test: import-includes-smoke cannot detect a broken @actions/core import (cited as #3547 proof) #3561

Summary

PR #3547's verification cites tests/js/import-includes-smoke.test.js as the regression guard ("On 3.0.1 the old import fails the smoke test; the new one passes"). That claim is false: the test passes identically with the broken import form.

Root cause

The test reads each file as text and regex-matches import specifiers, then keeps only targets starting with ./ or ../. @actions/core is a bare specifier, so it is never examined. The test never imports or executes the module under test, so it cannot observe an ESM named-export failure.

Reproduction (executed 2026-09-24, Node v24.21.0, @actions/core 3.0.1)

npm ci --ignore-scripts
npm install --no-save --ignore-scripts @actions/core@3.0.1
# revert scripts/agents/labeling.agent.js to the pre-#3547 default import
git show 16a1c4565d^:scripts/agents/labeling.agent.js > scripts/agents/labeling.agent.js
npx jest --config .jest.config.cjs tests/js/import-includes-smoke.test.js
# => Test Suites: 1 passed, 10 tests passed
node -e "import('./scripts/agents/labeling.agent.js').catch(e=>console.log(e.message))"
# => The requested module '@actions/core' does not provide an export named 'default'

The suite reports 10/10 green while the module it names is un-loadable.

Impact

#3503 (Dependabot @actions/core 3.0.1) was blocked by exactly this crash. Nothing in the repository currently fails if the import form regresses, so the same block can recur on the next major bump.

Recommended remediation

Add a guard that actually loads the modules, e.g. a test that dynamically imports each agent file and asserts the ESM namespace members exist (core.getInput, core.info, core.error, core.warning, core.summary, core.setFailed, core.startGroup, core.endGroup). Optionally also assert no bare import x from"@actions/..." default imports remain for ESM-only packages.

Acceptance

• A deliberately reverted import form makes the suite fail (mutation-proven, not just source-inspected)
• Guard runs in the existing npm run test:js gate — no new workflow needed