chore(deps): bump vite group to v8 and apply migration changes

[Copilot]

Bumps vite 7→8, vite-node 5→6, and vitest 4.0→4.1. Applies the required Vite 8 migration: drops the vite-tsconfig-paths plugin in favour of Vite 8's native tsconfig path resolution.

Changes

• src/vite.common.config.mts — remove vite-tsconfig-paths plugin; add resolve.tsconfigPaths: true
• src/__tests__/vitest.config.ts — same as above for the test config
• package.json — remove vite-tsconfig-paths from devDependencies

- import tsconfigPaths from 'vite-tsconfig-paths'
  
  defineConfig({
+   resolve: { tsconfigPaths: true },
-   plugins: [tsconfigPaths({ root: '..' })],
  })

---

🔒 GitHub Advanced Security automatically protects Copilot coding agent pull requests. You can protect all pull requests by enabling Advanced Security for your repositories. Learn more about Advanced Security.

[arturcic]

@copilot fix the build, using https://vite.dev/guide/migration from v7 to v8 for vite

[Copilot]

Just as a heads up, I was blocked by some firewall rules while working on your feedback. Expand below for details.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• vite.dev
  • Triggering command: /home/REDACTED/work/_temp/ghcca-node/node/bin/node /home/REDACTED/work/_temp/ghcca-node/node/bin/node --enable-source-maps /home/REDACTED/work/_temp/copilot-developer-action-main/dist/index.js (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

[Copilot]

@copilot fix the build, using https://vite.dev/guide/migration from v7 to v8 for vite

Fixed in commit 1e48815.

Vite 8 uses rolldown which changed the chunking behavior: lib.ts (shared between tools/lib and tools/cli entries) gets hoisted to dist/lib.mjs (root of dist/) instead of staying at dist/tools/lib.mjs. This broke the relative dynamic imports:

• './${buildAgent}/agent.mjs' from dist/lib.mjs was resolving to dist/github/agent.mjs (missing)
• Updated to './tools/${buildAgent}/agent.mjs' → correctly resolves to dist/tools/github/agent.mjs
• Same fix for tool runner: './libs/${tool}.mjs' → './tools/libs/${tool}.mjs'

Also added input validation for buildAgent and tool parameters to prevent path traversal.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud