Add bundler validation to prevent mixing Node.js and GitHub Script runtime modes

[Copilot]

The bundler was allowing scripts with incompatible runtime APIs to be bundled together, causing runtime failures when Node.js-only APIs like execSync were used in GitHub Script contexts or vice versa.

Changes

• Runtime mode detection (bundler_validation.go)

  • validateNoRuntimeMixing() - Validates all required files use compatible runtime APIs
  • detectRuntimeMode() - Detects Node.js-only APIs (execSync, spawnSync) vs GitHub Script APIs (core.*, github.*)
  • Recursively checks transitive dependencies

• Bundler integration (bundler.go)

  • Added validation call in BundleJavaScriptWithMode() before bundling starts
  • Fails fast with actionable error message on conflict

• Test coverage (bundler_runtime_mode_test.go)

  • 5 test cases covering cross-runtime conflicts, compatible helpers, and transitive dependencies
  • Fixed existing test using child_process to use Node.js mode

Example

// helper.cjs (Node.js-only)
const { execSync } = require('child_process');
function runCommand(cmd) {
  return execSync(cmd).toString();
}

// main.cjs (GitHub Script mode) - now caught at compile time
const { runCommand } = require('./helper.cjs');
core.info(runCommand('ls'));  // ❌ Error: runtime mode conflict

Error message:

runtime mode conflict: script requires 'helper.cjs' which is a nodejs script, 
but the main script is compiled for github-script mode.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• https://api.github.com/user
  • Triggering command: /usr/bin/gh gh api user --jq .login tags/v5 g/gateway/gateway_test.go ache/go/1.25.0/x64/pkg/tool/linu--systemd-cgroup GOINSECURE GOMOD GOMODCACHE ache/go/1.25.0/x64/pkg/tool/linux_amd64/compile -c it/ref/tags/v5 GOPROXY 1715067/b351=> GOSUMDB GOWORK 64/pkg/tool/linu"mcp-server-playwright" --help sh (http block)
  • Triggering command: /usr/bin/gh gh api user --jq .login .git GOPROXY (http block)
  • Triggering command: /usr/bin/gh gh api user --jq .login 40/add_labels.js x_amd64/asm 1ccd0cd1a20d3a3bf5b6236ffb3d5bcd6cd/log.json c4de662e6b74d780gh sh 64/pkg/tool/linuuser 1715067/b358/par--jq 1/x6�� t0 ../../**/*.json 1/x64/bin/node --ignore-path /dev/null 64/pkg/tool/linumoby /opt/hostedtoolc-address (http block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

Original prompt

Add validation in bundler that script from different runtimes are not mixed (nodejs vs github-script). Fail if conflict is found

---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.