Update dependencies

2025-06-24 17:40:40 +02:00
46 changed files with 157176 additions and 161623 deletions
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -1,19 +1,30 @@
 version: 2
 updates:
-  - package-ecosystem: 'github-actions'
-    directory: '/'
+  - package-ecosystem: github-actions
+    directory: /
    schedule:
-      interval: 'monthly'
+      interval: monthly
    groups:
-      github-actions-updates:
-        patterns:
-          - '*'
+      actions-minor:
+        update-types:
+          - minor
+          - patch

-  - package-ecosystem: 'npm'
-    directory: '/'
+  - package-ecosystem: npm
+    directory: /
    schedule:
-      interval: 'monthly'
+      interval: monthly
+    ignore:
+      - dependency-name: '@types/node'
+        update-types:
+          - 'version-update:semver-major'
    groups:
-      npm-updates:
-        patterns:
-          - '*'
+      npm-development:
+        dependency-type: development
+        update-types:
+          - minor
+          - patch
+      npm-production:
+        dependency-type: production
+        update-types:
+          - patch
--- a/.github/workflows/check-dist.yml
+++ b/.github/workflows/check-dist.yml
@@ -32,11 +32,11 @@ jobs:
    steps:
      - name: Checkout
        id: checkout
-        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+        uses: actions/checkout@v4

      - name: Setup Node.js
        id: setup-node
-        uses: actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903 # v6.0.0
+        uses: actions/setup-node@v4
        with:
          node-version-file: .node-version
          cache: npm
@@ -70,7 +70,7 @@ jobs:
      - if: ${{ failure() && steps.diff.outcome == 'failure' }}
        name: Upload Artifact
        id: upload
-        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
+        uses: actions/upload-artifact@v4
        with:
          name: dist
          path: dist/
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -18,9 +18,9 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
-        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+        uses: actions/checkout@v4
      - name: Setup Node.js
-        uses: actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903 # v6.0.0
+        uses: actions/setup-node@v4
        with:
          node-version-file: .node-version
          cache: npm
@@ -32,8 +32,6 @@ jobs:
        run: npm run lint
      - name: Test
        run: npm run test
-        env:
-          INPUT_GITHUB_TOKEN: ${{ github.token }} # for core.getInput()

  test-action:
    name: GraalVM
@@ -43,7 +41,7 @@ jobs:
      PASSES_GDS_TOKEN_CHECK: ${{ !matrix.set-gds-token || secrets.GDS_TOKEN != '' }}
    strategy:
      matrix:
-        java-version: ['25', '21', '17', '20', 'dev']
+        java-version: ['24', '21', '17', '20', 'dev']
        distribution: ['graalvm', 'graalvm-community']
        os: [
            ubuntu-latest, # Linux on Intel
@@ -54,9 +52,6 @@ jobs:
          ]
        set-gds-token: [false]
        components: ['']
-        exclude:
-          - os: macos-13
-            java-version: 'dev'
        include:
          - java-version: 'latest-ea'
            distribution: 'graalvm'
@@ -86,7 +81,7 @@ jobs:
            os: ubuntu-latest
            set-gds-token: true
    steps:
-      - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+      - uses: actions/checkout@v4
      - name: Run setup-graalvm action
        uses: ./
        with:
@@ -154,7 +149,7 @@ jobs:
            components: 'native-image'
            os: ubuntu-latest
    steps:
-      - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+      - uses: actions/checkout@v4
      - name: Run setup-graalvm action
        uses: ./
        with:
@@ -211,7 +206,7 @@ jobs:
            components: 'native-image'
            os: ubuntu-latest
    steps:
-      - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+      - uses: actions/checkout@v4
      - name: Run setup-graalvm action
        uses: ./
        with:
@@ -260,7 +255,7 @@ jobs:
            distribution: 'mandrel'
            os: ubuntu-latest
    steps:
-      - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+      - uses: actions/checkout@v4
      - name: Run setup-graalvm action
        uses: ./
        with:
@@ -295,7 +290,7 @@ jobs:
        java-package: ['', 'jdk', 'jdk+fx']
        os: [ubuntu-latest, macos-latest, windows-latest]
    steps:
-      - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+      - uses: actions/checkout@v4
      - name: Run setup-graalvm action
        uses: ./
        with:
@@ -335,7 +330,7 @@ jobs:
      contents: read
      pull-requests: write # for `native-image-pr-reports` option
    steps:
-      - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+      - uses: actions/checkout@v4
      - name: Run setup-graalvm action
        uses: ./
        with:
@@ -358,7 +353,7 @@ jobs:
      contents: read
      pull-requests: write # for `native-image-pr-reports` option
    steps:
-      - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+      - uses: actions/checkout@v4
      - name: Run setup-graalvm action
        uses: ./
        with:
@@ -375,22 +370,18 @@ jobs:
          ./helloworld

