ci(backend): auto-generate bindings (#3771)

# Motivation

We would like to auto-generate the bindings if necessary.

# Note

I had to remove the checkout from the single actions, because they would
go in conflict with the possibility to create PRs (different head_ref).
This is not an issue, since all actions are called after a previous
checkout in their usage in the code.

# Tests

We injected bad bindings in this PR and they were auto-fixed.

---------

Co-authored-by: github-actions <41898282+github-actions[bot]@users.noreply.github.com>

.github/actions/docker-build-backend/action.yml

@@ -15,8 +15,6 @@ outputs: {}
 runs:
   using: 'composite'
   steps:
-    - uses: actions/checkout@v4
-
     - name: Set up docker buildx
       uses: docker/setup-buildx-action@v3
 

.github/actions/docker-build-base/action.yml

@@ -7,9 +7,6 @@ outputs: {}
 runs:
   using: 'composite'
   steps:
-    - name: Checkout
-      uses: actions/checkout@v4
-
     - name: Update system packages
       run: sudo apt-get update
       shell: bash

.github/actions/oisy-backend/action.yml

@@ -7,9 +7,6 @@ outputs: {}
 runs:
   using: "composite"
   steps:
-    - name: Checkout
-      uses: actions/checkout@v4
-
     - name: Cache backend canister WASM
       uses: actions/cache@v4
       id: backend-wasm-cache

.github/workflows/binding-checks.yml

@@ -3,11 +3,29 @@ name: Binding Checks
 on:
   pull_request:
   workflow_dispatch:
+
 jobs:
   generate:
     runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@v4
+
+      - name: Check if commits can be added
+        id: check_can_add_commit
+        run: |
+          echo "can_add_commit=${{ secrets.GIX_CREATE_PR_PAT != '' && github.event_name == 'pull_request' }}" >> $GITHUB_OUTPUT
+
+      - name: Checkout code
+        if: steps.check_can_add_commit.outputs.can_add_commit == 'true'
+        uses: actions/checkout@v4
+        with:
+          repository: ${{ github.event.pull_request.head.repo.full_name }}
+          ref: ${{ github.event.pull_request.head.ref }}
+          token: ${{ secrets.GIX_CREATE_PR_PAT }}
+
+      - name: Checkout code
+        if: steps.check_can_add_commit.outputs.can_add_commit == 'false'
+        uses: actions/checkout@v4
+
       - uses: dorny/paths-filter@v3
         id: changes
         with:
@@ -29,36 +47,60 @@ jobs:
                 'scripts/build.*.sh'
               - # This workflow
                 '.github/workflows/binding-checks.yml'
+
       - name: Build oisy-backend WASM
         if: steps.changes.outputs.src == 'true'
         uses: ./.github/actions/oisy-backend
+
       - name: Prepare
         if: steps.changes.outputs.src == 'true'
         uses: ./.github/actions/prepare
+
       - name: Install dfx
         if: steps.changes.outputs.src == 'true'
         uses: dfinity/setup-dfx@main
+
       - name: Install binstall
         if: steps.changes.outputs.src == 'true'
         run: |
           BINSTALL_VERSION="1.8.0"
           curl -L --proto '=https' --tlsv1.2 -sSf "https://github.com/cargo-bins/cargo-binstall/releases/download/v${BINSTALL_VERSION}/cargo-binstall-x86_64-unknown-linux-musl.tgz" | tar -xvzf - cargo-binstall
           ./cargo-binstall -y --force "cargo-binstall@$BINSTALL_VERSION"
           rm cargo-binstall
+
       - name: Install candid-extractor
         if: steps.changes.outputs.src == 'true'
         run: cargo binstall --no-confirm candid-extractor@0.1.4 && candid-extractor --version
+
       - name: Generate bindings
         if: steps.changes.outputs.src == 'true'
         run: npm run generate
+
       - name: Check bindings
+        id: check_changes
         if: steps.changes.outputs.src == 'true'
         run: |
-          test -z "$(git status --porcelain | tee /dev/stderr)" || {
-                  echo "FIX: Please execute npm run generate"
-                  git diff
-                  exit 1
-          }
+          if [[ -n "$(git status --porcelain)" ]]; then
+            echo "changes_detected=true" >> $GITHUB_OUTPUT
+          else
+            echo "changes_detected=false" >> $GITHUB_OUTPUT
+          fi
+
+      - name: Commit bindings
+        if: steps.changes.outputs.src == 'true' && steps.check_can_add_commit.outputs.can_add_commit == 'true' && steps.check_changes.outputs.changes_detected == 'true'
+        uses: EndBug/add-and-commit@v9
+        with:
+          add: .
+          default_author: github_actions
+          message: '🤖 Apply bindings changes'
+
+      - name: Provide diff
+        if: steps.changes.outputs.src == 'true' && steps.check_can_add_commit.outputs.can_add_commit == 'false' && steps.check_changes.outputs.changes_detected == 'true'
+        run: |
+          echo "FIX: Please execute npm run generate"
+          git diff
+          exit 1
+
   binding-checks-pass:
     needs: [ 'generate' ]
     runs-on: ubuntu-24.04