Migrate to ESM and upgrade dependencies#752
Conversation
There was a problem hiding this comment.
Pull request overview
This PR migrates the action’s TypeScript codebase to ESM (NodeNext) and updates the toolchain/configuration to support ESM linting and testing, alongside a broad dependency refresh.
Changes:
- Switch TypeScript compilation to
NodeNextand update internal imports /__dirnameusage for ESM. - Replace legacy ESLint/Jest/Prettier configs with ESM-friendly equivalents and update tests to ESM mocking patterns.
- Bump runtime/dev dependencies and refresh
licensedmetadata to match new dependency graph.
Reviewed changes
Copilot reviewed 67 out of 78 changed files in this pull request and generated 2 comments.
Show a summary per file
| File | Description |
|---|---|
| tsconfig.json | Switch TS module system to NodeNext |
| tsconfig.eslint.json | Add dedicated TS config for ESLint |
| src/setup-dotnet.ts | Update imports and ESM path resolution |
| src/installer.ts | Update imports and ESM path resolution |
| src/cache-utils.ts | Update relative import to .js specifier |
| src/cache-save.ts | Update relative imports to .js specifiers |
| src/cache-restore.ts | Update relative imports to .js specifiers |
| package.json | Mark package as ESM; bump deps/scripts |
| jest.config.ts | New TS-based Jest config for ESM + ts-jest |
| jest.config.js | Remove legacy CommonJS Jest config |
| eslint.config.mjs | New flat ESLint config for ESM/TS |
| dist/setup/package.json | Mark bundled setup output as ESM |
| dist/cache-save/package.json | Mark bundled post step output as ESM |
| .prettierrc.json | Add JSON-based Prettier config |
| .prettierrc.js | Remove legacy CommonJS Prettier config |
| .licenses/npm/yallist.dep.yml | Remove outdated licensed entry |
| .licenses/npm/wrappy.dep.yml | Remove outdated licensed entry |
| .licenses/npm/universal-user-agent.dep.yml | Update licensed metadata for new version |
| .licenses/npm/semver.dep.yml | Update licensed metadata for new version |
| .licenses/npm/semver-7.6.0.dep.yml | Remove outdated licensed entry |
| .licenses/npm/once.dep.yml | Remove outdated licensed entry |
| .licenses/npm/ms.dep.yml | Update licensed metadata for new version |
| .licenses/npm/minimatch-3.1.5.dep.yml | Add licensed metadata for dependency |
| .licenses/npm/minimatch-10.2.5.dep.yml | Add licensed metadata for dependency |
| .licenses/npm/lru-cache.dep.yml | Remove outdated licensed entry |
| .licenses/npm/json-with-bigint.dep.yml | Update licensed metadata for dependency change |
| .licenses/npm/fast-xml-parser.dep.yml | Update licensed metadata for new version |
| .licenses/npm/deprecation.dep.yml | Remove outdated licensed entry |
| .licenses/npm/debug.dep.yml | Update licensed metadata for new version |
| .licenses/npm/content-type.dep.yml | Add licensed metadata for dependency |
| .licenses/npm/brace-expansion-5.0.6.dep.yml | Add licensed metadata for dependency |
| .licenses/npm/brace-expansion-1.1.15.dep.yml | Add licensed metadata for dependency |
| .licenses/npm/before-after-hook.dep.yml | Update licensed metadata for new version |
| .licenses/npm/balanced-match-4.0.4.dep.yml | Add licensed metadata for dependency |
| .licenses/npm/balanced-match-1.0.2.dep.yml | Add licensed metadata for dependency |
| .licenses/npm/@typespec/ts-http-runtime.dep.yml | Update licensed metadata for new version |
| .licenses/npm/@octokit/types.dep.yml | Update licensed metadata for new version |
| .licenses/npm/@octokit/types-13.10.0.dep.yml | Remove outdated licensed entry |
| .licenses/npm/@octokit/request.dep.yml | Update licensed metadata for new version |
| .licenses/npm/@octokit/request-error.dep.yml | Update licensed metadata for new version |
| .licenses/npm/@octokit/plugin-rest-endpoint-methods.dep.yml | Update licensed metadata for new version |
| .licenses/npm/@octokit/plugin-paginate-rest.dep.yml | Update licensed metadata for new version |
| .licenses/npm/@octokit/openapi-types.dep.yml | Update licensed metadata for new version |
| .licenses/npm/@octokit/graphql.dep.yml | Update licensed metadata for new version |
| .licenses/npm/@octokit/endpoint.dep.yml | Update licensed metadata for new version |
| .licenses/npm/@octokit/core.dep.yml | Update licensed metadata for new version |
| .licenses/npm/@octokit/auth-token.dep.yml | Update licensed metadata for new version |
| .licenses/npm/@azure/storage-common.dep.yml | Update licensed metadata for new version |
