chore(bundler-plugin-core): bump @actions/core and @actions/github

- @actions/core ^3.0.0, @actions/github ^9.0.0; engines.node >=20
- Adjust GitHubActions tests: ESM context export is read-only
- Changeset documents upstream RELEASES.md impact (ESM-only, Node 20, Octokit)

Made-with: Cursor

Author: thomasrockhu-codecov

.changeset/bump-actions-toolkit.md

@@ -0,0 +1,21 @@
+---
+"@codecov/bundler-plugin-core": minor
+---
+
+Bump `@actions/core` to ^3.0.0 and `@actions/github` to ^9.0.0, and set `engines.node` to `>=20.0.0` to match upstream.
+
+**@actions/core** ([actions/toolkit `packages/core/RELEASES.md`](https://github.com/actions/toolkit/blob/main/packages/core/RELEASES.md))
+
+- **v3.0.0**: ESM-only release; CommonJS callers must use dynamic `import()` instead of `require()`. `@codecov/bundler-plugin-core` already ships as ESM (`"type": "module"`), so this does not change how the package is consumed from modern bundlers and Node ESM.
+- **v2.x** (between 1.x and 3.x): Node 24 support and `@actions/http-client` upgrades (including 3.x in the 2.x line).
+
+**@actions/github** ([actions/toolkit `packages/github/RELEASES.md`](https://github.com/actions/toolkit/blob/main/packages/github/RELEASES.md))
+
+- **v9.0.0**: ESM-only (same consideration as `@actions/core` for this package). Release notes also note improved TypeScript behavior with ESM and `@octokit/core/types`.
+- **v8.0.0**: **Minimum Node.js is now 20** (previously 18); Octokit dependencies move to current major lines (`@octokit/core`, REST plugins, request stack).
+- **v8.0.1**: Dependency updates (`undici`, `@actions/http-client`).
+
+**Impact here**
+
+- Runtime behavior we rely on is unchanged: `context` for GitHub Actions metadata and `getIDToken()` for OIDC uploads are still the supported APIs.
+- **Node 18** is no longer a supported runtime for this package; use **Node 20+** (aligned with `@actions/github` 8+ and this repo’s Volta pin on Node 20).

packages/bundler-plugin-core/package.json

@@ -39,8 +39,8 @@
     "generate:typedoc": "typedoc --options ./typedoc.json"
   },
   "dependencies": {
-    "@actions/core": "^1.10.1",
-    "@actions/github": "^6.0.0",
+    "@actions/core": "^3.0.0",
+    "@actions/github": "^9.0.0",
     "chalk": "4.1.2",
     "semver": "^7.5.4",
     "unplugin": "^1.10.1",
@@ -66,6 +66,6 @@
     "extends": "../../package.json"
   },
   "engines": {
-    "node": ">=18.0.0"
+    "node": ">=20.0.0"
   }
 }

packages/bundler-plugin-core/src/utils/providers/__tests__/GitHubActions.test.ts

@@ -1,4 +1,3 @@
-import * as GitHub from "@actions/github";
 import { HttpResponse, http } from "msw";
 import { setupServer } from "msw/node";
 import { createEmptyArgs } from "../../../../test-utils/helpers.ts";
@@ -26,10 +25,25 @@ const mocks = vi.hoisted(() => ({
   headLabel: vi.fn().mockReturnValue(""),
 }));
 
+/** Holds overrides; @actions/github v9+ exports `context` as read-only in ESM. */
+const mockGitHubContext = vi.hoisted(() => ({
+  override: undefined as
+    | undefined
+    | {
+        eventName: string;
+        payload: Record<string, unknown>;
+      },
+}));
+
 vi.mock("@actions/github", async (importOriginal) => {
   // eslint-disable-next-line @typescript-eslint/consistent-type-imports
   const original = await importOriginal<typeof import("@actions/github")>();
-  return original;
+  return {
+    ...original,
+    get context() {
+      return mockGitHubContext.override ?? original.context;
+    },
+  };
 });
 
 beforeAll(() => {
@@ -38,6 +52,7 @@ beforeAll(() => {
 
 afterEach(() => {
   server.resetHandlers();
+  mockGitHubContext.override = undefined;
   vi.resetAllMocks();
 });
 
@@ -67,10 +82,9 @@ describe("GitHub Actions Params", () => {
     // TODO: verify that empty string belongs here, from a glance it seems PushEvent does not
     // include a pull_request key
     if (["pull_request", "pull_request_target", ""].includes(eventName)) {
-      vi.mocked(GitHub).context = {
+      mockGitHubContext.override = {
         eventName,
         payload: {
-          // @ts-expect-error - forcing the payload to be a PullRequestEvent
           pull_request: {
             head: {
               sha: "test-head-sha",
@@ -84,8 +98,7 @@ describe("GitHub Actions Params", () => {
         },
       };
     } else if (eventName === "merge_group") {
-      // @ts-expect-error - forcing the payload to be a MergeGroupEvent
-      vi.mocked(GitHub).context = {
+      mockGitHubContext.override = {
         eventName,
         payload: {
           merge_group: {