fix(autofix): skip delivery when eligible staging is empty

.github/workflows/reusable-18-autofix.yml

@@ -586,14 +586,21 @@ jobs:
           ruff check "${targets[@]}" --select I --fix --exit-zero
           ruff check "${targets[@]}" --fix --exit-zero
           black --line-length 100 "${targets[@]}" || true
-          if git diff --quiet; then
+          changed_paths=()
+          while IFS= read -r -d '' path; do
+            case "$path" in
+              workflows-lib|workflows-lib/*|node_modules|node_modules/*|*/node_modules|*/node_modules/*)
+                continue ;;
+            esac
+            changed_paths+=("$path")
+          done < <(git diff HEAD --name-only -z --diff-filter=ACDMRTUXB)
+          if [ ${#changed_paths[@]} -eq 0 ]; then
             echo "changed=false" >> "$GITHUB_OUTPUT"
           else
             echo "changed=true" >> "$GITHUB_OUTPUT"
           fi
           echo "remaining_issues=0" >> "$GITHUB_OUTPUT"
           echo "new_issues=0" >> "$GITHUB_OUTPUT"
-          mapfile -t changed_paths < <(git diff --name-only --diff-filter=ACMRTUXB)
           allowed_changes=()
           other_changes=()
           # targets already initialized above
@@ -646,7 +653,14 @@ jobs:
             rm -f node_modules/.package-lock.json
           fi
           : "${ALLOWED_FILE_GLOBS:=}"
-          mapfile -t changed_paths < <(git diff --name-only --diff-filter=ACMRTUXB || true)
+          changed_paths=()
+          while IFS= read -r -d '' path; do
+            case "$path" in
+              workflows-lib|workflows-lib/*|node_modules|node_modules/*|*/node_modules|*/node_modules/*)
+                continue ;;
+            esac
+            changed_paths+=("$path")
+          done < <(git diff HEAD --name-only -z --diff-filter=ACDMRTUXB)
           changed_flag=false
           file_list_payload=""
           if [ ${#changed_paths[@]} -gt 0 ]; then
@@ -832,6 +846,43 @@ jobs:
           else
             file_list="${AUTO_FILE_LIST:-}"
           fi
+          # Commit/patch decisions must reflect eligible staged changes, not
+          # dependency-install churn that is excluded from autofix delivery.
+          if [ "$changed" = "true" ]; then
+            git add -A
+            vendor_paths=()
+            while IFS= read -r -d '' path; do
+              case "$path" in
+                workflows-lib|workflows-lib/*|node_modules|node_modules/*|*/node_modules|*/node_modules/*)
+                  vendor_paths+=("$path") ;;
+              esac
+            done < <(git diff --cached --name-only -z)
+            if [ ${#vendor_paths[@]} -gt 0 ]; then
+              git --literal-pathspecs reset HEAD -- "${vendor_paths[@]}"
+            fi
+            file_list=$(git diff --cached --name-only)
+            if git diff --cached --quiet; then
+              echo "[autofix] No eligible changes remain after excluding vendored dependencies."
+              changed="false"
+              file_list=""
+            fi
+          fi
+          # Keep history and the emitted JSON artifact aligned with delivery.
+          AUTOFIX_CHANGED="$changed" AUTOFIX_FILE_LIST="$file_list" python - <<'PYREPORT'
+          import json
+          import os
+          from pathlib import Path
+
+          path = Path("autofix_report_enriched.json")
+          if path.exists():
+              payload = json.loads(path.read_text())
+              files = os.environ["AUTOFIX_FILE_LIST"].splitlines()
+              payload["changed"] = os.environ["AUTOFIX_CHANGED"] == "true"
+              payload["files"] = files
+              if "file_list" in payload:
+                  payload["file_list"] = files
+              path.write_text(json.dumps(payload) + "\n")
+          PYREPORT
           {
             echo "mode=${mode}"
             echo "changed=${changed}"
@@ -858,13 +909,6 @@ jobs:
         run: |
           git config user.name "github-actions[bot]"
           git config user.email "github-actions[bot]@users.noreply.github.com"
-          git add -A
-          # Unstage vendored node_modules that may have been modified by npm install
-          git reset HEAD -- \
-            .github/scripts/node_modules \
-            node_modules \
-            .workflows-lib/.github/scripts/node_modules \
-            2>/dev/null || true
           git commit -m "${AUTOFIX_COMMIT_PREFIX} formatting/lint"
           echo "AUTOFIX_COMMIT_SHA=$(git rev-parse HEAD)" >> "$GITHUB_ENV"
 
@@ -952,17 +996,11 @@ jobs:
         run: |
           git config user.name "github-actions[bot]"
           git config user.email "github-actions[bot]@users.noreply.github.com"
-          git add -A
-          # Unstage vendored node_modules that may have been modified by npm install
-          git reset HEAD -- \
-            .github/scripts/node_modules \
-            node_modules \
-            .workflows-lib/.github/scripts/node_modules \
-            2>/dev/null || true
-          git commit -m "${AUTOFIX_COMMIT_PREFIX} formatting/lint (patch)" || true
+          git commit -m "${AUTOFIX_COMMIT_PREFIX} formatting/lint (patch)"
           git format-patch -1 --stdout > autofix.patch
 
