fix: polish action entry point and recorder robustness

- Create packages/action/src/index.ts (was missing after hook blocked initial write)
- Use execFileSync with args array in action (no shell injection risk)
- Replace fragile regex type-stripping with esbuild transpilation in playwright-runner
- Fix video file resolution to sort by mtime instead of filename
- Export uploadArtifact/uploadToGitHubAssets from core's main index
- Add @actions/artifact to action deps, esbuild to core deps

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: DeDuckProject

.idea/.gitignore

@@ -11,6 +11,7 @@
     "test": "vitest run"
   },
   "dependencies": {
+    "@actions/artifact": "^2.1.11",
     "@actions/core": "^1.10.1",
     "@actions/github": "^6.0.0",
     "@git-glimpse/core": "workspace:*"

.idea/git-glimpse.iml

@@ -0,0 +1,151 @@
+import * as core from '@actions/core';
+import * as github from '@actions/github';
+import { execFileSync, spawn } from 'node:child_process';
+import {
+  loadConfig,
+  runPipeline,
+  postPRComment,
+  uploadArtifact,
+  type GitGlimpseConfig,
+} from '@git-glimpse/core';
+
+async function run(): Promise<void> {
+  const context = github.context;
+  const token = process.env['GITHUB_TOKEN'];
+
+  if (!token) {
+    core.setFailed('GITHUB_TOKEN is required');
+    return;
+  }
+
+  if (context.eventName !== 'pull_request') {
+    core.info('git-glimpse only runs on pull_request events. Skipping.');
+    return;
+  }
+
+  const pullNumber = context.payload.pull_request?.number;
+  if (!pullNumber) {
+    core.setFailed('Could not determine PR number');
+    return;
+  }
+
+  const configPath = core.getInput('config-path') || undefined;
+  const previewUrlInput = core.getInput('preview-url') || undefined;
+  const startCommandInput = core.getInput('start-command') || undefined;
+
+  let config = await loadConfig(configPath);
+  if (previewUrlInput) {
+    config = { ...config, app: { ...config.app, previewUrl: previewUrlInput } };
+  }
+  if (startCommandInput) {
+    config = { ...config, app: { ...config.app, startCommand: startCommandInput } };
+  }
+
+  const baseSha = context.payload.pull_request?.base?.sha;
+  const headSha = context.payload.pull_request?.head?.sha;
+  if (!baseSha || !headSha) {
+    core.setFailed('Could not determine PR base/head SHA');
+    return;
+  }
+
+  core.info(`Computing diff: ${baseSha}..${headSha}`);
+  // Use execFileSync with args array — no shell, no injection risk
+  const diff = execFileSync('git', ['diff', `${baseSha}..${headSha}`], { encoding: 'utf-8' });
+
+  const baseUrl = resolveBaseUrl(config, previewUrlInput);
+  if (!baseUrl) {
+    core.setFailed(
+      'No base URL available. Set app.previewUrl or app.startCommand + app.readyWhen in config.'
+    );
+    return;
+  }
+
+  if (config.setup) {
+    core.info(`Running setup: ${config.setup}`);
+    const parts = config.setup.split(' ');
+    execFileSync(parts[0]!, parts.slice(1), { stdio: 'inherit' });
+  }
+
+  let appProcess: ReturnType<typeof spawn> | null = null;
+  if (config.app.startCommand && !config.app.previewUrl) {
+    appProcess = await startApp(config.app.startCommand, config.app.readyWhen?.url ?? baseUrl);
+  }
+
+  try {
+    core.info('Running git-glimpse pipeline...');
+    const result = await runPipeline({ diff, baseUrl, outputDir: './recordings', config });
+
+    if (result.errors.length > 0) {
+      core.warning(`Pipeline completed with errors:\n${result.errors.join('\n')}`);
+    }
+
+    let recordingUrl: string | undefined;
+    if (result.recording) {
+      core.info(
+        `Recording created: ${result.recording.path} (${result.recording.sizeMB.toFixed(1)} MB)`
+      );
+      const upload = await uploadArtifact(result.recording.path);
+      recordingUrl = upload.url;
+      core.setOutput('recording-url', recordingUrl);
+    }
+
+    const { owner, repo } = context.repo;
+    const comment = await postPRComment(token, {
+      owner,
+      repo,
+      pullNumber,
+      analysis: result.analysis,
+      recordingUrl,
+      screenshots: result.screenshots,
+      script: result.script,
+    });
+
+    core.info(`Demo comment posted: ${comment.url}`);
+    core.setOutput('comment-url', comment.url);
+    core.setOutput('success', String(result.success));
+  } finally {
+    appProcess?.kill();
+  }
+}
+
+function resolveBaseUrl(config: GitGlimpseConfig, previewUrlOverride?: string): string | null {
+  const previewUrl = previewUrlOverride ?? config.app.previewUrl;
+  if (previewUrl) {
+    const resolved = process.env[previewUrl] ?? previewUrl;
+    return resolved.startsWith('http') ? resolved : null;
+  }
+  if (config.app.readyWhen?.url) {
+    const u = new URL(config.app.readyWhen.url);
+    return u.origin;
+  }
+  return 'http://localhost:3000';
+}
+
+async function startApp(
+  startCommand: string,
+  readyUrl: string
+): Promise<ReturnType<typeof spawn>> {
+  const parts = startCommand.split(' ');
+  core.info(`Starting app: ${startCommand}`);
+  const proc = spawn(parts[0]!, parts.slice(1), { stdio: 'inherit', shell: false });
+
+  await waitForUrl(readyUrl, 30000);
+  core.info('App is ready');
+  return proc;
+}
+
+async function waitForUrl(url: string, timeout: number): Promise<void> {
+  const deadline = Date.now() + timeout;
+  while (Date.now() < deadline) {
+    try {
+      const res = await fetch(url);
+      if (res.ok) return;
+    } catch {
+      // not ready yet
+    }
+    await new Promise((r) => setTimeout(r, 1000));
+  }
+  throw new Error(`App did not become ready at ${url} within ${timeout / 1000}s`);
+}
+
+run().catch((err) => core.setFailed(err instanceof Error ? err.message : String(err)));

