Default action API host to apex (buildpulse.io)

[loera140]

Apex cutover deep-link update: DEFAULT_API_HOST app2.buildpulse.io→buildpulse.io. The /api/test-results/upload-url endpoint is served identically at the apex (verified 401 auth-required, same as app2). Only affects runs that do not set api-host/BUILDPULSE_API_HOST; app2 stays alive so pinned releases keep working. Regenerated dist/ via ncc; 31 tests pass. A new tagged release is required for customers to pick this up.

🤖 Generated with Claude Code

[loera140]

Agent code review

Walkthrough

Apex cutover for the action's default API host: DEFAULT_API_HOST in src/upload.js moves from https://app2.buildpulse.io to https://buildpulse.io, and the matching positive-case assertion in src/__tests__/enforceHttps.test.js is updated in lockstep. dist/index.js and its source map are regenerated via ncc. Only affects runs that do not set api-host / BUILDPULSE_API_HOST; PR body documents that app2.buildpulse.io stays alive so pinned releases keep working, and that /api/test-results/upload-url returns identical 401 (auth-required) at both hosts.

Findings

• No issues found.

Notes that did not rise to a finding:

• The huge dist/index.js churn (~17k+/~21k-) is almost entirely a bundled-undici swap (EnvHttpProxyAgent/RetryAgent/interceptors/EventSource/fetch rewiring). The lockfile pins undici@5.29.0 and the rebuilt bundle is consistent with that pin; the prior main dist appears to have been built against a newer undici than the lockfile specifies, so this rebuild restores lockfile/dist consistency. None of the swapped surface area is referenced by src/ (the action's HTTP code uses Node's built-in https.request, not undici/@actions/http-client), so this delta is runtime-inert for the action itself.
• Only changed lines available for inline comments are inside dist/index.js; no actionable comment to anchor there.

Verdict

APPROVE. The semantic change is a one-line default-host swap fully covered by the existing enforceHttps test, with the test updated to match. PR title matches the diff, scope is tight, app2 stays alive as the rollback path (customers re-pin a prior tag), no tests removed or weakened, no hallucinated APIs, no prompt-injection content. CI gate is green.

Confidence

HIGH — Read both source files in full, confirmed no other app2.buildpulse.io references remain, validated the dist/ delta is a benign undici rebuild against the existing lockfile, and verified the action does not import undici-specific surface area in source.