[quality] dist/index.js self-containment is unguarded — a leaked external require() passes the bundle suite #265

Finding

action.yml runs dist/index.js directly (runs.main), on a runner that never installs node_modules. Every package the action imports therefore has to be inlined by ncc build. Nothing in the test suite guards that invariant:

• __tests__/bundle/bundle.test.ts → is a syntactically valid bundle with no unresolved modules asserts only that node --check passes and that the bundle has no webpackMissingModule marker. That marker is emitted when ncc cannot resolve a module at build time. A module that is resolved but left external (ncc build -e <pkg>, a future webpack externals entry, or a dependency ncc decides not to inline) is emitted as a literal require("<pkg>") and trips neither check.
• __tests__/bundle/runBundle.ts spawns the bundle with no cwd, i.e. from the repository root, where node_modules/ exists. A leaked require("js-yaml") resolves fine there, so every end-to-end case in the bundle suite stays green — and the action breaks only on a real runner with Cannot find module 'js-yaml'.

Verified on main @ c48bd6d: appending require("js-yaml") to dist/index.js leaves npx vitest run __tests__/bundle fully green. Today the bundle is clean — all 35 require() specifiers in dist/index.js are Node built-ins (fs, node:http, …) and @actions/core, @actions/github, @octokit/rest, js-yaml all appear as inlined node_modules/<pkg>/ modules — so this is a regression-risk finding, not a coverage gap.

Unit evidence (provenance): npm ci && npx vitest run --coverage on main @ c48bd6d, Node v26.10.0 → 69 files / 1447 tests, All files | 99.83 | 98.35 | 100 | 99.82. End-to-end evidence: the bundle suite is the e2e source and, per #235, emits no coverage data; this finding does not depend on it.

Recommendation

Add __tests__/bundle/selfContained.test.ts (new file, so it stays clear of the held PRs that edit bundle.test.ts) asserting:

• every require(<literal>) specifier in dist/index.js satisfies node:module's isBuiltin
• every bare package imported by src/**/*.ts appears in the bundle as an inlined node_modules/<pkg>/ module (this covers js-yaml, which is a runtime import declared under devDependencies, see [quality] dependabot PRs bumping ncc-bundled deps always fail the dist/ gate — add a repack-dist job to test.yml #171)

Mutation check: with require("js-yaml") appended to the bundle the first assertion fails with expected [ 'js-yaml' ] to deeply equal [].

Priority

• Impact: medium — a leaked external ships a bundle that is green in CI and fails on every consumer's first run
• Effort: low

Filed by quality agent (hold-gated mode)

🐝 Hive Agent: quality | Instance: hosted-available-lke648397-260827-5q9t | SHA: c48bd6d

— hive: agent=quality backend=copilot model=claude-fable-5.1 copilot=1.0.88