[No QA] Upgrade @actions and @octokit dependencies to their ESM-only majors by roryabraham · Pull Request #98701 · Expensify/App

roryabraham · 2026-08-15T00:04:41Z

Explanation of Change

This is PR 3 of the bottom-up ncc → esbuild migration plan. It upgrades @actions/core, @actions/github, and the @octokit/* plugin chain to their current majors. The action bundles are still built with ncc — swapping in esbuild and emitting ESM is PR 4.

PRs 1 and 2 (moving scripts to Bun and tests to bun:test) are already merged, so nothing does a runtime require() of these packages anymore.

Dependency upgrades

Package	Before	After
`@actions/core`	1.10.0	3.0.1
`@actions/github`	5.1.1	9.1.1
`@octokit/core`	4.0.4	^7.0.6
`@octokit/plugin-paginate-rest`	3.1.0	^14.0.0
`@octokit/plugin-rest-endpoint-methods`	(transitive)	^17.0.0
`@octokit/plugin-throttling`	4.1.0	^11.0.0
`@octokit/request-error`	3.0.3	^7.1.0
`@octokit/webhooks-types`	^7.5.1	^7.6.1

The @octokit/* versions are the ones @actions/github v9 itself bundles, so there is a single copy of each in the tree. @octokit/plugin-rest-endpoint-methods becomes an explicit dev dependency because we import types from it directly.

A new ncc patch was needed

@actions/core v3 and @actions/github v9 are ESM-only: their exports maps publish an import condition and nothing else. ncc emits CommonJS, so webpack resolves dependencies with the require condition only, and every action failed to build with:

Module not found: Error: Package path . is not exported from package @actions/core

@vercel+ncc+0.38.1+003+esm-only-package-exports.patch appends import to webpack's CommonJS condition list. require stays first, so dual-published packages are unaffected — verified by checking that checkSVGCompression's bundle still resolves svgo to dist/svgo-node.cjs (rather than its pure-ESM entry, which is what crashed under esbuild's CJS output and motivated PR 4's ESM switch).

This patch is deleted again in PR 4, when ncc itself goes away.

Breaking changes fixed

@octokit/plugin-throttling: onAbuseLimit was renamed onSecondaryRateLimit, and retryCount moved from options.request.retryCount to its own handler argument. Fixed in GithubUtils.ts and scripts/aggregateGitHubDataFromUpwork.ts.
@octokit/plugin-rest-endpoint-methods no longer exports RestEndpointMethods, nor any of its dist-types/* paths. It only exports Api, so RestEndpointMethods is now derived as Api['rest'].
@actions/github dropped ./lib/interfaces from its exports map, so WebhookPayload is derived from typeof github.context.payload.
@octokit/openapi-types version skew: @octokit/core depends on a newer copy than the plugins do, and the two disagree on some schema fields (e.g. issue.id is number | bigint in the newer one, because @octokit/request now decodes oversized integers as BigInt). GithubUtils no longer imports @octokit/openapi-types at all — OctokitIssueItem, OctokitCommit, OctokitArtifact, and OctokitPR are derived from the endpoint methods that return them, which pins them to the one copy the REST methods actually use. DeployChecklistUtils now imports OctokitIssueItem from GithubUtils instead of redeclaring it.

Two test-only breakages this surfaced

Both were silent failures worth calling out:

jest.spyOn no longer intercepts octokit REST methods. @octokit/plugin-rest-endpoint-methods now builds every scope (octokit.rest.issues, octokit.rest.pulls, …) as a Proxy that materializes endpoint methods on first access, and jest.spyOn has no effect through a Proxy under bun:test — the spy is installed, but reads still return the real method. The affected tests were quietly calling the real GitHub API (Bad credentials) instead of their mocks. New tests/utils/materializeOctokitScopes.ts spreads each scope into an ordinary object first, after which jest.spyOn/jest.restoreAllMocks behave normally and no other test code had to change.
@octokit/request reads JSON bodies with text() (then parses them itself, to support BigInt) rather than json(). postOrReplaceComment.test.ts stubs fetch, so its fake Response needed a text().

Rebuild

All 24 committed index.js action bundles were rebuilt with ncc.

Fixed Issues

$
PROPOSAL:

Tests

Check out this branch and run npm install (Node 26.5.0, per .nvmrc).
Run npm run gh-actions-build and confirm all 24 actions build without error.
Run ./.github/scripts/verifyActions.sh and confirm it reports Github Actions are up to date!.
Run npm run test:bun and confirm all tests pass.
Run npm run typecheck and ./scripts/lint.sh .github/ tests/ scripts/ and confirm both are clean.
Run npx knip and confirm no new unused/unlisted dependencies are reported versus main.
Run node .github/actions/javascript/checkSVGCompression/index.js with no GITHUB_TOKEN set and confirm it fails with Error: Input required and not supplied: GITHUB_TOKEN rather than crashing — this proves the ESM-only @actions/core bundled correctly and that svgo/css-tree still resolve.
Run node .github/actions/javascript/bumpVersion/index.js with no SEMVER_LEVEL set, confirm it fails with Error: Input required and not supplied: SEMVER_LEVEL, and confirm git status shows no version files were changed.
Run GITHUB_TOKEN=<a real token> node .github/actions/javascript/isDeployChecklistLocked/index.js and confirm it prints the current StagingDeployCash issue and its labels — this exercises the upgraded Octokit chain against the real API end to end.
Run rm -rf node_modules/@vercel/ncc && npm install --ignore-scripts && ./scripts/applyPatches.sh and confirm patch-package succeeded without errors or warnings, i.e. the new ncc patch applies to a pristine install.

Note that several of these bundled actions run on this PR before merge, at least isAuthorizedContributor and verifySignedCommits, and Validate GitHub Actions runs the build step in CI.

Verify that no errors appear in the JS console

Offline tests

N/A - this PR only changes CI/build tooling and its dependencies, not app code.

QA Steps

N/A - this PR only changes internal CI/build tooling; there is no end-user-facing or staging/production behavior to QA.

Verify that no errors appear in the JS console