  test-action-native-image-musl:
-    name: native-image-musl + JDK${{ matrix.java-version }} on ${{ matrix.os }}
-    runs-on: ${{ matrix.os }}
+    name: native-image-musl on ubuntu-latest
+    runs-on: ubuntu-latest
    permissions:
      contents: read
      pull-requests: write # for `native-image-pr-reports` option
-    strategy:
-      matrix:
-        java-version: ['21', '25']
-        os: [ubuntu-latest]
    steps:
-      - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+      - uses: actions/checkout@v4
      - name: Run setup-graalvm action
        uses: ./
        with:
-          java-version: ${{ matrix.java-version }}
-          distribution: 'graalvm'
+          java-version: 'dev'
+          distribution: 'graalvm-community'
          native-image-musl: 'true'
          native-image-job-reports: 'true'
          native-image-pr-reports: 'true'
@@ -399,7 +390,7 @@ jobs:
        run: |
          echo 'public class HelloWorld { public static void main(String[] args) { System.out.println("Hello, World!"); } }' > HelloWorld.java
          javac HelloWorld.java
-          native-image --static --libc=musl --gc=G1 HelloWorld
+          native-image --static --libc=musl HelloWorld
          ./helloworld

  test-action-extensive:
@@ -409,7 +400,7 @@ jobs:
      contents: read
      pull-requests: write # for `native-image-pr-reports` option
    steps:
-      - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+      - uses: actions/checkout@v4
      - name: Run setup-graalvm action
        uses: ./
        with:
@@ -465,12 +456,12 @@ jobs:
      contents: write
    strategy:
      matrix:
-        java-version: ['25', 'latest-ea']
+        java-version: ['24-ea', 'latest-ea']
        distribution: ['graalvm']
        os: [macos-latest, windows-latest, ubuntu-latest, ubuntu-22.04-arm]
        components: ['']
    steps:
-      - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+      - uses: actions/checkout@v4
      - name: Run setup-graalvm action
        uses: ./
        with:
--- a/README.md
+++ b/README.md
@@ -1,7 +1,5 @@
 # GitHub Action for GraalVM [![CI](https://github.com/graalvm/setup-graalvm/actions/workflows/ci.yml/badge.svg)](https://github.com/graalvm/setup-graalvm/actions/workflows/ci.yml)
-
-Set up your GitHub Actions workflow with a specific [GraalVM][graalvm] distribution, and use it both as your JDK and for [ahead-of-time Native Image compilation][graalvm].
-
+This GitHub action sets up [Oracle GraalVM][graalvm-medium], GraalVM [Community Edition (CE)][repo], [Enterprise Edition (EE)][graalvm-ee], [Mandrel][mandrel], or [Liberica Native Image Kit][liberica] as well as [Native Image][native-image] and GraalVM components such as [Truffle languages][truffle-languages].

 ## Key Features

@@ -9,10 +7,12 @@ This action:

 - supports Oracle GraalVM [releases][graalvm-dl], [EA builds][ea-builds], GraalVM Community Edition (CE) [releases], [dev builds][dev-builds], GraalVM Enterprise Edition (EE) [releases][graalvm-ee] (set [`gds-token`](#options)) 22.1.0 and later, [Mandrel][mandrel], and [Liberica Native Image Kit][liberica] (see [Options](#options))
 - exports a `$GRAALVM_HOME` environment variable
- adds `$GRAALVM_HOME/bin` to the `$PATH` environment variable<br>(`native-image`, `javac`, and other JDK tools can be invoked directly)
+- adds `$GRAALVM_HOME/bin` to the `$PATH` environment variable<br>(Native Image, Truffle languages, and tools can be invoked directly)
 - sets `$JAVA_HOME` to `$GRAALVM_HOME` by default<br>(can be disabled via `set-java-home: 'false'`, see [Options](#options))
 - supports `x64` and `aarch64/arm64` (see how to use [Linux arm64 runners](https://github.blog/changelog/2025-01-16-linux-arm64-hosted-runners-now-available-for-free-in-public-repositories-public-preview/))
 - supports dependency caching for Apache Maven, Gradle, and sbt (see [`cache` option](#options))
+- sets up Windows environments with build tools using [vcvarsall.bat][vcvarsall]
+- has built-in support for GraalVM components and the [GraalVM Updater][gu]


