actions/pr-lint/action.yml

# yaml-language-server: $schema=https://json.schemastore.org/github-action.json
# permissions:
#   - contents: write  # Required for committing linter fixes
#   - pull-requests: write  # Required for creating pull requests with fixes
---
# MegaLinter GitHub Action configuration file
# More info at https://megalinter.io
name: PR Lint
description: Runs MegaLinter against pull requests
author: Ismo Vuorinen

branding:
  icon: check-circle
  color: green

inputs:
  token:
    description: 'GitHub token for authentication'
    required: false
    default: ''
  username:
    description: 'GitHub username for commits'
    required: false
    default: 'github-actions'
  email:
    description: 'GitHub email for commits'
    required: false
    default: 'github-actions@github.com'

outputs:
  validation_status:
    description: 'Overall validation status (success/failure)'
    value: ${{ steps.ml.outputs.has_updated_sources == '1' && 'failure' || 'success' }}
  errors_found:
    description: 'Number of linting errors found'
    value: ${{ steps.ml.outputs.has_updated_sources }}

runs:
  using: composite
  steps:
    - name: Validate Inputs
      id: validate
      uses: ivuorinen/actions/validate-inputs@0fa9a68f07a1260b321f814202658a6089a43d42
      with:
        action-type: pr-lint
        token: ${{ inputs.token }}
        username: ${{ inputs.username }}
        email: ${{ inputs.email }}

    #   ╭──────────────────────────────────────────────────────────╮
    #   │                       Git Checkout                       │
    #   ╰──────────────────────────────────────────────────────────╯
    - name: Checkout Code
      uses: actions/checkout@71cf2267d89c5cb81562390fa70a37fa40b1305e # v6-beta
      with:
        token: ${{ inputs.token || github.token }}
        ref: ${{ github.event.pull_request.head.ref || github.head_ref || github.ref_name }}
        persist-credentials: false

        # If you use VALIDATE_ALL_CODEBASE = true, you can remove this line to
        # improve performance
        fetch-depth: 0

    #   ╭──────────────────────────────────────────────────────────╮
    #   │               Install packages for linting               │
    #   ╰──────────────────────────────────────────────────────────╯

    # Node.js tests if package.json exists
    - name: Detect package.json
      id: detect-node
      shell: sh
      run: |
        set -eu

        if [ -f package.json ]; then
          printf '%s\n' "found=true" >> "$GITHUB_OUTPUT"
        fi

    - name: Detect Package Manager
      if: steps.detect-node.outputs.found == 'true'
      id: detect-pm
      shell: sh
      run: |
        set -eu

        # Detect package manager from lockfiles
        if [ -f bun.lockb ]; then
          package_manager="bun"
        elif [ -f pnpm-lock.yaml ]; then
          package_manager="pnpm"
        elif [ -f yarn.lock ]; then
          package_manager="yarn"
        else
          package_manager="npm"
        fi

        printf 'package-manager=%s\n' "$package_manager" >> "$GITHUB_OUTPUT"
        echo "Detected package manager: $package_manager"

    - name: Setup Node.js
      if: steps.detect-node.outputs.found == 'true'
      uses: actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903 # v6.0.0
      with:
        node-version: '22'

    - name: Enable Corepack
      if: steps.detect-node.outputs.found == 'true'
      shell: sh
      run: |
        set -eu
        corepack enable

    - name: Install Package Manager
      if: steps.detect-node.outputs.found == 'true'
      shell: sh
      env:
        PACKAGE_MANAGER: ${{ steps.detect-pm.outputs.package-manager }}
      run: |
        set -eu

        case "$PACKAGE_MANAGER" in
          pnpm)
            corepack prepare pnpm@latest --activate
            ;;
          yarn)
            corepack prepare yarn@stable --activate
            ;;
          bun|npm)
            # Bun installed separately, npm built-in
            ;;
        esac