       - name: Upload patch artifact
+        id: upload_patch
         if: >-
           ${{
             steps.guard.outputs.skip != 'true' &&
@@ -1442,14 +1480,14 @@ jobs:
           RUN_ID: ${{ github.run_id }}
           SERVER_URL: ${{ github.server_url }}
           REPOSITORY: ${{ github.repository }}
-          CHANGED: ${{ steps.fix_results.outputs.changed }}
+          PATCH_UPLOAD_OUTCOME: ${{ steps.upload_patch.outcome }}
         shell: bash
         run: |
           set -euo pipefail
           mode="${AUTH_MODE:-fallback}"
           reason="${AUTH_REASON:-}"
           patch="false"
-          if [ "${CHANGED:-false}" = "true" ] && [ "$mode" != "pat" ]; then
+          if [ "${PATCH_UPLOAD_OUTCOME:-}" = "success" ]; then
             patch="true"
           fi
 
@@ -1916,7 +1954,7 @@ jobs:
           FILE_LIST: ${{ steps.fix_results.outputs.file_list }}
           AUTOFIX_DELIVERY_MODE: ${{ env.AUTOFIX_DELIVERY_MODE }}
           AUTOFIX_DELIVERY_REASON: ${{ env.AUTOFIX_DELIVERY_REASON }}
-          AUTOFIX_PATCH_AVAILABLE: ${{ env.AUTOFIX_PATCH_AVAILABLE }}
+          PATCH_UPLOAD_OUTCOME: ${{ steps.upload_patch.outcome }}
           TRIGGER_CONCLUSION: ${{ inputs.trigger_conclusion }}
           TRIGGER_CLASS: ${{ inputs.trigger_class }}
           TRIGGER_REASON: ${{ inputs.trigger_reason }}
@@ -1935,11 +1973,8 @@ jobs:
           file_list="${FILE_LIST:-}"
           delivery_mode="${AUTOFIX_DELIVERY_MODE:-fallback}"
           delivery_reason="${AUTOFIX_DELIVERY_REASON:-}"
-          patch="${AUTOFIX_PATCH_AVAILABLE:-false}"
-          if [ "$patch" != "true" ] && \
-            [ "$changed" = "true" ] && \
-            [ "$delivery_mode" != "pat" ]
-          then
+          patch="false"
+          if [ "${PATCH_UPLOAD_OUTCOME:-}" = "success" ]; then
             patch="true"
           fi
           skip_reason=""

docs/ci/WORKFLOWS.md

@@ -104,6 +104,18 @@ The gate uses the shared `.github/scripts/detect-changes.js` helper to decide wh
 
 ## Autofix & Maintenance
 
+Reusable Autofix stages eligible changes before publishing its consolidated result.
+Dependency-install changes under any `node_modules` directory and the helper
+checkout at `workflows-lib` are excluded before target validation and delivery;
+when nothing remains staged, the run reports no changes and skips commits, pushes,
+patch artifacts, and applied-change labels. Eligible source fixes still commit, and
+commit failures remain failures rather than producing a patch for an older commit.
+Change detection compares against HEAD so staged edits and deletions undergo the
+same scope validation as unstaged edits. Published file lists and enriched reports
+reflect the filtered staged index.
+Final outputs advertise a patch only after its artifact upload succeeds, including
+when an earlier commit, patch, or push step failed.
+
 * [`reusable-pr-context.yml`](../../.github/workflows/reusable-pr-context.yml) fetches comprehensive PR context via a single GraphQL query (60-80% API reduction vs REST). Returns PR metadata, labels, files, reviews, comments, and CI status as job outputs for downstream consumption.
 * [`reusable-codex-run.yml`](../../.github/workflows/reusable-codex-run.yml) exposes a reusable Codex runner with the `gpt-6-astra` default (`gpt-5.5` fallback), prompt-file input, sandbox/safety defaults, artifact upload, and commit/push handling so keepalive, autofix, and verifier wrappers can share the same execution surface.
 * [`reusable-model-profile-trial.yml`](../../.github/workflows/reusable-model-profile-trial.yml) is a separate immutable, read-only worker for one Astra/Sol/Terra/Luna instrumentation arm. A pinned helper checkout validates a target checkout that must equal current remote `main` before auth. It installs exactly Codex CLI 0.153.2, enforces high reasoning and the registry-backed `codex-standard` capacity mapping, and emits a strict v2 quarantine artifact with requested/CLI-reported identity and reasoning, GitHub provenance, and bounded source manifests before/after. It never commits, pushes, comments, refreshes auth, invokes an evaluator, or executes target-checkout code after auth; provider-resolved identity is explicitly null. Ordinary agent and Keepalive lanes reject these `lifecycle: trial` profiles.