The Great PR

.gitattributes

@@ -1 +1,2 @@
 dist/** -diff linguist-generated=true
+script/** -linguist-detectable

.github/workflows/acceptance.yml

@@ -0,0 +1,32 @@
+name: acceptance
+on:
+  pull_request:
+  push:
+    branches:
+      - main
+
+permissions:
+  contents: read
+
+jobs:
+  acceptance:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # pin@v7.0.0
+        with:
+          persist-credentials: false
+
+      - name: setup node
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # pin@v6.4.0
+        with:
+          node-version-file: .node-version
+          cache: 'npm'
+
+      - name: install dependencies
+        run: npm ci --ignore-scripts --no-audit --no-fund
+
+      - name: package
+        run: npm run package
+
+      - name: acceptance
+        run: npm run acceptance

.github/workflows/actions-config-validation.yml

@@ -14,12 +14,12 @@ jobs:
   actions-config-validation:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6.0.2
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # pin@v7.0.0
         with:
           persist-credentials: false
 
       - name: actions-config-validation
-        uses: GrantBirki/json-yaml-validate@3ff75979f3b21171f2e8a44705f0ff4bed30bbc0 # pin@v5.0.0
+        uses: GrantBirki/json-yaml-validate@9bbaa8474e3af4e91f25eda8ac194fdc30564d96 # pin@v4.0.0
         with:
           comment: "true" # enable comment mode
           yaml_schema: "__tests__/schemas/action.schema.yml"

.github/workflows/copilot-setup-steps.yml

@@ -12,15 +12,15 @@ jobs:
       contents: read
     steps:
       - name: checkout
-        uses: actions/checkout@v6.0.2
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # pin@v7.0.0
         with:
           persist-credentials: false
 
       - name: setup node
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # pin@v6.4.0
         with:
           node-version-file: .node-version
           cache: 'npm'
 
       - name: install dependencies
-        run: npm ci
+        run: npm ci --ignore-scripts --no-audit --no-fund

.github/workflows/lint.yml

@@ -12,20 +12,22 @@ jobs:
   lint:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6.0.2
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # pin@v7.0.0
         with:
           persist-credentials: false
 
       - name: setup node
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # pin@v6.4.0
         with:
           node-version-file: .node-version
           cache: 'npm'
 
       - name: install dependencies
-        run: npm ci
+        run: npm ci --ignore-scripts --no-audit --no-fund
 
       - name: lint
         run: |
           npm run format-check
+          npm run typecheck
+          npm run typecheck:runtime
           npm run lint

.github/workflows/old/sample-workflow.yml

@@ -18,7 +18,7 @@
 #     runs-on: ubuntu-latest
 #     steps:
 #       # Need to checkout for testing the Action in this repo
-#       - uses: actions/checkout@2541b1294d2704b0964813337f33b291d3f8596b # pin@v3.0.2
+#       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # pin@v7.0.0
 
 #       # Start the branch deployment
 #       - uses: ./
@@ -27,7 +27,7 @@
 #           admins: grantbirki
 
 #       # Check out the ref from the output of the IssueOps command
-#       - uses: actions/checkout@2541b1294d2704b0964813337f33b291d3f8596b # pin@v3.0.2
+#       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # pin@v7.0.0
 #         if: ${{ steps.branch-deploy.outputs.continue == 'true' }}
 #         with:
 #           ref: ${{ steps.branch-deploy.outputs.sha }}

.github/workflows/package-check.yml

@@ -15,33 +15,39 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v6.0.2
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # pin@v7.0.0
         with:
           persist-credentials: false
 
       - name: setup node
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # pin@v6.4.0
         with:
           node-version-file: .node-version
           cache: 'npm'
 
       - name: install dependencies
-        run: npm ci
+        run: npm ci --ignore-scripts --no-audit --no-fund
 
       - name: rebuild the dist/ directory
-        run: npm run bundle
+        run: npm run package
 
       - name: compare the expected and actual dist/ directories
         run: |
-          if [ "$(git diff --ignore-space-at-eol dist/ | wc -l)" -gt "0" ]; then
-            echo "Detected uncommitted changes after build.  See status below:"
-            git diff
+          if [[ -n "$(git status --porcelain --untracked-files=all -- dist/)" ]]; then
+            echo "Detected changes in dist/ after build. See status below:"
+            git status --short --untracked-files=all -- dist/
+            git diff -- dist/
             exit 1
           fi
         id: diff
 
+      - name: smoke test the ESM bundle
+        env:
+          BRANCH_DEPLOY_VITEST_TEST: 'true'
+        run: node --input-type=module --eval "const action = await import('./dist/index.js'); if (typeof action.run !== 'function') throw new Error('dist/index.js does not export run')"
+
       # If index.js was different than expected, upload the expected version as an artifact
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # pin@v7.0.1
+      - uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # pin@v7.0.0
         if: ${{ failure() && steps.diff.conclusion == 'failure' }}
         with:
           name: dist