fix: Resolve CVE-2025-25288 by migrating to ESM and upgrading dependencies

- Upgrade @actions/github to 6.0.1 and @octokit/rest to 22.0.1 to fix ReDoS vulnerability
- Migrate source code to ESM (import/export syntax)
- Replace Jest with Vitest and ncc with esbuild
- Change bundle output to .cjs extension for proper CommonJS handling
- All tests passing, no breaking changes to action interface

Author: CreatorHead

action.js

@@ -3,16 +3,12 @@
  * SPDX-License-Identifier: MPL-2.0
  */
 
-'use strict'
-
-const fs = require('fs').promises
-const os = require('os')
-const crypto = require('crypto')
-
-const core = require('@actions/core')
-const tc = require('@actions/tool-cache')
-
-const octokit = require('./octokit')
+import { promises as fs } from 'fs'
+import os from 'os'
+import crypto from 'crypto'
+import core from '@actions/core'
+import tc from '@actions/tool-cache'
+import octokit from './octokit.js'
 
 const owner = 'hashicorp'
 const repo = 'copywrite'
@@ -108,4 +104,4 @@ async function run () {
   }
 }
 
-module.exports = run
+export default run

action.test.js

@@ -3,12 +3,18 @@
  * SPDX-License-Identifier: MPL-2.0
  */
 
-const fs = require('fs')
-const nock = require('nock')
-const path = require('path')
-const os = require('os')
-
-const core = require('@actions/core')
+import fs from 'fs'
+import nock from 'nock'
+import path from 'path'
+import os from 'os'
+import { vi, describe, test, beforeAll, beforeEach, expect } from 'vitest'
+import core from '@actions/core'
+import { fileURLToPath } from 'url'
+import { dirname } from 'path'
+import action from './action.js'
+
+const __filename = fileURLToPath(import.meta.url)
+const __dirname = dirname(__filename)
 
 const mockRelease = {
   assets: [
@@ -45,9 +51,9 @@ beforeEach(() => {
   process.env.INPUT_VERSION = 'latest'
   process.env['INPUT_VERSION-CHECKSUM'] = '5663389ef1a8ec48af6ca622e66bf0f54ba8f22c127f14cb8a3f429e40868582'
 
-  const spyOsArch = jest.spyOn(os, 'arch')
+  const spyOsArch = vi.spyOn(os, 'arch')
   spyOsArch.mockReturnValue('x64')
-  const spyOsPlatform = jest.spyOn(os, 'platform')
+  const spyOsPlatform = vi.spyOn(os, 'platform')
   spyOsPlatform.mockReturnValue('win32')
 })
 
@@ -61,18 +67,17 @@ describe('action', () => {
     // const scopeWeb = nock('https://github.com')
     //   .get('/hashicorp/copywrite/releases/download/v0.1.3/copywrite_0.1.3_windows_x86_64.zip')
     //   .replyWithFile(200, path.resolve(__dirname, 'test.zip'), { 'content-type': 'application/octet-stream' })
-    const spyCoreAddPath = jest.spyOn(core, 'addPath')
-    const spyCoreSetOutput = jest.spyOn(core, 'setOutput')
+    const spyCoreAddPath = vi.spyOn(core, 'addPath')
+    const spyCoreSetOutput = vi.spyOn(core, 'setOutput')
 
     fs.mkdtemp(path.join(os.tmpdir(), 'setup-copywrite-'), async (err, directory) => {
       if (err) throw err
 
       process.env.RUNNER_TEMP = directory
 
-      const spyOsHomedir = jest.spyOn(os, 'homedir')
+      const spyOsHomedir = vi.spyOn(os, 'homedir')
       spyOsHomedir.mockReturnValue(directory)
 
