ci: auto-format pull requests

[AntonioVentilii]

Stacked on #898. Base is style/prettier-3-9-5-formatting so the diff stays clean; GitHub retargets this to main automatically once #898 merges.

Motivation

Today the Format job runs prettier --check and fails, leaving the contributor to run the formatter by hand and push a follow-up commit. dfinity/oisy-wallet instead runs the formatter in CI and commits the result back to the PR branch — see its frontend-checks.yml (frontend/prettier) and formatting-checks.yml (Rust/shell). This ports that pattern.

Changes

• .github/actions/add-and-commit — composite action ported from dfinity/oisy-wallet. Re-supplies the token to git locally (checkout runs with persist-credentials: false), commits, then unsets the config. The EndBug/add-and-commit pin is v10.0.0 — the one this repo already uses in e2e-snapshots.yml — rather than oisy-wallet's older v9.1.4.
• lib-checks.yml format job — mint a GitHub App token (continue-on-error), check out the PR head when one is available, run npm run format, and commit 🤖 Apply formatting changes if anything changed. Job permission goes contents: read -> contents: write.

Behaviour when the token is unavailable

can_add_commit is false for pushes, fork PRs, and any run where the app token did not mint. In that case the job checks out normally, formats, prints the diff and exits 1 — i.e. exactly today's behaviour, just with a diff attached. Nothing gets silently skipped.

This composes with #900: on a push to main, github.event_name != 'pull_request', so it takes the fail-with-diff path rather than trying to commit to main.

Blocker found on the first run — the private key is not available to this repo

The Format run on this PR shows the app variable resolves but the secret does not:

with:
  app-id: 1063231
Error: The 'private-key' input must be set to a non-empty string.
      If using a secret or variable, ensure it is available in this workflow context.

So vars.PR_AUTOMATION_BOT_PUBLIC_APP_ID reaches oisy-wallet-signer, but secrets.PR_AUTOMATION_BOT_PUBLIC_PRIVATE_KEY does not — most likely the org secret's repository-access list does not include this repo.

The fallback behaved exactly as designed: continue-on-error swallowed the failure, can_add_commit became false, the job checked out normally, formatted, found no changes and passed. So this PR is safe to merge as-is — it is a no-op relative to today's behaviour until the secret is granted, at which point auto-commit starts working with no further code change.

To actually enable it: grant PR_AUTOMATION_BOT_PUBLIC_PRIVATE_KEY repository access to dfinity/oisy-wallet-signer in the org secret settings, and confirm the app is installed here with contents: write.

Minor: actions/create-github-app-token now warns that app-id is deprecated in favour of client-id. Kept as-is to match the org variable (a numeric app id) and dfinity/oisy-wallet; switching would need a separate client-id variable.

Known limitation — this would not have auto-fixed #890

The prettier bump that started this was authored by app/dependabot. Dependabot-triggered pull_request runs get a read-only token and read from the separate Dependabot secrets store, not Actions secrets, so the app token will not mint on them and they take the fail-with-diff path.

Auto-formatting dependabot PRs too would additionally require the app credentials to be added under Dependabot secrets. Worth doing as a follow-up if the team wants it, since dependency bumps are exactly the PRs that trigger reformats.

Verification

• zizmor --persona pedantic passes locally on both changed files (the three audits needing a GitHub API token were skipped; the Lint GitHub Actions job here will cover those).
• prettier --check passes on both files.

[zeropath-ai]

✅ No security or compliance issues detected. Reviewed everything up to a58b925.

Security Overview

• 🔎 Scanned files: 2 changed file(s)
• 🔗 Scan Link: https://zeropath.com/app/repositories/ddb6c189-2e1b-4cd9-8464-d3af47246cd7?scanId=7251d9b4-74a1-4589-beb6-846c5f7287b0&codeScanTypes=PrScan&tab=issues

Detected Code Changes

Change Type	Relevant files
Enhancement	► .github/actions/add-and-commit/action.yml     Add new GitHub Action: Add and Commit functionality to set remote, commit, and push changes ► .github/workflows/lib-checks.yml     Modify lib checks workflow to support formatting changes: grant write permission, add steps for app token, commit, and diff output

The base branch was changed.