migrate reviewer to agentic platform - phase 1

[derekmisler]

Related Issues

Closes: https://github.com/docker/gordon/issues/416

Summary

Migrate the build system from Rollup to Vite and consolidate action artifacts into a single dist/ directory at the root level. This phase 1 migration prepares the codebase for integration with the agentic platform by simplifying the build pipeline, reducing dependencies, and centralizing built artifacts.

Changes

• Build toolchain: Replaced Rollup with Vite 6.4.2 in package.json and removed all Rollup-related plugins (@rollup/plugin-commonjs, @rollup/plugin-json, @rollup/plugin-node-resolve, @rollup/plugin-typescript, rollup-plugin-node-externals)
• Build output structure: Consolidated setup-credentials and signed-commit artifacts into a single dist/ root directory (dist/credentials.js and dist/signed-commit.js)
• Action entrypoints: Updated .github/actions/setup-credentials/action.yml to reference ../../../dist/credentials.js instead of the local dist/ subdirectory
• Workflow updates: Modified .github/workflows/release.yml, update-consumers.yml, and update-docker-agent-version.yml to:
  • Use centralized dist/ file checks instead of per-action directory checks
  • Reference $GITHUB_WORKSPACE/dist/signed-commit.js and $GITHUB_WORKSPACE/dist/credentials.js for signed commit CLI invocation
  • Updated comments to reflect the new structure ("credentials and signed-commit" instead of "setup-credentials and signed-commit")
• Test configuration: Updated package.json test scripts to use Vitest project-based configuration (--project unit and --project integration)
• Development dependencies: Updated biome.json to simplify the organizeImports action configuration

Test plan

• Run pnpm build to verify Vite builds both credential and signed-commit modules into dist/
• Run pnpm test and pnpm test:integration to verify test suite runs with new Vitest project configuration
• Run pnpm lint and pnpm actionlint to verify code quality checks pass
• Verify release workflow passes validation checks for the new dist/ structure on next release

[derekmisler]

/review

[docker-agent]

Assessment: 🟡 NEEDS ATTENTION

Migration: Rollup → Vite, file reorganization into src/credentials/ and src/signed-commit/

One medium-severity finding surfaced (verification was inconclusive — presenting raw finding for author review).

[derekmisler]

/review

[docker-agent]

Assessment: 🟢 APPROVE

This PR migrates the credential and signed-commit modules from action-local dist/ directories (.github/actions/*/dist/) to a centralized dist/ at the repository root, switches the build toolchain from Rollup to Vite, and consolidates the Vitest config into vite.config.ts.

Changes reviewed:

• action.yml: path updated to ../../../dist/credentials.js ✅ correct relative depth (3 levels up from .github/actions/setup-credentials/)
• release.yml / update-docker-agent-version.yml: path replacements only — logic unchanged ✅
• vite.config.ts (new): auto-discovery of src/<name>/index.ts entries, correct external pattern covering both node: prefixed and bare built-in modules, inlineDynamicImports: false correctly set for multi-entry builds ✅
• package.json: clean swap of Rollup plugins for Vite; vitest run integration correctly uses Vitest's filter argument ✅
• tsconfig.json: updated exclude list to match new file layout ✅
• All credential and signed-commit source files: pure renames (similarity index 100%) with no content changes — existing logic preserved ✅

No bugs found in the added code.

[derekmisler]

this feels weird, sure, but once everything moves to TS, this whole action isn't needed anymore, so it's only temporary.

[derekmisler]

this line here is the primary motivation for this PR, to get all of the .js files in a single directory at the root of the repo.

[docker-agent]

Assessment: 🟢 APPROVE

This PR cleanly migrates the build system from Rollup to Vite and consolidates the action artifacts into a unified dist/ directory. No bugs were found in the changed code.

What was reviewed:

• vite.config.ts: Auto-discovery of entry points via src/<name>/index.ts is correct; defineConfig from vitest/config is the right import for a combined Vite+Vitest config; external modules cover both node:-prefixed and bare builtin names correctly; inlineDynamicImports: false with multiple entries is safe since the release workflow uses find dist/ -type f which includes any generated chunks.
• action.yml: Path ../../../dist/credentials.js correctly resolves to dist/credentials.js at repo root, matching Vite's [name].js output for the credentials entry.
• Workflow changes: All references to $GITHUB_WORKSPACE/dist/signed-commit.js and $GITHUB_WORKSPACE/dist/credentials.js are correct; replacing CAGENT_DIR=$(pwd) with $GITHUB_WORKSPACE is actually more robust (survives directory changes in the step).
• tsconfig.json: Correctly excludes vite.config.ts in place of the deleted vitest.config.ts.
• Test config consolidation: Vitest project names (unit, integration) match the --project flags in package.json scripts.