    - name: Setup Bun
      if: steps.detect-node.outputs.found == 'true' && steps.detect-pm.outputs.package-manager == 'bun'
      uses: oven-sh/setup-bun@735343b667d3e6f658f44d0eca948eb6282f2b76 # v2.0.2
      with:
        bun-version: latest

    - name: Cache Node Dependencies
      if: steps.detect-node.outputs.found == 'true'
      id: node-cache
      uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
      with:
        path: node_modules
        key: ${{ runner.os }}-pr-lint-${{ steps.detect-pm.outputs.package-manager }}-${{ hashFiles('package-lock.json', 'yarn.lock', 'pnpm-lock.yaml', 'bun.lockb') }}
        restore-keys: |
          ${{ runner.os }}-pr-lint-${{ steps.detect-pm.outputs.package-manager }}-

    - name: Install Node Dependencies
      if: steps.detect-node.outputs.found == 'true' && steps.node-cache.outputs.cache-hit != 'true'
      shell: sh
      env:
        PACKAGE_MANAGER: ${{ steps.detect-pm.outputs.package-manager }}
      run: |
        set -eu

        echo "Installing dependencies using $PACKAGE_MANAGER..."

        case "$PACKAGE_MANAGER" in
          "pnpm")
            pnpm install --frozen-lockfile
            ;;
          "yarn")
            if [ -f ".yarnrc.yml" ]; then
              yarn install --immutable
            else
              yarn install --frozen-lockfile
            fi
            ;;
          "bun")
            bun install --frozen-lockfile
            ;;
          "npm"|*)
            npm ci
            ;;
        esac

        echo "✅ Dependencies installed successfully"

    # PHP tests if composer.json exists
    - name: Detect composer.json
      id: detect-php
      shell: sh
      run: |
        set -eu

        if [ -f composer.json ]; then
          printf '%s\n' "found=true" >> "$GITHUB_OUTPUT"
        fi

    - name: Detect PHP Version
      if: steps.detect-php.outputs.found == 'true'
      id: php-version
      shell: sh
      env:
        DEFAULT_VERSION: '8.4'
      run: |
        set -eu

        # Function to validate version format
        validate_version() {
          version=$1
          case "$version" in
            [0-9]*\.[0-9]* | [0-9]*\.[0-9]*\.[0-9]*)
              return 0
              ;;
            *)
              return 1
              ;;
          esac
        }

        # Function to clean version string
        clean_version() {
          printf '%s' "$1" | sed 's/^[vV]//' | tr -d ' \n\r'
        }

        detected_version=""

        # Parse .tool-versions file
        if [ -f .tool-versions ]; then
          echo "Checking .tool-versions for php..." >&2
          version=$(awk '/^php[[:space:]]/ {gsub(/#.*/, ""); print $2; exit}' .tool-versions 2>/dev/null || echo "")
          if [ -n "$version" ]; then
            version=$(clean_version "$version")
            if validate_version "$version"; then
              echo "Found PHP version in .tool-versions: $version" >&2
              detected_version="$version"
            fi
          fi
        fi

        # Parse Dockerfile
        if [ -z "$detected_version" ] && [ -f Dockerfile ]; then
          echo "Checking Dockerfile for php..." >&2
          version=$(grep -iF "FROM" Dockerfile | grep -F "php:" | head -1 | \
            sed -n -E "s/.*php:([0-9]+(\.[0-9]+)*)(-[^:]*)?.*/\1/p" || echo "")
          if [ -n "$version" ]; then
            version=$(clean_version "$version")
            if validate_version "$version"; then
              echo "Found PHP version in Dockerfile: $version" >&2
              detected_version="$version"
            fi
          fi
        fi

