feat(ci): Run lint --fix with dirtybot (#17538)

* Add flag support for git-check-dirty.sh

* Add lint:write step

* Compat script

* Revert check-dirty to main

* Run action

* Corrected lint --fix

* Add check-mode

* Move lintfix to linting job

* More parallel

* Add optarg

* Use optarg in lintfix

* Strip [] from affected list

* Add help

* Move action parsing to run_mode

* Split over lines & no check

* move git actions and don't exit on diff

* Don't run on 'dirty bypass' label

* Re-add linting from `main`

* Bad format

* Correct label check

* Use the MAX_JOBS env

* Checkout with token for writing

* chore: nx run-many --target lint --fix --parallel 3 --projects=application-system-form,application-template-api-modules,application-template-loader,application-templates-children-residence-change-v2,application-ui-shell update dirty files

* chore: nx format:write update dirty files

* chore: nx run-many --target lint --fix --parallel 3 --projects=api-domains-disability-license,api-domains-documents,api-domains-driving-license,api-domains-driving-license-book,api-domains-education,api-domains-email-signup,api-domains-endorsement-system update dirty files

* chore: nx run-many --target lint --fix --parallel 3 --projects=api-domains-auth,api-domains-auth-admin,api-domains-communications,api-domains-company-registry,api-domains-content-search,api-domains-criminal-record,api-domains-directorate-of-labour update dirty files

* chore: nx run-many --target lint --fix --parallel 3 --projects=web update dirty files

* chore: nx format:write update dirty files

* Revent apps/ & libs/

* Apply suggestions from code review

Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>

* fail-safe for incorrect usage (@CodeRabbit)

---------

Co-authored-by: andes-it <[email protected]>
Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>

.github/workflows/pullrequest.yml

@@ -367,6 +367,11 @@ jobs:
       matrix: ${{ fromJson(needs.prepare.outputs.LINT_CHUNKS) }}
     steps:
       - uses: actions/checkout@v4
+        if: ${{ github.event_name == 'pull_request' }}
+        # Needed for doing git commit in git-check-dirty script
+        with:
+          token: ${{ secrets.DIRTY_FIX_BOT_TOKEN }}
+          ref: ${{ github.event.pull_request.head.ref }}
       - uses: actions/setup-node@v4
         with:
           node-version-file: 'package.json'
@@ -379,6 +384,19 @@ jobs:
           github-token: ${{ secrets.GITHUB_TOKEN }}
           keys: ${{ needs.prepare.outputs.CACHE_KEYS }}
           enable-cache: 'node_modules,generated-files'
+      - name: Lintfix
+        if: ${{ !contains(github.event.pull_request.labels.*.name, 'dirty bypass') }}
+        run: |
+          set -euo pipefail
+          echo "Running lint --fix for affected projects: ${AFFECTED_PROJECTS}"
+          ./infra/scripts/ci/git-check-dirty.sh \
+            -p "/" \
+            -a "nx run-many --target lint --fix --parallel ${MAX_JOBS} --projects=${AFFECTED_PROJECTS//[[\]]}" \
+            -o "dirtybot" \
+            -r || {
+              echo "Error: Lintfix failed. Check the logs above for details." >&2
+              exit 1
+            }
       - name: Linting
         run: ./scripts/ci/run-in-parallel-native.sh lint
 

infra/scripts/ci/git-check-dirty.sh

@@ -6,6 +6,43 @@ rel_path=$1
 abs_path=$DIR/$rel_path
 action=$2
 owner="${3:-github actions}"
+check_mode="${CHECK_MODE:-}"
+run_mode="${RUN_MODE:-}"
+
+while getopts "p:a:o:crh" opt; do
+  case $opt in
+  p) abs_path="$DIR/$OPTARG" ;;
+  a) action="$OPTARG" ;;
+  o) owner="$OPTARG" ;;
+  c) check_mode=true ;;
+  r) run_mode=true ;;
+  h)
+    cat <<EOF
+Usage:
+  $0 <path> <action> <owner>
+  $0 [options]
+
+  The options -p, -a, -o are required if using the second form
+
+Options:
+  -p <path> path to the file to check
+  -a <action> action to run
+  -o <owner> owner to commit as
+  -c check mode
+  -r run mode
+EOF
+    exit 0
+    ;;
+  *) echo "Invalid option: -$OPTARG" >&2 ;;
+  esac
+done
+
+for opt in "$abs_path" "$action" "$owner"; do
+  if [[ -z "$opt" ]] || [[ "$opt" = -* ]]; then
+    echo "A required argument is missing" >&2
+    exit 1
+  fi
+done
 
 commit_as_github_actions() {
   git config user.name 'github-actions[bot]'
@@ -17,10 +54,22 @@ commit_as_dirty_bot() {
   git config user.email '[email protected]'
 }
 
+if [[ "$run_mode" == true ]]; then
+  # Split action into array safely:
+  IFS=' ' read -r -a action_array <<<"$action"
+  if ! yarn "${action_array[@]}"; then
+    echo "Error: Failed to execute yarn command: ${action_array[*]}" >&2
+    exit 1
+  fi
+fi
+
+if [[ "$check_mode" == true ]] && ! git diff --quiet; then
+  echo "found unstaged files from $action, aborting"
+  exit 1
+fi
 if [[ $(git diff --stat "$abs_path") != '' ]]; then
   echo "changes found in $rel_path that will be commited"
-  git diff "$abs_path"
-  git add "$abs_path"
+  git diff "$abs_path" || true
   if [ "$owner" == "github actions" ]; then
     commit_as_github_actions
   elif [ "$owner" == "dirtybot" ]; then
@@ -29,7 +78,7 @@ if [[ $(git diff --stat "$abs_path") != '' ]]; then
     echo "Error: Unknown owner!"
     exit 1
   fi
-  git commit -m "chore: $action update dirty files"
+  git commit -am "chore: $action update dirty files"
   git push
 else
   echo "found no unstaged files from $action, nothing to commit"