ethernet 64389a2ce2 fix(ci): js-autofix pushes via PR instead of direct push to main (#65186) ... * fix(js): never format package-lock.json prettier and eslint should never touch package-lock.json. main has a repo rule requiring team approval when lockfiles change, so an autofix PR touching it would hang waiting for review. - Add .prettierignore at repo root - Add '**/package-lock.json' to eslint shared config ignores * fix(ci): js-autofix pushes via PR instead of direct push to main Main now has repository rules requiring pull requests + required status checks ("All required checks pass"), so the workflow's direct push to main is rejected with GH013 every time eslint --fix produces changes. Switch apply-patch to push to a dedicated bot/js-autofix branch, create or update a PR, and enable auto-merge (squash). The PR auto-merges once CI passes. If CI fails or main moves, the PR is auto-closed and the branch deleted — the next run re-applies on the current state. The two-job security split is preserved: - generate-patch stays unprivileged (contents: read only) — it runs npm on an ephemeral runner with zero push permissions. - apply-patch (contents: write + pull-requests: write) still never runs npm, never installs anything, never executes repo code — it applies the trusted patch artifact and delivers it via PR.		2026-07-15 17:19:19 -04:00
..
actions	ci: add ci-reviewed label gate for CI-sensitive files	2026-07-16 01:42:02 +05:30
ISSUE_TEMPLATE	feat: add openrouter/elephant-alpha to curated model lists (#9378)	2026-04-13 21:16:14 -07:00
pr-screenshots	feat(billing): /billing terminal billing — interactive TUI + CLI client (#45449)	2026-06-19 01:53:32 +05:30
workflows	fix(ci): js-autofix pushes via PR instead of direct push to main (#65186)	2026-07-15 17:19:19 -04:00
dependabot.yml	chore(security): add OSV-Scanner CI + Dependabot for github-actions only (#20037)	2026-05-04 20:58:21 -07:00
PULL_REQUEST_TEMPLATE.md	docs: add documentation & housekeeping checklist to PR template	2026-03-05 07:23:52 -08:00