ci: fix SQLFluff annotation permissions for fork PRs #373
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: SQLFluff | |
| # Lints changed mimic-iv/concepts/*.sql on pull requests and posts GitHub | |
| # annotations. Fork PRs skip Annotate — GITHUB_TOKEN cannot create check runs | |
| # from forks (Resource not accessible by integration / 403). | |
| on: | |
| - pull_request | |
| jobs: | |
| lint-mimic-iv: | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| checks: write | |
| steps: | |
| - name: checkout | |
| uses: actions/checkout@v7 | |
| with: | |
| # Full history so we can diff the PR branch against its base | |
| fetch-depth: 0 | |
| - name: Install Python | |
| uses: actions/setup-python@v7 | |
| with: | |
| python-version: "3.12" | |
| - name: install sqlfluff | |
| run: "pip install sqlfluff==4.1.0" | |
| - name: Get changed .sql files in mimic-iv concepts folder | |
| id: get_files_to_lint | |
| shell: bash | |
| run: | | |
| # Added/modified (--diff-filter=AM) SQL files on the PR branch since | |
| # it diverged from the base branch, restricted to mimic-iv/concepts. | |
| files="$(git diff --name-only --diff-filter=AM \ | |
| "origin/${{ github.base_ref }}...HEAD" -- 'mimic-iv/concepts/' \ | |
| | grep -E '[.]sql$' | tr '\n' ' ' || true)" | |
| echo "lintees=${files}" >> "$GITHUB_OUTPUT" | |
| - name: Lint SQL files | |
| id: sqlfluff_json | |
| if: steps.get_files_to_lint.outputs.lintees != '' | |
| shell: bash | |
| run: sqlfluff lint --format github-annotation --annotation-level failure --nofail ${{ steps.get_files_to_lint.outputs.lintees }} > annotations.json | |
| - name: Annotate | |
| # Same-repo PRs only: fork tokens get 403 creating check runs, and | |
| # ignore-unauthorized-error does not treat that as unauthorized. | |
| if: > | |
| steps.get_files_to_lint.outputs.lintees != '' && | |
| github.event.pull_request.head.repo.full_name == github.repository | |
| uses: yuzutech/annotations-action@v0.6.0 | |
| with: | |
| repo-token: "${{ secrets.GITHUB_TOKEN }}" | |
| title: "SQLFluff Lint" | |
| input: "./annotations.json" | |
| ignore-unauthorized-error: true |