-      const action = require('./action')
       await expect(await action()).resolves
       expect(scopeAPI.isDone()).toBeTruthy()
       expect(spyCoreAddPath).toHaveBeenCalled()
@@ -90,19 +95,18 @@ describe('action', () => {
     // const scopeWeb = nock('https://github.com')
     //   .get('/hashicorp/copywrite/releases/download/v0.1.3/copywrite_0.1.3_windows_x86_64.zip')
     //   .replyWithFile(200, path.resolve(__dirname, 'test.zip'), { 'content-type': 'application/octet-stream' })
-    const spyCoreAddPath = jest.spyOn(core, 'addPath')
-    const spyCoreSetOutput = jest.spyOn(core, 'setOutput')
+    const spyCoreAddPath = vi.spyOn(core, 'addPath')
+    const spyCoreSetOutput = vi.spyOn(core, 'setOutput')
 
     fs.mkdtemp(path.join(os.tmpdir(), 'setup-copywrite-'), async (err, directory) => {
       if (err) throw err
 
       process.env.INPUT_VERSION = 'v0.1.3'
       process.env.RUNNER_TEMP = directory
 
-      const spyOsHomedir = jest.spyOn(os, 'homedir')
+      const spyOsHomedir = vi.spyOn(os, 'homedir')
       spyOsHomedir.mockReturnValue(directory)
 
-      const action = require('./action')
       await expect(await action()).resolves
       expect(scopeAPI.isDone()).toBeTruthy()
       expect(spyCoreAddPath).toHaveBeenCalled()
@@ -126,10 +130,9 @@ describe('action', () => {
       process.env.INPUT_VERSION = 'v0.1.3'
       process.env.RUNNER_TEMP = directory
 
-      const spyOsHomedir = jest.spyOn(os, 'homedir')
+      const spyOsHomedir = vi.spyOn(os, 'homedir')
       spyOsHomedir.mockReturnValue(directory)
 
-      const action = require('./action')
       await expect(await action()).resolves
       expect(scope.isDone()).toBeTruthy()
       done()
@@ -154,10 +157,9 @@ describe('action', () => {
       process.env.INPUT_VERSION = 'v0.1.3'
       process.env.RUNNER_TEMP = directory
 
-      const spyOsHomedir = jest.spyOn(os, 'homedir')
+      const spyOsHomedir = vi.spyOn(os, 'homedir')
       spyOsHomedir.mockReturnValue(directory)
 
-      const action = require('./action')
       await expect(await action()).resolves
       expect(scope.isDone()).toBeTruthy()
       done()
@@ -179,10 +181,9 @@ describe('action', () => {
       process.env.INPUT_VERSION = 'v0.1.3'
       process.env.RUNNER_TEMP = directory
 
-      const spyOsHomedir = jest.spyOn(os, 'homedir')
+      const spyOsHomedir = vi.spyOn(os, 'homedir')
       spyOsHomedir.mockReturnValue(directory)
 
-      const action = require('./action')
       await expect(await action()).resolves
       expect(scope.isDone()).toBeTruthy()
       done()

action.yml

@@ -21,7 +21,7 @@ outputs:
     description: 'The version of the copywrite CLI that was installed.'
 runs:
   using: 'node20'
-  main: 'dist/index.js'
+  main: 'dist/index.cjs'
 branding:
   icon: "file-text"
   color: "gray-dark"

build.js

@@ -0,0 +1,18 @@
+import { build } from 'esbuild'
+
+// Build as CommonJS for GitHub Actions
+// Using .cjs extension so Node treats it as CommonJS regardless of package.json "type"
+await build({
+  entryPoints: ['index.js'],
+  bundle: true,
+  platform: 'node',
+  target: 'node20',
+  format: 'cjs',
+  outfile: 'dist/index.cjs',
+  sourcemap: true,
+  banner: {
+    js: '// Copyright IBM Corp. 2023, 2025\n// SPDX-License-Identifier: MPL-2.0\n'
+  }
+})
+
+console.log('✓ Bundle created successfully: dist/index.cjs')