Add I/O function tests: 98% coverage on run.ts (#1)

* Add I/O function tests: 52 tests, 98% statement coverage

Export Metric interface and run/runIngest/runPRCheck/postCheckRun for
testability. Mock @actions/core, @actions/github, fs, and fetch via
vi.hoisted + vi.mock + vi.stubGlobal. Tests cover all early-exit paths
in run(), ingest success/failure, all threshold breach types, missing
GITHUB_TOKEN, baseline fetch errors, Check Run success/failure/fork
degradation, and the PR head SHA selection.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* Move /baseline out of Access-gated /api prefix

Cloudflare Access blocks all /api/* requests before the Worker sees them,
so the OIDC-gated baseline endpoint was returning the Access login page
(<!DOCTYPE html>) instead of JSON. The fix mirrors /ingest: mount baseline
at the root level so only the Worker's own requireOidc() middleware applies.

Route changes:
- Extract baseline handler into src/routes/baseline.ts (OIDC-gated)
- Remove baseline from src/routes/api.ts (Access-gated)
- Mount at /baseline in src/index.ts alongside /ingest
- Update Action fetch URL: /api/projects/:o/:r/baseline → /baseline/:o/:r
- Update test assertion to match new URL

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

---------

Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: tbjers

.github/actions/report/dist/run.js

@@ -19656,6 +19656,10 @@ __export(run_exports, {
   formatDelta: () => formatDelta,
   formatValue: () => formatValue,
   parseThreshold: () => parseThreshold,
+  postCheckRun: () => postCheckRun,
+  run: () => run,
+  runIngest: () => runIngest,
+  runPRCheck: () => runPRCheck,
   thresholdConfigured: () => thresholdConfigured
 });
 module.exports = __toCommonJS(run_exports);
@@ -24752,7 +24756,7 @@ async function runPRCheck(workerUrl, oidcToken, metrics, owner, repo) {
   const maxDuplication = parseThreshold(process.env.MAX_DUPLICATION);
   const baselines = {};
   for (const m of metrics) {
-    const url = `${workerUrl}/api/projects/${owner}/${repo}/baseline?metric=${encodeURIComponent(m.name)}`;
+    const url = `${workerUrl}/baseline/${owner}/${repo}?metric=${encodeURIComponent(m.name)}`;
     const res = await fetch(url, { headers: { Authorization: `Bearer ${oidcToken}` } });
     if (res.ok) {
       const data = await res.json();
@@ -24873,6 +24877,10 @@ if (require.main === module) {
   formatDelta,
   formatValue,
   parseThreshold,
+  postCheckRun,
+  run,
+  runIngest,
+  runPRCheck,
   thresholdConfigured
 });
 /*! Bundled license information: