Ci/digest final (#69)

* ci(digest): approve with DIGEST_PAT after disabling require_last_push_approval

require_last_push_approval blocked barrettruth from approving their
own push. Disabled that restriction in the ruleset — 1 approval is
still required for all PRs, but the approver can now be the pusher.
DIGEST_PAT (barrettruth) approves, CI runs via PAT push, auto-merge
fires when checks pass.

* ci: format + scripts

* ci: nix

flake.nix

@@ -13,9 +13,12 @@
       ...
     }:
     let
-      forEachSystem = f: nixpkgs.lib.genAttrs (import systems) (system: f nixpkgs.legacyPackages.${system});
+      forEachSystem =
+        f: nixpkgs.lib.genAttrs (import systems) (system: f nixpkgs.legacyPackages.${system});
     in
     {
+      formatter = forEachSystem (pkgs: pkgs.nixfmt-tree);
+
       devShells = forEachSystem (pkgs: {
         default = pkgs.mkShell {
           packages = [

scripts/ci.sh

@@ -4,4 +4,6 @@ set -eu
 nix develop --command stylua --check lua spec
 git ls-files '*.lua' | xargs nix develop --command selene --display-style quiet
 nix develop --command prettier --check .
+nix fmt
+git diff --exit-code -- '*.nix'
 nix develop --command busted