Avoid dumping listConfig().all via core.debug so checkout extraheader tokens are never written to action logs.
Co-authored-by: Cursor <cursoragent@cursor.com>
* fix: verify committed lib/ matches source in CI
Add a post-build diff check so the shipped action bundle cannot drift from src without failing CI, even when local hooks are bypassed.
Co-authored-by: Cursor <cursoragent@cursor.com>
* chore: rebuild lib/ against lockfile for CI integrity check
Co-authored-by: Cursor <cursoragent@cursor.com>
* ci: tighten lib integrity check and workflow permissions
Detect untracked lib/ artifacts, drop checkout credentials, and document Node 24 for local builds.
Co-authored-by: Cursor <cursoragent@cursor.com>
---------
Co-authored-by: Cursor <cursoragent@cursor.com>
* fix: prevent git option injection via new_branch
Validate new_branch as a branch name and pass it after -- so values like --force cannot force-checkout or force-push.
Co-authored-by: Cursor <cursoragent@cursor.com>
* fix: tighten new_branch validation and simplify checkout
Reject Unicode whitespace/C1 controls in branch names, and drop the checkout -- separator after early validation.
Co-authored-by: Cursor <cursoragent@cursor.com>
* fix: validate new_branch with git check-ref-format
Reject invalid ref forms via check-ref-format --branch, align docs, and clarify the remote-helper warning wording.
Co-authored-by: Cursor <cursoragent@cursor.com>
---------
Co-authored-by: Cursor <cursoragent@cursor.com>
* chore(deps): bump @actions/core from 2.0.2 to 3.0.0
Bumps [@actions/core](https://github.com/actions/toolkit/tree/HEAD/packages/core) from 2.0.2 to 3.0.0.
- [Changelog](https://github.com/actions/toolkit/blob/main/packages/core/RELEASES.md)
- [Commits](https://github.com/actions/toolkit/commits/HEAD/packages/core)
---
updated-dependencies:
- dependency-name: "@actions/core"
dependency-version: 3.0.0
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com>
* chore(deps): update build process for ESM-only @actions/core v3 (#717)
* Initial plan
* feat: update build process for ESM-only @actions/core v3
- Add "type": "module" to package.json for ESM support
- Update TypeScript config to output ES2022 modules with esModuleInterop
- Convert Jest config to ESM (.mjs) with proper ts-jest ESM preset
- Rename .prettierrc.js to .prettierrc.cjs for CommonJS compatibility
- Replace actions-toolkit with @actions/github for ESM compatibility
- Configure Jest to handle ESM modules from @actions packages
- Update test script to use NODE_OPTIONS for experimental VM modules
- Build now outputs ESM format successfully
Co-authored-by: EndBug <26386270+EndBug@users.noreply.github.com>
* fix: use getInput for github_token instead of process.env
Properly access github_token input using the getInput helper function
from io.ts instead of directly accessing process.env.
Co-authored-by: EndBug <26386270+EndBug@users.noreply.github.com>
* refactor: remove unnecessary moduleNameMappers from Jest config
The explicit moduleNameMappers for @actions/core and @actions/github were
not needed. The transformIgnorePatterns configuration is sufficient to
handle ESM modules from @actions packages. Only the relative import
mapper is required for TypeScript ESM compatibility.
Co-authored-by: EndBug <26386270+EndBug@users.noreply.github.com>
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: EndBug <26386270+EndBug@users.noreply.github.com>
---------
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Copilot <198982749+Copilot@users.noreply.github.com>
Co-authored-by: EndBug <26386270+EndBug@users.noreply.github.com>
* cleanup: Removes JSON array parsing.
JSON is a subset of YAML, making it redundant.
* ci: add tests for parseInputArray.
Makes tools into a function to be able to mock it.
It does not need to be exported.
* Update runner version
---------
Co-authored-by: Federico Grandi <fgrandi30@gmail.com>
* fix: re-stage files after pulling
This should fix an issue that prevented changes from being committed
when `git pull --rebase --autostash` used.
Issue #406
* chore: mark pre-commit hook as executable
* fix: detect conflicts after pull
* add check to allow empty commits if arg is set
* fix: target only the desired argument
* fix: add debug message
* fix: fix debug message
Co-authored-by: Federico Grandi <fgrandi30@gmail.com>
Jonah LawrenceandGitHub
Federico GrandiandGitHub
