chore(gha): migrate action bundler to esbuild

[macalbert]

Summary

Updates TypeScript to 7.0.2 and replaces the GitHub Action tooling that is incompatible with TypeScript 7.

The action remains a single committed bundle, with TypeScript preserving type checking and decorator metadata before esbuild packages the compiled output.

Changes

• Replace @vercel/ncc with esbuild for the GitHub Action bundle.
• Replace ts-node with tsx in direct TypeScript execution paths.
• Regenerate github-action/dist/index.js and update the dependency lockfile.
• Document the bundler decision and update related contributor guidance.

Testing

• pnpm build:gha, pnpm verify:gha, and the GitHub Action bundle smoke check locally
• pnpm lint, the website build, the CDK build, and focused GHA and website tests locally
• GitHub Actions CI
• CodeRabbit review

Related

#422

Summary by CodeRabbit

• Changed
  • GitHub Actions are now bundled with esbuild into a single optimized, minified output targeting Node.js 22.
  • Local TypeScript execution for development, installation, and CDK commands now uses tsx.
• Documentation
  • Updated architecture records, changelogs, and setup guidance to reflect the revised bundling and development workflow.
• Tests
  • End-to-end test setup now uses the updated TypeScript execution workflow.

[gemini-code-assist]

Caution

The consumer version of Gemini Code Assist on GitHub has been sunset. All code review activity has officially ceased.

[coderabbitai]

Warning

Review limit reached

@macalbert, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 12 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 1c8c1434-24d3-48ef-b08e-66fad9c658b8

📥 Commits

Reviewing files that changed from the base of the PR and between 8558eb4 and fc4abe4.

⛔ Files ignored due to path filters (1)

• github-action/action.yml is excluded by none and included by none

📒 Files selected for processing (3)

• docs/adr/0010-github-action-bundler.md
• docs/changelogs/gha.md
• scripts/README.md

Walkthrough

The pull request replaces GitHub Action bundling with esbuild, adds its build runner and ADR, and migrates local TypeScript execution from ts-node to tsx across scripts, CDK configuration, dependencies, tests, and documentation.

Changes

GitHub Action build tooling

Layer / File(s)	Summary
Esbuild bundling workflow docs/adr/0006-monorepo-structure.md, docs/adr/0010-github-action-bundler.md, scripts/build-github-action.mjs, scripts/README.md, docs/changelogs/gha.md	Documents and implements Node 22 ESM bundling with esbuild, producing a minified github-action/dist/index.js bundle with createRequire support.
Tsx execution migration src/iac/package.json, src/iac/cdk.json, scripts/pack-and-install.ts, e2e/cli.test.ts, scripts/README.md	Replaces ts-node with tsx for CDK execution, package installation, E2E setup, and related command documentation.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

• macalbert/envilder#454: Contains corresponding GitHub Action bundler and TypeScript tooling changes.
• macalbert/envilder#38: Also updates the documented local pack-and-install workflow in scripts/README.md.

Suggested labels: github-actions, dependencies

Suggested reviewers: copilot

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title clearly summarizes the main change: migrating the GitHub Action bundler to esbuild.
Description check	✅ Passed	The description covers the PR summary, key changes, testing, and related issue, though it omits some template sections.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/typescript-7-esbuild-ci

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[Copilot]

Pull request overview

This PR updates the GitHub Action bundling workflow to stay compatible with TypeScript 7.0.2, replacing the previous @vercel/ncc + ts-node setup with an esbuild-based bundling step and tsx for direct TypeScript execution across development tooling (including CDK and local install scripts).

Changes:

• Switch the GHA bundle pipeline from @vercel/ncc to esbuild (after tsc) and update root scripts accordingly.
• Replace ts-node execution paths with tsx (CDK app, local install script, E2E harness).
• Update documentation/ADRs and the GHA changelog entry to reflect the bundler/tooling decision; bump workspace TypeScript catalog to ^7.0.2.

Reviewed changes

Copilot reviewed 15 out of 17 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
package.json	Updates build:gha to run tsc then esbuild; replaces ts-node usage with tsx; adds esbuild dev dependency.
pnpm-workspace.yaml	Bumps catalog TypeScript to ^7.0.2 and replaces ts-node catalog entry with tsx.
pnpm-lock.yaml	Lockfile refresh reflecting TypeScript 7, removal of @vercel/ncc/ts-node, and addition of esbuild.
scripts/build-github-action.mjs	New esbuild bundling script that produces github-action/dist/index.js.
scripts/pack-and-install.ts	Switches the script shebang for TypeScript execution under tsx.
scripts/README.md	Updates contributor documentation to reflect tsx usage and esbuild bundling.
src/iac/package.json	Replaces ts-node devDependency with tsx for IaC package tooling.
src/iac/cdk.json	Updates CDK app execution from ts-node to pnpm exec tsx.
e2e/cli.test.ts	Updates E2E setup to run the pack/install script via pnpm exec tsx.
docs/changelogs/gha.md	Adds unreleased changelog entry describing esbuild bundling + tsx migration.
docs/adr/0010-github-action-bundler.md	Adds an ADR documenting the decision to bundle with esbuild and switch to tsx.
docs/adr/0006-monorepo-structure.md	Updates monorepo ADR table to reflect esbuild bundling for the GHA component.
CONTRIBUTING.md	Updates contributor docs to reference esbuild for pnpm build:gha.
.github/skills/common-security/SKILL.md	Updates internal security guidance to reflect esbuild bundling for GHA.
.github/copilot-instructions.md	Updates Copilot repo instructions to reflect esbuild bundling for GHA.

Files not reviewed (1)

• pnpm-lock.yaml: Generated file

[Copilot]

Pull request overview

Copilot reviewed 15 out of 17 changed files in this pull request and generated 2 comments.

Files not reviewed (1)

• pnpm-lock.yaml: Generated file

Comments suppressed due to low confidence (1)

scripts/README.md:25

• This usage example still says npm run build, but local:install now runs pnpm build && tsx … (root package.json). The “Behind the scene it runs” block is no longer accurate and mixes package managers; update it to match the actual scripts.

```bash
npm run build 
pnpm exec tsx scripts/pack-and-install.ts

</details>