Upgrade Node 20 -> 24 and latest Actions packages

[jessehouwing]

This pull request introduces several major updates to the repository, primarily focused on modernizing the build system, updating dependencies, and improving compatibility with newer Node.js versions. The most significant changes include switching from ncc to rollup for builds, updating the Node.js runtime, and adding Yarn 4 configuration and workflow improvements.

Build System Modernization:

• Switched the build tool from ncc to rollup, including the addition of a new rollup.config.js file and relevant plugins in package.json (@rollup/plugin-commonjs, @rollup/plugin-json, @rollup/plugin-node-resolve, and rollup), and updated the build script accordingly. ([[1]](https://github.com/TryGhost/action-deploy-theme/pull/133/files#diff-7ae45ad102eab3b6d7e7896acd08c427a9b25b346470d7bc6507b6481575d519L3-R9), [[2]](https://github.com/TryGhost/action-deploy-theme/pull/133/files#diff-7ae45ad102eab3b6d7e7896acd08c427a9b25b346470d7bc6507b6481575d519L19-R32), [[3]](https://github.com/TryGhost/action-deploy-theme/pull/133/files#diff-6814bf77564b4f1c92f5861e184e28fe217c080a047fefa8b73a728f755ec45cR1-R28))

Node.js and Action Runtime Updates:

• Updated the Node.js runtime used by the GitHub Action from node20 to node24 in action.yml, and enabled enable-corepack in the test workflow to support modern package management. ([[1]](https://github.com/TryGhost/action-deploy-theme/pull/133/files#diff-1243c5424efaaa19bd8e813c5e6f6da46316e63761421b3e5f5c8ced9a36e6b6L30-R30), [[2]](https://github.com/TryGhost/action-deploy-theme/pull/133/files#diff-faff1af3d8ff408964a57b2e475f69a6b7c7b71c9978cccc8f471798caac2c88R21))

Dependency and Package Management:

• Updated dependencies in package.json, including minor version bumps and removal of @vercel/ncc, and specified the use of yarn@4.16.0 as the package manager. ([package.jsonL19-R32](https://github.com/TryGhost/action-deploy-theme/pull/133/files#diff-7ae45ad102eab3b6d7e7896acd08c427a9b25b346470d7bc6507b6481575d519L19-R32))

Yarn 4 Configuration:

• Added a new .yarnrc.yml file to configure Yarn 4 settings, enabling scripts, setting the node linker to node-modules, and approving all Git repositories. ([.yarnrc.ymlR1-R8](https://github.com/TryGhost/action-deploy-theme/pull/133/files#diff-88fbe28c4102501b94961511a0d70ff895bf39970b4d3fc11917794a239117c5R1-R8))

Versioning:

• Bumped the package version to 2.0.0 in package.json to reflect these breaking and significant changes. ([package.jsonL3-R9](https://github.com/TryGhost/action-deploy-theme/pull/133/files#diff-7ae45ad102eab3b6d7e7896acd08c427a9b25b346470d7bc6507b6481575d519L3-R9))

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 155a1e8b-669b-4cbb-9b7a-9a6f33a36faf

📥 Commits

Reviewing files that changed from the base of the PR and between be18aa2 and 8c1c017.

📒 Files selected for processing (2)

• .github/workflows/test.yml
• .yarnrc.yml

---

Walkthrough

This PR upgrades the action-deploy-theme GitHub Action by migrating its build system from @vercel/ncc to Rollup, updating the runtime Node.js version from 20 to 24, and configuring Yarn 4 with Corepack support. The rollup.config.js bundles index.js into dist/index.js with CommonJS output using plugin-node-resolve, plugin-commonjs, and plugin-json. The package.json reflects these changes with a version bump to 2.0.0, an updated build script, and new Rollup dependencies. The runtime environment is configured via action.yml (Node 24), .yarnrc.yml (Yarn settings and package repository policies), CI workflow changes (Corepack enablement), and package.json (packageManager field).

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~12 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title describes the main changes in the PR (Node.js upgrade and modern Actions/package manager updates), but is somewhat vague about the build system modernization which is the most significant change.
Description check	✅ Passed	The description is comprehensive and directly related to all major changes in the PR, covering build system modernization, Node.js/Actions updates, dependency management, Yarn configuration, and versioning with clear context and examples.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/test.yml:
- Around line 21-23: Remove the invalid enable-corepack input from the
actions/setup-node@v6 step and add an explicit step that activates Corepack
before running yarn (e.g., run corepack enable or run corepack prepare
yarn@4.16.0 --activate) so the subsequent run: yarn and run: yarn lint commands
use Yarn Berry v4 as declared in packageManager; update the workflow to call
that run step immediately before the existing yarn/yarn lint commands.

In @.yarnrc.yml:
- Around line 1-8: Update the Yarn policy defaults to tighten supply-chain
protections: replace the permissive approvedGitRepositories: ["**"] with an
explicit allowlist of trusted repo URL globs (use specific host/path patterns
rather than "**"), set enableScripts: false to disable install-time lifecycle
scripts and document that packages requiring scripts must be opted into via
dependenciesMeta entries, and change npmMinimalAgeGate from 0 to a non-zero
value (e.g., 4320) for CI to enforce an npm release age gate.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 62bf5c61-e3a4-42e5-9701-fce693f76378

📥 Commits

Reviewing files that changed from the base of the PR and between c0861b6 and be18aa2.

⛔ Files ignored due to path filters (3)

• .yarn/install-state.gz is excluded by !**/.yarn/**, !**/*.gz
• dist/index.js is excluded by !**/dist/**
• yarn.lock is excluded by !**/yarn.lock, !**/*.lock

📒 Files selected for processing (5)

• .github/workflows/test.yml
• .yarnrc.yml
• action.yml
• package.json
• rollup.config.js

[aileen]

Upgraded Node version with edc1127