| .licenses/npm/@azure/storage-blob.dep.yml | Update licensed metadata for new version |
| .licenses/npm/@azure/core-xml.dep.yml | Update licensed metadata for new version |
| .licenses/npm/@azure/core-rest-pipeline.dep.yml | Update licensed metadata for new version |
| .licenses/npm/@azure/core-http-compat.dep.yml | Update licensed metadata for new version |
| .licenses/npm/@azure/core-client.dep.yml | Update licensed metadata for new version |
| .licenses/npm/@azure/abort-controller.dep.yml | Add licensed metadata for dependency |
| .licenses/npm/@actions/io.dep.yml | Update licensed metadata for new version |
| .licenses/npm/@actions/http-client-4.0.1.dep.yml | Update licensed metadata for new version |
| .licenses/npm/@actions/glob-0.7.0.dep.yml | Correct/update licensed metadata entry |
| .licenses/npm/@actions/glob-0.6.1.dep.yml | Update licensed metadata for new version |
| .licenses/npm/@actions/github.dep.yml | Update licensed metadata for new version |
| .licenses/npm/@actions/exec.dep.yml | Update licensed metadata for new version |
| .licenses/npm/@actions/core.dep.yml | Update licensed metadata for new version |
| .licenses/npm/@actions/cache.dep.yml | Update licensed metadata for new version |
| .licensed.yml | Allow/review new licenses introduced by bumps |
| .eslintrc.js | Remove legacy ESLint config |
| .eslintignore | Remove legacy ESLint ignore file |
| tests/setup-dotnet.test.ts | Convert tests to ESM module mocking/imports |
| tests/latest-version.test.ts | Convert tests to ESM module mocking/imports |
| tests/installer.test.ts | Convert tests to ESM module mocking/imports |
| tests/installation-scripts.test.ts | Fix __dirname usage for ESM tests |
| tests/csc.test.ts | Update JSON import + TS indexing workaround |
| tests/cache-utils.test.ts | Convert tests to ESM module mocking/imports |
| tests/cache-save.test.ts | Convert tests to ESM module mocking/imports |
| tests/cache-restore.test.ts | Convert tests to ESM module mocking/imports |
| tests/authutil.test.ts | Fix __dirname usage + ESM import specifiers |
| tests/snapshots/authutil.test.ts.snap | Update snapshot header text |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
716782d to
876a438
Compare
|
This should fix #731 |
|
Reports 18 moderate severity vulns so would be good to fix those as well. |
3d1f979 to
d4356c9
Compare
This is clean now https://github.com/actions/setup-dotnet/actions/runs/28840313597/job/85532800573#step:9:1 reports 0 vulns nice job! |
8578015
8578015 to
095bad8
Compare
095bad8 to
3c38197
Compare
Bumps [actions/setup-dotnet](https://github.com/actions/setup-dotnet) from 5.4.0 to 6.0.0. Release notes *Sourced from [actions/setup-dotnet's releases](https://github.com/actions/setup-dotnet/releases).* > v6.0.0 > ------ > > What's Changed > -------------- > > * Migrate to ESM and upgrade dependencies by [`@priyagupta108`](https://github.com/priyagupta108) in [actions/setup-dotnet#752](https://redirect.github.com/actions/setup-dotnet/pull/752) > * Bump actions/checkout from 6.0.3 to 7.0.0 by [`@dependabot`](https://github.com/dependabot)[bot] in [actions/setup-dotnet#751](https://redirect.github.com/actions/setup-dotnet/pull/751) > * chore(deps): bump `@actions/cache` to 6.2.0 by [`@philip-gai`](https://github.com/philip-gai) in [actions/setup-dotnet#756](https://redirect.github.com/actions/setup-dotnet/pull/756) > > New Contributors > ---------------- > > * [`@philip-gai`](https://github.com/philip-gai) made their first contribution in [actions/setup-dotnet#756](https://redirect.github.com/actions/setup-dotnet/pull/756) > > **Full Changelog**: <actions/setup-dotnet@v5...v6.0.0> Commits * [`a98b568`](actions/setup-dotnet@a98b568) chore(deps): bump `@actions/cache` to 6.2.0 ([#756](https://redirect.github.com/actions/setup-dotnet/issues/756)) * [`afb2931`](actions/setup-dotnet@afb2931) Bump actions/checkout from 6.0.3 to 7.0.0 ([#751](https://redirect.github.com/actions/setup-dotnet/issues/751)) * [`6df8cef`](actions/setup-dotnet@6df8cef) Migrate to ESM and upgrade dependencies ([#752](https://redirect.github.com/actions/setup-dotnet/issues/752)) * See full diff in [compare view](actions/setup-dotnet@26b0ec1...a98b568) [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- Dependabot commands and options You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
Description:
Convert to ESM, update imports/tests/configs for ESM, and bump dependencies.
Related issue:
#731
Check list: