fix: drop redundant decodeURIComponent and repair urlencoded schema v…

…alidation (#267)

* fix: URLSearchParams refactor broke valid urlencoded webhooks; drop redundant decodeURIComponent

The current `URL_ENCODED` branch of `parseRequestBody` has two bugs that combine to make every valid urlencoded GitHub webhook fail:

1. `bodySchema.parse(payloadParam)` is called with a `string | null` returned by `URLSearchParams.get("payload")`, but `bodySchema` is `z.object({ payload: z.string() })` — i.e. it expects an *object* with a `payload` key. zod throws `Invalid input: expected object, received string` on every valid payload, so the function returns `undefined`. The pre-existing fixture test (`fixtures/invalid-payload-urlencoded.txt`) hides this because it only exercises an invalid payload that's expected to be rejected with 403.

2. `JSON.parse(decodeURIComponent(payload))` calls `decodeURIComponent` a second time on a value `URLSearchParams.get` has already URL-decoded. This throws `URIError: URI malformed` whenever the decoded JSON contains a literal `%` that isn't part of a valid `%XX` escape — which is common in real PR titles, commit messages, and comments ("30% threshold", "set %USERPROFILE% to ~", "WHERE x LIKE '%foo%'", "printf(\"%s\", val)").

Fixes:

- Wrap the `URLSearchParams.get("payload")` value into the `{ payload: string }` shape the schema expects, so schema validation actually runs against valid payloads.
- Drop the redundant `decodeURIComponent(payload)` — `URLSearchParams.get` already URL-decodes once, which is exactly what GitHub's single-URL-encoded webhook body needs.

Tests: 9 new cases in `lambda/proxy.test.ts` cover the percent-character regression patterns plus a control and a `%20`-preservation case, exercised both end-to-end through the handler and directly against `parseRequestBody`.

* Apply suggestions from code review

Co-authored-by: Dan Adajian <danadajian@gmail.com>

---------

Co-authored-by: Dan Adajian <danadajian@gmail.com>

fix(deps): replace actions/setup-node action with semantic-release ac…

…tion (#249)

* chore(deps): update actions/setup-node action from vv5 to v6

* Replace Bun setup with semantic-release action

* Update release.yaml

---------

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Co-authored-by: Dan Adajian <dadajian@expediagroup.com>

feat(deps): update dependencies (#235)

* feat(deps): update dependencies

* terraform-docs: automated action

---------

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>

terraform-docs: automated action

fix(deps): update dependencies axios from v1.7.3 to v1.7.4 [security]

terraform-docs: automated action

fix(deps): update dependencies zod from v3.23.6 to v3.23.8 (#197)

feat(repo): switch to bun (#191)

* switch to bun

* workflows

* terraform-docs: automated action

---------

Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>

fix(deps): update dependency hashicorp/terraform from v1.8.0 to v1.8.1 (

#189)

fix(deps): update dependencies