| if [ $EXIT_CODE -ne 0 ]; then | |
| echo "::error::PR auto-fix failed (iteration $ITERATION)" | |
| exit 1 | |
| fi | |
| git push | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| COMMENT_BODY: ${{ github.event.comment.body }} |