Validate Content-Type before forwarding GitHub API proxy responses

[mikevitelli]

Context

/api/github/route.ts proxies GitHub API responses and forces Content-Type: application/json on the response, regardless of what GitHub actually returns.

const body = await res.text();
return new NextResponse(body, {
  status: res.status,
  headers: { "Content-Type": "application/json", ... },
});

Risk: If GitHub returns an HTML error page (500, maintenance), the raw HTML is returned with a JSON content type. While modern browsers respect content-type, edge cases could lead to HTML being rendered.

Proposed approach

1. Check GitHub response content-type before forwarding
2. If response is not JSON, return a structured error instead of raw body
3. Add response body validation (ensure it parses as JSON before forwarding)

Acceptance criteria

• Non-JSON GitHub responses are caught and returned as structured errors
• HTML error pages are never forwarded to the client
• GitHub API status codes are preserved (502 for upstream errors)