chore!: migrate to ESM, adopt node24 runtime, roll up open Dependabot PRs

Summary:
=======
Three Dependabot PRs (#108, #114, #120) were all stuck on a red `check-dist`
because Dependabot only edits `package.json` / `package-lock.json` and never
rebuilds the checked-in `dist/` bundle. #108 was additionally red on `units`:
`@actions/core` 3.0.0 is ESM-only and its `exports` map declares no `require`
condition, so `require("@actions/core")` fails outright with
`ERR_PACKAGE_PATH_NOT_EXPORTED` on any Node version. Taking that bump therefore
required converting the action from CommonJS to ESM, which pairs naturally with
moving the published runtime to node24.

Two latent CI defects surfaced while verifying the above and are fixed here:

- `node-version-file: package.json` never resolved, because the manifest had no
  `engines.node`. setup-node logged "Could not determine node version ...
  Falling back" and silently built `dist/` on the runner's Node 22, so CI was
  not exercising the runtime the action declares.
- The `check-dist` comparison used `git diff`, which cannot see files the build
  newly adds. ncc 0.44 emits `dist/package.json` and renames
  `sourcemap-register.js` to `.cjs`; without the untracked-file check, shipping
  the action with a missing `sourcemap-register.cjs` would have passed CI and
  failed at runtime.

Actions:
=======
- Convert `index.js` and `find-python-projects.js` to ESM named exports and set
  `"type": "module"`.
- Rewrite the test suite to mock via `jest.unstable_mockModule`, since frozen
  ESM namespaces cannot be patched by `jest.spyOn`; run jest under
  `--experimental-vm-modules`. All 12 tests and 4 snapshots pass unchanged,
  confirming the migration is behavior-neutral.
- Bump `@actions/core` to ^3.0.1 (#108) and `@vercel/ncc` to ^0.44.0 (#114).
- Apply the npm_and_yarn security group (#120): brace-expansion 1.1.12 -> 1.1.18
  and 2.1.0 -> 2.1.4, flatted 3.3.3 -> 3.4.4, undici 5.29.0 -> 6.28.0.
- Set `runs.using` to node24 in `action.yml` and add `engines.node: ^24.0.0` so
  `node-version-file: package.json` resolves.
- Add setup-node to the `units` job so unit tests run on the same pinned Node.
- Harden the `check-dist` comparison to also fail on untracked files in `dist/`.
- Repair `npm run lint`, broken since the eslint 10 bump: the flat config
  imported `globals`, `@eslint/js` and `@eslint/eslintrc`, none of which were
  declared and which eslint 10 no longer provides transitively. Declare
  `globals` and `@eslint/js`, and drop the `FlatCompat`/eslintrc shim in favor
  of `js.configs.recommended`.
- Rebuild `dist/`; add `dist/package.json` and `dist/sourcemap-register.cjs`,
  remove the now-stale `dist/sourcemap-register.js`.

BREAKING CHANGE: the action now runs on the node24 runtime and its sources are
ESM. Consumers referencing the action by tag are unaffected, but GitHub Actions
runners must support `runs.using: node24`.

ai-generated: true

Author: BrandonLWhite

.github/workflows/check-dist.yml

@@ -37,9 +37,16 @@ jobs:
 
       - name: Compare the expected and actual dist/ directories
         run: |
-          if [ "$(git diff --ignore-space-at-eol dist/ | wc -l)" -gt "0" ]; then
+          # `git diff` alone can't see files the build newly added, so check for
+          # untracked files in dist/ too.
+          untracked="$(git ls-files --others --exclude-standard -- dist/)"
+          changed="$(git diff --ignore-space-at-eol -- dist/)"
+          if [ -n "$untracked" ] || [ -n "$changed" ]; then
             echo "Detected uncommitted changes after build.  See status below:"
-            git diff
+            if [ -n "$untracked" ]; then
+              printf 'Untracked files in dist/:\n%s\n' "$untracked"
+            fi
+            git diff -- dist/
             exit 1
           fi
         id: diff

.github/workflows/test.yml

@@ -12,6 +12,13 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - uses: actions/checkout@v7
+
+    - name: Setup Node.js
+      uses: actions/setup-node@v7.0.0
+      with:
+        node-version-file: package.json
+        cache: npm
+
     - run: npm ci
     - run: npm test
 

action.yml

@@ -49,5 +49,5 @@ outputs:
     description: JSON array of all found projects (`project` object) that implement a `package` command
 
 runs:
-  using: "node20"
+  using: "node24"
   main: "dist/index.js"

determine-skips.test.js

@@ -1,4 +1,6 @@
-const { determineSkips } = require("./find-python-projects.js");
+import { describe, it, expect } from "@jest/globals";
+
+import { determineSkips } from "./find-python-projects.js";
 
 describe("determineSkips", () => {
   const GLOBAL_KEY = "__GLOBAL__";