Migrate to TypeScript, add reproducible Nix setup

.github/workflows/ci.yaml

@@ -22,3 +22,16 @@ jobs:
         run: git config --global core.autocrlf false
       - uses: actions/checkout@v7
       - uses: ./.
+  dist:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+      - uses: cachix/install-nix-action@v31
+      - name: Build dist/ with Nix
+        run: nix build
+      - name: Check that committed dist/ is up to date
+        run: |
+          if ! diff -r dist result/dist; then
+            echo "::error::dist/ is out of date. Run 'nix build' and commit the result."
+            exit 1
+          fi

.gitignore

@@ -1,4 +1,5 @@
 node_modules/
+lib/
 packages/*/node_modules/
 packages/*/lib/
 packages/*/__tests__/_temp/

CHANGELOG.md

@@ -1,3 +1,15 @@
+## Unpublished
+
+* Rewrote the action in TypeScript (`src/index.ts`), bundled into
+  `dist/index.js` with `ncc`. No change in behavior or inputs.
+* Added a reproducible build with Nix (`flake.nix`): `nix build` produces the
+  bundled `dist/` hermetically, and `nix develop` provides a pinned Node.js
+  dev shell. CI now verifies that the committed `dist/` matches a fresh build.
+* Updated the `@actions/*` dependencies to their current major versions. As
+  a side effect, `@actions/tool-cache` 2.x pulls in `undici`, which
+  increases the size of the bundled `dist/index.js`. This does not affect
+  the action's runtime performance.
+
 ## Ormolu action v20
 
 * Switch to the new official upstream of the project and default to the

README.md

@@ -60,9 +60,41 @@ jobs:
 Here, the `build` job depends on `ormolu` and will not run unless `ormolu`
 passes.
 
+## Development
+
+The action is written in TypeScript (`src/index.ts`) and bundled into a
+single JavaScript file (`dist/index.js`) with [`ncc`][ncc]. The `dist/`
+directory is committed to the repository because the GitHub Actions runner
+executes the bundled output directly.
+
+The build is reproducible with [Nix][nix] (flakes must be enabled):
+
+```shell
+# Enter a dev shell with a pinned Node.js and build the bundle:
+$ nix develop
+$ npm ci
+$ npm run prepare
+
+# Or produce the bundle hermetically without a dev shell:
+$ nix build   # result/dist/ contains the bundle
+```
+
+Whenever you change `src/` or the dependencies, rebuild and commit the
+updated `dist/`. CI verifies that the committed `dist/` matches a fresh
+`nix build`.
+
+If you change dependencies (`package.json` / `package-lock.json`), the
+`npmDepsHash` in `flake.nix` must be updated. Recompute it with:
+
+```shell
+$ nix run nixpkgs#prefetch-npm-deps -- package-lock.json
+```
+
 [ormolu]: https://github.com/mrkkrp/ormolu
 [multiple-patterns-example]: https://github.com/haskell-actions/run-ormolu/blob/master/action.yml#L9-L11
 [git-core-autocrlf]: https://www.git-scm.com/docs/git-config#Documentation/git-config.txt-coreautocrlf
+[ncc]: https://github.com/vercel/ncc
+[nix]: https://nixos.org/
 
 ## Example which commits the formatted files: