fix-php-code-style-issues.yml lacks a branch filter, auto-committing Pint fixes to every branch push

[morcen]

Problem

.github/workflows/fix-php-code-style-issues.yml triggers on every push to every branch, with no branches: filter:

on:
  push:
    paths:
      - '**.php'

It then checks out the pushed branch, runs Pint, and if there are style violations, commits and pushes the fix straight back to that same branch via stefanzweifel/git-auto-commit-action, using contents: write permission.

This is inconsistent with every other workflow in the repo that reacts to push, all of which are explicitly scoped to main:

• run-tests.yml: push: branches: [main]
• test-matrix.yml: push: branches: [main]
• security-audit.yml: push: branches: [main]
• update-changelog.yml: checks out ref: main explicitly

fix-php-code-style-issues.yml is the only push-triggered workflow without such a restriction.

Why it matters

Because there's no branch filter, any push containing a .php file change — to a feature branch, a fix branch, a bot/automation branch, or any other in-repo branch — triggers an automatic commit that gets pushed back to that branch. Concretely:

• It creates surprise extra commits on in-progress/PR branches that aren't ready for a style-fix commit yet, potentially confusing reviewers or diff history.
• It can race with a contributor's own follow-up push or a force-push/rebase on that branch (the auto-commit and a manual force-push can conflict, or the auto-commit can silently reappear after a rebase that had already fixed the style issue differently).
• It runs CI/commits on branches that may never be merged (short-lived experiment branches), which is wasted signal and noise on the branch's history.
• It applies to any branch pushed to this repository, including automation-created branches (e.g. claude/* session branches), not just human contributor branches.

The ref: ${{ github.head_ref }} used for checkout is also a leftover from a pull_request-shaped workflow — github.head_ref is only populated for pull_request events and is empty for push events, so it has no effect here (harmless today only because actions/checkout treats an empty ref as "use the default"), but it's a sign this workflow's trigger/checkout combination wasn't fully thought through for the push-to-any-branch case it currently allows.

Where

• .github/workflows/fix-php-code-style-issues.yml:3-19

Suggested fix

Restrict the trigger to main (or to whatever branch(es) are meant to receive auto-formatting commits), matching the convention used by run-tests.yml / test-matrix.yml / security-audit.yml:

on:
  push:
    branches: [main]
    paths:
      - '**.php'

If the intent is instead to style-check (not auto-commit) on arbitrary branches/PRs, that's already covered by the vendor/bin/pint --test step conditionally run in test-matrix.yml, so this workflow's auto-commit behavior should most likely be main-only.

---

Found via automated codebase audit.