ci: fix SQLFluff annotation permissions for fork PRs

.github/workflows/lint_sqlfluff.yml

@@ -1,11 +1,17 @@
 name: SQLFluff
 
+# Lints changed mimic-iv/concepts/*.sql on pull requests and posts GitHub
+# annotations. Fork PRs skip Annotate — GITHUB_TOKEN cannot create check runs
+# from forks (Resource not accessible by integration / 403).
 on:
   - pull_request
 
 jobs:
   lint-mimic-iv:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      checks: write
     steps:
       - name: checkout
         uses: actions/checkout@v7
@@ -35,8 +41,14 @@ jobs:
         shell: bash
         run: sqlfluff lint --format github-annotation --annotation-level failure --nofail ${{ steps.get_files_to_lint.outputs.lintees }} > annotations.json
       - name: Annotate
+        # Same-repo PRs only: fork tokens get 403 creating check runs, and
+        # ignore-unauthorized-error does not treat that as unauthorized.
+        if: >
+          steps.get_files_to_lint.outputs.lintees != '' &&
+          github.event.pull_request.head.repo.full_name == github.repository
         uses: yuzutech/annotations-action@v0.6.0
         with:
           repo-token: "${{ secrets.GITHUB_TOKEN }}"
           title: "SQLFluff Lint"
-          input: "./annotations.json"
+          input: "./annotations.json"
+          ignore-unauthorized-error: true

scripts/lint_changed_mimic_iv_concepts.sh

@@ -0,0 +1,12 @@
+#!/usr/bin/env bash
+# Local mirror of .github/workflows/lint_sqlfluff.yml for changed concept SQL.
+set -euo pipefail
+BASE_REF="${1:-origin/main}"
+files="$(git diff --name-only --diff-filter=AM "${BASE_REF}...HEAD" -- 'mimic-iv/concepts/' \
+  | grep -E '[.]sql$' || true)"
+if [[ -z "${files}" ]]; then
+  echo "No changed mimic-iv/concepts SQL files versus ${BASE_REF}."
+  exit 0
+fi
+# shellcheck disable=SC2086
+sqlfluff lint ${files}

styleguide.md

@@ -27,3 +27,7 @@ For more detail, following the guidelines at: http://www.sqlstyle.guide/
 ## Python
 
 Following PEP8 guidelines is recommended. Read more here: https://www.python.org/dev/peps/pep-0008/
+
+## SQL style checking
+
+Pull requests that change `mimic-iv/concepts/**/*.sql` are linted by the SQLFluff GitHub Action (`.github/workflows/lint_sqlfluff.yml`). Findings are posted as pull-request annotations when the workflow has permission to write checks.