.idea/modules.xml

@@ -23,6 +23,7 @@
     "@anthropic-ai/sdk": "^0.24.3",
     "@playwright/test": "^1.44.0",
     "@octokit/rest": "^20.1.1",
+    "esbuild": "^0.21.5",
     "minimatch": "^10.0.1",
     "zod": "^3.23.4"
   },

.idea/vcs.xml

@@ -15,3 +15,5 @@ export type { ChangeAnalysis } from './analyzer/change-summarizer.js';
 
 export { generateDemoScript } from './generator/script-generator.js';
 export { postPRComment } from './publisher/github-comment.js';
+export { uploadArtifact, uploadToGitHubAssets } from './publisher/storage.js';
+export type { UploadResult } from './publisher/storage.js';

packages/action/package.json

@@ -66,19 +66,21 @@ async function createContext(
   });
 }
 
-async function executeScript(script: string, page: Page, baseUrl: string): Promise<void> {
-  // Write script to a temp module and import it
+async function executeScript(script: string, page: Page, _baseUrl: string): Promise<void> {
   const { writeFileSync, unlinkSync } = await import('node:fs');
   const { tmpdir } = await import('node:os');
   const { pathToFileURL } = await import('node:url');
+  const { transformSync } = await import('esbuild');
 
-  const tmpPath = join(tmpdir(), `git-glimpse-script-${Date.now()}.mjs`);
-
-  // Wrap the TypeScript-style script in runnable ESM
-  // Strip type annotations for direct execution
-  const runnableScript = stripTypeAnnotations(script);
+  // Transpile TypeScript → ESM JavaScript via esbuild
+  const { code } = transformSync(script, {
+    loader: 'ts',
+    format: 'esm',
+    target: 'node20',
+  });
 
-  writeFileSync(tmpPath, runnableScript, 'utf-8');
+  const tmpPath = join(tmpdir(), `git-glimpse-script-${Date.now()}.mjs`);
+  writeFileSync(tmpPath, code, 'utf-8');
 
   try {
     const mod = await import(pathToFileURL(tmpPath).href);
@@ -91,22 +93,15 @@ async function executeScript(script: string, page: Page, baseUrl: string): Promi
   }
 }
 
-function stripTypeAnnotations(script: string): string {
-  // Remove TypeScript import and type annotations for direct Node.js execution
-  return script
-    .replace(/^import type.*$/gm, '') // remove type-only imports
-    .replace(/: Page/g, '') // remove : Page annotation
-    .replace(/: Promise<void>/g, '') // remove return type
-    .replace(/^import \{ .* \} from '@playwright\/test';$/gm, ''); // remove playwright import (page is passed in)
-}
-
 async function resolveVideoPath(outputDir: string): Promise<string> {
-  const { readdirSync } = await import('node:fs');
-  const files = readdirSync(outputDir).filter((f) => f.endsWith('.webm'));
-  files.sort(); // latest by name
+  const { readdirSync, statSync } = await import('node:fs');
+  const files = readdirSync(outputDir)
+    .filter((f) => f.endsWith('.webm'))
+    .map((f) => ({ name: f, mtime: statSync(join(outputDir, f)).mtimeMs }))
+    .sort((a, b) => b.mtime - a.mtime); // newest first
 
-  const latest = files[files.length - 1];
+  const latest = files[0];
   if (!latest) throw new Error(`No video file found in ${outputDir}`);
 
-  return join(outputDir, latest);
+  return join(outputDir, latest.name);
 }