Read API error details without an undeclared import, fix a null crash, add tests

[daltonbr]

Problem

#3 started reporting the more specific message the GitHub API sometimes puts in
response.data.errors. It had two flaws:

• It imported RequestError from @octokit/request-error, which is not declared in
  package.json and only resolved because npm hoists it out of @actions/github.
• It assumed response.data is an object. When data is null, the catch block
  throws a TypeError that replaces the real error.

What this changes

A new getApiErrorMessage in src/utils.ts checks each field before reading it.
It prefers response.data.errors when that is a string, then error.message, then
String(error). The undeclared import is gone. Eleven tests in
tests/utils.test.js cover it, using Node's built-in runner, no framework added.

Who is affected

Normal API error messages are unchanged. Unusual failures now report the real
message instead of a crash or an empty one: null or non-object data, a missing
response, and thrown values that are not an Error, such as a string or null.

Notes

• Why not declare @octokit/request-error: the code reads one field, the
  as RequestError cast gave no runtime safety, and a direct dependency can drift
  from the version @actions/github pins, leaving two copies installed.
• globals is a new devDependency, used only by ESLint. no-undef stays on for the
  plain JS tests, and the first console or process in a test would fail lint
  without it.
• tsconfig.json pins rootDir to ./src, so a stray .ts file in tests/ can
  no longer move the output to lib/src/ and break ncc's entry point.
• npm test builds first. npm run all also runs the tests, so CI picks them up.
• CONTRIBUTING.md gains a note on testing a change against a built dist/ branch.
• dist/ is left out and is rebuilt by build.yml after merge.

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

Package	Version	Score	Details
npm/globals	^17.11.0	Unknown	Unknown

Scanned Files

• package.json

[Copilot]

🟢 Approval recommended

The dependency declaration and lockfile update are consistent, complete, and runtime-neutral.

Pull request overview

Declares the existing RequestError type dependency explicitly, removing reliance on transitive npm hoisting without changing runtime behavior.

Changes:

• Converts RequestError to a type-only import.
• Adds and locks @octokit/request-error at ^5.1.1.

File summaries

File	Description
src/main.ts	Uses an explicit type-only import.
package.json	Declares the direct development dependency.
package-lock.json	Synchronizes root dependency metadata.

Review details

• Files reviewed: 2/3 changed files
• Comments generated: 0
• Review effort level: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

🟢 Approval recommended

The focused implementation safely fixes null handling, removes the undeclared import, and provides adequate regression coverage.

Review details

• Files reviewed: 5/5 changed files
• Comments generated: 0 new
• Review effort level: Balanced