Ruff workflow (taylorwilsdon/google_workspace_mcp)

name: Ruff
 
on:
  pull_request:
    branches: [ main ]
  push:
    branches: [ main ]
 
permissions:
  contents: read
 
concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true
 
jobs:
  autofix:
    timeout-minutes: 30
    if: github.event.pull_request.head.repo.full_name == github.repository
    runs-on: latchkey-small
    permissions:
      contents: write
    steps:
    - uses: actions/checkout@v6
      with:
        ref: ${{ github.event.pull_request.head.ref }}
        token: ${{ secrets.GITHUB_TOKEN }}
    - uses: actions/setup-python@v6
      with:
        cache: 'pip'
        python-version: '3.11'
    - name: Install uv
      uses: astral-sh/setup-uv@v7
    - name: Auto-fix ruff lint and format
      # Same-repo only (guarded by job `if`), so we still avoid `uv sync`
      # to keep behaviour consistent and minimise blast radius.
      run: |
        uvx ruff check --fix
        uvx ruff format
    - name: Commit and push fixes
      run: |
        git diff --quiet && exit 0
        git config user.name "github-actions[bot]"
        git config user.email "github-actions[bot]@users.noreply.github.com"
        git add -A
        git commit -m "style: auto-fix ruff lint and format"
        git push
 
  ruff:
    timeout-minutes: 30
    if: always() && (github.event_name == 'pull_request' || github.event_name == 'push')
    needs: [autofix]
    runs-on: latchkey-small
    steps:
    - uses: actions/checkout@v6
    - uses: actions/setup-python@v6
      with:
        cache: 'pip'
        python-version: '3.11'
    - name: Install uv
      uses: astral-sh/setup-uv@v7
    - name: Validate
      # Use `uvx` so we run ruff in an isolated environment without invoking
      # the project's build backend or executing pyproject.toml hooks. This
      # keeps the validation step safe to run on untrusted fork PR code.
      # For same-repo PRs, this runs after autofix commits any formatting fixes.
      run: |
        uvx ruff check
        uvx ruff format --check