fix: remediate SonarQube high severity issues (S1192, S3776)

[devin-ai-integration]

Closes: N/A — addresses SonarQube static analysis findings

Summary

Remediates one High severity issue from each of two SonarQube rules:

1. S1192 — String literals should not be duplicated (pullrequests.go)

Replaced 34 occurrences of the raw strings "Repository owner" and "Repository name" in pullrequests.go with the existing package-level constants DescriptionRepositoryOwner and DescriptionRepositoryName (already defined in actions.go). This is a purely mechanical change with no behavioral impact.

Note: The same duplication exists in repositories.go, issues.go, and discussions.go — those are left for a follow-up.

2. S3776 — Cognitive Complexity of functions should not be too high (repositories.go)

Refactored GetFileContents by extracting four helper functions to flatten the nesting:

Helper	Responsibility
inferSHAFromPullRef	Resolves refs/pull/N/head to the PR's head SHA
buildResourceURI	Constructs a repo:// URI from owner/repo/sha/ref/path
getFileFromRawContent	Fetches file via raw content API; returns (nil, nil) on non-200 to signal fallthrough
getDirContents	Fetches directory listing via Contents API

No logic was changed — each helper preserves the original behavior exactly.

Tradeoffs

• Scoped to one file per rule as requested; remaining files can be addressed incrementally.
• The extracted helpers are unexported, keeping the package's public API unchanged.
• getFileFromRawContent uses a (nil, nil) return to signal "not found, try another method." This is documented in the function's godoc but is an implicit convention worth noting.

Human Review Checklist

• Verify getFileFromRawContent returning (nil, nil) on non-200 correctly mirrors the original fallthrough behavior (original: the inner block only executed on StatusOK, otherwise fell through).
• Verify buildResourceURI parameter order (owner, repo, sha, ref, path) matches all call sites.
• Confirm the extracted helpers don't change defer resp.Body.Close() semantics — body is now closed when the helper returns rather than when the outer handler returns. This is safe because the body has already been fully read or the result is being discarded.
• Existing tests pass (confirmed locally: script/lint and script/test both green).

Link to Devin session: https://app.devin.ai/sessions/10a70a97f4fa47b4bf49ce67f04e0cc5
Requested by: @VedantKh

---

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment and CI monitoring

[sonarqubecloud]

Quality Gate failed

Failed conditions
21.5% Duplication on New Code (required ≤ 3%)

See analysis details on SonarQube Cloud

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no potential bugs to report.

View in Devin Review to see 3 additional findings.