Use workflow-setup outputs for repo name; inline safe step-outcome expressions

.github/actions/detect-relevant-changes/action.yaml

@@ -20,6 +20,10 @@ inputs:
     description: "Optional glob filters (comma or newline separated)"
     required: false
     default: ""
+  exclude-globs:
+    description: "Optional glob filters to exclude (comma or newline separated)"
+    required: false
+    default: ""
   type-pattern-add:
     description: >-
       Additional type-to-glob mappings (comma or newline separated, e.g. cpp:*.cc). '.in' variants are added
@@ -45,6 +49,7 @@ runs:
         HEAD_REF: ${{ inputs.head-ref }}
         FILE_TYPE: ${{ inputs.file-type }}
         INCLUDE_GLOBS: ${{ inputs.include-globs }}
+        EXCLUDE_GLOBS: ${{ inputs.exclude-globs }}
         TYPE_PATTERN_ADD: ${{ inputs.type-pattern-add }}
       # yamllint disable rule:line-length
       run: |
@@ -90,6 +95,7 @@ runs:
 
         mapfile -t REQUESTED_TYPES < <(parse_list "$FILE_TYPE")
         mapfile -t INCLUDE_PATTERNS < <(parse_list "$INCLUDE_GLOBS")
+        mapfile -t EXCLUDE_PATTERNS < <(parse_list "$EXCLUDE_GLOBS")
 
         if [ -z "$HEAD_REF" ]; then
           HEAD_REF=$(git rev-parse HEAD)
@@ -159,22 +165,23 @@ runs:
           ALL_PATTERNS=()
         fi
 
-        FIND_CMD=(find . -type f)
-        if [ "${#ALL_PATTERNS[@]}" -gt 0 ]; then
-          FIND_CMD+=(\()
-          first=true
-          for pattern in "${ALL_PATTERNS[@]}"; do
-            if [ "$first" = true ]; then
-              first=false
-            else
-              FIND_CMD+=(-o)
-            fi
-            FIND_CMD+=(-name "$pattern")
-          done
-          FIND_CMD+=(\))
-        fi
-
-        "${FIND_CMD[@]}" | sed 's|^\./||' | LC_ALL=C sort > "$RUNNER_TEMP/find-matches.txt"
+        # Use git ls-tree instead of find so this works even when the working
+        # tree contains no files (e.g. after a sparse checkout with no patterns).
+        {
+          if [ "${#ALL_PATTERNS[@]}" -gt 0 ]; then
+            git ls-tree -r --name-only "${HEAD_REF}" | while IFS= read -r file; do
+              basename="${file##*/}"
+              for pattern in "${ALL_PATTERNS[@]}"; do
+                if [[ "$basename" == $pattern ]]; then
+                  printf '%s\n' "$file"
+                  break
+                fi
+              done
+            done
+          else
+            git ls-tree -r --name-only "${HEAD_REF}"
+          fi
+        } | LC_ALL=C sort > "$RUNNER_TEMP/find-matches.txt"
         LC_ALL=C sort "$RUNNER_TEMP/changed-files.txt" > "$RUNNER_TEMP/changed-files-sorted.txt"
 
         if [ -s "$RUNNER_TEMP/find-matches.txt" ]; then
@@ -194,10 +201,19 @@ runs:
           return 1
         }
 
+        filter_by_exclude() {
+          local file="$1"
+          for exclude_pattern in "${EXCLUDE_PATTERNS[@]}"; do
+            # $exclude_pattern intentionally unquoted to enable glob matching
+            [[ "$file" == $exclude_pattern ]] && return 1
+          done
+          return 0
+        }
+
         : > "$RUNNER_TEMP/matched-files.txt"
         while IFS= read -r matched_file; do
           [ -z "$matched_file" ] && continue
-          if filter_by_include "$matched_file"; then
+          if filter_by_include "$matched_file" && filter_by_exclude "$matched_file"; then
             echo "$matched_file" >> "$RUNNER_TEMP/matched-files.txt"
           fi
         done < "$RUNNER_TEMP/initial-matched.txt"

.github/actions/run-change-detection/action.yaml

@@ -45,6 +45,10 @@ runs:
         ref: ${{ inputs.ref }}
         repository: ${{ inputs.repo }}
         persist-credentials: false
+        # Use empty sparse checkout so no PR files are materialized in the working
+        # tree — only git objects are needed for diff and ls-tree operations.
+        sparse-checkout-cone-mode: false
+        sparse-checkout: ""
 
     - name: Detect relevant changes
       id: filter

.github/workflows/actionlint-check.yaml

@@ -87,15 +87,18 @@ jobs:
           ref: ${{ needs.setup.outputs.ref }}
           path: ${{ needs.setup.outputs.checkout_path }}
           repository: ${{ needs.setup.outputs.repo }}
+          persist-credentials: false
 
       - name: Announce actionlint check
         run: echo "➡️ Running actionlint check..."
 