 ## Templates
@@ -29,7 +29,7 @@ jobs:
      - uses: actions/checkout@v4
      - uses: graalvm/setup-graalvm@v1
        with:
-          java-version: '25'      # See 'Options' for more details
+          java-version: '21'      # See 'Options' for more details
          distribution: 'graalvm' # See 'Supported distributions' for available options
          github-token: ${{ secrets.GITHUB_TOKEN }}
      - name: Example step
@@ -61,7 +61,7 @@ jobs:

      - uses: graalvm/setup-graalvm@v1
        with:
-          java-version: '25'
+          java-version: '21'
          distribution: 'graalvm'
          github-token: ${{ secrets.GITHUB_TOKEN }}
          native-image-job-reports: 'true'
@@ -92,7 +92,7 @@ jobs:
      - uses: actions/checkout@v4
      - uses: graalvm/setup-graalvm@v1
        with:
-          java-version: '26-ea' # or 'latest-ea' for the latest Java version available
+          java-version: '24-ea' # or 'latest-ea' for the latest Java version available
          distribution: 'graalvm'
          github-token: ${{ secrets.GITHUB_TOKEN }}
 ```
@@ -194,7 +194,7 @@ This actions can be configured with the following options:

 | Name            | Default  | Description |
 |-----------------|:--------:|-------------|
-| `java-version`<br>*(required)* | n/a | Java version <ul><li>major versions: `'25'`, `'21'`, `'17'`, `'11'`, `'8'`</li><li>specific versions: `'21.0.3'`, `'17.0.11'`</li><li>early access (EA) builds: `'26-ea'` *(requires `distribution: 'graalvm'`)*</li><li>latest EA build: `'latest-ea'` *(requires `distribution: 'graalvm'`)*</li><li>dev builds: `'dev'`</li></ul> |
+| `java-version`<br>*(required)* | n/a | Java version <ul><li>major versions: `'24'`, `'21'`, `'17'`, `'11'`, `'8'`</li><li>specific versions: `'21.0.3'`, `'17.0.11'`</li><li>early access (EA) builds: `'25-ea'` *(requires `distribution: 'graalvm'`)*</li><li>latest EA build: `'latest-ea'` *(requires `distribution: 'graalvm'`)*</li><li>dev builds: `'dev'`</li></ul> |
 | `distribution`  | `'graalvm'` | GraalVM distribution (see [supported distributions](#supported-distributions)) |
 | `java-package`  | `'jdk'` | The package type (`'jdk'` or `'jdk+fx'`). Currently applies to Liberica only. |
 | `github-token`  | `'${{ github.token }}'` | Token for communication with the GitHub API. Please set this to `${{ secrets.GITHUB_TOKEN }}` (see [templates](#templates)) to allow the action to authenticate with the GitHub API, which helps reduce rate-limiting issues. |
@@ -270,16 +270,21 @@ Only pull requests from committers that can be verified as having signed the OCA
 [gha-self-hosted-runners]: https://docs.github.com/en/actions/hosting-your-own-runners/about-self-hosted-runners
 [gu]: https://www.graalvm.org/reference-manual/graalvm-updater/
 [graalvm]: https://www.graalvm.org/
-[graalvm-dl]: https://www.graalvm.org/downloads/
+[graalvm-dl]: https://www.oracle.com/java/technologies/downloads/
+[graalvm-medium]: https://medium.com/graalvm/a-new-graalvm-release-and-new-free-license-4aab483692f5
 [graalvm-ee]: https://www.oracle.com/downloads/graalvm-downloads.html
 [liberica]: https://bell-sw.com/liberica-native-image-kit/
 [mandrel]: https://github.com/graalvm/mandrel
 [mandrel-releases]: https://github.com/graalvm/mandrel/releases
 [mandrel-stable]: https://github.com/graalvm/mandrel/releases/latest
 [musl]: https://musl.libc.org/
+[native-image]: https://www.graalvm.org/native-image/
 [native-image-musl-build]: https://github.com/graalvm/setup-graalvm/blob/778131f1d6837ccd4b2e91382c31830896a2d56e/.github/workflows/test.yml#L74-L92
 [native-image-static]: https://github.com/oracle/graal/blob/fa6f4a974dedacf4688dcc430dd100849d9882f2/docs/reference-manual/native-image/StaticImages.md
 [oca]: https://oca.opensource.oracle.com
