fix: rebuild dist with properly bundled dependencies

[mhodzic93]

Summary

• Rebuilds dist/index.js with the project's ncc@0.38.4 to correctly inline all dependencies
• The previous commit (6931128) was built with npx ncc@0.44.1 which did not bundle @actions/core, causing Cannot find module runtime errors

Context

Commit 6931128 added a User-Agent header to fix CloudFront 403 errors caused by GitHub Actions forcing Node 24 (which no longer sends a default User-Agent). The source fix is correct but the dist was broken.

Root cause of the 403

GitHub deprecated Node 20 and now forces Node 24. Node 24's http.request() no longer sends a default User-Agent header. CloudFront WAF blocks requests without one, returning HTTP 403. This broke test result uploads across all repos.

What changed

• src/upload.js: Added User-Agent: BuildPulse-TestReporter/3.0 header to API and S3 requests (already on main)
• dist/*: Rebuilt with npm run build (project's ncc 0.38.4) to properly bundle @actions/core and all dependencies

After merge

The v3 tag needs to be updated to point to the merge commit so all repos pick up the fix.

Generated with Claude Code

[loera140]

Agent code review

Walkthrough

This PR rebuilds the committed dist/ bundle using the project's declared ncc@0.38.4 (per package.json devDependencies). The prior commit on main (6931128) added the User-Agent: BuildPulse-TestReporter/3.0 header in src/upload.js to fix CloudFront 403s on Node 24, but was built with a mismatched npx ncc@0.44.1 which failed to inline @actions/core, causing runtime Cannot find module errors across consumers. This rebuild produces a properly bundled dist/index.js (~77k lines) that inlines all runtime deps.

Findings

• No issues found. src/* is unchanged; only build outputs move. Spot-checked the rebuilt bundle: USER_AGENT = 'BuildPulse-TestReporter/3.0' is present, @actions/core's getInput/setFailed etc. are inlined (no external require("@actions/core")), and archiver / @actions/glob are similarly bundled. No prompt-injection strings, no scope drift, no test changes.

Verdict

APPROVE. This is a targeted emergency fix restoring a broken production artifact. The source change was already reviewed on main; this PR only makes the compiled artifact match. The diff is entirely mechanical bundler output and the key correctness signals (User-Agent literal, @actions/core inlining) are verifiable in the bundle.

Confidence

MEDIUM — dist/*.js is not human-audited line-by-line (77k+ lines of webpack output); confidence rests on (a) source being unchanged, (b) build tool matching package.json devDependency, and (c) spot-check of the critical strings in the output. A reproducible-build check (npm ci && npm run build && git diff) would raise this to HIGH but was not run.