[aiqiaoy]

The latest version of @actions/http-client, @actions/core and @actions/github packages are ESM only. We need to migrate checkout to ESM so we can update our dependencies to get the security fixes.

Mostly followed actions/upload-artifact#762

[Copilot]

Pull request overview

This PR migrates the actions/checkout TypeScript codebase and build/test tooling to ESM so it can consume newer ESM-only @actions/* packages (and related dependency updates) for security fixes.

Changes:

• Switch TypeScript compilation to NodeNext/ESM and update internal relative imports to use .js specifiers.
• Update build/test tooling for ESM (ncc entrypoint, Jest ESM config, updated tests/mocks).
• Bump @actions/* (and transitive Octokit) dependencies and refresh generated .licenses metadata.

Show a summary per file

File	Description
tsconfig.json	Moves TS compiler output to NodeNext/ESM settings and updates exclusions.
package.json	Declares ESM module type, updates build/test scripts, bumps dependencies, and requires Node >=24.
package-lock.json	Locks updated dependency graph for the ESM-only toolkit/Octokit updates.
jest.config.ts	Adds Jest configuration compatible with ESM + ts-jest.
jest.config.js	Removes CommonJS Jest config replaced by TS/ESM config.
dist/package.json	Ensures dist/ is treated as ESM for the bundled runtime output.
src/main.ts	Updates entrypoint for ESM and adjusts problem matcher registration/unregistration.
src/misc/generate-docs.ts	Replaces __dirname usage with import.meta.url-based resolution for ESM.
src/git-source-provider.ts	Updates internal imports for ESM .js specifiers.
src/git-auth-helper.ts	Updates internal imports for ESM .js specifiers.
src/git-command-manager.ts	Updates internal imports for ESM .js specifiers.
src/git-directory-helper.ts	Updates internal imports for ESM .js specifiers.
src/github-api-helper.ts	Updates internal imports for ESM .js specifiers.
src/input-helper.ts	Updates internal imports for ESM .js specifiers.
src/ref-helper.ts	Updates internal imports for ESM .js specifiers.
src/unsafe-pr-checkout-helper.ts	Updates internal imports for ESM .js specifiers.
src/url-helper.ts	Updates internal imports for ESM .js specifiers.
test/url-helper.test.ts	Updates test imports for ESM and uses ESM-friendly Jest globals.
test/unsafe-pr-checkout-helper.test.ts	Migrates mocking to jest.unstable_mockModule + dynamic imports for ESM.
test/retry-helper.test.ts	Migrates mocking to jest.unstable_mockModule + dynamic imports for ESM.
test/ref-helper.test.ts	Migrates mocking to jest.unstable_mockModule + dynamic imports for ESM.
test/input-helper.test.ts	Migrates mocking to jest.unstable_mockModule + dynamic imports for ESM.
test/github-api-helper.test.ts	Migrates mocking to jest.unstable_mockModule + dynamic imports for ESM.
test/git-version.test.ts	Updates test imports for ESM .js specifiers.
test/git-directory-helper.test.ts	Fixes __dirname usage for ESM and updates mocking approach.
test/git-command-manager.test.ts	Migrates mocking to jest.unstable_mockModule + dynamic imports for ESM.
test/git-auth-helper.test.ts	Fixes __dirname usage for ESM and updates mocking approach.
.licenses/npm/@actions/core.dep.yml	Updates licensed metadata for bumped @actions/core.
.licenses/npm/@actions/exec.dep.yml	Updates licensed metadata for bumped @actions/exec.
.licenses/npm/@actions/github.dep.yml	Updates licensed metadata for bumped @actions/github.
.licenses/npm/@actions/io.dep.yml	Updates licensed metadata for bumped @actions/io.
.licenses/npm/@actions/tool-cache.dep.yml	Updates licensed metadata for bumped @actions/tool-cache.
.licenses/npm/@actions/http-client-3.0.2.dep.yml	Updates licensed metadata for @actions/http-client (transitive).
.licenses/npm/@actions/http-client-4.0.1.dep.yml	Adds licensed metadata for @actions/http-client (direct).
.licenses/npm/@octokit/auth-token.dep.yml	Updates licensed metadata for bumped Octokit dependencies.
.licenses/npm/@octokit/core.dep.yml	Updates licensed metadata for bumped Octokit dependencies.
.licenses/npm/@octokit/endpoint.dep.yml	Updates licensed metadata for bumped Octokit dependencies.
.licenses/npm/@octokit/graphql.dep.yml	Updates licensed metadata for bumped Octokit dependencies.
.licenses/npm/@octokit/openapi-types.dep.yml	Updates licensed metadata for bumped Octokit dependencies.
.licenses/npm/@octokit/openapi-types-22.1.0.dep.yml	Removes outdated licensed metadata entry no longer present.
.licenses/npm/@octokit/plugin-paginate-rest.dep.yml	Updates licensed metadata for bumped Octokit dependencies.
.licenses/npm/@octokit/plugin-rest-endpoint-methods.dep.yml	Updates licensed metadata for bumped Octokit dependencies.
.licenses/npm/@octokit/request.dep.yml	Updates licensed metadata for bumped Octokit dependencies.
.licenses/npm/@octokit/request-error.dep.yml	Updates licensed metadata for bumped Octokit dependencies.
.licenses/npm/@octokit/types.dep.yml	Updates licensed metadata for bumped Octokit dependencies.
.licenses/npm/@octokit/types-13.4.1.dep.yml	Removes outdated licensed metadata entry no longer present.
.licenses/npm/before-after-hook.dep.yml	Updates licensed metadata for bumped transitive dependency.
.licenses/npm/content-type.dep.yml	Adds licensed metadata for new transitive dependency.
.licenses/npm/deprecation.dep.yml	Removes outdated licensed metadata entry no longer present.
.licenses/npm/json-with-bigint.dep.yml	Updates licensed metadata for new/updated transitive dependency.
.licenses/npm/once.dep.yml	Removes outdated licensed metadata entry no longer present.
.licenses/npm/semver.dep.yml	Updates licensed metadata for bumped transitive dependency.
.licenses/npm/undici.dep.yml	Updates licensed metadata for bumped transitive dependency.
.licenses/npm/universal-user-agent.dep.yml	Updates licensed metadata for bumped transitive dependency.
.licenses/npm/wrappy.dep.yml	Removes outdated licensed metadata entry no longer present.

Copilot's findings

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Comments suppressed due to low confidence (1)

.licenses/npm/@actions/http-client-3.0.2.dep.yml:7

• This dependency license entry uses license: other, but the repo’s .licensed.yml allowlist includes SPDX IDs like mit/isc and does not include other. This will likely cause npm run licensed-check to fail even though the embedded license text is clearly MIT. Consider changing the license identifier to mit (or otherwise aligning it with the allowlist).

• Files reviewed: 51/56 changed files
• Comments generated: 1