Add knip, publint, actionlint as specialized linters

Add three specialized linters to complement strict TS + Prettier — each
catches a class of problem neither of those sees.

- knip: dead code and unused exports. Found: two unused test helpers
  (setGithubEnv, useMockAgent, TestContext interface). Removed. Would
  have caught the original @octokit/rest / actions-toolkit / node-fetch
  leftovers automatically if it had been in place from the start.
- publint: npm package hygiene. Added 'type: commonjs' (explicit module
  type), 'private: true' (this project ships as a GitHub Action, not via
  npm), and 'files: [dist/, action.yml]' (if it ever is published, only
  the artifacts users need get packaged).
- actionlint: GitHub Actions workflow linter. Found nodejs.yml pinning
  actions/setup-node@v3 (deprecated) and testing on Node 18/20 when the
  action.yml runtime is node24. Bumped to setup-node@v4 and the matrix
  to 20/22/24.

Swapped nock devDep (not used since we moved to undici MockAgent in the
earlier test-harness commit) for an explicit 'undici: ^5.29' devDep —
this resolves the version knip was flagging as 'unlisted' and pins it
to match what @actions/github resolves, which is required for MockAgent
interception to work in-process.

Scripts:
- lint:knip, lint:publint, lint (runs format:check + both).
- CI workflow runs 'npm run lint' and 'npm test' before the build.
- New .github/workflows/actionlint.yml runs actionlint on any change
  to .github/workflows/**.

Author: iainmcgin

.github/workflows/actionlint.yml

@@ -0,0 +1,19 @@
+name: actionlint
+
+on:
+  push:
+    branches: ['*']
+  pull_request:
+    branches: [master]
+    paths:
+      - '.github/workflows/**'
+
+jobs:
+  actionlint:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Install and run actionlint
+        run: |
+          bash <(curl -sSfL https://raw.githubusercontent.com/rhysd/actionlint/main/scripts/download-actionlint.bash)
+          ./actionlint -color

.github/workflows/nodejs.yml

@@ -15,7 +15,7 @@ jobs:
     runs-on: ubuntu-latest
     strategy:
       matrix:
-        node-version: [18.x, 20.x]
+        node-version: [20.x, 22.x, 24.x]
     steps:
     - name: Initialize Energy Estimation
       uses: green-coding-berlin/eco-ci-energy-estimation@v1
@@ -29,11 +29,15 @@ jobs:
         task: get-measurement
         label: 'repository checkout'
     - name: Use Node.js ${{ matrix.node-version }}
-      uses: actions/setup-node@v3
+      uses: actions/setup-node@v4
       with:
         node-version: ${{ matrix.node-version }}
     - name: Npm install
       run: npm ci
+    - name: Lint (prettier + knip + publint)
+      run: npm run lint
+    - name: Npm test
+      run: npm test
     - name: Npm build
       run: npm run build --if-present
     - name: Checkout Repo Measurement

__tests__/integration/errorPaths.test.ts

@@ -84,7 +84,9 @@ describe('error paths', () => {
 
     // The action reports the failure through core.setFailed. It does not
     // silently retry (v6 @actions/github does not ship plugin-retry).
-    expect(watch.failures.join('\n')).toMatch(/Could not retrieve repository contents|Could not update the JSON file/)
+    expect(watch.failures.join('\n')).toMatch(
+      /Could not retrieve repository contents|Could not update the JSON file/
+    )
     watch.restore()
   })
 
@@ -145,9 +147,9 @@ describe('error paths', () => {
       body: 'i have read the cla document and i hereby sign the cla',
       user: { login: 'alice', id: 1001 }
     })
-    fake.repo('acme', 'widgets').addWorkflow('cla-check', [
-      { id: 777, conclusion: 'failure' }
-    ])
+    fake
+      .repo('acme', 'widgets')
+      .addWorkflow('cla-check', [{ id: 777, conclusion: 'failure' }])
 
     // Rerun-workflow-run fails at the 'listWorkflowRuns' step.
     fake.injectFailure({
@@ -178,7 +180,9 @@ describe('error paths', () => {
 
