fix: strengthen diff behavior and type safety - #96

Summary

• Add a narrow GitHubClient boundary and an Octokit adapter so diff behavior uses typed, focused fakes instead of concrete-client casts.
• Restore Octokit's Link-aware pagination for commit files, compare commits, and pull-request files while keeping compare files as one request.
• Strengthen TypeScript checks and event/configuration parsing, including early required-context errors and cap-aware incomplete push-payload fallback.
• Expand behavioral coverage for diff fallbacks, push aggregation, filters, JSON outputs, orchestration failures, throttling, and API boundaries.
• Replace print-only integration steps with output invariants, and document the resulting output, filtering, validation, and maintainer contracts.

Motivation

GitHubDiff previously depended on the entire Octokit surface, which forced broad fakes and unsafe assertions. Event payloads were trusted after an unchecked JSON cast, unreadable payloads silently changed diff selection, and truncated push commit lists could omit files. The initial adapter also inferred pagination completion from response length instead of GitHub's Link: rel="next" contract.

Behavioral coverage

• Link-aware commit, compare, and pull-file pagination, including exactly full final pages without a next link, realistic next links, optional response collections, and a single unpaginated compare-files request.
• Push payloads below and exactly at GitHub's 2,048-commit cap, missing IDs, size mismatches, empty/new-ref payloads, custom bases, and non-default branches.
• Compare/Pulls/commit fallback boundaries, known PR file counts, same-ref commits, missing SHAs and filenames, and fallback failures.
• Stateful push sequences including add/remove/recreate/rename behavior, duplicate commit refs, removal filtering, and stable output order.
• Required repository/ref/SHA context, malformed event files and JSON, pull request variants, custom bases, and all-zero-before pushes.
• Ordered filter negation/re-inclusion, CRLF and blank patterns, dotfiles, Unicode, spaces, duplicates, independent filters, and no-match sets.
• Exact JSON round trips for unusual filenames, empty base outputs, deterministic dynamic output ordering, partial output failures, non-Error rejections, and bounded throttle retries.

Coverage

Compatibility

Input names, output names, the Node 24 runtime, default-base selection, and the default exclusion of removed files are unchanged. The space-delimited outputs remain available. Observable improvements are limited to early errors for malformed required context/event files, conservative range fallback for push lists at the documented cap or with missing entries, deduplicated/stably ordered filter results, and avoiding duplicate Pulls fallback requests after a failure.

Generated bundle

dist/index.js was regenerated from src/main.ts. Consecutive and post-commit builds produced the same SHA-256 and left the committed bundle clean.

Risks and follow-ups

• New-ref push payloads with an all-zero before SHA cannot use a before/after comparison; the action conservatively retains any available commit IDs and otherwise keeps the existing same-ref fallback.
• Event parsing intentionally validates only fields used by diffset rather than introducing a full webhook schema dependency.