Replace ncc with esbuild

[jeffwidman]

Why this is required

This is a prerequisite for updating the GitHub Actions toolkit dependencies, not just a build-tool cleanup. The next major versions of @actions/core, @actions/github, and @actions/http-client are ESM-only, and the current ncc build cannot package them into a self-contained action reliably.

The migration unblocks these open Dependabot PRs:

• Bump @actions/core from 2.0.2 to 3.0.1 #1671: @actions/core 2.0.2 to 3.0.1
• Bump @actions/http-client from 3.0.1 to 4.0.1 #1672: @actions/http-client 3.0.1 to 4.0.1
• Bump @actions/github from 6.0.1 to 9.1.1 #1674: @actions/github 6.0.1 to 9.1.1
• Bump undici, @actions/http-client and @actions/github #1620: grouped undici, @actions/http-client, and @actions/github updates, including Undici security fixes

Under ncc, those updates currently fail build and runtime checks. For example, the @actions/core update leaves require("@actions/core") unresolved and fails on a clean runner with Cannot find module '@actions/core'. The @actions/github update also causes ncc to fail resolving the package's exported lib/context types. Esbuild understands the newer ESM package exports and still emits the CommonJS bundles required by this Node 24 action.

Benefits

• unblocks current and future ESM-only @actions/* dependency updates, including security-related transitive updates
• reduces committed dist output from 40 files and 17.3 MB to 2 files and 6.5 MB, a roughly 62% reduction
• removes source maps that are not consumed by the action and runtime assets for unsupported Docker SSH, BuildKit, and gRPC capabilities
• replaces two ncc invocations with one copy-and-pasteable esbuild command for both entry points
• makes the supported runtime explicit with --platform=node --target=node24
• keeps bundles unminified so generated failures remain easier to inspect

Implementation

• replace @vercel/ncc with esbuild and bundle both Node 24 action entry points in one command
• switch the action to flat dist/main.js and dist/cleanup.js entry points
• remove ncc-specific source maps, native SSH binaries, protobuf files, and other generated assets
• treat optional .node SSH accelerators as empty because this action supports local Unix Docker sockets, not remote Docker over SSH

Esbuild currently uses its bundled-output default for legal comments (eof), preserving recognized notices inside each JavaScript bundle while OSPO guidance is pending.

Validation

• npm run format-check
• npm run typecheck
• npm run lint-check
• 134 unit tests pass; the local command retains a pre-existing nonzero exit when the Actions environment is absent, reproduced on main
• npm run fetch-images -- bundler && npm run test-integration (17 tests)
• executed both generated bundles through deterministic no-op paths
• clean install reproduces both bundles byte-for-byte
• npm clean-install && npm run package && script/check-diff

[jeffwidman]

These can be safely ignored because they are no longer generated, they're skipped via passing the --loader:.node=empty flag to esbuild

[Copilot]

Pull request overview

Migrates action packaging from ncc to esbuild, enabling future ESM-only GitHub Actions toolkit upgrades.

Changes:

• Builds flat Node 24 bundles with esbuild.
• Updates action entry points and contributor documentation.
• Removes obsolete ncc artifacts, runtime assets, and source maps.

Show a summary per file

File	Description
.gitignore	Removes native-extension exclusions.
README.md	Updates generated-bundle example.
action.yml	Uses flat bundle entry points.
dist/cleanup.js	Adds esbuild cleanup bundle.
dist/cleanup/auth.proto	Removes unused runtime asset.
dist/cleanup/buildkit_status.proto	Removes unused BuildKit asset.
dist/cleanup/index.js	Removes ncc cleanup bundle.
dist/cleanup/index.js.map	Removes cleanup source map.
dist/cleanup/licenses.txt	Removes ncc license aggregation.
dist/cleanup/pagent.exe	Removes SSH helper.
dist/cleanup/proto/channelz.proto	Removes gRPC asset.
dist/cleanup/proto/protoc-gen-validate/LICENSE	Removes generated license asset.
dist/cleanup/proto/protoc-gen-validate/validate/validate.proto	Removes validation schema.
dist/cleanup/proto/xds/LICENSE	Removes generated license asset.
dist/cleanup/proto/xds/xds/data/orca/v3/orca_load_report.proto	Removes ORCA schema.
dist/cleanup/proto/xds/xds/service/orca/v3/orca.proto	Removes ORCA service schema.
dist/cleanup/protoc-gen-validate/LICENSE	Removes duplicate license asset.
dist/cleanup/protoc-gen-validate/validate/validate.proto	Removes duplicate validation schema.
dist/cleanup/sourcemap-register.js	Removes source-map support.
dist/cleanup/xds/LICENSE	Removes duplicate license asset.
dist/cleanup/xds/xds/data/orca/v3/orca_load_report.proto	Removes duplicate ORCA schema.
dist/cleanup/xds/xds/service/orca/v3/orca.proto	Removes duplicate ORCA service schema.
dist/main.js	Adds esbuild main bundle.
dist/main/auth.proto	Removes unused runtime asset.
dist/main/buildkit_status.proto	Removes unused BuildKit asset.
dist/main/index.js	Removes ncc main bundle.
dist/main/index.js.map	Removes main source map.
dist/main/licenses.txt	Removes ncc license aggregation.
dist/main/pagent.exe	Removes SSH helper.
dist/main/proto/channelz.proto	Removes gRPC asset.
dist/main/proto/protoc-gen-validate/LICENSE	Removes generated license asset.
dist/main/proto/protoc-gen-validate/validate/validate.proto	Removes validation schema.
dist/main/proto/xds/LICENSE	Removes generated license asset.
dist/main/proto/xds/xds/data/orca/v3/orca_load_report.proto	Removes ORCA schema.
dist/main/proto/xds/xds/service/orca/v3/orca.proto	Removes ORCA service schema.
dist/main/protoc-gen-validate/LICENSE	Removes duplicate license asset.
dist/main/protoc-gen-validate/validate/validate.proto	Removes duplicate validation schema.
dist/main/sourcemap-register.js	Removes source-map support.
dist/main/xds/LICENSE	Removes duplicate license asset.
dist/main/xds/xds/data/orca/v3/orca_load_report.proto	Removes duplicate ORCA schema.
dist/main/xds/xds/service/orca/v3/orca.proto	Removes duplicate ORCA service schema.
package-lock.json	Locks esbuild dependencies.
package.json	Replaces ncc packaging with esbuild.

Review details

Tip

Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

• Files reviewed: 3/43 changed files
• Comments generated: 1
• Review effort level: Balanced

[jeffwidman]

Yes, I've got an open discussion internally with the licensing team about this. That is expected to be resolved in a few days.

In the meantime, the default is sufficient for now and whatever they tell us will be a fast-follow PR before we cut our next release.

I do not want to block this PR on ☝️ because there's some other additional PR's (like the ones) that are blocked on the migration to esbuild.