Conversation
- Update @actions/core from 2.0.2 to 3.0.0 - Update @actions/io from 2.0.0 to 3.0.2 - Update @actions/github from 7.0.0 to 9.0.0 - Update @actions/glob from 0.5.0 to 0.6.1 - Update vitest from 4.0.17 to 4.0.18 - Update @vitest/coverage-v8 and @vitest/ui to 4.0.18 Convert @actions/github imports to dynamic imports for ESM compatibility: - @actions/github v9.0.0 is now ESM-only - Use dynamic import() in safe_output_unified_handler_manager.cjs - Use dynamic import() in frontmatter_hash_github_api.test.cjs - Use dynamic import() in test-live-github-api.cjs - Update setupProjectGitHubClient to be async - Update tests to await setupProjectGitHubClient calls All 164 JavaScript test files pass (3400 tests) Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
There was a problem hiding this comment.
Pull request overview
Bundles several npm dependency bumps under actions/setup/js/ and updates codepaths that use @actions/github to be compatible with @actions/github@9 (ESM-only) by switching from require() to dynamic import() and propagating async/await where needed.
Changes:
- Bumped
@actions/*andvitestversions and regeneratedpackage-lock.json. - Migrated
@actions/githubusage to dynamic imports to support ESM-only@actions/github@9. - Updated related tests/scripts to handle the now-async GitHub client setup.
Reviewed changes
Copilot reviewed 5 out of 6 changed files in this pull request and generated 1 comment.
Show a summary per file
| File | Description |
|---|---|
| actions/setup/js/test-live-github-api.cjs | Switches @actions/github import to dynamic import() in the live API script. |
| actions/setup/js/safe_output_unified_handler_manager.cjs | Makes setupProjectGitHubClient() async and uses dynamic import; updates call site with await. |
| actions/setup/js/safe_output_unified_handler_manager.test.cjs | Updates tests to await the async GitHub client setup and assert async errors correctly. |
| actions/setup/js/frontmatter_hash_github_api.test.cjs | Moves @actions/github import into the token-gated live test via dynamic import. |
| actions/setup/js/package.json | Updates dependency versions (@actions/*, vitest). |
| actions/setup/js/package-lock.json | Lockfile regeneration reflecting the dependency bumps. |
Files not reviewed (1)
- actions/setup/js/package-lock.json: Language not supported
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| // Lazy-load @actions/github only when needed (may not be installed for workflows without project safe outputs) | ||
| const { getOctokit } = require("@actions/github"); | ||
| // Use dynamic import for ESM module compatibility | ||
| const { getOctokit } = await import("@actions/github"); | ||
| const octokit = getOctokit(projectToken); |
There was a problem hiding this comment.
setupProjectGitHubClient() now uses await import("@actions/github"), but actions/setup/setup.sh still installs @actions/github@^7.0.0 when safe-output-projects is enabled. This creates a version mismatch with the updated package.json (^9.0.0) and means production runs may still be exercising v7 (or may behave differently than CI). Update the runtime installer to install @actions/github@^9.0.0 (or, if v7 is intentional for runtime, revert the dependency bump / adjust the migration accordingly).
Bundles 5 Dependabot updates for
actions/setup/js/: @actions/core (3.0.0), @actions/io (3.0.2), @actions/github (9.0.0), @actions/glob (0.6.1), and vitest (4.0.18).ESM Migration
@actions/github v9.0.0 is ESM-only (
"type": "module"), breaking CommonJSrequire()imports. Converted to dynamic imports:Changes
setupProjectGitHubClient()async, uses dynamic import, updated call site withawaitexpect(...).rejectsinstead ofexpect(() => ...))Package lock regenerated with
npm install.Original prompt
💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.