Fix multi-level config merging (default → org → repo)

[Copilot]

When both an org-level (.github repo) and repo-level comment-ops.yml exist, the org config was silently skipped — only default → repo was applied instead of the intended default → org → repo.

Root Cause

The @probot/octokit-plugin-config plugin only falls back to the org's .github repo when the requesting repo has no config file. So a single octokit.config.get call can never return both configs simultaneously.

Changes

• app/router.js: Split config loading into two explicit calls — one for {owner}/.github (org) and one for the actual repo — then merge in the correct precedence order. Extracted into a mergeConfigs helper that correctly handles:
  • Missing configs at any level
  • _extends chains (the plugin returns multiple files per level; only the first file's existence is checked to avoid the plugin's org-fallthrough being double-counted)

// Before: single call — org config skipped when repo config exists
const { config } = await octokit.config.get({
  owner, repo: repoName, path: configPath,
  defaults: (configs) => deepmerge.all([defaultConfig, ...configs]),
});

// After: explicit fetch of both levels, merged in correct order
const { files: orgFiles } = await octokit.config.get({ owner, repo: ".github", path: configPath });
const { files: repoFiles } = await octokit.config.get({ owner, repo: repoName, path: configPath });
const config = mergeConfigs(defaultConfig, orgFiles, repoFiles);
// → deepmerge.all([default, ...orgConfigs, ...repoConfigs])

• app/router.test.js: Unit tests for mergeConfigs covering all combinations: no config, org-only, repo-only, both (the broken case), precedence ordering, and _extends chains.

• Fixes Multiple levels of configuration don't seem to be working #81

[timja]

@copilot resolve the merge conflicts in this pull request

[Copilot]

@copilot resolve the merge conflicts in this pull request

Merge conflicts resolved in 826cab9. The conflict was in app/router.js where the validateConfig call (added in #539) was integrated into the new multi-call config loading approach — validateConfig now runs after mergeConfigs produces the final merged config. All 90 tests pass.