u

Signed-off-by: Joe Isaacs <joe.isaacs@live.co.uk>

Author: joseph-isaacs

.github/workflows/fmt-fix.yml

@@ -13,78 +13,72 @@ env:
   NIGHTLY_TOOLCHAIN: nightly-2026-02-05
 
 jobs:
-  check-ci-fmt:
-    name: "Check if CI fmt failed"
-    # Only act on PR runs that completed (success or failure — the fmt step
-    # uses continue-on-error so the workflow can "succeed" even when fmt fails).
-    if: github.event.workflow_run.event == 'pull_request'
+  check-lint-failed:
+    name: "Check if rust-lint failed"
+    # Only run when the triggering workflow was for a PR.
+    if: >-
+      github.event.workflow_run.event == 'pull_request'
+      && github.event.workflow_run.conclusion == 'failure'
     runs-on: ubuntu-latest
     timeout-minutes: 5
     outputs:
-      fmt-failed: ${{ steps.check.outputs.fmt-failed }}
-      head-sha: ${{ steps.check.outputs.head-sha }}
-      head-ref: ${{ steps.check.outputs.head-ref }}
+      lint-failed: ${{ steps.check-job.outputs.lint-failed }}
+      pr-head-sha: ${{ steps.resolve.outputs.head-sha }}
+      pr-head-ref: ${{ steps.resolve.outputs.head-ref }}
     steps:
-      - name: Check CI fmt step outcome
-        id: check
+      - name: Resolve PR ref
+        id: resolve
         uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea  # v7
         with:
           script: |
-            const runId = context.payload.workflow_run.id;
-            const headSha = context.payload.workflow_run.head_sha;
-            const headBranch = context.payload.workflow_run.head_branch;
+            const wr = context.payload.workflow_run;
+            core.setOutput('head-sha', wr.head_sha);
+            core.setOutput('head-ref', wr.head_branch);
 
-            // Find the "Rust (lint)" job in the CI run.
-            const { data: { jobs } } = await github.rest.actions.listJobsForWorkflowRun({
-              ...context.repo,
-              run_id: runId,
+      - name: Check if rust-lint job failed
+        id: check-job
+        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea  # v7
+        with:
+          script: |
+            const jobs = await github.rest.actions.listJobsForWorkflowRun({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              run_id: context.payload.workflow_run.id,
             });
-            const lintJob = jobs.find(j => j.name === 'Rust (lint)');
-            if (!lintJob) {
-              core.info('Rust (lint) job not found — skipping');
-              core.setOutput('fmt-failed', 'false');
-              return;
-            }
-
-            // Find the fmt step by its id ("fmt") or name.
-            const fmtStep = lintJob.steps.find(
-              s => s.name === 'Rust Lint - Format'
-            );
-            if (!fmtStep) {
-              core.info('fmt step not found — skipping');
-              core.setOutput('fmt-failed', 'false');
-              return;
+            const lintJob = jobs.data.jobs.find(j => j.name === 'Rust (lint)');
+            const failed = lintJob && lintJob.conclusion === 'failure';
+            core.setOutput('lint-failed', failed ? 'true' : 'false');
+            if (!failed) {
+              core.info('rust-lint did not fail, skipping fmt fix');
             }
 
-            const failed = fmtStep.conclusion === 'failure';
-            core.info(`fmt step conclusion: ${fmtStep.conclusion}`);
-            core.setOutput('fmt-failed', String(failed));
-            core.setOutput('head-sha', headSha);
-            core.setOutput('head-ref', headBranch);
-
   apply-fmt:
     name: "Apply formatting fix"
-    needs: check-ci-fmt
-    if: needs.check-ci-fmt.outputs.fmt-failed == 'true'
+    needs: check-lint-failed
+    if: needs.check-lint-failed.outputs.lint-failed == 'true'
     runs-on: ubuntu-latest
     timeout-minutes: 15
+    # The fmt-fix environment must be configured with required reviewers
+    # in the repo settings. This creates an accept/reject gate on the PR
+    # before the fmt commit is pushed.
     environment: fmt-fix
     permissions:
       contents: write
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6
         with:
-          # Check out the exact commit that CI ran against, not the latest
-          # branch HEAD (which may have moved during the approval wait).
-          ref: ${{ needs.check-ci-fmt.outputs.head-sha }}
+          ref: ${{ needs.check-lint-failed.outputs.pr-head-sha }}
 
       - name: Install nightly for fmt
         run: rustup toolchain install $NIGHTLY_TOOLCHAIN --component rustfmt
 
       - name: Run cargo fmt
         run: cargo +$NIGHTLY_TOOLCHAIN fmt --all
 
-      - name: Commit fix
+      - name: Commit and push
+        env:
+          EXPECTED_SHA: ${{ needs.check-lint-failed.outputs.pr-head-sha }}
+          BRANCH: ${{ needs.check-lint-failed.outputs.pr-head-ref }}
         run: |
           git config user.name "github-actions[bot]"
           git config user.email "github-actions[bot]@users.noreply.github.com"
@@ -94,14 +88,9 @@ jobs:
 
           Signed-off-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>"
 
-      - name: Push (fails if branch moved since CI ran)
-        env:
-          EXPECTED_SHA: ${{ needs.check-ci-fmt.outputs.head-sha }}
-          BRANCH: ${{ needs.check-ci-fmt.outputs.head-ref }}
-        run: |
           # --force-with-lease atomically checks that the remote branch HEAD
           # is still EXPECTED_SHA before pushing. If someone else pushed a
-          # commit to the PR between the CI run and approval, this fails safely.
+          # commit to the PR between trigger and approval, this fails safely.
           git push origin \
             "HEAD:refs/heads/$BRANCH" \
             "--force-with-lease=refs/heads/$BRANCH:$EXPECTED_SHA"