From f60ecb934ca333fe9716eca99306051e9d66cd86 Mon Sep 17 00:00:00 2001 From: Taksh Date: Fri, 31 Jul 2026 15:05:50 +0300 Subject: [PATCH 1/6] ci(sqlfluff): declare contents/checks permissions for annotations Fork PRs need an explicit checks:write grant so the annotation action can post findings without relying on the default GITHUB_TOKEN scope. --- .github/workflows/lint_sqlfluff.yml | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/.github/workflows/lint_sqlfluff.yml b/.github/workflows/lint_sqlfluff.yml index 0986785b..3900182d 100644 --- a/.github/workflows/lint_sqlfluff.yml +++ b/.github/workflows/lint_sqlfluff.yml @@ -6,6 +6,9 @@ on: jobs: lint-mimic-iv: runs-on: ubuntu-latest + permissions: + contents: read + checks: write steps: - name: checkout uses: actions/checkout@v7 @@ -39,4 +42,4 @@ jobs: with: repo-token: "${{ secrets.GITHUB_TOKEN }}" title: "SQLFluff Lint" - input: "./annotations.json" \ No newline at end of file + input: "./annotations.json" From 760fa096db1b01fde9ae6b34ce4ff4c22429fd9b Mon Sep 17 00:00:00 2001 From: Taksh Date: Fri, 31 Jul 2026 15:05:50 +0300 Subject: [PATCH 2/6] ci(sqlfluff): skip annotate when no SQL changed Avoid running the annotations action against a missing annotations.json on PRs that do not touch mimic-iv/concepts, and tolerate unauthorized check writes with ignore-unauthorized-error. --- .github/workflows/lint_sqlfluff.yml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/.github/workflows/lint_sqlfluff.yml b/.github/workflows/lint_sqlfluff.yml index 3900182d..5b603162 100644 --- a/.github/workflows/lint_sqlfluff.yml +++ b/.github/workflows/lint_sqlfluff.yml @@ -38,8 +38,10 @@ jobs: shell: bash run: sqlfluff lint --format github-annotation --annotation-level failure --nofail ${{ steps.get_files_to_lint.outputs.lintees }} > annotations.json - name: Annotate + if: steps.get_files_to_lint.outputs.lintees != '' uses: yuzutech/annotations-action@v0.6.0 with: repo-token: "${{ secrets.GITHUB_TOKEN }}" title: "SQLFluff Lint" input: "./annotations.json" + ignore-unauthorized-error: true From 3cd6bce2ad12f5e9c57dabbe54f69bdf9051d7ed Mon Sep 17 00:00:00 2001 From: Taksh Date: Fri, 31 Jul 2026 15:06:52 +0300 Subject: [PATCH 3/6] ci(sqlfluff): document the fork-PR annotation contract Spell out why the workflow sets checks:write and ignore-unauthorized-error so future edits do not reintroduce continue-on-error. --- .github/workflows/lint_sqlfluff.yml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/.github/workflows/lint_sqlfluff.yml b/.github/workflows/lint_sqlfluff.yml index 5b603162..71f08fca 100644 --- a/.github/workflows/lint_sqlfluff.yml +++ b/.github/workflows/lint_sqlfluff.yml @@ -1,5 +1,7 @@ name: SQLFluff +# Lints changed mimic-iv/concepts/*.sql on pull requests and posts GitHub +# annotations. permissions + ignore-unauthorized-error keep fork PRs usable. on: - pull_request From a14a1987f71325792dc80a2bb5da6bbcdbf617c4 Mon Sep 17 00:00:00 2001 From: Taksh Date: Fri, 31 Jul 2026 15:06:52 +0300 Subject: [PATCH 4/6] docs: mention SQLFluff PR linting in the style guide Point contributors at the workflow that reviews changed MIMIC-IV concept SQL. --- styleguide.md | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/styleguide.md