     // The signature should still have been recorded even though the rerun
     // request failed.
-    const sigFile = fake.repo('acme', 'widgets').getFile('signatures/v1/cla.json') as {
+    const sigFile = fake
+      .repo('acme', 'widgets')
+      .getFile('signatures/v1/cla.json') as {
       signedContributors: Array<{ name: string }>
     }
     expect(sigFile.signedContributors.map(c => c.name)).toContain('alice')

__tests__/integration/pagination.test.ts

@@ -62,7 +62,9 @@ describe('pagination', () => {
     )
     // alice's signing comment lives on page 2. If pagination were broken,
     // newSigned would be empty.
-    expect(result.newSigned.map((c: { name: string }) => c.name)).toEqual(['alice'])
+    expect(result.newSigned.map((c: { name: string }) => c.name)).toEqual([
+      'alice'
+    ])
   })
 
   it('fake emits rel="next" only when there are more pages', async () => {

__tests__/integration/preVsPostRegression.test.ts

@@ -90,13 +90,13 @@ function scenarioEnv(
   }
 }
 
-import {createHash} from 'crypto'
+import { createHash } from 'crypto'
 
 interface NormalizedRequest {
   method: string
   path: string
   status: number
-  bodyHash: string  // stable hash of the canonicalized request body
+  bodyHash: string // stable hash of the canonicalized request body
   bodyShape: string // tag, e.g. 'empty' | 'json' | 'text', for readable diffs
 }
 
@@ -106,8 +106,8 @@ interface NormalizedRequest {
  * diff, but any semantic change — a missing field, a new field, a different
  * commit message — still produces a distinct hash.
  */
-function canonicalBody(raw: string): {hash: string; shape: string} {
-  if (!raw) return {hash: 'empty', shape: 'empty'}
+function canonicalBody(raw: string): { hash: string; shape: string } {
+  if (!raw) return { hash: 'empty', shape: 'empty' }
   let parsed: unknown
   try {
     parsed = JSON.parse(raw)
@@ -126,7 +126,7 @@ function canonicalBody(raw: string): {hash: string; shape: string} {
 
 function normalizeLog(log: FakeGitHubHttp['requestLog']): NormalizedRequest[] {
   return log.map(e => {
-    const {hash, shape} = canonicalBody(e.body)
+    const { hash, shape } = canonicalBody(e.body)
     return {
       method: e.method,
       path: decodeURIComponent(e.path.split('?')[0] || ''),
@@ -256,8 +256,16 @@ describe('pre- vs post-refactor: HTTP-level behaviour is unchanged', () => {
       // focused unit tests to pin down body shape.
       const bodySensitive = (r: NormalizedRequest): boolean => {
         if (r.method === 'POST' && r.path === '/graphql') return false
-        if (r.method === 'PATCH' && r.path.startsWith('/repos/acme/widgets/issues/comments/')) return false
-        if (r.method === 'PUT' && r.path === '/repos/acme/widgets/contents/signatures/cla.json') return false
+        if (
+          r.method === 'PATCH' &&
+          r.path.startsWith('/repos/acme/widgets/issues/comments/')
+        )
+          return false
+        if (
+          r.method === 'PUT' &&
+          r.path === '/repos/acme/widgets/contents/signatures/cla.json'
+        )
+          return false
         return true
       }
       const key = (r: NormalizedRequest) =>

__tests__/testHelpers/context.ts

@@ -1,6 +1,6 @@
 import * as github from '@actions/github'
 
-export interface TestContext {
+interface TestContext {
   owner: string
   repo: string
   issueNumber: number

__tests__/testHelpers/env.ts

@@ -12,17 +12,6 @@ export function setInput(name: string, value: string): void {
   trackedKeys.add(key)
 }
 
-export function setGithubEnv(vars: Record<string, string | undefined>): void {
-  for (const [k, v] of Object.entries(vars)) {
-    if (v === undefined) {
-      delete process.env[k]
-    } else {
-      process.env[k] = v
-    }
-    trackedKeys.add(k)
-  }
-}
-
 export function resetEnv(): void {
   for (const key of trackedKeys) {
     delete process.env[key]

