The Great PR

[GrantBirki]

Why this PR exists

This is a large PR, but the goal is simple: move branch-deploy onto a safer, smaller, and easier-to-maintain v12 foundation.

I built and reviewed this foundation as 35 smaller PRs in my fork, then released it as the immutable and attested v12.0.0 release. The PR head now includes a small post-release js-yaml security update. The current upstream main commit is already in this history, so this PR does not undo any upstream work.

What changed

• Converted all project-owned runtime code, tests, and tools from JavaScript to strict TypeScript.
• Reduced the lockfile from 216 package entries to 29 and direct packages from 17 to 8. This removes Vitest, ESLint, Nunjucks, @actions/core, and several smaller packages.
• Added 819 native tests and a 92-scenario acceptance suite that runs the real dist/index.js main and post lifecycle against a strict mock GitHub API. First-party code keeps 100% line, branch, and function coverage.
• Simplified the runtime by splitting prechecks, commands, deployments, locks, templates, and post behavior into smaller typed operations.
• Hardened the supply chain with full-SHA Action pins, exact dependency versions, disabled install scripts, dependency policy tests, build attestations, and a js-yaml 4.3.0 security pin.
• Fully automated releases. A version bump on protected main now verifies the bundle, creates the exact version tag and immutable release, and moves the vMAJOR tag after verification.

Bug fixes

• Correctly handles CI reruns, pagination, duplicate checks, legacy status contexts, and unavailable GitHub data.
• Loads deployment message templates from the exact trusted workflow commit and replaces Nunjucks with a small safe renderer.
• Rechecks mutable refs before deployment and stops when a branch moves or GitHub creates a deployment for the wrong SHA.
• Makes lock creation atomic and idempotent while keeping old lock files compatible.
• Correctly reads the latest deployment history and enforced deployment order, including malformed or incomplete API responses.
• Fixes several smaller issues with unlock failures, lock cleanup, labels, reactions, and untrusted log values.

Migration guide

v12 includes some breaking changes. The v11 to v12 upgrade guide explains them and includes a ready-to-use prompt for coding agents.

I know this is a lot to review, and I am happy to walk through any part of it or split review by area.

[Copilot]

Copilot wasn't able to review this pull request because it exceeds the maximum number of lines (20,000). Try reducing the number of changed lines and requesting a review from Copilot again.

[GrantBirki]

cc: @nobe4 as my merge buddy ❤️

[nobe4]

@GrantBirki can you explain why you replaced @github/core with your custom implementation?

[GrantBirki]

I replaced @actions/core as part of my efforts to reduce the dependency graph of this project (see here GrantBirki#13). This project only consumes ten small functions from it, so replacing that with a 153-line stdlib adapter helped to reduce deps. I left in deps like @actions/http-client which would have been too extreme to roll into this project.