ci: push auto-format commits via deploy key so CI re-runs

Switch the auto-format workflow to push over SSH using an
AUTOFORMAT_DEPLOY_KEY deploy key instead of the default GITHUB_TOKEN.
Pushes made with GITHUB_TOKEN never trigger workflows; a deploy-key push
does, so the formatted commit now gets a full CI run.

Add an if: guard so the workflow skips its own format commit (the
deploy-key push re-triggers push), keeping it from waking itself on every
fix. Drop GITHUB_TOKEN write permission since the push no longer uses it.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EGsDJWMXo8LTiQTKfvKhXN

Author: claude

.github/workflows/auto-format.yml

@@ -4,8 +4,17 @@ name: Auto-format
 # the pushed branch and commits the result back. Prettier runs last so it tidies
 # whatever ESLint rewrote; `eslint-config-prettier` means the two never fight.
 #
-# The commit is pushed with the default GITHUB_TOKEN, which by design does NOT
-# re-trigger `push` workflows, so this can't loop on its own formatting commit.
+# The fix commit is pushed over SSH using the AUTOFORMAT_DEPLOY_KEY deploy key
+# (NOT the default GITHUB_TOKEN, whose pushes never trigger workflows). Pushing
+# with a deploy key DOES re-trigger CI, so the formatted commit gets a full CI
+# run — the whole point of using a key here. The `if:` guard below stops this
+# workflow from re-running on its own commit, and the `git diff --quiet` check
+# makes it a no-op even if it ever did.
+#
+# Setup (one-time, in repo settings):
+#   ssh-keygen -t ed25519 -f autoformat_key -N ""
+#   - Add autoformat_key.pub as a Deploy key WITH write access.
+#   - Add autoformat_key (private) as an Actions secret AUTOFORMAT_DEPLOY_KEY.
 
 on:
   push:
@@ -15,7 +24,7 @@ on:
   workflow_dispatch:
 
 permissions:
-  contents: write
+  contents: read # push happens over the deploy key, not GITHUB_TOKEN
 
 # One in-flight run per branch; a newer push supersedes an older, half-finished
 # format so we never race two auto-format commits onto the same ref.
@@ -26,8 +35,17 @@ concurrency:
 jobs:
   format:
     runs-on: ubuntu-latest
+    # Don't re-run on our own format commit — the deploy-key push re-triggers
+    # `push`, so without this guard the workflow would wake itself once per fix
+    # (harmless thanks to `git diff --quiet`, but a wasted run). workflow_dispatch
+    # has no head_commit, so the guard passes and manual runs still work.
+    if: "github.event_name == 'workflow_dispatch' || !startsWith(github.event.head_commit.message, 'style: apply eslint --fix and prettier')"
     steps:
       - uses: actions/checkout@v6.0.3
+        with:
+          # Check out over SSH with the deploy key so the later `git push` is
+          # authenticated as the key (and therefore re-triggers CI).
+          ssh-key: ${{ secrets.AUTOFORMAT_DEPLOY_KEY }}
 
       - uses: actions/setup-node@v6
         with: { node-version: '22', cache: 'npm' }