chore(deps): bump @actions/core to 3.x and @actions/tool-cache to 4.x#159
Merged
chore(deps): bump @actions/core to 3.x and @actions/tool-cache to 4.x#159
Conversation
There was a problem hiding this comment.
Pull request overview
This PR updates the GitHub Actions toolkit dependencies to their current major versions and adjusts the build pipeline to accommodate the toolkits’ move to ESM-only packages by switching bundlers.
Changes:
- Bump
@actions/coreto^3.0.0and@actions/tool-cacheto^4.0.0. - Replace
@vercel/nccwithesbuildfor bundling and update the build script accordingly. - Update the lockfile and regenerate
dist/index.jswith the new bundler/dependency graph.
Reviewed changes
Copilot reviewed 1 out of 3 changed files in this pull request and generated 2 comments.
| File | Description |
|---|---|
| package.json | Updates toolkit deps and replaces ncc build with esbuild bundling. |
| package-lock.json | Lockfile updates for the new toolkit majors and added esbuild dependency tree. |
| dist/index.js | Rebuilt bundled action output to work with ESM-only toolkit packages. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Add --format=cjs to build script to make CJS output explicit. Add --legal-comments=external so licenses.txt is kept in sync with bundled dependencies on every build. Rebuild dist/ with updated build script. Signed-off-by: Terry Howe <terrylhowe@gmail.com>
Replace --legal-comments=external (which only captured inline comments) with a generate-licenses.js script that reads actual LICENSE files from node_modules for every package bundled by esbuild. The build now uses --metafile to identify bundled packages, then runs the script to write dist/licenses.txt, matching the ncc-generated format. Signed-off-by: Terry Howe <terrylhowe@gmail.com>
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 2 out of 5 changed files in this pull request and generated 1 comment.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Merged
TerryHowe
added a commit
that referenced
this pull request
Apr 6, 2026
Bump \`package.json\` version to \`2.0.0\` in preparation for the v2.0.0 release. ## What's in v2.0.0 - Bump \`@actions/core\` from \`^2.0.3\` to \`^3.0.0\` (#138) - Bump \`@actions/tool-cache\` from \`^3.0.1\` to \`^4.0.0\` (#137) - Replace \`@vercel/ncc\` with \`esbuild\` to support ESM-only toolkit packages (#159) - Add \`scripts/generate-licenses.js\` to regenerate \`dist/licenses.txt\` from bundled packages on every build (#159) - Pin \`undici\` to \`>=6.24.1\` to address 5 CVEs (#155) Signed-off-by: Terry Howe <terrylhowe@gmail.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Bumps the GitHub Actions toolkit to current major versions, replacing the two dependabot PRs that fail `check-dist`:
Both 3.x (`@actions/core`) and 4.x (`@actions/tool-cache`) are now ESM-only packages. `@vercel/ncc` (webpack-based) cannot bundle ESM-only packages in CJS mode, so this PR also replaces `ncc` with `esbuild` as the bundler. `esbuild` handles ESM→CJS bundling natively and requires no changes to the TypeScript source.
Changes
Test plan