 [releases]: https://github.com/graalvm/graalvm-ce-builds/releases
+[repo]: https://github.com/oracle/graal
 [setup-java-caching]: https://github.com/actions/setup-java/tree/5b36705a13905facb447b6812d613a06a07e371d#caching-packages-dependencies
 [stable]: https://github.com/graalvm/graalvm-ce-builds/releases/latest
+[truffle-languages]: https://www.graalvm.org/reference-manual/languages/
+[vcvarsall]: https://docs.microsoft.com/en-us/cpp/build/building-on-the-command-line
--- a/fixtures/cache.ts
+++ b/fixtures/cache.ts
@@ -1,7 +0,0 @@
-import * as cache from '@actions/cache'
-import { jest } from '@jest/globals'
-
-export const ReserveCacheError = cache.ReserveCacheError
-export const restoreCache = jest.fn<typeof cache.restoreCache>()
-export const saveCache = jest.fn<typeof cache.saveCache>()
-export const ValidationError = cache.ValidationError
--- a/fixtures/core.ts
+++ b/fixtures/core.ts
@@ -1,13 +0,0 @@
-import type * as core from '@actions/core'
-import { jest } from '@jest/globals'
-
-export const debug = jest.fn<typeof core.debug>()
-export const error = jest.fn<typeof core.error>()
-export const exportVariable = jest.fn<typeof core.exportVariable>()
-export const getInput = jest.fn<typeof core.getInput>()
-export const getState = jest.fn<typeof core.getState>()
-export const info = jest.fn<typeof core.info>()
-export const saveState = jest.fn<typeof core.saveState>()
-export const setFailed = jest.fn<typeof core.setFailed>()
-export const setOutput = jest.fn<typeof core.setOutput>()
-export const warning = jest.fn<typeof core.warning>()
--- a/fixtures/github.ts
+++ b/fixtures/github.ts
@@ -1,15 +0,0 @@
-import * as github from '@actions/github'
-import { jest } from '@jest/globals'
-
-export const context = {
-  repo: {
-    owner: 'test-owner',
-    repo: 'test-repo'
-  },
-  sha: 'test-sha',
-  ref: 'test-ref',
-  workflow: 'test-workflow',
-  job: 'test-job',
-  runId: '12345'
-}
-export const getOctokit = jest.fn<typeof github.getOctokit>()
--- a/fixtures/glob.ts
+++ b/fixtures/glob.ts
@@ -1,4 +0,0 @@
-import * as glob from '@actions/glob'
-import { jest } from '@jest/globals'
-
-export const create = jest.fn<typeof glob.create>()
--- a/tests/cache.test.ts
+++ b/tests/cache.test.ts
@@ -24,28 +24,24 @@
 * Forked from https://github.com/actions/setup-java/blob/5b36705a13905facb447b6812d613a06a07e371d/__tests__/cache.test.ts
 */

-import { jest } from '@jest/globals'
 import { mkdtempSync } from 'fs'
 import { tmpdir } from 'os'
 import { join } from 'path'
+import { restore, save } from '../src/features/cache'
 import * as fs from 'fs'
 import * as os from 'os'
-import * as cache from '../__fixtures__/cache.js'
-import * as core from '../__fixtures__/core.js'
-
-// Mocks should be declared before the module being tested is imported.
-jest.unstable_mockModule('@actions/core', () => core)
-jest.unstable_mockModule('@actions/cache', () => cache)
-
-// The module being tested should be imported dynamically. This ensures that the
-// mocks are used in place of any actual dependencies.
-const { restore, save } = await import('../src/features/cache.js')
+import * as core from '@actions/core'
+import * as cache from '@actions/cache'

 describe('dependency cache', () => {
  const ORIGINAL_RUNNER_OS = process.env['RUNNER_OS']
  const ORIGINAL_GITHUB_WORKSPACE = process.env['GITHUB_WORKSPACE']
  const ORIGINAL_CWD = process.cwd()
  let workspace: string
+  let spyInfo: jest.SpyInstance<void, Parameters<typeof core.info>>
+  let spyWarning: jest.SpyInstance<void, Parameters<typeof core.warning>>
+  let spyDebug: jest.SpyInstance<void, Parameters<typeof core.debug>>
+  let spySaveState: jest.SpyInstance<void, Parameters<typeof core.saveState>>

  beforeEach(() => {
