bump @actions/core from 1.10.1 to 3.0.0 in /snapshoty/run

[dependabot]

Bumps @actions/core from 1.10.1 to 3.0.0.

Since @actions/core 3.0.0 is now a pure ESM package, the following additional changes were required to make the action fully functional:

• Converted index.js from CommonJS (require) to ESM (import) syntax
• Added "type": "module" to package.json
• Fixed an implicit global variable in a for...of loop
• Rebuilt dist/index.js using ncc in ESM mode

[github-actions]

Dependency Update Analysis

Summary: actions/core was updated from 1.10.1 to 3.0.0 in snapshoty/run (npm, direct production dependency). Overall risk: high due to a confirmed breaking runtime/build incompatibility (ESM-only package consumed via CommonJS require).

actions/core 1.10.1 → 3.0.0

Ecosystem: npm / Node

Check	Result
Breaking changes	⚠️ Found — actions/core 3.0.0 is ESM-only; CommonJS consumers must use dynamic import()
Testable in PR	⚠️ No evidence of PR workflow coverage for snapshoty/run in this repo

Changelog highlights (v1.10.1 → v3.0.0)

• Release notes state a breaking change in 3.0.0: ESM-only.
• Intermediate major updates include Node 24 alignment and dependency bumps (actions/http-client, actions/exec).
• No explicit CVE IDs / GHSA advisories are listed in release notes for this range.
• Transitive security-relevant surface changed (newer HTTP stack including undici), but that does not offset the immediate module-format break.

Usage in this repository

snapshoty/run/index.js uses CommonJS import and core APIs:

• snapshoty/run/index.js:1 → const core = require('@actions/core');
• snapshoty/run/index.js:7-12 → core.getInput(...)
• snapshoty/run/index.js:30 and :40 → core.setSecret(...)
• snapshoty/run/index.js:52 → core.isDebug()
• snapshoty/run/index.js:59 → core.setFailed(...)

The action is configured as a Node action (snapshoty/run/action.yml:23-24, using: 'node24', main: 'dist/index.js').

Compatibility assessment (CVE-focused)

• Verified incompatibility: local install/build for snapshoty/run fails after this bump during ncc build with:
  • Package path . is not exported from package ... node_modules/@actions/core``
• Root cause: repository code still uses CommonJS require('@actions/core'), while v3 is ESM-only.
• CVE-focused view:
  • No release-note CVE/GHSA entries were identified for this update.
  • Internal dependency shifts may preserve or slightly improve baseline HTTP security posture.
  • Practical risk here is a functional availability regression (action packaging/runtime break), not an exploitable-security reduction in this repo.

Risk conclusion: high.

Labels Applied

No labels applied. oblt-aw/ai/merge-ready criteria are not met (overall risk is high and breaking change affects current repository usage).

Note

🔒 Integrity filtering filtered 1 item

Integrity filtering activated and filtered the following item during workflow execution.
This happens when a tool call accesses a resource that does not meet the required integrity or secrecy level of the workflow.

• pr:bump @actions/core from 1.10.1 to 3.0.0 in /snapshoty/run #522 (pull_request_read: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".)

---

What is this? | From workflow: Observability Agentic Workflow Entrypoint

Give us feedback! React with 🚀 if perfect, 👍 if helpful, 👎 if not.

[v1v]

@copilot review if the changes will be enough for the snapshoty/run action

[Copilot]

@copilot review if the changes will be enough for the snapshoty/run action

The original dependency bump (package.json + package-lock.json) wasn't enough — @actions/core 3.0.0 is a pure ESM package, which means:

1. The old require('@actions/core') CJS syntax would fail at runtime
2. ncc couldn't bundle it when building the dist/index.js

Fixed in commit 7cc8f9a with:

• Converted index.js to use ESM (import instead of require)
• Added "type": "module" to package.json
• Fixed an implicit global variable in a for...of loop
• Rebuilt dist/index.js using ncc in ESM mode (the bundled dist grew from ~63kB to ~490kB, reflecting the new @actions/core 3.0.0 dependencies)