Repository: huggingface/transformers
Pull request: [don't merge] Better sec

# What does this PR do?

<!--
Congratulations! You've made it this far! You're not quite done yet though.

Once merged, your PR is going to appear in the release notes with the title you set, so make sure it's a great title that fully reflects the extent of your awesome contribution.

Then, please replace this with a description of the change and which issue is fixed (if applicable). Please also include relevant motivation and context. List any dependencies (if any) that are required for this change.

Once you're done, someone will review your PR shortly (see the section "Who can review?" below to tag some potential reviewers). They may suggest changes to make the code even better. If no one reviewed your PR after a week has passed, don't hesitate to post a new comment @-mentioning the same persons---sometimes notifications get lost.
-->

<!-- Remove if not applicable -->

Fixes # (issue)


## Before submitting
- [ ] This PR fixes a typo or improves the docs (you can dismiss the other checks if that's the case).
- [ ] Did you read the [contributor guideline](https://github.com/huggingface/transformers/blob/main/CONTRIBUTING.md#create-a-pull-request),
      Pull Request section?
- [ ] Was this discussed/approved via a Github issue or the [forum](https://discuss.huggingface.co/)? Please add a link
      to it if that's the case.
- [ ] Did you make sure to update the documentation with your changes? Here are the
      [documentation guidelines](https://github.com/huggingface/transformers/tree/main/docs), and
      [here are tips on formatting docstrings](https://github.com/huggingface/transformers/tree/main/docs#writing-source-documentation).
- [ ] Did you write any new necessary tests?


## Who can review?

Anyone in the community is free to review the PR once the tests have passed. Feel free to tag
members/contributors who may be interested in your PR.

<!-- Your PR will be replied to more quickly if you can figure out the right person to tag with @

 If you know how to use git blame, that is the easiest way, otherwise, here is a rough guide of **who to tag**.
 Please tag fewer than 3 people.

Models:

- text models: @ArthurZucker @Cyrilvallez
- vision models: @yonigozlan @molbap
- audio models: @eustlb @ebezzam @vasqu
- multimodal models: @zucchini-nlp
- graph models: @clefourrier

Library:

- generate: @zucchini-nlp (visual-language models) or @gante (all others)
- continuous batching: @remi-or @ArthurZucker @McPatate
- pipelines: @Rocketknight1
- tokenizers: @ArthurZucker and @itazap
- trainer: @SunMarc
- attention: @vasqu @ArthurZucker @CyrilVallez
- model loading (from pretrained, etc): @CyrilVallez
- distributed: @3outeille @ArthurZucker
- CIs: @ydshieh

Integrations:

- ray/raytune: @richardliaw, @amogkam
- Big Model Inference: @SunMarc
- quantization: @SunMarc @MekkCyber
- kernels: @MekkCyber @drbh
- peft: @BenjaminBossan @githubnemo

Devices/Backends:

- AMD ROCm: @ivarflakstad
- Intel XPU: @IlyasMoutawwakil
- Ascend NPU: @ivarflakstad 

Documentation: @stevhliu

Research projects are not maintained and should be taken as is.

 -->


Changed files:
filename: .github/workflows/pr-repo-consistency-bot.yml
patch: @@ -138,18 +138,29 @@ jobs:
           # Check if there are changes
           if [ -n "$(git status --porcelain)" ]; then
             echo "changes_detected=true" >> $GITHUB_OUTPUT
-            # Create a patch file with all changes
-            git diff > consistency-fixes.patch
           else
             echo "changes_detected=false" >> $GITHUB_OUTPUT
           fi
 
-      - name: Upload patch
+      - name: Save modified files
+        if: steps.run_checks.outputs.changes_detected == 'true'
+        run: |
+          mkdir -p pr-repo
+          git diff --name-only > modified-files.txt
+          # Copy each modified file to pr-repo directory
+          while IFS= read -r file; do
+            mkdir -p "pr-repo/$(dirname "$file")"
+            cp "$file" "pr-repo/$file"
+          done < modified-files.txt
+
+      - name: Upload modified files
         if: steps.run_checks.outputs.changes_detected == 'true'
         uses: actions/upload-artifact@v4
         with:
-          name: consistency-fixes-patch
-          path: consistency-fixes.patch
+          name: modified-files
+          path: |
+            modified-files.txt
+            pr-repo/
 
   commit-and-comment:
     runs-on: ubuntu-22.04
@@ -158,37 +169,103 @@ jobs:
     permissions:
       pull-requests: write
     steps:
-      - uses: actions/checkout@v4
-        if: needs.run-repo-consistency-checks.outputs.changes_detected == 'true'
-        with:
-          repository: ${{ needs.get-pr-info.outputs.PR_HEAD_REPO_FULL_NAME }}
-          ref: ${{ needs.check-timestamps.outputs.VERIFIED_PR_HEAD_SHA }}
-          fetch-depth: "1"
-          # Need to specify `token` here, so we can push in `Commit and push changes` below.
-          token: ${{ secrets.HF_STYLE_BOT_ACTION }}
-
-      - name: Download patch
+      - name: Download modified files
         if: needs.run-repo-consistency-checks.outputs.changes_detected == 'true'
         uses: actions/download-artifact@v4
         with:
-          name: consistency-fixes-patch
+          name: modified-files
 
