From 00222612348938ae0d3c4442557ba0ef3651ff7a Mon Sep 17 00:00:00 2001
From: ethernet <arilotter@gmail.com>
Date: Thu, 16 Jul 2026 15:46:01 -0400
Subject: [PATCH] fix(ci): use autofix-bot PAT

---
 .github/workflows/js-autofix.yml | 12 +++++++-----
 package-lock.json                |  1 +
 2 files changed, 8 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/js-autofix.yml b/.github/workflows/js-autofix.yml
index ca9ec82aa104..ed0cd58abf76 100644
--- a/.github/workflows/js-autofix.yml
+++ b/.github/workflows/js-autofix.yml
@@ -7,9 +7,11 @@ name: auto-fix lint issues & formatting
 # auto-corrected on merge so PRs aren't blocked by them. The PR-time eslint
 # check in typecheck.yml fails only when un-fixable errors remain.
 #
-# Pushes made by GITHUB_TOKEN don't trigger further workflow runs, so there's
-# no infinite loop — the push to bot/js-autofix and the resulting squash merge
-# to main are both made by GITHUB_TOKEN.
+# NOTE: AUTOFIX_BOT_PAT pushes DO trigger further workflow runs (unlike
+# secrets.GITHUB_TOKEN). The concurrency group (ts-autofix-${{ github.ref }})
+# with cancel-in-progress: true prevents an infinite loop — a re-triggered
+# run cancels the in-flight one, and since the second run finds no new fixes
+# (the first run already applied them), it exits with an empty patch.
 #
 # ── Security model: two-job split ───────────────────────────────────────────
 #
@@ -159,7 +161,7 @@ jobs:
 
       - name: Create/update PR and enable auto-merge
         env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GH_TOKEN: ${{ secrets.AUTOFIX_BOT_PAT }}
           BOT_BRANCH: bot/js-autofix
         run: |
           set -euo pipefail
@@ -182,7 +184,7 @@ jobs:
 
       - name: Wait for merge, auto-close on failure or stale
         env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GH_TOKEN: ${{ secrets.AUTOFIX_BOT_PAT }}
           START_SHA: ${{ github.sha }}
         run: |
           set -euo pipefail
diff --git a/package-lock.json b/package-lock.json
index cde4ea308593..7f4c1e5f2eb0 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -19497,6 +19497,7 @@
       "name": "@hermes/root-tests",
       "devDependencies": {
         "@types/plist": "^3.0.5",
+        "eslint": "^9.39.4",
         "plist": "^3.1.0",
         "typescript": "^6.0.3",
         "vitest": "^4.1.9"