Apply all review comments from PR #1: TypeScript migration, token consolidation, style fixes

.github/workflows/test.yml

@@ -11,10 +11,14 @@ jobs:
   test:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           persist-credentials: false
-      - uses: actions/setup-node@v6
+      - uses: actions/setup-node@v7
         with:
           node-version: 24
-      - run: npm test
+      - uses: pnpm/action-setup@v4
+        with:
+          version: 11
+      - run: pnpm install
+      - run: pnpm test

.gitignore

@@ -3,6 +3,7 @@ logs
 *.log
 npm-debug.log*
 yarn-debug.log*
+package-lock.json
 yarn-error.log*
 lerna-debug.log*
 

README.md

@@ -11,11 +11,14 @@ name: Contributor detection
 
 on:
   issues:
-    types: [opened]
+    types: 
+      - opened
   issue_comment:
-    types: [created]
+    types: 
+      - created
   pull_request_target:
-    types: [opened]
+    types: 
+      - opened
 
 permissions:
   contents: read
@@ -30,9 +33,8 @@ jobs:
     steps:
       - uses: Open-Source-Bazaar/contributor-trust-action@v1
         with:
-          github-token: ${{ github.token }}
-          organization-token: ${{ secrets.PAT }}
-          block-high-confidence-automation: 'true'
+          github-token: ${{ secrets.PAT }}
+          block-high-confidence-automation: true
 ```
 
 The action never checks out or executes code from an external pull request. GitHub Models is best-effort: if Models is disabled, the public-evidence report still completes.
@@ -45,6 +47,6 @@ The action never checks out or executes code from an external pull request. GitH
 - `report-json`
 - `blocked`: `true` when the organization block request succeeded
 
-Set `fail-on-high-risk: 'true'` only after reviewing the action against your community's contribution patterns.
+Set `fail-on-high-risk: true` only after reviewing the action against your community's contribution patterns.
 
-`organization-token` must be a dedicated fine-grained PAT or GitHub App token with organization `Blocking users: write`. Keep blocking disabled when that permission is not intentionally configured.
+When `block-high-confidence-automation` is enabled, `github-token` must be a dedicated fine-grained PAT or GitHub App token with organization `Blocking users: write`. Keep blocking disabled when that permission is not intentionally configured.

action.yml

@@ -4,31 +4,28 @@ author: Open-Source-Bazaar contributors
 
 inputs:
   github-token:
-    description: GitHub token with read access and permission to comment or label.
+    description: GitHub token with read access, permission to comment or label, and optionally organization Blocking users write permission.
     required: true
-  organization-token:
-    description: Optional organization token with Blocking users write permission.
-    required: false
   block-high-confidence-automation:
-    description: Block high-confidence automated user accounts when an organization token is provided.
+    description: Block high-confidence automated user accounts when the token has organization Blocking users write permission.
     required: false
-    default: 'false'
+    default: false
   ai-review:
     description: Use GitHub Models for a second, evidence-grounded review.
     required: false
-    default: 'true'
+    default: true
   model:
     description: GitHub Models model identifier.
     required: false
     default: openai/gpt-4.1
   comment:
     description: Create or update the contributor report comment.
     required: false
-    default: 'true'
+    default: true
   fail-on-high-risk:
-    description: Fail the workflow when the report is high risk.
+    description: Report a workflow error when the contributor is high risk.
     required: false
-    default: 'false'
+    default: false
 
 outputs:
   author: