fix(build): swap Vite for tsup to fix DOMParser ReferenceError

[docker-agent]

Problem

The Setup credentials step was failing in production with:

ReferenceError: DOMParser is not defined

Failing run: https://github.com/docker/cagent-action/actions/runs/25329159765/job/74257978215

Root cause

Vite (the previous bundler) was resolving the AWS SDK's browser export condition instead of the node one. The Smithy XML codec used by @aws-sdk/client-secrets-manager contains a reference to DOMParser — a browser-only global that does not exist in Node.js. Because the action runs as a composite GHA step (node dist/credentials.js) with no node_modules, the bundled output was shipping browser code into a pure Node runtime.

Fix

Swap Vite → tsup with explicit Node targeting:

• platform: 'node' — tells esbuild to resolve the node export condition from every package
• target: 'node24' — matches the GHA runner Node version; enables modern JS output
• noExternal: [/.*/] — bundles all npm deps (required; action has no node_modules at runtime)
• splitting: false / format: 'esm' — single-file ESM bundles per entry point
• Entry points auto-discovered: src/*/index.ts → dist/credentials.js + dist/signed-commit.js

Also bump @aws-sdk/client-secrets-manager 3.787.0 → 3.972.0 to align with the @aws-sdk/credential-provider-web-identity 3.972.x family already in the lockfile, so all SDK packages share a single Smithy runtime instance and avoid version-mismatch issues.

vite.config.ts is deleted; its Vitest configuration is extracted into the new vitest.config.ts.

Verification

• ✅ pnpm build — tsup v8.5.1, builds dist/credentials.js (1.99 MB) + dist/signed-commit.js (148 KB) cleanly
• ✅ 30/30 unit tests pass (pnpm test)
• ✅ 0 DOMParser references in dist output
• ✅ pnpm typecheck + biome ci pass

cc @derekmisler

[docker-agent]

cc @derekmisler — ready for review when you are

[docker-agent]

Assessment: 🟢 APPROVE

The Vite → tsup migration correctly resolves the DOMParser is not defined ReferenceError. Setting platform: 'node' forces esbuild to resolve the Node.js export conditions in AWS SDK packages (preventing the browser DOMParser-using Smithy XML codec from being bundled), and noExternal: [/.*/] correctly ensures all npm dependencies are self-contained in the output for a GHA environment without node_modules.

Key verifications performed:

• noExternal: [/.*/] + platform: 'node' is safe: esbuild unconditionally keeps all Node.js built-ins (including node:-prefixed forms) external at the esbuild core layer — noExternal only affects tsup's externalizeDepsPlugin layer and cannot override esbuild's built-in exclusion. ✅
• Vitest config extraction to vitest.config.ts is complete and functionally equivalent. ✅
• tsconfig.json exclude list correctly swapped vite.config.ts for tsup.config.ts and vitest.config.ts. ✅
• @aws-sdk/client-secrets-manager bump to 3.972.0 is consistent with the lockfile. ✅

Minor notes (no action required):

• splitting: false with two entry points means each output file is fully self-contained, which the PR description acknowledges. The AWS SDK will be present in both dist/credentials.js and dist/signed-commit.js even though the latter doesn't use it. This is an intentional trade-off for simplicity and self-containment.
• There is a minor patch-level version skew between the direct @aws-sdk/credential-provider-web-identity@3.972.29 and the transitive @3.972.0 pulled by client-secrets-manager. Both patch versions will be bundled, which is harmless for correctness given the minor patch delta.

No bugs found in the changed code.

[derekmisler]

/review

[docker-agent]

Assessment: 🟢 APPROVE

The fix is correct and well-structured. The root cause (Vite resolving AWS SDK browser exports instead of Node exports) is accurately diagnosed, and the tsup configuration directly addresses it:

• platform: 'node' ensures esbuild selects the node export condition from every package, preventing browser-only globals like DOMParser from entering the bundle
• noExternal: [/.*/] correctly bundles all dependencies so the action works without node_modules at runtime
• splitting: false + format: 'esm' produces self-contained per-entry-point ESM files
• The outExtension: () => ({ js: '.js' }) preserves the .js suffix expected by the composite action's node dist/credentials.js invocation
• Extracting Vitest config to its own vitest.config.ts is a clean separation; no test regressions
• AWS SDK version alignment to 3.972.0 across all packages avoids Smithy runtime version-mismatch issues

No bugs found in the changed code.