[WIP] feat!: upgrade to Node.js 24, refresh security dependencies, SHA-pin GitHub Actions, and make backports strategy-independent and conflict-safe

[chandler-solo]

Summary

This PR modernizes and secures the GitHub Cherry Pick Action by upgrading its runtime to Node.js 24, refreshing its dependency stack, pinning every GitHub Actions dependency to an immutable commit SHA, and correcting several issues discovered during a repository-wide code review.

The backport implementation has also been redesigned so it reliably handles pull requests merged through merge commits, squash merges, or rebase merges. Conflicting or empty backports now fail safely without committing unresolved files or pushing partial results.

Motivation

The existing implementation had several correctness and security problems:

• The action attempted to pass || true as arguments to git cherry-pick; @actions/exec does not invoke a shell, so these were treated as invalid Git arguments.
• The generated branch name included the complete author identity, producing invalid branch names containing spaces and angle brackets.
• Backporting merge_commit_sha did not work consistently across GitHub merge strategies.
• Cherry-pick failures were ignored, after which every working-tree file was staged and committed. This could commit unresolved conflict markers.
• Author and committer fields were crossed, and some configured identity fields were ignored.
• The action token was used for GitHub API calls but not Git fetch and push operations.
• The team-reviewers metadata name did not match the input name read by the implementation.
• Workflow permissions were incomplete.
• The Dependabot labeling workflow could not reliably write labels when triggered by Dependabot pull requests.
• Tests mocked every Git command as successful and did not verify the generated commands.
• CI rebuilt the bundled action but did not detect an uncommitted dist/index.js.
• Several metadata and README examples were incomplete or inaccurate.

Runtime and dependency modernization

• Upgrade the action runtime in action.yml to Node.js 24.
• Require Node.js 24 or newer through the package engine declaration.
• Configure CI and publishing workflows to use Node.js 24.
• Refresh production and development dependencies to current compatible releases.
• Keep Node type definitions aligned with the Node.js 24 runtime.
• Retain the latest compatible TypeScript and ESLint versions where newer majors are not yet supported by the surrounding toolchain.
• Regenerate package-lock.json.
• Rebuild the checked-in dist/index.js bundle.

Backport correctness

• Require a merged pull-request event before attempting a backport.

• Validate the source, target, and generated branch names with git check-ref-format.

• Replace the invalid author-based default branch with:

  cherry-pick-{sanitized target branch}-{source PR number}

• Fetch the target branch, source base branch, and pull-request head explicitly.

• Detect shallow checkouts and unshallow the repository when required.

• Generate the complete binary pull-request diff from the event’s base SHA to the pull-request head.

• Apply the diff with git apply --3way --index.

• Preserve binary changes and full object identifiers in generated patches.

• Refuse to continue when the pull request is empty, already applied, or cannot be merged cleanly.

• Create one non-interactive backport commit containing the complete pull-request change set.

• Use the configured author name and email as the Git author.

• Use the configured committer name and email as the Git committer.

• Use --force-with-lease instead of an unconditional force push.

• Fetch an existing backport branch before using force-with-lease.

This makes the backport behavior independent of whether the source PR was merged with a merge commit, squash merge, or rebase merge.

Authentication and API handling

• Use the action’s token input for both Git operations and GitHub API requests.
• Mark the token and derived Git authorization values as secrets.
• Store Git identity and authentication configuration locally instead of modifying global runner configuration.
• Correctly read the hyphenated team-reviewers input.
• Parse boolean inputs through the Actions toolkit’s strict boolean parser.
• Reject malformed repository context instead of returning an undefined pull-request response.
• Replace every title and body template placeholder, not only the first occurrence.
• Deduplicate inherited and explicitly configured labels without mutating input arrays.
• Skip the source PR author when requesting reviewers.
• Combine user and team reviewer requests into one API operation.
• Avoid logging untrusted pull-request titles and bodies.

Workflow and supply-chain hardening

• Pin every GitHub Action used by repository workflows to a full 40-character commit SHA.
• Retain version comments beside SHA pins for maintainability.
• Add explicit read-only permissions to the test workflow.
• Add the required contents: write permission to the publishing workflow.
• Add explicit label and pull-request read permissions to the label verification workflow.
• Remove the Dependabot autolabel workflow, whose token could be read-only for Dependabot-authored pull requests.
• Configure Dependabot itself to apply the maintenance label.
• Add a generated-bundle check so CI detects when dist/index.js is not committed after a source change.
• Ensure lint and aggregate verification scripts do not silently rewrite repository files.

Metadata and documentation

• Declare the action’s data, number, and html_url outputs.
• Correct the inverted inherit_labels description.
• Document the new conflict-safe aggregate-diff behavior.
• Document required workflow permissions.
• Document token forwarding for Git and API operations.
• Correct the output example’s YAML structure.
• Document fork and pull_request_target security considerations.
• Explain the approval behavior of pull requests created with GITHUB_TOKEN.
• Correct package name, description, keywords, and repository metadata.

Test coverage

The test suite now verifies:

• Exact Git argument ordering
• Valid default branch generation
• Custom branch handling
• Hyphenated team-reviewer input handling
• Force-with-lease behavior
• Patch data being forwarded through standard input
• Correct author and committer identities
• Safe failure when a patch cannot be applied
• Refusal to process unmerged pull requests
• Strict boolean parsing
• Array input parsing
• Branch-component sanitization
• Author identity validation
• Pull-request title and body template replacement
• Label inheritance and deduplication
• Input immutability
• Assignee handling
• Reviewer filtering
• Invalid repository context handling

Breaking and operational changes

• Node.js 24 is now required.
• The default backport branch naming convention has changed.
• Backport conflicts now fail the action instead of creating a potentially invalid pull request.
• force: true now uses force-with-lease.
• Workflows using the default token must grant contents: write, pull-requests: write, and issues: write when all optional PR configuration features are used.
• Consumers requiring automatically started downstream workflows may need a GitHub App token or personal access token.

Validation

Validated under Node.js v24.19.0:

• npm ci
• 3 test suites and 12 tests passing
• TypeScript type-check
• ESLint, including source and tests
• Prettier format check
• NCC production bundle generation
• Bundled JavaScript syntax check
• GitHub Actions workflow validation with actionlint
• Complete dependency-tree validation
• Full and production-only npm security audits
• git diff --check

Both npm audits report zero known vulnerabilities.

[github-actions]

This pull request does not contain a valid label. Please add one of the following labels: bug, enhancement, maintenance