fix: modernize dependencies and lock GitHub Actions

.github/workflows/actions.lock

@@ -0,0 +1,46 @@
+# This file is machine-generated by `gh actions-lock`.
+# Do not edit by hand; run `gh actions-lock` to update.
+# Docs: https://gh.io/actions-lockfile
+version: 'v0.0.3'
+workflows:
+    '.github/workflows/build.yml':
+        - 'actions/checkout@v7.0.1'
+        - 'actions/download-artifact@v8.0.2'
+        - 'actions/setup-node@v7.1.0'
+        - 'actions/upload-artifact@v7.0.2'
+        - 'pnpm/action-setup@v6.1.1'
+    '.github/workflows/release.yml':
+        - 'actions/checkout@v7.0.1'
+        - 'actions/download-artifact@v8.0.2'
+        - 'googleapis/release-please-action@v5.0.0'
+dependencies:
+    'actions/checkout@v7.0.1':
+        ref: 'v7.0.1'
+        commit: 'sha1-3d3c42e5aac5ba805825da76410c181273ba90b1'
+        owner_id: 44036562
+        repo_id: 197814629
+    'actions/download-artifact@v8.0.2':
+        ref: 'v8.0.2'
+        commit: 'sha1-9000827ccba6bdab643e8b6fd33ac0654aef8333'
+        owner_id: 44036562
+        repo_id: 192626254
+    'actions/setup-node@v7.1.0':
+        ref: 'v7.1.0'
+        commit: 'sha1-949feb2413d6458794dcd2491c4babbbce0c15c1'
+        owner_id: 44036562
+        repo_id: 189476904
+    'actions/upload-artifact@v7.0.2':
+        ref: 'v7.0.2'
+        commit: 'sha1-cf430e030ddbb5b0abf93d22962f4752f3646cd9'
+        owner_id: 44036562
+        repo_id: 192625955
+    'googleapis/release-please-action@v5.0.0':
+        ref: 'v5.0.0'
+        commit: 'sha1-45996ed1f6d02564a971a2fa1b5860e934307cf7'
+        owner_id: 16785467
+        repo_id: 262236530
+    'pnpm/action-setup@v6.1.1':
+        ref: 'v6.1.1'
+        commit: 'sha1-73e46992e05b19abd31f2f3c20e0e7370d762115'
+        owner_id: 21320719
+        repo_id: 262289747

.github/workflows/build.yml

@@ -10,9 +10,9 @@ jobs:
   build:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: pnpm/action-setup@v3
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@v7.0.1
+      - uses: pnpm/action-setup@v6.1.1
+      - uses: actions/setup-node@v7.1.0
         with:
           node-version-file: 'package.json'
           cache: 'pnpm'
@@ -21,7 +21,7 @@ jobs:
       - run: pnpm test
       - run: pnpm build
       - run: pnpm package
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v7.0.2
         with:
           name: dist
           path: ./dist/
@@ -33,7 +33,7 @@ jobs:
         os: [ubuntu, macos, windows]
     runs-on: ${{ matrix.os }}-latest
     steps:
-      - uses: actions/download-artifact@v4
+      - uses: actions/download-artifact@v8.0.2
         with:
           name: dist
       - name: "Install default channel on ${{ matrix.os }}"

.github/workflows/release.yml

@@ -12,15 +12,15 @@ jobs:
     runs-on: ubuntu-latest
     needs: [build]
     steps:
-      - uses: google-github-actions/release-please-action@v4
+      - uses: googleapis/release-please-action@v5.0.0
         id: release
 
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7.0.1
         with:
           fetch-depth: 0
           ref: 'latest'
         if: ${{ steps.release.outputs.release_created }}
-      - uses: actions/download-artifact@v4
+      - uses: actions/download-artifact@v8.0.2
         with:
           name: dist
         if: ${{ steps.release.outputs.release_created }}