        # Parse devcontainer.json
        if [ -z "$detected_version" ] && [ -f .devcontainer/devcontainer.json ]; then
          echo "Checking devcontainer.json for php..." >&2
          if command -v jq >/dev/null 2>&1; then
            version=$(jq -r '.image // empty' .devcontainer/devcontainer.json 2>/dev/null | sed -n -E "s/.*php:([0-9]+(\.[0-9]+)*)(-[^:]*)?.*/\1/p" || echo "")
            if [ -n "$version" ]; then
              version=$(clean_version "$version")
              if validate_version "$version"; then
                echo "Found PHP version in devcontainer: $version" >&2
                detected_version="$version"
              fi
            fi
          else
            echo "jq not found; skipping devcontainer.json parsing" >&2
          fi
        fi

        # Parse .php-version file
        if [ -z "$detected_version" ] && [ -f .php-version ]; then
          echo "Checking .php-version..." >&2
          version=$(tr -d '\r' < .php-version | head -1)
          if [ -n "$version" ]; then
            version=$(clean_version "$version")
            if validate_version "$version"; then
              echo "Found PHP version in .php-version: $version" >&2
              detected_version="$version"
            fi
          fi
        fi

        # Parse composer.json
        if [ -z "$detected_version" ] && [ -f composer.json ]; then
          echo "Checking composer.json..." >&2
          if command -v jq >/dev/null 2>&1; then
            version=$(jq -r '.require.php // empty' composer.json 2>/dev/null | sed -n 's/[^0-9]*\([0-9]\+\.[0-9]\+\(\.[0-9]\+\)\?\).*/\1/p')
            if [ -z "$version" ]; then
              version=$(jq -r '.config.platform.php // empty' composer.json 2>/dev/null | sed -n 's/[^0-9]*\([0-9]\+\.[0-9]\+\(\.[0-9]\+\)\?\).*/\1/p')
            fi
            if [ -n "$version" ]; then
              version=$(clean_version "$version")
              if validate_version "$version"; then
                echo "Found PHP version in composer.json: $version" >&2
                detected_version="$version"
              fi
            fi
          else
            echo "jq not found; skipping composer.json parsing" >&2
          fi
        fi

        # Use default version if nothing detected
        if [ -z "$detected_version" ]; then
          detected_version="$DEFAULT_VERSION"
          echo "Using default PHP version: $detected_version" >&2
        fi

        # Set output
        printf 'detected-version=%s\n' "$detected_version" >> "$GITHUB_OUTPUT"
        echo "Final detected PHP version: $detected_version" >&2

    - name: Setup PHP
      if: steps.detect-php.outputs.found == 'true'
      uses: shivammathur/setup-php@bf6b4fbd49ca58e4608c9c89fba0b8d90bd2a39f # 2.35.5
      with:
        php-version: ${{ steps.php-version.outputs.detected-version }}
        tools: composer
        coverage: none
      env:
        GITHUB_TOKEN: ${{ inputs.token }}

    - name: Setup problem matchers for PHP
      if: steps.detect-php.outputs.found == 'true'
      shell: sh
      env:
        RUNNER_TOOL_CACHE: ${{ runner.tool_cache }}
      run: |
        set -eu

        echo "::add-matcher::$RUNNER_TOOL_CACHE/php.json"

    - name: Install PHP dependencies
      if: steps.detect-php.outputs.found == 'true'
      shell: sh
      run: |
        set -eu

        composer install --no-progress --prefer-dist --no-interaction

    # Python tests if requirements.txt exists
    - name: Detect requirements.txt
      id: detect-python
      shell: sh
      run: |
        set -eu

        if [ -f requirements.txt ]; then
          printf '%s\n' "found=true" >> "$GITHUB_OUTPUT"
        fi

    - name: Detect Python Version
      if: steps.detect-python.outputs.found == 'true'
      id: python-version
      shell: sh
      env:
        DEFAULT_VERSION: '3.11'
      run: |
        set -eu

        # Function to validate version format
        validate_version() {
          version=$1
          case "$version" in
            [0-9]*\.[0-9]* | [0-9]*\.[0-9]*\.[0-9]*)
              return 0
              ;;
            *)
              return 1
              ;;
          esac
        }

