chore(bundler-plugin-core): bump @actions/core and @actions/github

.changeset/bump-actions-toolkit.md

@@ -0,0 +1,22 @@
+---
+"@codecov/bundler-plugin-core": major
+---
+
+Bump `@actions/core` to ^3.0.0 and `@actions/github` to ^9.0.0, and set `engines.node` to `>=20.0.0` to match upstream. **Semver major** because supported Node.js drops below 20 (breaking for anyone still on Node 18).
+
+**@actions/core** ([actions/toolkit `packages/core/RELEASES.md`](https://github.com/actions/toolkit/blob/main/packages/core/RELEASES.md))
+
+- **v3.0.0**: ESM-only release; apps that `require("@actions/core")` directly must use dynamic `import()`. **`@codecov/bundler-plugin-core` bundles `@actions/core` and `@actions/github` into `dist/index.cjs`**, so `require("@codecov/bundler-plugin-core")` (e.g. Rollup/Webpack CJS configs) keeps working.
+- **v2.x** (between 1.x and 3.x): Node 24 support and `@actions/http-client` upgrades (including 3.x in the 2.x line).
+
+**@actions/github** ([actions/toolkit `packages/github/RELEASES.md`](https://github.com/actions/toolkit/blob/main/packages/github/RELEASES.md))
+
+- **v9.0.0**: ESM-only (same consideration as `@actions/core` for this package). Release notes also note improved TypeScript behavior with ESM and `@octokit/core/types`.
+- **v8.0.0**: **Minimum Node.js is now 20** (previously 18); Octokit dependencies move to current major lines (`@octokit/core`, REST plugins, request stack).
+- **v8.0.1**: Dependency updates (`undici`, `@actions/http-client`).
+
+**Impact here**
+
+- Runtime behavior we rely on is unchanged: `context` for GitHub Actions metadata and `getIDToken()` for OIDC uploads are still the supported APIs.
+- **Build**: unbuild inlines `@actions/*` (and their transitive deps) like `@sentry/core`; `failOnWarn: false` suppresses expected “inlined implicit external” noise. Published `dist` is larger (~9 MB CJS) but avoids `ERR_PACKAGE_PATH_NOT_EXPORTED` for CJS consumers.
+- **Node 18** is no longer a supported runtime for this package; use **Node 20+** (aligned with `@actions/github` 8+ and this repo’s Volta pin on Node 20).

packages/bundler-plugin-core/build.config.ts

@@ -7,6 +7,8 @@ export default defineBuildConfig({
   outDir: "dist",
   declaration: "compatible",
   sourcemap: true,
+  // Inlining @actions/* pulls transitive deps (octokit, undici, …); unbuild warns about each.
+  failOnWarn: false,
   rollup: {
     dts: {
       compilerOptions: {
@@ -29,7 +31,13 @@ export default defineBuildConfig({
         isResolved?: boolean,
       ) => boolean;
       opts.external = (source, importer, isResolved) => {
-        if (source === "@sentry/core") {
+        // Bundle these into dist so CJS consumers never `require()` them.
+        // @actions/* v3+ is ESM-only (no CJS "main"); externalizing breaks Rollup/Webpack CJS configs.
+        if (
+          source === "@sentry/core" ||
+          source === "@actions/core" ||
+          source === "@actions/github"
+        ) {
           return false;
         }
         return isExternal(source, importer, isResolved);

packages/bundler-plugin-core/package.json

@@ -39,8 +39,8 @@
     "generate:typedoc": "typedoc --options ./typedoc.json"
   },
   "dependencies": {
-    "@actions/core": "^1.10.1",
-    "@actions/github": "^6.0.0",
+    "@actions/core": "^3.0.0",
+    "@actions/github": "^9.0.0",
     "chalk": "4.1.2",
     "semver": "^7.5.4",
     "unplugin": "^1.10.1",
@@ -66,6 +66,6 @@
     "extends": "../../package.json"
   },
   "engines": {
-    "node": ">=18.0.0"
+    "node": ">=20.0.0"
   }
 }

packages/bundler-plugin-core/src/utils/providers/__tests__/GitHubActions.test.ts

@@ -1,4 +1,3 @@
-import * as GitHub from "@actions/github";
 import { HttpResponse, http } from "msw";
 import { setupServer } from "msw/node";
 import { createEmptyArgs } from "../../../../test-utils/helpers.ts";
@@ -26,10 +25,25 @@ const mocks = vi.hoisted(() => ({
   headLabel: vi.fn().mockReturnValue(""),
 }));
 
+/** Holds overrides; @actions/github v9+ exports `context` as read-only in ESM. */
+const mockGitHubContext = vi.hoisted(() => ({
+  override: undefined as
+    | undefined
+    | {
+        eventName: string;
+        payload: Record<string, unknown>;
+      },
+}));
+
 vi.mock("@actions/github", async (importOriginal) => {
   // eslint-disable-next-line @typescript-eslint/consistent-type-imports
   const original = await importOriginal<typeof import("@actions/github")>();
-  return original;
+  return {
+    ...original,
+    get context() {
+      return mockGitHubContext.override ?? original.context;
+    },
+  };
 });
 
 beforeAll(() => {
@@ -38,6 +52,7 @@ beforeAll(() => {
 
 afterEach(() => {
   server.resetHandlers();
+  mockGitHubContext.override = undefined;
   vi.resetAllMocks();
 });
 
@@ -67,10 +82,9 @@ describe("GitHub Actions Params", () => {
     // TODO: verify that empty string belongs here, from a glance it seems PushEvent does not
     // include a pull_request key
     if (["pull_request", "pull_request_target", ""].includes(eventName)) {
-      vi.mocked(GitHub).context = {
+      mockGitHubContext.override = {
         eventName,
         payload: {
-          // @ts-expect-error - forcing the payload to be a PullRequestEvent
           pull_request: {
             head: {
               sha: "test-head-sha",
@@ -84,8 +98,7 @@ describe("GitHub Actions Params", () => {
         },
       };
     } else if (eventName === "merge_group") {
-      // @ts-expect-error - forcing the payload to be a MergeGroupEvent
-      vi.mocked(GitHub).context = {
+      mockGitHubContext.override = {
         eventName,
         payload: {
           merge_group: {