From 38b3470a2a560517140fd3ad13adf28204b1c6df Mon Sep 17 00:00:00 2001 From: Taksh Date: Fri, 31 Jul 2026 15:05:50 +0300 Subject: [PATCH 1/6] ci(sqlfluff): declare contents/checks permissions for annotations Fork PRs need an explicit checks:write grant so the annotation action can post findings without relying on the default GITHUB_TOKEN scope. Co-authored-by: Cursor --- .github/workflows/lint_sqlfluff.yml | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/.github/workflows/lint_sqlfluff.yml b/.github/workflows/lint_sqlfluff.yml index 0986785b..3900182d 100644 --- a/.github/workflows/lint_sqlfluff.yml +++ b/.github/workflows/lint_sqlfluff.yml @@ -6,6 +6,9 @@ on: jobs: lint-mimic-iv: runs-on: ubuntu-latest + permissions: + contents: read + checks: write steps: - name: checkout uses: actions/checkout@v7 @@ -39,4 +42,4 @@ jobs: with: repo-token: "${{ secrets.GITHUB_TOKEN }}" title: "SQLFluff Lint" - input: "./annotations.json" \ No newline at end of file + input: "./annotations.json" From 7cfddefbc27dfcd531efcc793b77792b43886e47 Mon Sep 17 00:00:00 2001 From: Taksh Date: Fri, 31 Jul 2026 15:05:50 +0300 Subject: [PATCH 2/6] ci(sqlfluff): skip annotate when no SQL changed Avoid running the annotations action against a missing annotations.json on PRs that do not touch mimic-iv/concepts, and tolerate unauthorized check writes with ignore-unauthorized-error. Co-authored-by: Cursor --- .github/workflows/lint_sqlfluff.yml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/.github/workflows/lint_sqlfluff.yml b/.github/workflows/lint_sqlfluff.yml index 3900182d..5b603162 100644 --- a/.github/workflows/lint_sqlfluff.yml +++ b/.github/workflows/lint_sqlfluff.yml @@ -38,8 +38,10 @@ jobs: shell: bash run: sqlfluff lint --format github-annotation --annotation-level failure --nofail ${{ steps.get_files_to_lint.outputs.lintees }} > annotations.json - name: Annotate + if: steps.get_files_to_lint.outputs.lintees != '' uses: yuzutech/annotations-action@v0.6.0 with: repo-token: "${{ secrets.GITHUB_TOKEN }}" title: "SQLFluff Lint" input: "./annotations.json" + ignore-unauthorized-error: true From 2a15638bcb0eefa10aaeebe26e25d32bf85a9922 Mon Sep 17 00:00:00 2001 From: Taksh Date: Fri, 31 Jul 2026 15:06:52 +0300 Subject: [PATCH 3/6] ci(sqlfluff): document the fork-PR annotation contract Spell out why the workflow sets checks:write and ignore-unauthorized-error so future edits do not reintroduce continue-on-error. Co-authored-by: Cursor --- .github/workflows/lint_sqlfluff.yml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/.github/workflows/lint_sqlfluff.yml b/.github/workflows/lint_sqlfluff.yml index 5b603162..71f08fca 100644 --- a/.github/workflows/lint_sqlfluff.yml +++ b/.github/workflows/lint_sqlfluff.yml @@ -1,5 +1,7 @@ name: SQLFluff +# Lints changed mimic-iv/concepts/*.sql on pull requests and posts GitHub +# annotations. permissions + ignore-unauthorized-error keep fork PRs usable. on: - pull_request From 852ea593335e5cad49c9f7811bad3312cefeca20 Mon Sep 17 00:00:00 2001 From: Taksh Date: Fri, 31 Jul 2026 15:06:52 +0300 Subject: [PATCH 4/6] docs: mention SQLFluff PR linting in the style guide Point contributors at the workflow that reviews changed MIMIC-IV concept SQL. Co-authored-by: Cursor --- styleguide.md | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/styleguide.md