fix: Resolve CVE-2025-25288 by migrating to ESM and upgrading depende…

[CreatorHead]

Summary

Resolves CVE-2025-25288 (ReDoS vulnerability in @octokit/plugin-paginate-rest) by upgrading dependencies and migrating to ESM architecture.

Security Fix

• CVE-2025-25288 / GHSA-h5c3-5r3r-rr8q - Regular Expression Denial of Service
• Upgraded @actions/github to 6.0.1 and @octokit/rest to 22.0.1
• Verified with npm audit - vulnerability resolved

Key Changes

Dependencies:

• @actions/github: 5.x → 6.0.1
• @octokit/rest: 19.x → 22.0.1
• @octokit/plugin-throttling: 4.x → 5.2.3
• @octokit/plugin-retry: 3.x → 4.1.6

Code Modernization:

• Migrated all source files to ESM (import/export syntax)
• Replaced Jest with Vitest (ESM-native testing)
• Replaced ncc with esbuild (modern bundler)
• Bundle output: index.js → index.cjs (proper CommonJS handling)

Testing

• All 5 unit tests passing
• Integration tested with real GitHub token
• Successfully downloads and installs copywrite CLI
• Bundle executes without module format errors

Breaking Changes

None - Fully backward compatible:

• action.yml inputs/outputs unchanged
• User workflow syntax identical
• Only internal implementation modernized

Verification

npm test              # All tests pass
npm audit             # CVE-2025-25288 resolved
node dist/index.cjs   # Bundle executes successfully

Users can continue using the action without any changes to their workflows.

PCI review checklist

• I have documented a clear reason for, and description of, the change I am making.

• If applicable, I've documented a plan to revert these changes if they require more than reverting the pull request.

• If applicable, I've documented the impact of any changes to security controls.

  Examples of changes to security controls include using new access control methods, adding or removing logging pipelines, etc.

[CreatorHead]

CodeQL Flags:

This is a false positive.

The SHA1 usage on line 16377 is in the bundled undici library's WebSocket implementation and is required by RFC 6455 (WebSocket Protocol Standard) for the handshake process.

Context:

This is protocol compliance, not cryptographic security
Same SHA1 usage existed in the original bundle (main branch, line 1367)
Not introduced by this PR - standard in all WebSocket implementations
Used for handshake validation only, not encryption
CodeQL flags all SHA1 by default, but this is a legitimate protocol requirement. The alert note confirms this was detected due to large code changes, not because it's new.

[sonamtenzin2]

Were the files under dist created with build command ?

[CreatorHead]

Yes, the files under dist. were created with the build command. npm run prepare