        # Function to clean version string
        clean_version() {
          printf '%s' "$1" | sed 's/^[vV]//' | tr -d ' \n\r'
        }

        detected_version=""

        # Parse .tool-versions file
        if [ -f .tool-versions ]; then
          echo "Checking .tool-versions for python..." >&2
          version=$(awk '/^python[[:space:]]/ {gsub(/#.*/, ""); print $2; exit}' .tool-versions 2>/dev/null || echo "")
          if [ -n "$version" ]; then
            version=$(clean_version "$version")
            if validate_version "$version"; then
              echo "Found Python version in .tool-versions: $version" >&2
              detected_version="$version"
            fi
          fi
        fi

        # Parse Dockerfile
        if [ -z "$detected_version" ] && [ -f Dockerfile ]; then
          echo "Checking Dockerfile for python..." >&2
          version=$(grep -iF "FROM" Dockerfile | grep -F "python:" | head -1 | \
            sed -n -E "s/.*python:([0-9]+(\.[0-9]+)*)(-[^:]*)?.*/\1/p" || echo "")
          if [ -n "$version" ]; then
            version=$(clean_version "$version")
            if validate_version "$version"; then
              echo "Found Python version in Dockerfile: $version" >&2
              detected_version="$version"
            fi
          fi
        fi

        # Parse devcontainer.json
        if [ -z "$detected_version" ] && [ -f .devcontainer/devcontainer.json ]; then
          echo "Checking devcontainer.json for python..." >&2
          if command -v jq >/dev/null 2>&1; then
            version=$(jq -r '.image // empty' .devcontainer/devcontainer.json 2>/dev/null | sed -n -E "s/.*python:([0-9]+(\.[0-9]+)*)(-[^:]*)?.*/\1/p" || echo "")
            if [ -n "$version" ]; then
              version=$(clean_version "$version")
              if validate_version "$version"; then
                echo "Found Python version in devcontainer: $version" >&2
                detected_version="$version"
              fi
            fi
          else
            echo "jq not found; skipping devcontainer.json parsing" >&2
          fi
        fi

        # Parse .python-version file
        if [ -z "$detected_version" ] && [ -f .python-version ]; then
          echo "Checking .python-version..." >&2
          version=$(tr -d '\r' < .python-version | head -1)
          if [ -n "$version" ]; then
            version=$(clean_version "$version")
            if validate_version "$version"; then
              echo "Found Python version in .python-version: $version" >&2
              detected_version="$version"
            fi
          fi
        fi

        # Parse pyproject.toml
        if [ -z "$detected_version" ] && [ -f pyproject.toml ]; then
          echo "Checking pyproject.toml..." >&2
          if grep -q '^\\[project\\]' pyproject.toml; then
            version=$(grep -A 20 '^\\[project\\]' pyproject.toml | grep -E '^\\s*requires-python[[:space:]]*=' | sed -n 's/[^0-9]*\([0-9]\+\.[0-9]\+\(\.[0-9]\+\)\?\).*/\1/p' | head -1)
            if [ -n "$version" ]; then
              version=$(clean_version "$version")
              if validate_version "$version"; then
                echo "Found Python version in pyproject.toml: $version" >&2
                detected_version="$version"
              fi
            fi
          fi
        fi

        # Use default version if nothing detected
        if [ -z "$detected_version" ]; then
          detected_version="$DEFAULT_VERSION"
          echo "Using default Python version: $detected_version" >&2
        fi

        # Set output
        printf 'detected-version=%s\n' "$detected_version" >> "$GITHUB_OUTPUT"
        echo "Final detected Python version: $detected_version" >&2

    - name: Setup Python
      if: steps.detect-python.outputs.found == 'true'
      uses: actions/setup-python@e797f83bcb11b83ae66e0230d6156d7c80228e7c # v6.0.0
      with:
        python-version: ${{ steps.python-version.outputs.detected-version }}
        cache: 'pip'