    workspace = mkdtempSync(join(tmpdir(), 'setup-graalvm-cache-'))
@@ -69,9 +65,17 @@ describe('dependency cache', () => {
  })

  beforeEach(() => {
-    core.info.mockImplementation(() => null)
-    core.warning.mockImplementation(() => null)
-    core.debug.mockImplementation(() => null)
+    spyInfo = jest.spyOn(core, 'info')
+    spyInfo.mockImplementation(() => null)
+
+    spyWarning = jest.spyOn(core, 'warning')
+    spyWarning.mockImplementation(() => null)
+
+    spyDebug = jest.spyOn(core, 'debug')
+    spyDebug.mockImplementation(() => null)
+
+    spySaveState = jest.spyOn(core, 'saveState')
+    spySaveState.mockImplementation(() => null)
  })

  afterEach(() => {
@@ -82,8 +86,13 @@ describe('dependency cache', () => {
  })

  describe('restore', () => {
+    let spyCacheRestore: jest.SpyInstance<ReturnType<typeof cache.restoreCache>, Parameters<typeof cache.restoreCache>>
+
    beforeEach(() => {
-      cache.restoreCache.mockImplementation((_paths: string[], _primaryKey: string) => Promise.resolve(undefined))
+      spyCacheRestore = jest
+        .spyOn(cache, 'restoreCache')
+        .mockImplementation((_paths: string[], _primaryKey: string) => Promise.resolve(undefined))
+      spyWarning.mockImplementation(() => null)
    })

    it('throws error if unsupported package manager specified', () => {
@@ -102,9 +111,9 @@ describe('dependency cache', () => {
        createFile(join(workspace, 'pom.xml'))

        await restore('maven')
-        expect(cache.restoreCache).toHaveBeenCalled()
-        expect(core.warning).not.toHaveBeenCalled()
-        expect(core.info).toHaveBeenCalledWith('maven cache is not found')
+        expect(spyCacheRestore).toHaveBeenCalled()
+        expect(spyWarning).not.toHaveBeenCalled()
+        expect(spyInfo).toHaveBeenCalledWith('maven cache is not found')
      })
    })
    describe('for gradle', () => {
@@ -119,17 +128,17 @@ describe('dependency cache', () => {
        createFile(join(workspace, 'build.gradle'))

        await restore('gradle')
-        expect(cache.restoreCache).toHaveBeenCalled()
-        expect(core.warning).not.toHaveBeenCalled()
-        expect(core.info).toHaveBeenCalledWith('gradle cache is not found')
+        expect(spyCacheRestore).toHaveBeenCalled()
+        expect(spyWarning).not.toHaveBeenCalled()
+        expect(spyInfo).toHaveBeenCalledWith('gradle cache is not found')
      })
      it('downloads cache based on build.gradle.kts', async () => {
        createFile(join(workspace, 'build.gradle.kts'))

        await restore('gradle')
-        expect(cache.restoreCache).toHaveBeenCalled()
-        expect(core.warning).not.toHaveBeenCalled()
-        expect(core.info).toHaveBeenCalledWith('gradle cache is not found')
+        expect(spyCacheRestore).toHaveBeenCalled()
+        expect(spyWarning).not.toHaveBeenCalled()
+        expect(spyInfo).toHaveBeenCalledWith('gradle cache is not found')
      })
    })
    it('downloads cache based on buildSrc/Versions.kt', async () => {
@@ -137,9 +146,9 @@ describe('dependency cache', () => {
      createFile(join(workspace, 'buildSrc', 'Versions.kt'))

      await restore('gradle')
-      expect(cache.restoreCache).toHaveBeenCalled()
-      expect(core.warning).not.toHaveBeenCalled()
-      expect(core.info).toHaveBeenCalledWith('gradle cache is not found')
+      expect(spyCacheRestore).toHaveBeenCalled()
+      expect(spyWarning).not.toHaveBeenCalled()
+      expect(spyInfo).toHaveBeenCalledWith('gradle cache is not found')
    })
    describe('for sbt', () => {
      it('throws error if no build.sbt found', async () => {
@@ -153,16 +162,20 @@ describe('dependency cache', () => {
        createFile(join(workspace, 'build.sbt'))

        await restore('sbt')
