Run dependency-check in Test Action Workflow

[gr2m]

I just found out by chance that @octokit/auth-oauth-app was using universal-user-agent without having it listed as dependency. That caused a problem with loading the package from https://cdn.skypack.dev/@octokit/[email protected].

I did a quick research and found dependency-check, which can check for that. It can also check if a dependency is listed in package.json that is not used in the code

It needs to be run against the build version of the package, but making sure that the package builds is a good idea anyway. So I think we should add these to steps to .github/workflows/test.yml's test job

run: npm run build
run: npx dependency-check ./pkg/package.json --no-dev --ignore-module @octokit/types --ignore-module @octokit/openapi-types --ignore-module "@types/*"

One thing that's tricky: when we use only types from a package, it's not used in the code, but the package still needs to be a production dependency to make sure all required types are present when installing a package

[gr2m]

I just ran this against my local clones of octokit/*.js repositories and this is what I found:

• @octokit/app: packages not used in code: deprecation
• @octokit/auth-app: packages not used in code: @octokit/request-error
• @octokit/auth-oauth-app: packages not used in code: @octokit/auth-oauth-device, @octokit/request-error
• @octokit/auth-unauthenticated: packages not used in code: @octokit/request-error
• @octokit/core: packages not used in code: @octokit/request-error
• @octokit/oauth-app: packages not used in code: @octokit/oauth-authorization-url, btoa-lite
• @octokit/plugin-create-or-update-text-file: packages not used in code: @octokit/core, @octokit/core
• @octokit/plugin-enterprise-server: packages not used in code: @octokit/core, @octokit/core
• @octokit/plugin-paginate-rest: packages not used in code: @octokit/core, @octokit/core
• @octokit/plugin-request-log: packages not used in code: @octokit/core, @octokit/core
• @octokit/plugin-rest-endpoint-methods: packages not used in code: deprecation, @octokit/core, @octokit/core
• @octokit/plugin-throttling: packages not used in code: @octokit/core, @octokit/core
• @octokit/request: packages not used in code: deprecation, once
• @octokit/webhooks: packages not used in code: @octokit/request-error, @octokit/webhooks-definitions

This is more a note to self :)