-      - name: Apply patch and push
+      - name: Push changes via GitHub API (no checkout)
         if: needs.run-repo-consistency-checks.outputs.changes_detected == 'true'
+        uses: actions/github-script@v6
         env:
           PR_HEAD_REF: ${{ needs.get-pr-info.outputs.PR_HEAD_REF }}
-          GITHUB_TOKEN: ${{ secrets.HF_STYLE_BOT_ACTION }}
-        run: |
-          git config user.name "github-actions[bot]"
-          git config user.email "github-actions[bot]@users.noreply.github.com"
-          
-          # Apply the patch
-          git apply consistency-fixes.patch
-          
-          # Only add updates to tracked files (ignores new untracked files like the patch)
-          git add -u
-          git commit -m "Apply repo. consistency fixes"
-          git push origin HEAD:$PR_HEAD_REF
+          PR_HEAD_SHA: ${{ needs.check-timestamps.outputs.VERIFIED_PR_HEAD_SHA }}
+          PR_HEAD_REPO_OWNER: ${{ needs.get-pr-info.outputs.PR_HEAD_REPO_OWNER }}
+          PR_HEAD_REPO_NAME: ${{ needs.get-pr-info.outputs.PR_HEAD_REPO_NAME }}
+        with:
+          github-token: ${{ secrets.HF_STYLE_BOT_ACTION }}
+          script: |
+            const fs = require('fs');
+            const path = require('path');
+            
+            const owner = process.env.PR_HEAD_REPO_OWNER;
+            const repo = process.env.PR_HEAD_REPO_NAME;
+            const baseSha = process.env.PR_HEAD_SHA;
+            const branch = process.env.PR_HEAD_REF;
+            
+            console.log(`Creating commit on ${owner}/${repo} branch ${branch} from ${baseSha}`);
+            
+            // Read list of modified files
+            const modifiedFiles = fs.readFileSync('modified-files.txt', 'utf8')
+              .trim()
+              .split('\n')
+              .filter(f => f.length > 0);
+            
+            console.log(`Modified files: ${modifiedFiles.join(', ')}`);
+            
+            // Get the base commit to retrieve its tree SHA (metadata only, no checkout)
+            const { data: baseCommit } = await github.rest.git.getCommit({
+              owner,
+              repo,
+              commit_sha: baseSha
+            });
+            
+            console.log(`Base tree SHA: ${baseCommit.tree.sha}`);
+            
+            // Create blobs for each modified file
+            const tree = [];
+            for (const file of modifiedFiles) {
+              const filePath = path.join('pr-repo', file);
+              const content = fs.readFileSync(filePath, 'utf8');
+              
+              console.log(`Creating blob for ${file}`);
+              const { data: blob } = await github.rest.git.createBlob({
+                owner,
+                repo,
+                content: content,
+                encoding: 'utf-8'
+              });
+              
+              tree.push({
+                path: file,
+                mode: '100644',
+                type: 'blob',
+                sha: blob.sha
+              });
+            }
+            
+            // Create new tree based on the base tree
+            console.log(`Creating tree with ${tree.length} modified files`);
+            const { data: newTree } = await github.rest.git.createTree({
+              owner,
+              repo,
+              base_tree: baseCommit.tree.sha,
+              tree: tree
+            });
+            
+            // Create commit
+            console.log(`Creating commit`);
+            const { data: newCommit } = await github.rest.git.createCommit({
+              owner,
+              repo,
+              message: 'Apply repo. consistency fixes',
+              tree: newTree.sha,
+              parents: [baseSha]
+            });
+            
+            console.log(`Created commit: ${newCommit.sha}`);
+            
+            // Update branch ref
+            console.log(`Updating ref heads/${branch} to ${newCommit.sha}`);
+            await github.rest.git.updateRef({
+              owner,
+              repo,
+              ref: `heads/${branch}`,
+              sha: newCommit.sha
+            });
+            
+            console.log(`Successfully pushed commit to ${branch}`);
 
       - name: Prepare final comment message
         id: prepare_final_comment
@@ -215,4 +292,4 @@ jobs:
               repo: context.repo.repo,
               comment_id: ${{ needs.init_comment_with_url.outputs.comment_id }},
               body: `${{ steps.prepare_final_comment.outputs.final_comment }}`
-            });
+            });
\ No newline at end of file