bump @actions/core from 1.10.1 to 3.0.0 in /snapshoty/run

[dependabot]

Bumps @actions/core from 1.10.1 to 3.0.0.

Since @actions/core 3.0.0 is now a pure ESM package, the following additional changes were required to make the action fully functional:

• Converted index.js from CommonJS (require) to ESM (import) syntax
• Added "type": "module" to package.json
• Fixed an implicit global variable in a for...of loop
• Rebuilt dist/index.js using ncc in ESM mode

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

[github-actions]

Dependency Update Analysis

Summary: actions/core was updated from 1.10.1 to 3.0.0 in snapshoty/run (npm, direct production dependency). Overall risk: high due to a confirmed breaking runtime/build incompatibility (ESM-only package consumed via CommonJS require).

actions/core 1.10.1 → 3.0.0

Ecosystem: npm / Node

Check	Result
Breaking changes	⚠️ Found — actions/core 3.0.0 is ESM-only; CommonJS consumers must use dynamic import()
Testable in PR	⚠️ No evidence of PR workflow coverage for snapshoty/run in this repo

Changelog highlights (v1.10.1 → v3.0.0)

• Release notes state a breaking change in 3.0.0: ESM-only.
• Intermediate major updates include Node 24 alignment and dependency bumps (actions/http-client, actions/exec).
• No explicit CVE IDs / GHSA advisories are listed in release notes for this range.
• Transitive security-relevant surface changed (newer HTTP stack including undici), but that does not offset the immediate module-format break.

Usage in this repository

snapshoty/run/index.js uses CommonJS import and core APIs:

• snapshoty/run/index.js:1 → const core = require('@actions/core');
• snapshoty/run/index.js:7-12 → core.getInput(...)
• snapshoty/run/index.js:30 and :40 → core.setSecret(...)
• snapshoty/run/index.js:52 → core.isDebug()
• snapshoty/run/index.js:59 → core.setFailed(...)

The action is configured as a Node action (snapshoty/run/action.yml:23-24, using: 'node24', main: 'dist/index.js').

Compatibility assessment (CVE-focused)

• Verified incompatibility: local install/build for snapshoty/run fails after this bump during ncc build with:
  • Package path . is not exported from package ... node_modules/@actions/core``
• Root cause: repository code still uses CommonJS require('@actions/core'), while v3 is ESM-only.
• CVE-focused view:
  • No release-note CVE/GHSA entries were identified for this update.
  • Internal dependency shifts may preserve or slightly improve baseline HTTP security posture.
  • Practical risk here is a functional availability regression (action packaging/runtime break), not an exploitable-security reduction in this repo.

Risk conclusion: high.

Labels Applied

No labels applied. oblt-aw/ai/merge-ready criteria are not met (overall risk is high and breaking change affects current repository usage).

Note

🔒 Integrity filtering filtered 1 item

Integrity filtering activated and filtered the following item during workflow execution.
This happens when a tool call accesses a resource that does not meet the required integrity or secrecy level of the workflow.

• pr:bump @actions/core from 1.10.1 to 3.0.0 in /snapshoty/run #522 (pull_request_read: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".)

---

What is this? | From workflow: Observability Agentic Workflow Entrypoint

Give us feedback! React with 🚀 if perfect, 👍 if helpful, 👎 if not.

[v1v]

@copilot review if the changes will be enough for the snapshoty/run action

[Copilot]

@copilot review if the changes will be enough for the snapshoty/run action

The original dependency bump (package.json + package-lock.json) wasn't enough — @actions/core 3.0.0 is a pure ESM package, which means:

1. The old require('@actions/core') CJS syntax would fail at runtime
2. ncc couldn't bundle it when building the dist/index.js

Fixed in commit 7cc8f9a with:

• Converted index.js to use ESM (import instead of require)
• Added "type": "module" to package.json
• Fixed an implicit global variable in a for...of loop
• Rebuilt dist/index.js using ncc in ESM mode (the bundled dist grew from ~63kB to ~490kB, reflecting the new @actions/core 3.0.0 dependencies)

[github-actions]

Dependency Update Analysis

Summary: @actions/core was upgraded from 1.10.1 to 3.0.0 in snapshoty/run with required ESM migration changes; overall PR risk is moderate due to a major-version runtime dependency bump that is not exercised by any PR-triggered workflow in this repository.

@actions/core 1.10.1 → 3.0.0

Ecosystem: npm / Node (GitHub Action runtime dependency)

Check	Result
Breaking changes	⚠️ Found — upstream marks 3.0.0 as ESM-only (packages/core/RELEASES.md)
Testable in PR	⚠️ No — no workflow references ./snapshoty/run or elastic/oblt-actions/snapshoty/run; no-test.yml covers this path with "No test to run"

Changelog highlights (v1.10.1 → v3.0.0)

• @actions/core 3.0.0 introduces a breaking change: ESM-only packaging.
• PR adapts accordingly:
  • Converts snapshoty/run/index.js from require to import.
  • Adds "type": "module" in snapshoty/run/package.json and bundled dist/package.json.
  • Rebuilds dist/index.js.
• Transitive lockfile shifts relevant to behavior/security:
  • @actions/http-client 2.1.0 → 4.0.0 (via @actions/core).
  • undici added at 6.24.1.
  • uuid removed from this dependency path.

Usage in this repository

• Runtime usage in this action is limited to:
  • core.getInput(...)
  • core.setSecret(...)
  • core.isDebug()
  • core.setFailed(...)
• Source file: snapshoty/run/index.js.
• No in-repo workflow uses this action path directly (./snapshoty/run) for PR validation.
• The action is primarily consumed externally (documented in snapshoty/run/README.md as elastic/oblt-actions/snapshoty/run@v1).

Compatibility assessment (including CVE/security focus)

• Direct compatibility:
  • The ESM migration in this PR matches the upstream breaking change and aligns with action runtime node24 (snapshoty/run/action.yml), so the direct @actions/core upgrade is structurally compatible.
• CVE/advisory-related findings:
  • @actions/core release notes for 3.0.0 do not list CVE/GHSA items.
  • Transitive undici path includes a security release: v6.23.0 fixed GHSA-g9mf-h72j-4rw9 / CVE-2026-22036 (unbounded content-encoding chain leading to CPU/memory DoS). Lockfile resolves to undici 6.24.1, which includes that fix lineage.
• Internal implementation changes affecting exposure:
  • HTTP internals move through newer @actions/http-client/undici stack. This generally reduces exposure to the known undici decompression-chain DoS class compared to vulnerable ranges.
  • For this repo’s current usage (getInput, setSecret, isDebug, setFailed), no direct HTTP client API is called, so vulnerable surface is limited in this action’s code path.
• Potential regressions / new attack surface:
  • Main regression vector is ESM module loading/tooling assumptions (already addressed in this PR).
  • No new authn/authz, crypto/TLS, or deserialization logic is introduced in this action code itself.
  • Residual risk remains because this path is not PR-validated in-repo.

Overall risk level: moderate (major upgrade + untestable production-facing action path in PR context).

Labels Applied

No labels applied. oblt-aw/ai/merge-ready was not applied because the updated runtime dependency path is not testable in PR context and has production impact.

---

What is this? | From workflow: Observability Agentic Workflow Entrypoint

Give us feedback! React with 🚀 if perfect, 👍 if helpful, 👎 if not.

[dependabot]

A newer version of @​actions/core exists, but since this PR has been edited by someone other than Dependabot I haven't updated it. You'll get a PR for the updated version as normal once this PR is merged.