fix, test, chore: runtime bug fixes, Vitest migration, and ESLint v10 upgrade (#219)

## Bug Fixes

- **Missing `await` on email send** (`src/main.ts`) —
`sendAlertsToEmailSmtp()` was fire-and-forget, silently dropping email
failures
- **Unsafe `alerts[0]` access** (`slack.ts`, `microsoft-teams.ts`,
`zenduty.ts`) — added early return guard in each destination so they are
safe to call independently
- **Unsafe `references[0]` access** (`src/entities/advisory.ts`) —
replaced with optional chaining (`references?.[0]?.url ?? ''`) to handle
advisories with no references
- **No HTTP error handling** (`src/utils/request/index.ts`) — fetch
wrapper now throws on non-OK responses, surfacing 4xx/5xx failures
instead of silently succeeding
- **`parseInt` missing radix** (`src/main.ts`) — added `, 10` to both
calls to prevent potential octal interpretation
- **Floating promise** (`src/main.ts`) — added `void` to the top-level
`run()` call to satisfy `no-floating-promises`

## Test Coverage

- Migrated from Jest + ts-jest to **Vitest** (`jest.config.js` removed,
`vitest.config.ts` added, `test` script updated)
- Added tests for all previously untested modules:
- `src/entities/` — `toAdvisory`, `toVulnerability`,
`toRepositoryAlert`, `toOrgAlert`, `toEnterpriseAlert`,
`getFullRepositoryNameFromAlert`
- `src/fetch-alerts.ts` — repo, org, and enterprise alert fetching,
ecosystem filtering, count passthrough
- `src/destinations/` — Slack (including `validateSlackWebhookUrl`),
PagerDuty, Zenduty, Email
- Mock data in entity and fetch-alert tests typed with
`DependabotAlert`, `DependabotOrgAlert`, `DependabotEnterpriseAlert`
from `@octokit/types` — no `as any`
- Test files moved to a top-level `tests/` directory mirroring `src/`
structure to keep source files uncluttered

## ESLint Upgrade

- Upgraded `@kunalnagarco/eslint-config` from v2.2.0 to v3.0.5
- Upgraded ESLint from v8 to v10 with flat config format
(`eslint.config.mjs`)
- Removed: `@typescript-eslint/eslint-plugin`,
`@typescript-eslint/parser`, `eslint-config-airbnb`,
`eslint-config-airbnb-typescript`, `eslint-plugin-import`,
`eslint-plugin-jsx-a11y`, `eslint-plugin-react`, `.eslintrc`,
`.eslintignore`
- Added: `@eslint/js`, `typescript-eslint`, `eslint-plugin-import-x`,
`eslint-import-resolver-typescript`

## Test plan

- [x] `yarn test` — all 48 tests pass
- [x] `yarn build` — TypeScript compiles cleanly
- [x] `yarn lint` — no lint errors
- [ ] Trigger the action with an SMTP destination and verify email
failures surface as action failures
- [ ] Trigger against a repo with no open alerts and confirm no crash on
`alerts[0]`

Author: kunalnagar

.eslintignore

@@ -0,0 +1,42 @@
+import configPkg from '@kunalnagarco/eslint-config'
+import tseslint from 'typescript-eslint'
+import { createTypeScriptImportResolver } from 'eslint-import-resolver-typescript'
+
+const config = configPkg.default ?? configPkg
+
+export default tseslint.config(
+  { ignores: ['dist/**', 'lib/**', 'node_modules/**'] },
+  ...config,
+  {
+    languageOptions: {
+      parserOptions: {
+        project: true,
+      },
+    },
+    settings: {
+      jest: { version: 29 },
+      'import-x': {
+        resolver: createTypeScriptImportResolver(),
+      },
+    },
+    rules: {
+      'import-x/prefer-default-export': 'off',
+      'import-x/no-cycle': 'off',
+      'import-x/no-extraneous-dependencies': [
+        'error',
+        { devDependencies: ['tests/**/*.test.ts', 'vitest.config.ts'] },
+      ],
+    },
+  },
+  {
+    files: ['tests/**/*.test.ts'],
+    rules: {
+      '@typescript-eslint/no-explicit-any': 'off',
+      '@typescript-eslint/no-unsafe-argument': 'off',
+      '@typescript-eslint/no-unsafe-assignment': 'off',
+      '@typescript-eslint/no-unsafe-member-access': 'off',
+      '@typescript-eslint/no-unsafe-return': 'off',
+      '@typescript-eslint/no-unsafe-call': 'off',
+    },
+  },
+)