b/styleguide.md index 14eca419..3e65da63 100644 --- a/styleguide.md +++ b/styleguide.md @@ -27,3 +27,7 @@ For more detail, following the guidelines at: http://www.sqlstyle.guide/ ## Python Following PEP8 guidelines is recommended. Read more here: https://www.python.org/dev/peps/pep-0008/ + +## SQL style checking + +Pull requests that change `mimic-iv/concepts/**/*.sql` are linted by the SQLFluff GitHub Action (`.github/workflows/lint_sqlfluff.yml`). Findings are posted as pull-request annotations when the workflow has permission to write checks. From 9e6f9250301148fe1e58336d05afb79e1b53725c Mon Sep 17 00:00:00 2001 From: Taksh Date: Fri, 31 Jul 2026 15:06:52 +0300 Subject: [PATCH 5/6] chore: add local SQLFluff helper for changed concept SQL Mirrors the PR workflow so contributors can lint mimic-iv/concepts changes before pushing. --- scripts/lint_changed_mimic_iv_concepts.sh | 12 ++++++++++++ 1 file changed, 12 insertions(+) create mode 100755 scripts/lint_changed_mimic_iv_concepts.sh diff --git a/scripts/lint_changed_mimic_iv_concepts.sh b/scripts/lint_changed_mimic_iv_concepts.sh new file mode 100755 index 00000000..5da6eff7 --- /dev/null +++ b/scripts/lint_changed_mimic_iv_concepts.sh @@ -0,0 +1,12 @@ +#!/usr/bin/env bash +# Local mirror of .github/workflows/lint_sqlfluff.yml for changed concept SQL. +set -euo pipefail +BASE_REF="${1:-origin/main}" +files="$(git diff --name-only --diff-filter=AM "${BASE_REF}...HEAD" -- 'mimic-iv/concepts/' \ + | grep -E '[.]sql$' || true)" +if [[ -z "${files}" ]]; then + echo "No changed mimic-iv/concepts SQL files versus ${BASE_REF}." + exit 0 +fi +# shellcheck disable=SC2086 +sqlfluff lint ${files} From d83dbaf72ce282aa3f0cc87cbf9edee255097356 Mon Sep 17 00:00:00 2001 From: Taksh Date: Sat, 1 Aug 2026 15:16:34 +0300 Subject: [PATCH 6/6] ci: skip SQLFluff Annotate on fork PRs ignore-unauthorized-error does not catch the fork 403 (Resource not accessible by integration). Skip Annotate when head.repo != base repo so lint-mimic-iv can stay green. --- .github/workflows/lint_sqlfluff.yml | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/.github/workflows/lint_sqlfluff.yml b/.github/workflows/lint_sqlfluff.yml index 71f08fca..d6e1c3f0 100644 --- a/.github/workflows/lint_sqlfluff.yml +++ b/.github/workflows/lint_sqlfluff.yml @@ -1,7 +1,8 @@ name: SQLFluff # Lints changed mimic-iv/concepts/*.sql on pull requests and posts GitHub -# annotations. permissions + ignore-unauthorized-error keep fork PRs usable. +# annotations. Fork PRs skip Annotate — GITHUB_TOKEN cannot create check runs +# from forks (Resource not accessible by integration / 403). on: - pull_request @@ -40,7 +41,11 @@ jobs: shell: bash run: sqlfluff lint --format github-annotation --annotation-level failure --nofail ${{ steps.get_files_to_lint.outputs.lintees }} > annotations.json - name: Annotate - if: steps.get_files_to_lint.outputs.lintees != '' + # Same-repo PRs only: fork tokens get 403 creating check runs, and + # ignore-unauthorized-error does not treat that as unauthorized. + if: > + steps.get_files_to_lint.outputs.lintees != '' && + github.event.pull_request.head.repo.full_name == github.repository uses: yuzutech/annotations-action@v0.6.0 with: repo-token: "${{ secrets.GITHUB_TOKEN }}"