This repository was archived by the owner on Sep 30, 2026. It is now read-only.
Repository navigation
Ship standalone Action bundle and validate API event artifacts - #1
Merged
Merged
Conversation
schchit
marked this pull request as ready for review
September 13, 2026 02:35
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Ship standalone Action bundle and validate API event artifacts.
Ship the executable dependencies required by action.yml.
Changes
The build emits a committed ncc bundle and third-party licenses, with a lockfile. RFC 8785 key ordering handles numeric-looking property names. Artifacts are schema checked. D/T/V require explicit what_json; event_ref is separate from the Git ref. Unknown modes and unsuccessful API validation fail the action. Informational JAC metadata is not marked critical without a handler.
Validation
npm ci --ignore-scripts npm run build npm testCompatibility and remaining limits
Artifact mode remains explicitly unsigned and level 0. README examples use main because the advertised v0.6.0 tag does not exist; after merge, pin a reviewed commit or release. No release tag or package publication is performed. The schema copy is synchronized with the accompanying jep-v06 conformance repair.
Follow-up hardening
The schema matches the companion conformance repair. API requests have a 30-second timeout; returned events must satisfy the structural schema and match the reported hash. The integration harness executes a copied standalone bundle outside node_modules. Action results in artifact mode remain explicitly unsigned Level 0.
Shared event schema SHA-256:
5d0527c1649bd49f0de632e660eff46096522ea76a49eb7104ac83522614059f.Verification for this revision
5 Node tests, TypeScript build, and the copied standalone bundle against the real local API passed.
The companion cross-repository harness passed all 12 SDK J/D/T/V checks, 8 Python/TypeScript reference-validator checks, the packaged Action API path, and API restart/replay persistence. No merge or package publication is included.
CI and dependency follow-up
A clean checkout rebuild replaces symlink-dependent webpack module IDs. The runtime is now Node 24 with pinned patched Actions dependencies, an ESM bundle at dist/index.mjs, and an ESM-aware build script. npm audit --omit=dev reports zero vulnerabilities (the previous lockfile reported 1 high and 8 moderate). Unit tests and the standalone copied bundle/API restart integration pass. The bundle consistency gate is retained, and CI also exercises actual artifact upload.