ci: set up autofix.ci for Prettier on pull requests

.github/workflows/autofix.yml

@@ -0,0 +1,38 @@
+# autofix.ci — auto-apply Prettier fixes to PRs (and main pushes).
+# Workflow name must remain exactly "autofix.ci" so the autofix.ci GitHub App
+# can securely identify this workflow. Install the app for this repository at
+# https://autofix.ci before expecting commits to land.
+name: autofix.ci # needed to securely identify the workflow
+
+on:
+ pull_request:
+ push:
+ branches: ["main"]
+
+permissions:
+ contents: read
+
+concurrency:
+ group: autofix-${{ github.event.pull_request.number || github.ref }}
+ cancel-in-progress: true
+
+jobs:
+ autofix:
+ runs-on: ubuntu-24.04
+ timeout-minutes: 15
+ steps:
+ - name: Checkout
+ uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+ with:
+ persist-credentials: false
+
+ - name: Setup Node and dependencies
+ uses: ./.github/actions/setup-node-cached
+
+ - name: Format with Prettier
+ run: npm run format
+
+ - name: Apply autofix.ci patch
+ uses: autofix-ci/action@c5b2d67aa2274e7b5a18224e8171550871fc7e4a # v1.3.4
+ with:
+ commit-message: "style: apply Prettier format"

scripts/github-action-pins.mjs

@@ -33,6 +33,10 @@ const reviewedActionPins = new Map([
  ["peter-evans/create-or-update-comment", new Map([["e8674b075228eee787fea43ef493e45ece1004c9", "v5"]])],
  ["docker/setup-buildx-action", new Map([["bb05f3f5519dd87d3ba754cc423b652a5edd6d2c", "v4"]])],
  ["docker/build-push-action", new Map([["53b7df96c91f9c12dcc8a07bcb9ccacbed38856a", "v7"]])],
+ // Reviewed 2026-07-31: official autofix.ci action; tag v1.3.4 / moving v1 both
+ // resolve to this immutable commit (node24 runtime). Used only after local
+ // Prettier write; the action itself never receives write tokens in-workflow.
+ ["autofix-ci/action", new Map([["c5b2d67aa2274e7b5a18224e8171550871fc7e4a", "v1.3.4"]])],
 ]);
 
 const usesPattern = /^\s*(?:-\s*)?uses:\s*([^@\s]+)@([^\s#]+)(?:\s+#\s*(\S.*?))?\s*$/;

tests/github-action-pins.test.ts

@@ -35,4 +35,10 @@ describe("GitHub Action pin validation", () => {
  it("allows repository-local actions", () => {
  expect(validateActionReference(" uses: ./.github/actions/example@v1")).toBeNull();
  });
+
+ it("accepts the reviewed autofix.ci action pin", () => {
+ expect(
+ validateActionReference(" - uses: autofix-ci/action@c5b2d67aa2274e7b5a18224e8171550871fc7e4a # v1.3.4"),
+ ).toBeNull();
+ });
 });