v3.0.0

[nanasess]

Highlights

v3.0.0 is a major release that rewrites the action from the ground up. The installation logic is now implemented natively in TypeScript — the legacy shell/PowerShell scripts are no longer on the execution path — and the build toolchain has been hardened against supply-chain attacks.

Native TypeScript rewrite (#446)

The Bash (setup-chromedriver.sh) and PowerShell (setup-chromedriver.ps1) installers have been replaced by a native TypeScript implementation, split into focused modules under src/installer/:

• http.ts — fetchText / fetchJson with curl-like retry/redirect handling
• download.ts — ZIP download & extraction via @actions/tool-cache
• version.ts — Chrome version detection + Chrome-for-Testing JSON resolution with fallback
• unix.ts / windows.ts — platform-specific install (legacy < 115 / modern split)

Behavioral parity is preserved: install locations (/usr/local/bin/chromedriver, C:\SeleniumWebDrivers\ChromeDriver) are unchanged, and PATH resolution via the well-known install directory continues to work without an explicit core.addPath. The legacy shell scripts are retained for one release cycle as an emergency rollback option.

Supply-chain hardening

• Migrated from yarn to pnpm (build: migrate from yarn to pnpm to harden the supply chain #456) — install-time build scripts are blocked by default (allowBuilds), and freshly published versions are held back by a cooldown (minimumReleaseAge).
• All external actions in CI workflows are now pinned to a full commit SHA (chore(ci): 全ワークフローの外部アクションを SHA 固定 #450).

ESM migration (#458, #439)

• The codebase moved from CommonJS to ESM, and @actions/tool-cache was upgraded from 2.x to 4.x.

Security fixes

• Fixed a command-injection vector in Windows version detection (env-passing).
• Fixed cross-drive move failure (EXDEV) on Windows via io.cp.
• Added retry-with-backoff to downloads.
• Overrode qs to 6.15.2 to resolve a DoS advisory (fix(security): override qs to 6.15.2 to fix qs.stringify DoS (GHSA-q8mj-m7cp-5q26) #457, build(deps): bump qs from 6.13.0 to 6.15.2 #444).

Testing

• Container-compatibility tests are now a permanent PR gate (test(ci): add container compatibility test (#32 / #243) #453).
• Added install/smoke tests for legacy ChromeDriver (< 115) (test(ci): add legacy (<115) and version-resolution smoke tests (#229) #454).

---

Breaking Changes

• The action is now a native TypeScript / ESM implementation. The shell/PowerShell scripts are no longer executed (kept only for one-cycle rollback).
• Build/contribution workflow now requires pnpm (corepack enable) instead of yarn.

Note: The Node 24 runtime migration shipped in v2.4.0; there is no runtime change in v3.0.0.

Migration

Update your workflow reference to @v3. SHA pinning is recommended:

- uses: nanasess/setup-chromedriver@v3
# or, pinned:
- uses: nanasess/setup-chromedriver@<full-commit-sha> # v3.0.0

---

What's Changed (since v2.4.0)

• feat: rewrite setup-chromedriver natively in TypeScript by @nanasess in feat: Rewrite in native TypeScript (#159) #446
• build: migrate from yarn to pnpm for supply-chain hardening by @nanasess in build: migrate from yarn to pnpm to harden the supply chain #456
• build: migrate to ESM and update @actions/tool-cache to 4.x by @nanasess in build: migrate to ESM and bump @actions/tool-cache to 4.x #458, build(deps): bump @actions/tool-cache from 2.0.2 to 4.0.0 #439
• fix(security): override qs to 6.15.2 (DoS) by @nanasess in fix(security): override qs to 6.15.2 to fix qs.stringify DoS (GHSA-q8mj-m7cp-5q26) #457, build(deps): bump qs from 6.13.0 to 6.15.2 #444
• chore(ci): pin all external actions to a full commit SHA by @nanasess in chore(ci): 全ワークフローの外部アクションを SHA 固定 #450
• test(ci): make container-compatibility tests a permanent PR gate by @nanasess in test(ci): add container compatibility test (#32 / #243) #453
• test(ci): add legacy ChromeDriver (< 115) install/smoke tests by @nanasess in test(ci): add legacy (<115) and version-resolution smoke tests (#229) #454
• test: add contract tests by @nanasess in Add contract tests for chromedriver setup logic #437
• chore: remove unnecessary version field from package.json by @nanasess in chore: remove unnecessary version field from package.json #460
• fix(ci): remove invalid #sha pin from marketplace URL by @nanasess in fix(ci): marketplace URL の無効な #sha 固定を除去 #451
• chore(ci): update claude-code-action to v1 form by @nanasess in chore(ci): claude-code-action を v1 形式に更新 #448, Add claude GitHub actions 1780183999732 #449
• docs(readme): update examples to @V3 and recommend SHA pinning by @nanasess in docs(readme): update examples to @v3 and recommend SHA pinning #455
• build(deps): dependency bumps by @dependabot in build(deps): bump @actions/github from 6.0.0 to 9.0.0 #438, build(deps-dev): bump jest and @types/jest #440, build(deps-dev): bump prettier from 3.7.4 to 3.8.1 #441, build(deps): bump picomatch from 2.3.1 to 2.3.2 #442, build(deps): bump handlebars from 4.7.8 to 4.7.9 #443, build(deps): bump tmp from 0.2.5 to 0.2.7 #445

---

This discussion was created from the release v3.0.0.