diff --git a/.github/actions/add-and-commit/action.yml b/.github/actions/add-and-commit/action.yml
new file mode 100644
index 00000000..5c93f52f
--- /dev/null
+++ b/.github/actions/add-and-commit/action.yml
@@ -0,0 +1,41 @@
+name: Add and Commit
+description: Set git remote and commit changes (e.g., formatting)
+
+inputs:
+  add:
+    description: Files to add
+    required: false
+    default: '.'
+  message:
+    description: Commit message
+    required: true
+  token:
+    description: GitHub token
+    required: true
+
+runs:
+  using: 'composite'
+  steps:
+    # Checkout runs with persist-credentials: false, so re-supply the token to
+    # git (scoped to this local repo) enabling add-and-commit to push.
+    - name: Set git remote silently and locally
+      run: |
+        git config url."https://github-actions:$GITHUB_TOKEN@github.com/".insteadOf "https://github.com/"
+      env:
+        GITHUB_TOKEN: ${{ inputs.token }}
+      shell: bash
+
+    - name: Commit
+      uses: EndBug/add-and-commit@290ea2c423ad77ca9c62ae0f5b224379612c0321 # v10.0.0
+      with:
+        add: ${{ inputs.add }}
+        default_author: github_actions
+        message: ${{ inputs.message }}
+
+    - name: Unset local git remote config
+      run: |
+        git config --unset-all url."https://github-actions:${GITHUB_TOKEN}@github.com/".insteadOf || true
+        git config --unset-all url."https://github.com/".insteadOf || true
+      env:
+        GITHUB_TOKEN: ${{ inputs.token }}
+      shell: bash
diff --git a/.github/workflows/lib-checks.yml b/.github/workflows/lib-checks.yml
index 4f5fc276..9c9305ac 100644
--- a/.github/workflows/lib-checks.yml
+++ b/.github/workflows/lib-checks.yml
@@ -15,17 +15,59 @@ jobs:
     name: Format
     runs-on: ubuntu-latest
     permissions:
-      contents: read
+      contents: write # Required to commit and push formatting changes back to the pull request branch.
 
     steps:
+      - name: Create GitHub App Token
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        continue-on-error: true
+        id: app-token
+        with:
+          app-id: ${{ vars.PR_AUTOMATION_BOT_PUBLIC_APP_ID }}
+          private-key: ${{ secrets.PR_AUTOMATION_BOT_PUBLIC_PRIVATE_KEY }}
+      - name: Check if commits can be added
+        id: check_can_add_commit
+        run: |
+          echo "can_add_commit=$CAN_ADD_COMMIT" >> $GITHUB_OUTPUT
+        env:
+          CAN_ADD_COMMIT: ${{ steps.app-token.outputs.token != '' && github.event_name == 'pull_request' }}
+      - name: Checkout for pull request
+        if: steps.check_can_add_commit.outputs.can_add_commit == 'true'
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          repository: ${{ github.event.pull_request.head.repo.full_name }}
+          ref: ${{ github.event.pull_request.head.ref }}
+          token: ${{ steps.app-token.outputs.token }}
+          persist-credentials: false
       - name: Checkout
+        if: steps.check_can_add_commit.outputs.can_add_commit == 'false'
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
       - name: Prepare
         uses: ./.github/actions/prepare
       - name: Format
-        run: npm run format:check
+        run: npm run format
+      - name: Check for changes
+        id: check_changes
+        run: |
+          if [[ -n "$(git status --porcelain)" ]]; then
+            echo "changes_detected=true" >> $GITHUB_OUTPUT
+          else
+            echo "changes_detected=false" >> $GITHUB_OUTPUT
+          fi
+      - name: Commit format
+        if: steps.check_can_add_commit.outputs.can_add_commit == 'true' && steps.check_changes.outputs.changes_detected == 'true'
+        uses: ./.github/actions/add-and-commit
+        with:
+          message: '🤖 Apply formatting changes'
+          token: ${{ steps.app-token.outputs.token }}
+      - name: Provide diff
+        if: steps.check_can_add_commit.outputs.can_add_commit == 'false' && steps.check_changes.outputs.changes_detected == 'true'
+        run: |
+          echo "FIX: Please run 'npm run format' and commit the result."
+          git diff
+          exit 1
 
   lint:
     name: Lint