.eslintrc

@@ -30,7 +30,7 @@
     "lint": "eslint src/**/*.ts",
     "lint:fix": "eslint --fix src/**/*.ts",
     "package": "ncc build --source-map --license licenses.txt",
-    "test": "jest",
+    "test": "vitest run",
     "all": "yarn build && yarn format && yarn lint && yarn package && yarn test",
     "release": "semantic-release"
   },
@@ -56,36 +56,31 @@
     "nodemailer": "8.0.4"
   },
   "devDependencies": {
-    "@kunalnagarco/eslint-config": "2.2.0",
+    "@eslint/js": "^10.0.1",
+    "@kunalnagarco/eslint-config": "3.0.5",
     "@semantic-release/changelog": "6.0.3",
     "@semantic-release/commit-analyzer": "13.0.1",
     "@semantic-release/git": "10.0.1",
     "@semantic-release/github": "10.3.5",
     "@semantic-release/release-notes-generator": "14.0.3",
-    "@types/jest": "29.5.14",
     "@types/node": "20.19.39",
     "@types/nodemailer": "6.4.23",
-    "@typescript-eslint/eslint-plugin": "^7.18.0",
-    "@typescript-eslint/parser": "^7.18.0",
     "@vercel/ncc": "0.38.4",
     "conventional-changelog-conventionalcommits": "7.0.2",
-    "eslint": "^8.57.0",
-    "eslint-config-airbnb": "^19.0.4",
-    "eslint-config-airbnb-typescript": "^18.0.0",
+    "eslint": "^10.2.0",
     "eslint-config-prettier": "^9.1.0",
-    "eslint-plugin-import": "^2.29.1",
-    "eslint-plugin-jest": "^28.8.0",
-    "eslint-plugin-jsx-a11y": "^6.9.0",
-    "eslint-plugin-react": "^7.35.0",
+    "eslint-import-resolver-typescript": "^4.4.4",
+    "eslint-plugin-import-x": "^4.16.2",
+    "eslint-plugin-jest": "^29.15.2",
     "husky": "9.1.7",
-    "jest": "29.7.0",
     "lint-staged": "15.5.2",
     "prettier": "3.7.3",
     "semantic-release": "23.1.1",
     "sort-package-json": "2.10.0",
     "swiper": "^12.0.0",
-    "ts-jest": "29.2.4",
-    "typescript": "5.5.4"
+    "typescript": "5.5.4",
+    "typescript-eslint": "^8.58.1",
+    "vitest": "^4.1.4"
   },
   "packageManager": "yarn@4.1.1"
 }

eslint.config.mjs

@@ -37,6 +37,7 @@ export const sendAlertsToMicrosoftTeams = async (
   webhookUrl: string,
   alerts: Alert[],
 ): Promise<void> => {
+  if (alerts.length === 0) return
   const alertCount = alerts.length
   const repositoryOwner = alerts[0].repository.owner
   const repositoryName = alerts[0].repository.name

jest.config.js

@@ -63,6 +63,7 @@ export const sendAlertsToSlack = async (
   webhookUrl: string,
   alerts: Alert[],
 ): Promise<void> => {
+  if (alerts.length === 0) return
   const webhook = new IncomingWebhook(webhookUrl)
   const alertBlocks: KnownBlock[] = []
   alerts.forEach((alert) => {

package.json

@@ -8,6 +8,7 @@ export const sendAlertsToZenduty = async (
   escalationPolicyId: string,
   alerts: Alert[],
 ): Promise<void> => {
+  if (alerts.length === 0) return
   let summary = `
     You have ${alerts.length} vulnerabilities in ${alerts[0].repository.owner}/${alerts[0].repository.name}
 

src/destinations/microsoft-teams.ts

@@ -45,7 +45,7 @@ export const toAdvisory = (securityAdvisory: SecurityAdvisory): Advisory => ({
     (securityAdvisory.severity?.toUpperCase() as AdvisorySeverity) || 'LOW',
   summary: securityAdvisory.summary,
   description: securityAdvisory.description || '',
-  url: securityAdvisory.references[0].url,
+  url: securityAdvisory.references?.[0]?.url ?? '',
   publishedAt: securityAdvisory.published_at || '',
   updatedAt: securityAdvisory.updated_at || '',
   withdrawnAt: securityAdvisory.withdrawn_at || '',

src/destinations/slack.ts

@@ -33,10 +33,11 @@ async function run(): Promise<void> {
     const emailTransportSmtpHost = getInput('email_transport_smtp_host')
     const emailTransportSmtpPort = parseInt(
       getInput('email_transport_smtp_port'),
+      10,
     )
     const emailTransportSmtpUser = getInput('email_transport_smtp_user')
     const emailTransportSmtpPassword = getInput('email_transport_smtp_password')
-    const count = parseInt(getInput('count'))
+    const count = parseInt(getInput('count'), 10)
     const severity = getInput('severity')
     const ecosystem = getInput('ecosystem')
 
@@ -103,7 +104,7 @@ async function run(): Promise<void> {
               pass: emailTransportSmtpPassword,
             },
           }
-          sendAlertsToEmailSmtp(
+          await sendAlertsToEmailSmtp(
             emailTransportSmtpConfig,
             alerts,
             emailList,
@@ -126,4 +127,4 @@ async function run(): Promise<void> {
   }
 }
 
-run()
+void run()