ci(release-action): bundle with esbuild to support ESM-only deps

[ggazzo]

Summary

• @actions/core@3, @actions/exec@3, @actions/github@9, @octokit/core@7, @octokit/plugin-throttling@11 (bumped in chore(deps): bump @actions/github to v9 to remove undici 5.29.0 #40265) are ESM-only. The existing tsc-emitted CJS dist/index.js fails at require time with ERR_PACKAGE_PATH_NOT_EXPORTED, breaking the Start release candidate job (see run 26192703525).
• Replace tsc build with tsc --noEmit && esbuild src/index.ts --bundle --platform=node --target=node20 --format=cjs --outfile=dist/index.js. The action now ships a single self-contained CJS bundle — ESM deps are resolved at build time. No source changes; type-checking still runs via tsc --noEmit.
• Alternatives considered: convert package to ESM (requires .js extensions on every relative import), revert chore(deps): bump @actions/github to v9 to remove undici 5.29.0 #40265 (reintroduces undici 5.29.0 vulnerability). Bundling is the least-invasive fix.

Test plan

• yarn build inside packages/release-action produces dist/index.js
• node -e "require('./dist/index.js')" from packages/release-action exits with the expected ::error::Please add the GITHUB_TOKEN to the changesets action (confirms ESM @actions/core resolves and the action entrypoint runs)
• Re-run the Start new release workflow on this branch to confirm the release-action step succeeds

Summary by CodeRabbit

• Chores
  • Updated the build configuration with improved type-checking and bundling processes to enhance development workflow efficiency.

[dionisio-bot]

Looks like this PR is not ready to merge, because of the following issues:

• This PR is missing the 'stat: QA assured' label
• This PR is missing the required milestone or project

Please fix the issues and try again

If you have any trouble, please check the PR guidelines

[changeset-bot]

⚠️ No Changeset found

Latest commit: 638c116

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[coderabbitai]

Walkthrough

The release-action build process is updated to introduce esbuild-based bundling. The build script now performs TypeScript type checking without emitting output, then bundles the entry point into a CommonJS distribution for Node 20. The esbuild dev dependency is added to support the bundling step.

Changes

Release Action Build Configuration

Layer / File(s)	Summary
Build script and esbuild dependency packages/release-action/package.json	The build script transitions from plain tsc to a two-step process: tsc --noEmit for type checking followed by esbuild bundling of src/index.ts into dist/index.js targeting Node 20 CommonJS. The esbuild dependency (~0.25.10) is added to devDependencies.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~3 minutes

Suggested labels

type: bug

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title mentions bundling with esbuild to support ESM-only deps, which is the core change shown in the package.json modifications where esbuild is added and the build script is updated.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[cubic-dev-ai]

No issues found across 2 files

_{Re-trigger cubic}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 69.64%. Comparing base (f7d47dd) to head (638c116).

Additional details and impacted files

@@           Coverage Diff            @@
##           develop   #40636   +/-   ##
========================================
  Coverage    69.64%   69.64%           
========================================
  Files         3338     3338           
  Lines       123232   123232           
  Branches     21989    21962   -27     
========================================
  Hits         85830    85830           
+ Misses       34049    34046    -3     
- Partials      3353     3356    +3     

Flag	Coverage Δ
unit	70.47% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[sampaiodiego]

not liked