From b3fea2ef59096243d250a135a4171d75cdb2f053 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marc-Andr=C3=A9=20Bombeck?= <mbombeck@gmail.com>
Date: Fri, 19 Jun 2026 22:20:11 +0200
Subject: [PATCH] ci(quality): add a prettier format-check gate

Wire `pnpm format:check` into the Lint/Typecheck/Test job and extend
.prettierignore so prettier never rewrites generator-owned artifacts:
the OpenAPI contract (whose exact bytes the openapi:check job enforces),
the build-emitted service worker, the Prisma client, and the lockfile.
---
 .github/workflows/security.yml |  6 ++++++
 .prettierignore                | 12 ++++++++++++
 2 files changed, 18 insertions(+)

diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml
index ebdea3088..e2367f2b7 100644
--- a/.github/workflows/security.yml
+++ b/.github/workflows/security.yml
@@ -33,6 +33,12 @@ jobs:
       - name: ESLint
         run: pnpm lint
 
+      # Prettier formatting gate. The format pass excludes generator-owned
+      # artifacts via .prettierignore (notably docs/api/openapi.yaml, which
+      # the OpenAPI drift check below enforces byte-for-byte).
+      - name: Prettier format check
+        run: pnpm format:check
+
       - name: TypeScript strict check
         run: pnpm typecheck
 
diff --git a/.prettierignore b/.prettierignore
index 06202557b..68f690586 100644
--- a/.prettierignore
+++ b/.prettierignore
@@ -2,5 +2,17 @@ node_modules
 .next
 out
 build
+coverage
+
+# Prisma-generated client.
 src/generated
+
+# Lockfile — owned by pnpm.
 pnpm-lock.yaml
+
+# Generator-owned API contract. The openapi:check job enforces its exact
+# bytes against the Zod registry, so prettier must never rewrite it.
+docs/api/openapi.yaml
+
+# Build-generated service worker (the PWA build emits it).
+public/sw.js