accept-baselines-fix-lints.yaml

name: Accept Baselines, Fix Lints, and Format

on:
  workflow_dispatch: {}

permissions:
  contents: read
  id-token: write

# Ensure scripts are run with pipefail. See:
# https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#exit-codes-and-error-action-preference
defaults:
  run:
    shell: bash

jobs:
  build:
    runs-on: ubuntu-latest
    environment:
      name: azure
      deployment: false

    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false
      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
          node-version: 'lts/*'

      - name: Configure Git, Run Tests, Update Baselines, Apply Fixes
        run: |
          git config user.email "290192711+typescript-automation[bot]@users.noreply.github.com"
          git config user.name "typescript-automation[bot]"
          npm ci
          git rm -r --quiet tests/baselines/reference
          npx hereby runtests-parallel --ci --fix || true
          npx hereby baseline-accept
          npx hereby format
          git add ./src
          git add ./tests/baselines/reference
          git diff --cached
          git commit -m "Update Baselines, Applied Lint Fixes, and/or Formatted"
      - uses: azure/login@532459ea530d8321f2fb9bb10d1e0bcf23869a43 # v3.0.0
        with:
          client-id: ${{ vars.AZURE_CLIENT_ID }}
          tenant-id: ${{ vars.AZURE_TENANT_ID }}
          subscription-id: ${{ vars.AZURE_SUBSCRIPTION_ID }}
      - name: Create GitHub App token
        id: app-token
        uses: microsoft/create-github-app-token-via-key-vault@5ba0d436e9c3cac52feff4d1f2f66f9698ce4a2d # v1
        with:
          client-id: ${{ vars.TYPESCRIPT_AUTOMATION_GITHUB_APP_CLIENT_ID }}
          key-id: ${{ vars.TYPESCRIPT_AUTOMATION_GITHUB_APP_KEY_ID }}
          owner: microsoft
          repositories: TypeScript
          permission-contents: write
      - name: Configure git for GitHub App token
        shell: bash
        env:
          GITHUB_APP_TOKEN: ${{ steps.app-token.outputs.token }}
        run: |
          set -euo pipefail
          basic_auth="$(node -e 'process.stdout.write(Buffer.from("x-access-token:" + process.env.GITHUB_APP_TOKEN).toString("base64"))')"
          echo "::add-mask::$basic_auth"
          git config --local http.https://github.com/.extraheader "AUTHORIZATION: basic ${basic_auth}"
      - run: git push