feat(lint): add auto-fix reusable workflow for formatters

[Copilot]

Fixing CI formatting failures (dprint, yamlfmt, shfmt) currently requires running each tool locally and pushing a fix commit. This adds a reusable autofix.yml workflow that runs all three formatters in write mode and commits the result back to the branch.

Changes

• .github/workflows/autofix.yml — New reusable workflow (on: workflow_call) with:

  • mise-version required input (ADR 0001 compliant)
  • Per-formatter boolean toggles (autofix-dprint, autofix-yamlfmt, autofix-shfmt), all defaulting to true
  • Custom commit-message input (default: style: auto-fix formatting), passed via env var to prevent shell injection
  • Commits and pushes only when there are actual changes
  • Intentionally excludes check-only tools (shellcheck, actionlint, checkov, trivy, zizmor)

• workflow-templates/autofix.yml — Caller template triggered via workflow_dispatch; developers run it manually on any branch needing formatting fixes

• workflow-templates/autofix.properties.json — Template metadata

• docs/design-decisions/0001-reusable-workflow-version-inputs.md — Adds autofix.yml to the ADR compliance table

Usage

jobs:
  autofix:
    uses: DevSecNinja/.github/.github/workflows/autofix.yml@<sha>
    permissions:
      contents: write
    with:
      # renovate: datasource=github-releases depName=jdx/mise
      mise-version: "2026.4.5"

Tool	Check mode (lint.yml)	Fix mode (autofix.yml)
dprint	dprint check	dprint fmt
yamlfmt	yamlfmt -lint	yamlfmt
shfmt	shfmt --diff	shfmt --write