b/styleguide.md index 14eca419..3e65da63 100644 --- a/styleguide.md +++ b/styleguide.md @@ -27,3 +27,7 @@ For more detail, following the guidelines at: http://www.sqlstyle.guide/ ## Python Following PEP8 guidelines is recommended. Read more here: https://www.python.org/dev/peps/pep-0008/ + +## SQL style checking + +Pull requests that change `mimic-iv/concepts/**/*.sql` are linted by the SQLFluff GitHub Action (`.github/workflows/lint_sqlfluff.yml`). Findings are posted as pull-request annotations when the workflow has permission to write checks. From 060eefadfb2a4077933fe459dc37ee24b3b10b5a Mon Sep 17 00:00:00 2001 From: Taksh Date: Fri, 31 Jul 2026 15:06:52 +0300 Subject: [PATCH 5/6] chore: add local SQLFluff helper for changed concept SQL Mirrors the PR workflow so contributors can lint mimic-iv/concepts changes before pushing. Co-authored-by: Cursor --- scripts/lint_changed_mimic_iv_concepts.sh | 12 ++++++++++++ 1 file changed, 12 insertions(+) create mode 100755 scripts/lint_changed_mimic_iv_concepts.sh diff --git a/scripts/lint_changed_mimic_iv_concepts.sh b/scripts/lint_changed_mimic_iv_concepts.sh new file mode 100755 index 00000000..5da6eff7 --- /dev/null +++ b/scripts/lint_changed_mimic_iv_concepts.sh @@ -0,0 +1,12 @@ +#!/usr/bin/env bash +# Local mirror of .github/workflows/lint_sqlfluff.yml for changed concept SQL. +set -euo pipefail +BASE_REF="${1:-origin/main}" +files="$(git diff --name-only --diff-filter=AM "${BASE_REF}...HEAD" -- 'mimic-iv/concepts/' \ + | grep -E '[.]sql$' || true)" +if [[ -z "${files}" ]]; then + echo "No changed mimic-iv/concepts SQL files versus ${BASE_REF}." + exit 0 +fi +# shellcheck disable=SC2086 +sqlfluff lint ${files} From 743555144e8912f05d36046d2cd275a71e8af30a Mon Sep 17 00:00:00 2001 From: Taksh Date: Sat, 1 Aug 2026 15:16:34 +0300 Subject: [PATCH 6/6] ci: skip SQLFluff Annotate on fork PRs ignore-unauthorized-error does not catch the fork 403 (Resource not accessible by integration). Skip Annotate when head.repo != base repo so lint-mimic-iv can stay green. --- .github/workflows/lint_sqlfluff.yml | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/.github/workflows/lint_sqlfluff.yml b/.github/workflows/lint_sqlfluff.yml index 71f08fca..d6e1c3f0 100644 --- a/.github/workflows/lint_sqlfluff.yml +++ b/.github/workflows/lint_sqlfluff.yml @@ -1,7 +1,8 @@ name: SQLFluff # Lints changed mimic-iv/concepts/*.sql on pull requests and posts GitHub -# annotations. permissions + ignore-unauthorized-error keep fork PRs usable. +# annotations. Fork PRs skip Annotate — GITHUB_TOKEN cannot create check runs +# from forks (Resource not accessible by integration / 403). on: - pull_request @@ -40,7 +41,11 @@ jobs: shell: bash run: sqlfluff lint --format github-annotation --annotation-level failure --nofail ${{ steps.get_files_to_lint.outputs.lintees }} > annotations.json - name: Annotate - if: steps.get_files_to_lint.outputs.lintees != '' + # Same-repo PRs only: fork tokens get 403 creating check runs, and + # ignore-unauthorized-error does not treat that as unauthorized. + if: > + steps.get_files_to_lint.outputs.lintees != '' && + github.event.pull_request.head.repo.full_name == github.repository uses: yuzutech/annotations-action@v0.6.0 with: repo-token: "${{ secrets.GITHUB_TOKEN }}"