    - name: Install Python dependencies
      if: steps.detect-python.outputs.found == 'true'
      shell: sh
      run: |
        set -eu

        pip install -r requirements.txt

    # Go tests if go.mod exists
    - name: Detect go.mod
      id: detect-go
      shell: sh
      run: |
        set -eu

        if [ -f go.mod ]; then
          printf '%s\n' "found=true" >> "$GITHUB_OUTPUT"
        fi

    - name: Detect Go Version
      if: steps.detect-go.outputs.found == 'true'
      id: go-version
      shell: sh
      env:
        DEFAULT_VERSION: '1.24'
      run: |
        set -eu

        # Function to validate version format
        validate_version() {
          version=$1
          case "$version" in
            [0-9]*\.[0-9]* | [0-9]*\.[0-9]*\.[0-9]*)
              return 0
              ;;
            *)
              return 1
              ;;
          esac
        }

        # Function to clean version string
        clean_version() {
          printf '%s' "$1" | sed 's/^[vV]//' | tr -d ' \n\r'
        }

        detected_version=""

        # Parse .tool-versions file
        if [ -f .tool-versions ]; then
          echo "Checking .tool-versions for golang..." >&2
          version=$(awk '/^golang[[:space:]]/ {gsub(/#.*/, ""); print $2; exit}' .tool-versions 2>/dev/null || echo "")
          if [ -n "$version" ]; then
            version=$(clean_version "$version")
            if validate_version "$version"; then
              echo "Found Go version in .tool-versions: $version" >&2
              detected_version="$version"
            fi
          fi
        fi

        # Parse Dockerfile
        if [ -z "$detected_version" ] && [ -f Dockerfile ]; then
          echo "Checking Dockerfile for golang..." >&2
          version=$(grep -iF "FROM" Dockerfile | grep -F "golang:" | head -1 | \
            sed -n -E "s/.*golang:([0-9]+(\.[0-9]+)*)(-[^:]*)?.*/\1/p" || echo "")
          if [ -n "$version" ]; then
            version=$(clean_version "$version")
            if validate_version "$version"; then
              echo "Found Go version in Dockerfile: $version" >&2
              detected_version="$version"
            fi
          fi
        fi

        # Parse devcontainer.json
        if [ -z "$detected_version" ] && [ -f .devcontainer/devcontainer.json ]; then
          echo "Checking devcontainer.json for golang..." >&2
          if command -v jq >/dev/null 2>&1; then
            version=$(jq -r '.image // empty' .devcontainer/devcontainer.json 2>/dev/null | sed -n -E "s/.*golang:([0-9]+(\.[0-9]+)*)(-[^:]*)?.*/\1/p" || echo "")
            if [ -n "$version" ]; then
              version=$(clean_version "$version")
              if validate_version "$version"; then
                echo "Found Go version in devcontainer: $version" >&2
                detected_version="$version"
              fi
            fi
          else
            echo "jq not found; skipping devcontainer.json parsing" >&2
          fi
        fi

        # Parse .go-version file
        if [ -z "$detected_version" ] && [ -f .go-version ]; then
          echo "Checking .go-version..." >&2
          version=$(tr -d '\r' < .go-version | head -1)
          if [ -n "$version" ]; then
            version=$(clean_version "$version")
            if validate_version "$version"; then
              echo "Found Go version in .go-version: $version" >&2
              detected_version="$version"
            fi
          fi
        fi

        # Parse go.mod
        if [ -z "$detected_version" ] && [ -f go.mod ]; then
          echo "Checking go.mod..." >&2
          version=$(grep -E '^go[[:space:]]+[0-9]' go.mod | awk '{print $2}' | head -1 || echo "")
          if [ -n "$version" ]; then
            version=$(clean_version "$version")
            if validate_version "$version"; then
              echo "Found Go version in go.mod: $version" >&2
              detected_version="$version"
            fi
          fi
        fi

        # Use default version if nothing detected
        if [ -z "$detected_version" ]; then
          detected_version="$DEFAULT_VERSION"
          echo "Using default Go version: $detected_version" >&2
        fi

