deps: resolve 36 of 37 open Dependabot alerts

.github/dependabot.yml

@@ -1,9 +1,13 @@
 version: 2
 updates:
+  # cooldown applies to version updates only, never to security updates, so
+  # vulnerability patches are still delivered immediately.
   - package-ecosystem: github-actions
     directory: /
     schedule:
       interval: weekly
+    cooldown:
+      default-days: 7
     groups:
       actions-minor:
         update-types:
@@ -14,6 +18,8 @@ updates:
     directory: /
     schedule:
       interval: weekly
+    cooldown:
+      default-days: 7
     groups:
       npm-development:
         dependency-type: development

.github/linters/zizmor.yaml

@@ -0,0 +1,19 @@
+# zizmor configuration, used by super-linter's GITHUB_ACTIONS_ZIZMOR linter.
+#
+# unpinned-uses: as of zizmor v1.20.0 the default policy requires every
+# action to be pinned to a full commit SHA. This repository only consumes
+# actions from GitHub's own `actions` and `github` organizations and from
+# super-linter, all of which are tag-pinned today and tracked by Dependabot
+# (see .github/dependabot.yml). Allowing symbolic (tag) references for those
+# three owners restores zizmor's own pre-v1.20.0 default behavior.
+#
+# Any owner not listed below falls back to zizmor's implicit '*': hash-pin
+# rule, so a new third-party action must be pinned to a SHA or this audit
+# fails the build. Tighten an entry to `hash-pin` to require SHAs again.
+rules:
+  unpinned-uses:
+    config:
+      policies:
+        'actions/*': ref-pin
+        'github/*': ref-pin
+        'super-linter/super-linter/*': ref-pin

.github/workflows/check-dist.yml

@@ -33,6 +33,8 @@ jobs:
       - name: Checkout
         id: checkout
         uses: actions/checkout@v4
+        with:
+          persist-credentials: false
 
       - name: Setup Node.js
         id: setup-node

.github/workflows/ci.yml

@@ -20,6 +20,8 @@ jobs:
       - name: Checkout
         id: checkout
         uses: actions/checkout@v4
+        with:
+          persist-credentials: false
 
       - name: Setup Node.js
         id: setup-node
@@ -52,6 +54,8 @@ jobs:
       - name: Checkout
         id: checkout
         uses: actions/checkout@v4
+        with:
+          persist-credentials: false
 
       - name: Test Local Action
         id: test-action
@@ -60,6 +64,10 @@ jobs:
           baseName: myregistry/myimage
 
       - name: 'Print Output: imageName'
-        run: echo "${{ steps.test-action.outputs.imageName }}"
+        env:
+          IMAGE_NAME: ${{ steps.test-action.outputs.imageName }}
+        run: echo "$IMAGE_NAME"
       - name: 'Print Output: tag'
-        run: echo "${{ steps.test-action.outputs.tag }}"
+        env:
+          TAG: ${{ steps.test-action.outputs.tag }}
+        run: echo "$TAG"

.github/workflows/codeql-analysis.yml

@@ -41,6 +41,8 @@ jobs:
     steps:
       - name: Checkout repository
         uses: actions/checkout@v4
+        with:
+          persist-credentials: false
 
       # Initializes the CodeQL tools for scanning.
       - name: Initialize CodeQL

.github/workflows/linter.yml

@@ -24,6 +24,7 @@ jobs:
         uses: actions/checkout@v4
         with:
           fetch-depth: 0
+          persist-credentials: false
 
       - name: Setup Node.js
         id: setup-node
@@ -38,11 +39,18 @@ jobs:
 
       - name: Lint Codebase
         id: super-linter
-        uses: super-linter/super-linter/slim@v6
+        uses: super-linter/super-linter/slim@v8
         env:
           DEFAULT_BRANCH: main
           FILTER_REGEX_EXCLUDE: dist/**/*
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          JAVASCRIPT_DEFAULT_STYLE: prettier
           VALIDATE_ALL_CODEBASE: true
+          # Biome is new in super-linter v8 and duplicates the JavaScript
+          # toolchain this repo already uses. Its defaults (double quotes,
+          # semicolons, tabs) are the exact inverse of .prettierrc.json, so
+          # Biome and Prettier cannot both be satisfied. super-linter warns
+          # about this conflict and recommends keeping only one of the pair.
+          # Prettier/ESLint remain enabled here and in ci.yml.
+          VALIDATE_BIOME_FORMAT: false
+          VALIDATE_BIOME_LINT: false
           VALIDATE_JSCPD: false

__tests__/main.test.js

@@ -5,7 +5,7 @@ const core = require('@actions/core')
 const main = require('../src/main')
 
 // Mock the GitHub Actions core library
-const debugMock = jest.spyOn(core, 'debug').mockImplementation()
+jest.spyOn(core, 'debug').mockImplementation()
 const getInputMock = jest.spyOn(core, 'getInput').mockImplementation()
 const setFailedMock = jest.spyOn(core, 'setFailed').mockImplementation()
 const setOutputMock = jest.spyOn(core, 'setOutput').mockImplementation()

babel.config.js

@@ -0,0 +1,14 @@
+/**
+ * Babel configuration used by babel-jest.
+ *
+ * Several transitive dependencies of @actions/github (the @octokit/* packages,
+ * universal-user-agent and before-after-hook) are published as ESM only. Jest 29
+ * loads modules through its own CommonJS registry, so those files must be
+ * transpiled to CommonJS before they can be required from the tests. The
+ * matching allowlist lives in the jest.transformIgnorePatterns entry in
+ * package.json. The published action itself is unaffected: it runs the ncc
+ * bundle in dist/, which resolves these modules at build time.
+ */
+module.exports = {
+  presets: [['@babel/preset-env', { targets: { node: 'current' } }]]
+}