AGENTS.md

@@ -58,3 +58,9 @@ Tests live in `__test__/` and use [Vitest](https://vitest.dev/).
 - **Conventional Commits** are required for all commits (`feat:`, `fix:`, `chore:`, etc.).
 - **Never commit `dist/`** — it is built by CI and deployed to the `latest` branch on release.
 - The `action.yml` `main` field points to `index.js` inside `dist/`, not the TypeScript source.
+
+## GitHub Actions lockfile
+
+Workflow dependencies are tracked in `.github/workflows/actions.lock`. After changing any workflow action reference, run `gh actions-lock` and commit the updated workflows and lockfile together. Install the CLI extension with `gh extension install github/gh-actions-lock --pin v0.4.1` if needed.
+
+Run `gh actions-lock --verify-local` for an offline coverage check and `gh actions-lock --verify` to verify upstream references.

__test__/edge_api.test.ts

@@ -35,6 +35,49 @@ describe("EdgeUpdatesProduct", () => {
   });
 
   describe("getReleaseByPlatform", () => {
+    it("skips matching releases without an installer artifact", async () => {
+      const content = await fs.promises.readFile(
+        path.join(import.meta.dirname, "./testdata.json"),
+        "utf-8",
+      );
+      const data = JSON.parse(content);
+      const stable = data.find(
+        (product: { Product: string }) => product.Product === "Stable",
+      );
+      const mac = stable.Releases.find(
+        (release: { Platform: string }) => release.Platform === "MacOS",
+      );
+      stable.Releases = [
+        { ...mac, Architecture: "universal", Artifacts: [] },
+        { ...mac, Architecture: "universal" },
+      ];
+
+      const release = new EdgeUpdates(data)
+        .getProduct("stable")
+        ?.getReleaseByPlatform({ os: "darwin", arch: "arm64" });
+
+      expect(release?.getPreferredArtifact()?.ArtifactName).toBe("pkg");
+    });
+
+    it("returns undefined when matching releases have no installer artifact", async () => {
+      const content = await fs.promises.readFile(
+        path.join(import.meta.dirname, "./testdata.json"),
+        "utf-8",
+      );
+      const data = JSON.parse(content);
+      for (const product of data) {
+        for (const release of product.Releases) {
+          release.Artifacts = [];
+        }
+      }
+
+      expect(
+        new EdgeUpdates(data)
+          .getProduct("stable")
+          ?.getReleaseByPlatform({ os: "darwin", arch: "amd64" }),
+      ).toBeUndefined();
+    });
+
     it("returns the release by platform", async () => {
       const product = updates?.getProduct("stable");
       const release = product?.getReleaseByPlatform({

biome.json

@@ -1,11 +1,19 @@
 {
   "files": {
-    "includes": ["**", "!package.json", "!__test__/*.json", "!dist"]
+    "includes": [
+      "**",
+      "!package.json",
+      "!__test__/*.json",
+      "!!**/dist",
+      "!**/*.md",
+      "!**/*.yml",
+      "!**/*.yaml"
+    ]
   },
   "linter": {
     "enabled": true,
     "rules": {
-      "recommended": true,
+      "preset": "recommended",
       "complexity": {
         "useLiteralKeys": "off"
       },

package.json

@@ -4,7 +4,7 @@
   "description": "Set up your GitHub Actions workflow with a specific version of edge",
   "type": "module",
   "main": "dist/index.js",
-  "packageManager": "pnpm@8.7.5",
+  "packageManager": "pnpm@10.34.9",
   "engines": {
     "node": ">=24.0.0"
   },
@@ -16,11 +16,11 @@
     "@actions/tool-cache": "^4.0.0"
   },
   "devDependencies": {
-    "@biomejs/biome": "^2.4.14",
-    "@types/node": "^25.6.0",
-    "@vercel/ncc": "^0.38.4",
+    "@biomejs/biome": "^2.6.4",
+    "@types/node": "^26.6.6",
+    "@vercel/ncc": "^0.45.0",
     "typescript": "^6.0.3",
-    "vitest": "^4.1.5"
+    "vitest": "^5.1.0"
   },
   "scripts": {
     "build": "ncc build src/index.ts",