        # Set output
        printf 'detected-version=%s\n' "$detected_version" >> "$GITHUB_OUTPUT"
        echo "Final detected Go version: $detected_version" >&2

    - name: Setup Go
      if: steps.detect-go.outputs.found == 'true'
      uses: actions/setup-go@44694675825211faa026b3c33043df3e48a5fa00 # v6.0.0
      with:
        go-version: ${{ steps.go-version.outputs.detected-version }}
        cache: true

    #   ╭──────────────────────────────────────────────────────────╮
    #   │                        MegaLinter                        │
    #   ╰──────────────────────────────────────────────────────────╯
    - name: MegaLinter
      # You can override MegaLinter flavor used to have faster performances
      # More info at https://megalinter.io/latest/flavors/
      uses: oxsecurity/megalinter/flavors/cupcake@62c799d895af9bcbca5eacfebca29d527f125a57 # v9.1.0
      id: ml

      # All available variables are described in documentation
      # https://megalinter.io/latest/configuration/
      env:
        # Validates all source when push on main, else just the git diff with
        # main. Override with true if you always want to lint all sources
        #
        # To validate the entire codebase, set to:
        # VALIDATE_ALL_CODEBASE: true
        #
        # To validate only diff with main, set to:
        # VALIDATE_ALL_CODEBASE: >-
        #   ${{
        #     github.event_name == 'push' &&
        #     contains(fromJSON('["refs/heads/main", "refs/heads/master"]'), github.ref)
        #   }}
        VALIDATE_ALL_CODEBASE: >-
          ${{
            github.event_name == 'push' &&
            contains(fromJSON('["refs/heads/main", "refs/heads/master"]'), github.ref)
          }}

        GITHUB_TOKEN: ${{ inputs.token || github.token }}

        # Apply linter fixes configuration
        #
        # When active, APPLY_FIXES must also be defined as environment variable
        # (in .github/workflows/mega-linter.yml or other CI tool)
        APPLY_FIXES: all

        # Decide which event triggers application of fixes in a commit or a PR
        # (pull_request, push, all)
        APPLY_FIXES_EVENT: pull_request

        # If APPLY_FIXES is used, defines if the fixes are directly committed (commit)
        # or posted in a PR (pull_request)
        APPLY_FIXES_MODE: commit

        # ADD YOUR CUSTOM ENV VARIABLES HERE OR DEFINE THEM IN A FILE
        # .mega-linter.yml AT THE ROOT OF YOUR REPOSITORY

        # Uncomment to disable copy-paste and spell checks
        DISABLE: COPYPASTE,SPELL

    # Export env vars to make them available for subsequent expressions
    - name: Export Apply Fixes Variables
      shell: sh
      run: |
        echo "APPLY_FIXES_EVENT=pull_request" >> "$GITHUB_ENV"
        echo "APPLY_FIXES_MODE=commit" >> "$GITHUB_ENV"

    # Upload MegaLinter artifacts
    - name: Archive production artifacts
      if: success() || failure()
      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
      with:
        name: MegaLinter reports
        include-hidden-files: 'true'
        path: |
          megalinter-reports
          mega-linter.log

    # Set APPLY_FIXES_IF var for use in future steps
    - name: Set APPLY_FIXES_IF var
      shell: sh
      env:
        APPLY_FIXES_CONDITION: >-
          ${{
            steps.ml.outputs.has_updated_sources == 1 &&
            (env.APPLY_FIXES_EVENT == 'all' || env.APPLY_FIXES_EVENT == github.event_name) &&
            (github.event_name == 'push' || github.event.pull_request.head.repo.full_name == github.repository)
          }}
      run: |
        set -eu

        # Sanitize by removing newlines to prevent env var injection
        sanitized_condition="$(echo "$APPLY_FIXES_CONDITION" | tr -d '\n\r')"
        printf 'APPLY_FIXES_IF=%s\n' "$sanitized_condition" >> "${GITHUB_ENV}"