       - name: Run actionlint
         id: lint
+        env:
+          CHECKOUT_PATH: ${{ needs.setup.outputs.checkout_path }}
         run: |
           docker run --rm \
-            -v "${{ github.workspace }}/${{ needs.setup.outputs.checkout_path }}:/work" \
+            -v "$GITHUB_WORKSPACE/${CHECKOUT_PATH}:/work" \
             -w /work \
             rhysd/actionlint:latest \
             -config-file .github/actionlint.yaml

.github/workflows/clang-format-check.yaml

@@ -47,6 +47,7 @@ jobs:
           ref: ${{ needs.setup.outputs.ref }}
           path: ${{ needs.setup.outputs.checkout_path }}
           repository: ${{ needs.setup.outputs.repo }}
+          persist-credentials: false
 
       - name: Announce clang-format check
         run: echo "➡️ Running clang-format check..."
@@ -62,11 +63,14 @@ jobs:
 
       - name: Evaluate clang-format result
         if: always() && steps.lint.outcome != 'skipped'
+        env:
+          REPO: ${{ needs.setup.outputs.repo }}
         run: |
+          REPO_NAME="${REPO##*/}"
           if [ "${{ steps.lint.outcome }}" = 'success' ]; then
             echo "✅ clang-format check passed."
           else
             echo "::error::clang-format check failed. Please review the output above for details."
-            echo "::error::Comment '@${{ github.event.repository.name }}bot format' on the PR to attempt auto-fix."
+            echo "::error::Comment '@${REPO_NAME}bot format' on the PR to attempt auto-fix."
             exit 1
           fi

.github/workflows/clang-tidy-check.yaml

@@ -59,6 +59,7 @@ jobs:
           ref: ${{ needs.setup.outputs.ref }}
           path: ${{ needs.setup.outputs.checkout_path }}
           repository: ${{ needs.setup.outputs.repo }}
+          persist-credentials: false
 
       - name: Setup build environment
         uses: Framework-R-D/phlex/.github/actions/setup-build-env@main
@@ -78,20 +79,28 @@ jobs:
       - name: Run clang-tidy using CMake
         id: tidy
         shell: bash
+        working-directory: ${{ needs.setup.outputs.build_path }}
+        env:
+          REPO: ${{ needs.setup.outputs.repo }}
         run: |
           . /entrypoint.sh
-          cd "$GITHUB_WORKSPACE/${{ needs.setup.outputs.build_path }}"
+          REPO_NAME="${REPO##*/}"
 
           echo "➡️ Running clang-tidy checks..."
           cmake_status=0
           cmake --build . -j "$(nproc)" > clang-tidy.log 2>&1 || cmake_status=$?
 
           if [ "$cmake_status" -ne 0 ]; then
-            echo "::error::CMake build failed with exit code $cmake_status"
-            exit 1
-          elif grep -qE '^/.+\.(cpp|hpp|c|h):[0-9]+:[0-9]+: (warning|error):' clang-tidy.log; then
+            echo "::error::clang-tidy CMake build failed (exit code $cmake_status)"
+            echo "::group::clang-tidy log output"
+            cat clang-tidy.log
+            echo "::endgroup::"
+            exit "$cmake_status"
+          fi
+
+          if grep -qE '^/.+\.(cpp|hpp|c|h):[0-9]+:[0-9]+: (warning|error):' clang-tidy.log; then
             echo "::warning::Clang-tidy found issues in the code"
-            exit 1
+            echo "Comment '@${REPO_NAME}bot tidy-fix [<check>...]' on the PR to attempt auto-fix"
           else
             echo "✅ clang-tidy check passed"
           fi

.github/workflows/clang-tidy-fix.yaml

@@ -52,7 +52,8 @@ jobs:
         env:
           COMMENT_BODY: ${{ github.event.comment.body }}
         run: |
-          bot_name="${{ github.event.repository.name }}bot"
+          REPO_NAME="${GITHUB_REPOSITORY##*/}"
+          bot_name="${REPO_NAME}bot"
           checks_line=$(echo "$COMMENT_BODY" |
             sed -nE "s/^@${bot_name}[[:space:]]+tidy-fix[[:space:]]+(.*)/\1/p" | tr -d '\r')
           if [ -n "$checks_line" ]; then
@@ -110,12 +111,20 @@ jobs:
         if:
           needs.setup.outputs.tidy_checks == '' && (steps.download_fixes_check.outcome == 'success' ||
           steps.download_fixes_fix.outcome == 'success')
+        env:
+          CHECKOUT_PATH: ${{ needs.setup.outputs.checkout_path }}
         run: |
-          if [ -f fixes/clang-tidy-fixes.yaml ]; then
+          # The artifact preserves the build directory prefix in its path structure.
+          FIXES_FILE=""
+          if [ -d fixes ]; then
+            FIXES_FILE=$(find fixes -name "clang-tidy-fixes.yaml" | head -1)
+          fi
+          if [ -n "$FIXES_FILE" ]; then
             echo "Applying fixes from existing artifact..."
             . /entrypoint.sh
-            cd "${{ needs.setup.outputs.checkout_path }}"
-            clang-apply-replacements ../fixes || true
+            FIXES_DIR="$(realpath "${FIXES_FILE%/*}")"
+            cd "${CHECKOUT_PATH}"
+            clang-apply-replacements "${FIXES_DIR}" || true
             echo "applied=true" >> "$GITHUB_OUTPUT"
           else
             echo "applied=false" >> "$GITHUB_OUTPUT"
@@ -156,16 +165,20 @@ jobs:
 
