Conflict Ledger and attention rebalancing scaffolds

.github/workflows/auto-fix.yml

@@ -9,6 +9,7 @@ on:
 permissions:
   contents: write
   pull-requests: write
+  security-events: write
 
 jobs:
   detector:

.github/workflows/ci_ruff.yml

@@ -12,6 +12,8 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
       - name: Setup Python
         uses: actions/setup-python@v5
         with:
@@ -20,8 +22,38 @@ jobs:
         run: |
           python -m pip install -U pip
           pip install -r requirements.txt || true
+      - name: Detect changed Python files
+        id: changed-python
+        shell: bash
+        env:
+          EVENT_NAME: ${{ github.event_name }}
+          BASE_REF: ${{ github.base_ref }}
+          BEFORE_SHA: ${{ github.event.before }}
+        run: |
+          set -euo pipefail
+          if [ "$EVENT_NAME" = "pull_request" ] && [ -n "${BASE_REF:-}" ]; then
+            git fetch --no-tags --prune origin "+refs/heads/${BASE_REF}:refs/remotes/origin/${BASE_REF}"
+            BASE="origin/${BASE_REF}"
+          elif [ -n "${BEFORE_SHA:-}" ] && [ "$BEFORE_SHA" != "0000000000000000000000000000000000000000" ] && git cat-file -e "${BEFORE_SHA}^{commit}" 2>/dev/null; then
+            BASE="${BEFORE_SHA}"
+          else
+            BASE="$(git rev-list --max-parents=0 HEAD)"
+          fi
+          git diff --name-only -z --diff-filter=ACMR "${BASE}...HEAD" -- "*.py" > changed-python-files.txt
+          if [ -s changed-python-files.txt ]; then
+            echo "has_changed_python=true" >> "$GITHUB_OUTPUT"
+            tr "\0" "\n" < changed-python-files.txt
+          else
+            echo "has_changed_python=false" >> "$GITHUB_OUTPUT"
+            echo "No changed Python files."
+          fi
       - name: Ruff
         run: |
           python -m pip install ruff
           ruff --version
-          ruff check .
+          if [ "${{ steps.changed-python.outputs.has_changed_python }}" = "true" ]; then
+            xargs -0 -r python -m ruff check < changed-python-files.txt
+            xargs -0 -r python -m ruff format --check < changed-python-files.txt
+          else
+            echo "Skipping Ruff: no changed Python files."
+          fi