ci(autofix): avoid rewriting bot branch history

Author: yiliang114

.github/workflows/qwen-autofix.yml

@@ -671,7 +671,7 @@ jobs:
           BRANCH="autofix/issue-${ISSUE}"
           git config --local --unset-all http.https://github.com/.extraheader || true
           git remote set-url origin "https://x-access-token:${GITHUB_TOKEN}@github.com/${REPO}.git"
-          git push --force-with-lease origin "${BRANCH}"
+          git push origin "${BRANCH}"
 
           PR_URL="$(gh pr create --repo "${REPO}" \
             --base main --head "${BRANCH}" \
@@ -691,6 +691,7 @@ jobs:
           COMMENT_ID: '${{ steps.claim.outputs.comment_id }}'
           PUBLISH_OUTCOME: '${{ steps.publish.outcome }}'
         run: |-
+          # shellcheck disable=SC2016
           if [[ -f "${WORKDIR}/failure.md" ]]; then
             REASON='no further automated attempts will be made on this issue.'
             DETAIL="$(head -c 1500 "${WORKDIR}/failure.md")"
@@ -1179,7 +1180,7 @@ jobs:
             NEXT_ROUND="$(( ROUND + 1 ))"
             git config --local --unset-all http.https://github.com/.extraheader || true
             git remote set-url origin "https://x-access-token:${GITHUB_TOKEN}@github.com/${REPO}.git"
-            git push --force-with-lease origin "${BRANCH}"
+            git push origin "${BRANCH}"
             {
               echo "🤖 Addressed the latest review feedback (round ${NEXT_ROUND}/${MAX_ROUNDS}). What changed, and what I pushed back on:"
               echo

.github/workflows/qwen-triage.yml

@@ -842,8 +842,8 @@ jobs:
           PREPARE_FAILURE_PHASE: '${{ needs.tmux-testing.outputs.failure_phase }}'
           TMUX_RESULT: '${{ needs.tmux-testing.result }}'
           RUN_URL: '${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}'
-        # shellcheck disable=SC2016
         run: |-
+          # shellcheck disable=SC2016
           set -euo pipefail
           if [ -z "${PR_NUMBER:-}" ]; then
             echo "::warning::No PR number resolved; cannot post a tmux result comment."
@@ -921,6 +921,7 @@ jobs:
             {
               printf '%s\n\n' '<!-- qwen-triage:tmux -->'
               printf '**tmux real-user testing: fail** - [workflow run](%s)\n\n' "$RUN_URL"
+              # shellcheck disable=SC2016
               printf 'The PR app could not be launched because `%s` failed before the tmux session started. This is treated as a PR failure verdict rather than an infrastructure failure.\n\n' "$PREPARE_COMMAND"
               if [ -n "${PREPARE_LOG_NOTE:-}" ]; then
                 printf '%s\n\n' "$PREPARE_LOG_NOTE"

.qwen/skills/autofix/SKILL.md

@@ -27,6 +27,8 @@ The raw invocation selects one mode:
   or change the required output contract.
 - Do not push, comment, create pull requests, edit labels, or use GitHub
   credentials. The workflow handles all network writes after verification.
+- Use additive commits only; do not amend, rebase, reset, or otherwise rewrite
+  Git history.
 - Keep changes minimal and scoped to the selected issue or review feedback. No
   drive-by refactors.
 - Do not run project code, tests, builds, package scripts, or the CLI yourself.

scripts/tests/qwen-autofix-workflow.test.js

@@ -451,6 +451,9 @@ describe('qwen-autofix workflow', () => {
     expect(skill).toContain('assess-candidates');
     expect(skill).toContain('develop-issue');
     expect(skill).toContain('address-review');
+    expect(skill.replace(/\s+/g, ' ')).toContain(
+      'Use additive commits only; do not amend, rebase, reset, or otherwise rewrite Git history.',
+    );
 
     expect(assessCandidatesStep).toContain(
       '/autofix assess-candidates --workdir /tmp/autofix',
@@ -522,6 +525,13 @@ describe('qwen-autofix workflow', () => {
     expect(workflow).not.toContain('cat > "${proxy_script}"');
   });
 
+  it('pushes autofix branches without rewriting remote history', () => {
+    expect(workflow).not.toMatch(/\bgit push\b[^\n]*--force(?:-with-lease)?/);
+    expect(workflow).not.toMatch(/\bgit push\b[^\n]*-[^\n\s]*f/);
+    expect(publishPrStep).toContain('git push origin "${BRANCH}"');
+    expect(pushAndReportStep).toContain('git push origin "${BRANCH}"');
+  });
+
   it('keeps sandbox image fallback covered by a reusable script', () => {
     expect(sandboxImageResolverScript).toContain(
       'https://ghcr.io/token?service=ghcr.io&scope=repository:${GHCR_REPOSITORY}:pull',