Add AbortSignal.timeout(30s) to fetch requests to ensure they fail
fast instead of hanging indefinitely when network issues occur.
This fixes issues where the action would hang and eventually get
killed by GitHub Actions without a clear error message.
The previous implementation checked `github.event.sender.login`, which
is whoever triggered the event (e.g., someone closing/reopening the PR).
This fixes it to check `github.event.pull_request.user.login` instead —
the PR author — so the workflow runs correctly whenever a
Dependabot-created PR is opened, synchronized, or reopened.
When Dependabot bumps dependencies in package.json, this workflow
automatically runs `npm run all` to rebuild the dist folder and commits
the changes back to the PR.
This ensures the compiled JavaScript in `dist/` stays in sync with
dependency updates.
**How it works:**
1. Triggers on PRs opened by `dependabot[bot]`
2. Runs `npm ci` and `npm run all` (build, check, package, test)
3. Commits any changes to `dist/` back to the PR branch
Uses `stefanzweifel/git-auto-commit-action` for the commit step.
Debian unstable and testing don't have VERSION_ID in /etc/os-release.
This change falls back to VERSION_CODENAME when VERSION_ID is missing,
producing cache keys like 'debian-sid' for unstable.
Fixes#773