__tests__/testHelpers/fakeGithubCore.ts

@@ -220,13 +220,21 @@ export function createFakeGitHubCore(): FakeGitHubCore {
       path
     })
   })
-  addRoute(getRoutes, '/repos/:owner/:repo/issues/:num/comments', (m, _body, query) => {
-    const owner = decodeURIComponent(m[1]!)
-    const name = decodeURIComponent(m[2]!)
-    const num = parseInt(m[3]!, 10)
-    const all = getRepo(owner, name).comments.get(num) || []
-    return paginate(all, query, `/repos/${owner}/${name}/issues/${num}/comments`)
-  })
+  addRoute(
+    getRoutes,
+    '/repos/:owner/:repo/issues/:num/comments',
+    (m, _body, query) => {
+      const owner = decodeURIComponent(m[1]!)
+      const name = decodeURIComponent(m[2]!)
+      const num = parseInt(m[3]!, 10)
+      const all = getRepo(owner, name).comments.get(num) || []
+      return paginate(
+        all,
+        query,
+        `/repos/${owner}/${name}/issues/${num}/comments`
+      )
+    }
+  )
   addRoute(getRoutes, '/repos/:owner/:repo/pulls/:num', m => {
     const owner = decodeURIComponent(m[1]!)
     const name = decodeURIComponent(m[2]!)
@@ -423,7 +431,10 @@ export function createFakeGitHubCore(): FakeGitHubCore {
     })
   }
 
-  function consumeFault(method: string, pathname: string): RouteResult | undefined {
+  function consumeFault(
+    method: string,
+    pathname: string
+  ): RouteResult | undefined {
     // Match against both the raw and percent-decoded pathname so test regexes
     // can be written naturally ('/signatures/cla.json') and still match the
     // encoded URLs octokit emits ('/signatures%2Fcla.json').
@@ -439,7 +450,8 @@ export function createFakeGitHubCore(): FakeGitHubCore {
       if (f.times <= 0) faults.splice(i, 1)
       return {
         status: f.status,
-        body: f.body ?? JSON.stringify({ message: `fault-injected ${f.status}` }),
+        body:
+          f.body ?? JSON.stringify({ message: `fault-injected ${f.status}` }),
         headers: f.headers
       }
     }

__tests__/testHelpers/fakeGithubHttp.ts

@@ -17,7 +17,12 @@ export interface FakeGitHubHttp {
   repo(owner: string, name: string): FakeRepoHandle
   recordedLocks: FakeGitHubCore['recordedLocks']
   recordedRerunRequests: FakeGitHubCore['recordedRerunRequests']
-  requestLog: Array<{ method: string; path: string; status: number; body: string }>
+  requestLog: Array<{
+    method: string
+    path: string
+    status: number
+    body: string
+  }>
   close(): Promise<void>
 }
 
@@ -30,11 +35,11 @@ export async function startFakeGitHubHttp(): Promise<FakeGitHubHttp> {
     req.on('data', c => chunks.push(c))
     req.on('end', () => {
       const body = Buffer.concat(chunks).toString('utf-8')
-      const { status, body: out, headers } = core.route(
-        req.method || 'GET',
-        req.url || '/',
-        body
-      )
+      const {
+        status,
+        body: out,
+        headers
+      } = core.route(req.method || 'GET', req.url || '/', body)
       requestLog.push({
         method: req.method || 'GET',
         path: req.url || '/',

__tests__/testHelpers/mockAgent.ts

@@ -34,19 +34,6 @@ export function installMockAgent(): MockAgentHarness {
   }
 }
 
-/** Jest-style beforeEach/afterEach setup. Returns a getter. */
-export function useMockAgent(): () => MockAgentHarness {
-  let harness: MockAgentHarness | undefined
-  beforeEach(() => {
-    harness = installMockAgent()
-  })
-  afterEach(async () => {
-    await harness!.close()
-    harness = undefined
-  })
-  return () => harness!
-}
-
 /**
  * Install an interceptor that captures the request body as JSON and returns
  * the given reply. The returned object's `body` is populated after the request