Add prettier setup and expand README with fork guide and local dev bootstrap

- Add prettier (package.json, .prettierrc.yml, .prettierignore) with mise tasks
- Format all existing YAML/MD files with prettier
- Expand README: two fork alternatives (fork this repo vs start fresh), official
  safe-settings docs links, accurate permissions table from app.yml at 2.1.17,
  and local dev bootstrap instructions (mise install, npm install, fmt tasks)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: 2 people

.github/repos/examples/new-service.yml

@@ -11,7 +11,7 @@
 # --- Force-create the repo if it doesn't exist yet ---
 # Useful for bootstrapping: push this file, safe-settings creates the repo.
 repository:
-  force_create: true         # Create the repo if it doesn't exist in the org
+  force_create: true # Create the repo if it doesn't exist in the org
   # template: template-service  # Uncomment to initialize from a template repo
   description: "Short description shown on GitHub"
   homepage: ""
@@ -22,7 +22,6 @@ repository:
   # private: true
   # visibility: private
 
-
 # --- Teams ---
 # Override team access for this specific repo.
 # Useful for: giving a specific team admin on their own service.
@@ -35,7 +34,6 @@ teams:
   # - name: payments-team
   #   permission: push
 
-
 # --- Collaborators ---
 # Add specific GitHub users (outside the org or for special cases).
 # Cannot grant admin — enforced by deployment-settings.yml configvalidator.
@@ -45,7 +43,6 @@ teams:
 #     include:
 #       - this-repo-only
 
-
 # --- Branch protection override ---
 # Only needed if this repo differs from the suborg default.
 # Example: a critical payments service requiring 2 reviews instead of 1.
@@ -66,15 +63,13 @@ teams:
 #       allow_force_pushes: false
 #       allow_deletions: false
 
-
 # --- Additional labels specific to this repo ---
 # labels:
 #   include:
 #     - name: "payments"
 #       color: "0075ca"
 #       description: "Payments-related issue"
 
-
 # --- Autolinks ---
 # Link issue tracker references in commits/PRs automatically.
 # autolinks:
@@ -85,7 +80,6 @@ teams:
 #     url_template: "https://yourcompany.atlassian.net/browse/JIRA-<num>"
 #     is_alphanumeric: false
 
-
 # --- Custom properties ---
 # Set custom properties for filtering/suborg matching.
 # custom_properties:

.github/repos/examples/open-source-lib.yml

@@ -30,7 +30,6 @@ repository:
     enableVulnerabilityAlerts: true
     enableAutomatedSecurityFixes: true
 
-
 # Labels for community contributions
 labels:
   include:
@@ -53,7 +52,6 @@ labels:
       color: "e4e669"
       description: "This doesn't seem right"
 
-
 # Stricter branch protection for public repos:
 # require CODEOWNERS review so maintainers control what gets merged.
 branches:
@@ -62,7 +60,7 @@ branches:
       required_pull_request_reviews:
         required_approving_review_count: 1
         dismiss_stale_reviews: true
-        require_code_owner_reviews: true   # Maintainers must approve community PRs
+        require_code_owner_reviews: true # Maintainers must approve community PRs
         require_last_push_approval: false
       required_status_checks:
         strict: true
@@ -74,7 +72,6 @@ branches:
       allow_deletions: false
       restrictions: null
 
-
 # Autolinks: link PR descriptions to your internal tracker
 # autolinks:
 #   - key_prefix: "LIN-"

.github/settings.yml

@@ -17,11 +17,11 @@ repository:
   default_branch: main
 
   has_issues: true
-  has_projects: false   # Use a dedicated project management tool (Linear, Jira, etc.)
-  has_wiki: false       # Prefer docs-as-code in the repo itself
+  has_projects: false # Use a dedicated project management tool (Linear, Jira, etc.)
+  has_wiki: false # Prefer docs-as-code in the repo itself
 
   allow_squash_merge: true
-  allow_merge_commit: false  # Keep history clean — squash or rebase only
+  allow_merge_commit: false # Keep history clean — squash or rebase only
   allow_rebase_merge: true
   allow_auto_merge: false
   delete_branch_on_merge: true
@@ -31,7 +31,6 @@ repository:
     enableVulnerabilityAlerts: true
     enableAutomatedSecurityFixes: true
 
-
 # --- Labels ---
 # Standard label set across all repos. Enables consistent filtering in GitHub,
 # Linear, and any automation that reads issue/PR labels.
@@ -105,7 +104,6 @@ labels:
     # Never delete labels that start with "release" — managed by the release workflow
     - name: "^release"
 
-
 # --- Branch protection (default branch) ---
 # Baseline: 1 review, conversations must be resolved, no force pushes.
 # CI check contexts are left empty — each repo's own workflow registers

.github/suborgs/backend.yml

@@ -34,7 +34,7 @@ branches:
         require_last_push_approval: false
 
       required_status_checks:
-        strict: true   # Branch must be up to date with main before merge
+        strict: true # Branch must be up to date with main before merge
         contexts: []
       enforce_admins: false
       required_conversation_resolution: true

.github/suborgs/infrastructure.yml

@@ -29,13 +29,13 @@ branches:
       required_pull_request_reviews:
         required_approving_review_count: 2
         dismiss_stale_reviews: true
-        require_code_owner_reviews: true   # CODEOWNERS file should designate platform team
-        require_last_push_approval: true   # Last commit must be approved by someone else
+        require_code_owner_reviews: true # CODEOWNERS file should designate platform team
+        require_last_push_approval: true # Last commit must be approved by someone else
 
       required_status_checks:
         strict: true
         contexts: []
-      enforce_admins: false   # Set to true if you want even admins to go through PR flow
+      enforce_admins: false # Set to true if you want even admins to go through PR flow
       required_conversation_resolution: true
       allow_force_pushes: false
       allow_deletions: false

.github/workflows/safe-settings-sync.yml

@@ -13,9 +13,9 @@ on:
   workflow_dispatch:
     inputs:
       nop:
-        description: 'Dry-run mode: show diffs without applying (true/false)'
+        description: "Dry-run mode: show diffs without applying (true/false)"
         required: false
-        default: 'false'
+        default: "false"
 
 jobs:
   sync:
@@ -38,7 +38,7 @@ jobs:
       - name: Setup Node.js
         uses: actions/setup-node@v4
         with:
-          node-version: '20'
+          node-version: "20"
           cache: npm
           cache-dependency-path: ${{ env.SAFE_SETTINGS_CODE_DIR }}/package-lock.json
 

.gitignore

@@ -0,0 +1 @@
+node_modules/

.mise.toml

@@ -0,0 +1,10 @@
+[tools]
+node = "lts"
+
+[tasks.fmt]
+run = "npx prettier --write ."
+description = "Format all files with Prettier"
+
+[tasks."fmt:check"]
+run = "npx prettier --check ."
+description = "Check formatting without writing"

.prettierignore

@@ -0,0 +1,2 @@
+node_modules/
+package-lock.json

.prettierrc.yml

@@ -0,0 +1,2 @@
+proseWrap: always
+printWidth: 100