chore: merge all open Dependabot PRs with full ESM migration (@actions/core v3, TypeScript 6.0, ESLint 10, and more)

[Copilot]

Consolidates all open Dependabot PRs into a single update and converts the project to native ESM ("type": "module"), enabling the use of @actions/core v3 and @actions/io v3 (both ESM-only packages).

Dependency Updates

• @actions/core 2.0.2 → 3.0.0 (ESM-only, now included via full ESM migration)
• @actions/io 2.0.0 → 3.0.2 (ESM-only, now included via full ESM migration)
• typescript 5.9.3 → 6.0.2
• eslint 9.39.2 → 10.1.0
• typescript-eslint / @typescript-eslint/* 8.53.0 → 8.58.0
• eslint-plugin-jest 29.12.1 → 29.15.1
• jest / jest-circus 30.2.0 → 30.3.0
• ts-jest 29.4.6 → 29.4.9
• prettier 3.8.0 → 3.8.1
• @types/node 25.0.9 → 25.5.0
• GitHub Actions: setup-node v6.2.0 → v6.3.0, codecov v5.5.2 → v6.0.0
• Transitive (lockfile only): lodash 4.17.21 → 4.18.1, handlebars 4.7.8 → 4.7.9

ESM Migration

• package.json: added "type": "module", updated test script with NODE_OPTIONS=--experimental-vm-modules
• tsconfig.json: switched to module: NodeNext / target: es2022
• src/*.ts: added .js extensions to all relative imports (TypeScript NodeNext requirement); interface-only imports changed to import type
• src/lib.ts: re-export of ActionInterface changed to export type
• jest.config.js → jest.config.cjs: renamed for CJS format compatibility; added extensionsToTreatAsEsm: ['.ts'], useESM: true, and moduleNameMapper for .js→.ts resolution
• tsconfig.test.json: added isolatedModules: true
• __tests__/*.test.ts: updated relative imports to use .js extensions; jest APIs imported from @jest/globals (required in ESM VM module mode)
• __tests__/lib.test.ts: switched from jest.mock() to jest.unstable_mockModule() with dynamic imports (ESM-compatible mocking for @actions/core)
• eslint.config.mjs: removed CJS-only module global; added sourceType: 'commonjs' override for .cjs files

TypeScript 6.0 / ESLint 10 Compatibility

• tsconfig.json: explicit "types": ["node"] required by TypeScript 6.0
• src/fetch.ts: import {render} from 'mustache' → import Mustache from 'mustache' (mustache ESM entry is default-export only)
• eslint.config.mjs: added ignores: ['lib/', 'coverage/']; added @eslint/js as explicit dev dependency
• package.json: resolutions to deduplicate @typescript-eslint/utils to 8.58.0

Testing

All 20 tests pass. TypeScript compilation, lint, and format checks are clean.

[JamesIves]

@copilot convert things to esm instead of writing around it

[Copilot]

@copilot convert things to esm instead of writing around it

Done in c2b4f31. The project is now fully ESM:

• package.json has "type": "module" and @actions/core 3.0.0 + @actions/io 3.0.2 are included
• tsconfig.json uses module: NodeNext / target: es2022
• All relative imports in src/ and __tests__/ use .js extensions (TypeScript NodeNext requirement)
• Interface-only imports use import type
• jest.config.js renamed to jest.config.cjs with useESM: true and extensionsToTreatAsEsm: ['.ts']
• Tests updated to import jest APIs from @jest/globals and use jest.unstable_mockModule() for mocking the ESM @actions/core package

All 20 tests pass.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 98.75%. Comparing base (fe7ec25) to head (c2b4f31).

Additional details and impacted files

@@            Coverage Diff             @@
##              dev    #1257      +/-   ##
==========================================
- Coverage   98.94%   98.75%   -0.20%     
==========================================
  Files           4        4              
  Lines          95       80      -15     
  Branches       30       31       +1     
==========================================
- Hits           94       79      -15     
  Misses          1        1              

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.