fix(admin): restrict admin-only routes to administrators #6885
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Auto Format | |
| # Stage 1 of 2 (producer). Runs with the default read-only token and never | |
| # pushes or comments, so it is safe to format PR-authored code — including | |
| # from forks. The companion "Auto Format — Apply" workflow (triggered by | |
| # workflow_run) commits the result back with elevated permissions, isolated | |
| # from PR-authored code. | |
| on: | |
| pull_request: | |
| branches: [main] | |
| types: [opened, synchronize] | |
| permissions: | |
| contents: read | |
| jobs: | |
| format: | |
| name: Format | |
| # Skip the bot's own format commits to avoid a re-format loop. | |
| if: github.actor != 'emdashbot[bot]' | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 10 | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| with: | |
| ref: ${{ github.event.pull_request.head.sha }} | |
| persist-credentials: false | |
| - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 | |
| with: | |
| node-version: 22 | |
| - name: Run formatter | |
| run: npx oxfmt@0.58.0 --ignore-path .gitignore | |
| - name: Compute patch | |
| id: patch | |
| run: | | |
| git add -A | |
| if git diff --staged --quiet; then | |
| echo "changed=false" >> "$GITHUB_OUTPUT" | |
| echo "Already formatted — nothing to apply." | |
| else | |
| echo "changed=true" >> "$GITHUB_OUTPUT" | |
| mkdir -p auto-format-out | |
| git diff --staged --binary > auto-format-out/format.patch | |
| echo "${{ github.event.pull_request.number }}" > auto-format-out/pr-number | |
| echo "Formatting changes detected — uploading patch for the Apply workflow." | |
| fi | |
| - name: Upload patch artifact | |
| if: steps.patch.outputs.changed == 'true' | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: auto-format-patch | |
| path: auto-format-out/ | |
| retention-days: 7 | |
| if-no-files-found: error |