ref: modernize: ESM, Node 24, latest deps, security fix (#105)

* Modernize to ESM, Node 24, and latest deps; mask private key

- Mask private key via core.setSecret() to prevent leaking in error logs
- Convert to native ESM (type: module, nodenext)
- Upgrade action runtime to node24
- Upgrade all deps to latest (octokit 8/22, actions/core 3, TS 5.9, ESLint 10, Jest 30, Prettier 3)
- Migrate ESLint to flat config, remove redundant rules covered by recommendedTypeChecked
- Consolidate config: jest/prettier inline in package.json, remove husky/lint-staged
- Add test suite covering secret masking, scoping, error handling
- Remove unused deps (js-yaml, eslint-config-sentry, eslint-plugin-github)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: joshuarli

.eslintignore

@@ -3,18 +3,21 @@ name: "test"
 on: pull_request
 
 jobs:
-  build: # make sure build/ci work properly
+  build:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
 
-    - uses: actions/setup-node@v4
+    - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
       with:
         cache: yarn
-        node-version: 20
+        node-version: 24
 
     - run: yarn
 
+    - name: test
+      run: yarn test
+
     - name: lint
       run: |
         yarn lint
@@ -31,7 +34,7 @@ jobs:
         private_key: ${{ secrets.INTEGRATION_TEST_APP_PRIVATE_KEY }}
 
     - name: Integration test - checkout private repo
-      uses: actions/checkout@v4
+      uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
       with:
         repository: getsentry/action-github-app-token-test
         token: ${{ steps.my-app.outputs.token }}

.eslintrc.json

@@ -16,5 +16,5 @@ outputs:
   token:
     description: 'Github Token for App installation'
 runs:
-  using: 'node20'
+  using: 'node24'
   main: 'dist/index.js'