       - name: Generate clang-tidy fixes using CMake build
         if: steps.apply_from_artifact.outputs.applied != 'true'
+        env:
+          BUILD_PATH: ${{ needs.setup.outputs.build_path }}
         run: |
           . /entrypoint.sh
-          cd "$GITHUB_WORKSPACE/${{ needs.setup.outputs.build_path }}"
+          cd "$GITHUB_WORKSPACE/${BUILD_PATH}"
           cmake --build . -j "$(nproc)" || true
 
       - name: Apply clang-tidy fixes
         if: steps.apply_from_artifact.outputs.applied != 'true'
+        env:
+          BUILD_PATH: ${{ needs.setup.outputs.build_path }}
         run: |
           . /entrypoint.sh
-          cd "$GITHUB_WORKSPACE/${{ needs.setup.outputs.build_path }}"
+          cd "$GITHUB_WORKSPACE/${BUILD_PATH}"
           if [ -f clang-tidy-fixes.yaml ]; then
             clang-apply-replacements . || true
           fi
@@ -195,6 +208,7 @@ jobs:
     runs-on: ubuntu-latest
     permissions:
       pull-requests: write
+      issues: write
     steps:
       - name: Post Clang-Tidy results
         uses: Framework-R-D/phlex/.github/actions/post-clang-tidy-results@main

.github/workflows/cmake-build.yaml

@@ -143,6 +143,7 @@ jobs:
           path: ${{ needs.setup.outputs.checkout_path }}
           ref: ${{ needs.setup.outputs.ref }}
           repository: ${{ needs.setup.outputs.repo }}
+          persist-credentials: false
 
       - name: Setup build environment
         uses: Framework-R-D/phlex/.github/actions/setup-build-env@main
@@ -178,9 +179,11 @@ jobs:
 
       - name: Run tests
         if: matrix.sanitizer != 'valgrind'
+        env:
+          BUILD_PATH: ${{ needs.setup.outputs.build_path }}
         run: |
           . /entrypoint.sh
-          cd "$GITHUB_WORKSPACE/${{ needs.setup.outputs.build_path }}"
+          cd "$GITHUB_WORKSPACE/${BUILD_PATH}"
 
           echo "➡️ Running tests..."
           echo "::group::Running ctest"
@@ -195,9 +198,11 @@ jobs:
 
       - name: Run Valgrind tests
         if: matrix.sanitizer == 'valgrind'
+        env:
+          BUILD_PATH: ${{ needs.setup.outputs.build_path }}
         run: |
           . /entrypoint.sh
-          cd "$GITHUB_WORKSPACE/${{ needs.setup.outputs.build_path }}"
+          cd "$GITHUB_WORKSPACE/${BUILD_PATH}"
 
           echo "➡️ Running Valgrind tests..."
           echo "::group::Running ctest -T memcheck"

.github/workflows/cmake-format-check.yaml

@@ -80,6 +80,7 @@ jobs:
           ref: ${{ needs.setup.outputs.ref }}
           path: ${{ needs.setup.outputs.checkout_path }}
           repository: ${{ needs.setup.outputs.repo }}
+          persist-credentials: false
 
       - name: Set up Python
         uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
@@ -91,20 +92,25 @@ jobs:
 
       - name: Check CMake formatting
         id: lint
+        env:
+          CHECKOUT_PATH: ${{ needs.setup.outputs.checkout_path }}
         run: |
           echo "➡️ Checking CMake file formatting..."
-          gersemi --check ${{ needs.setup.outputs.checkout_path }}
+          gersemi --check "${CHECKOUT_PATH}"
         continue-on-error: true
 
       - name: Evaluate CMake formatting result
         if: always() && steps.lint.outcome != 'skipped'
+        env:
+          REPO: ${{ needs.setup.outputs.repo }}
         # yamllint disable rule:line-length
         run: |
+          REPO_NAME="${REPO##*/}"
           if [ "${{ steps.lint.outcome }}" = 'success' ]; then
             echo "✅ All CMake files are properly formatted."
           else
             echo "::error::Found files with formatting issues."
-            echo "::error::Run 'gersemi -i <file>' locally or comment '@${{ github.event.repository.name }}bot format' on the PR to auto-fix."
+            echo "::error::Run 'gersemi -i <file>' locally or comment '@${REPO_NAME}bot format' on the PR to auto-fix."
             exit 1
           fi
         # yamllint enable

.github/workflows/cmake-format-fix.yaml

@@ -108,9 +108,10 @@ jobs:
         run: pip install gersemi
 
       - name: Apply CMake formatting
+        working-directory: ${{ needs.setup.outputs.checkout_path }}
         run: |
           echo "Applying CMake formatting..."
-          gersemi -i ${{ needs.setup.outputs.checkout_path }}
+          gersemi -i .
 
       - name: Handle fix commit
         id: handle_commit