    # Set APPLY_FIXES_IF_* vars for use in future steps
    - name: Set APPLY_FIXES_IF_* vars
      shell: sh
      env:
        APPLY_FIXES_IF_PR_CONDITION: ${{ env.APPLY_FIXES_IF == 'true' && env.APPLY_FIXES_MODE == 'pull_request' }}
        APPLY_FIXES_IF_COMMIT_CONDITION: ${{ env.APPLY_FIXES_IF == 'true' && env.APPLY_FIXES_MODE == 'commit' && (!contains(fromJSON('["refs/heads/main", "refs/heads/master"]'), github.ref)) }}
      run: |
        set -eu

        # Sanitize by removing newlines to prevent env var injection
        sanitized_pr="$(echo "$APPLY_FIXES_IF_PR_CONDITION" | tr -d '\n\r')"
        sanitized_commit="$(echo "$APPLY_FIXES_IF_COMMIT_CONDITION" | tr -d '\n\r')"

        printf 'APPLY_FIXES_IF_PR=%s\n' "$sanitized_pr" >> "${GITHUB_ENV}"
        printf 'APPLY_FIXES_IF_COMMIT=%s\n' "$sanitized_commit" >> "${GITHUB_ENV}"

    # Create pull request if applicable
    # (for now works only on PR from same repository, not from forks)
    - name: Create Pull Request with applied fixes
      uses: peter-evans/create-pull-request@271a8d0340265f705b14b6d32b9829c1cb33d45e # v7.0.8
      id: cpr
      if: env.APPLY_FIXES_IF_PR == 'true'
      with:
        token: ${{ inputs.token || github.token }}
        commit-message: 'style: apply linter fixes'
        title: 'style: apply linter fixes'
        labels: bot

    - name: Create PR output
      if: env.APPLY_FIXES_IF_PR == 'true'
      shell: sh
      env:
        PR_NUMBER: ${{ steps.cpr.outputs.pull-request-number }}
        PR_URL: ${{ steps.cpr.outputs.pull-request-url }}
      run: |
        set -eu

        echo "PR Number - $PR_NUMBER"
        echo "PR URL - $PR_URL"

    # Push new commit if applicable
    # (for now works only on PR from same repository, not from forks)
    - name: Prepare commit
      if: env.APPLY_FIXES_IF_COMMIT == 'true'
      shell: sh
      env:
        BRANCH_REF: >-
          ${{
            github.event.pull_request.head.ref ||
            github.head_ref ||
            github.ref_name
          }}
      run: |
        set -eu

        # Fix .git directory ownership after MegaLinter container execution
        sudo chown -Rc "$UID" .git/

        # Ensure we're on the correct branch (not in detached HEAD state)
        # This is necessary because MegaLinter may leave the repo in a detached HEAD state
        current_branch=$(git rev-parse --abbrev-ref HEAD)
        if [ "$current_branch" = "HEAD" ]; then
          echo "Repository is in detached HEAD state, checking out $BRANCH_REF"
          # Validate branch reference to prevent command injection
          if ! git check-ref-format --branch "$BRANCH_REF"; then
            echo "::error::Invalid branch reference format: $BRANCH_REF"
            exit 1
          fi
          git checkout "$BRANCH_REF"
        else
          echo "Repository is on branch: $current_branch"
        fi

    - name: Commit and push applied linter fixes
      uses: stefanzweifel/git-auto-commit-action@28e16e81777b558cc906c8750092100bbb34c5e3 # v7.0.0
      if: env.APPLY_FIXES_IF_COMMIT == 'true'
      with:
        branch: >-
          ${{
            github.event.pull_request.head.ref ||
            github.head_ref ||
            github.ref
          }}
        commit_message: 'style: apply linter fixes'
        commit_user_name: ${{ inputs.username }}
        commit_user_email: ${{ inputs.email }}