-        expect(cache.restoreCache).toHaveBeenCalled()
-        expect(core.warning).not.toHaveBeenCalled()
-        expect(core.info).toHaveBeenCalledWith('sbt cache is not found')
+        expect(spyCacheRestore).toHaveBeenCalled()
+        expect(spyWarning).not.toHaveBeenCalled()
+        expect(spyInfo).toHaveBeenCalledWith('sbt cache is not found')
      })
    })
  })
  describe('save', () => {
+    let spyCacheSave: jest.SpyInstance<ReturnType<typeof cache.saveCache>, Parameters<typeof cache.saveCache>>
+
    beforeEach(() => {
-      cache.saveCache.mockImplementation((_paths: string[], _key: string) => Promise.resolve(0))
-      core.warning.mockImplementation(() => null)
+      spyCacheSave = jest
+        .spyOn(cache, 'saveCache')
+        .mockImplementation((_paths: string[], _key: string) => Promise.resolve(0))
+      spyWarning.mockImplementation(() => null)
    })

    it('throws error if unsupported package manager specified', () => {
@@ -170,18 +183,18 @@ describe('dependency cache', () => {
    })

    it('save with -1 cacheId , should not fail workflow', async () => {
-      cache.saveCache.mockImplementation(() => Promise.resolve(-1))
+      spyCacheSave.mockImplementation(() => Promise.resolve(-1))
      createStateForMissingBuildFile()

      await save('maven')
-      expect(cache.saveCache).toHaveBeenCalled()
-      expect(core.warning).not.toHaveBeenCalled()
-      expect(core.info).toHaveBeenCalled()
-      expect(core.info).toHaveBeenCalledWith(expect.stringMatching(/^Cache saved with the key:.*/))
+      expect(spyCacheSave).toHaveBeenCalled()
+      expect(spyWarning).not.toHaveBeenCalled()
+      expect(spyInfo).toHaveBeenCalled()
+      expect(spyInfo).toHaveBeenCalledWith(expect.stringMatching(/^Cache saved with the key:.*/))
    })

    it('saves with error from toolkit, should fail workflow', async () => {
-      cache.saveCache.mockImplementation(() => Promise.reject(new cache.ValidationError('Validation failed')))
+      spyCacheSave.mockImplementation(() => Promise.reject(new cache.ValidationError('Validation failed')))
      createStateForMissingBuildFile()

      expect.assertions(1)
@@ -192,24 +205,24 @@ describe('dependency cache', () => {
      it('uploads cache even if no pom.xml found', async () => {
        createStateForMissingBuildFile()
        await save('maven')
-        expect(cache.saveCache).toHaveBeenCalled()
-        expect(core.warning).not.toHaveBeenCalled()
+        expect(spyCacheSave).toHaveBeenCalled()
+        expect(spyWarning).not.toHaveBeenCalled()
      })
      it('does not upload cache if no restore run before', async () => {
        createFile(join(workspace, 'pom.xml'))

        await save('maven')
-        expect(cache.saveCache).not.toHaveBeenCalled()
-        expect(core.warning).toHaveBeenCalledWith('Error retrieving key from state.')
+        expect(spyCacheSave).not.toHaveBeenCalled()
+        expect(spyWarning).toHaveBeenCalledWith('Error retrieving key from state.')
      })
      it('uploads cache', async () => {
        createFile(join(workspace, 'pom.xml'))
        createStateForSuccessfulRestore()

        await save('maven')
-        expect(cache.saveCache).toHaveBeenCalled()
-        expect(core.warning).not.toHaveBeenCalled()
-        expect(core.info).toHaveBeenCalledWith(expect.stringMatching(/^Cache saved with the key:.*/))
+        expect(spyCacheSave).toHaveBeenCalled()
+        expect(spyWarning).not.toHaveBeenCalled()
+        expect(spyInfo).toHaveBeenCalledWith(expect.stringMatching(/^Cache saved with the key:.*/))
      })
    })
    describe('for gradle', () => {
@@ -217,33 +230,33 @@ describe('dependency cache', () => {
        createStateForMissingBuildFile()

        await save('gradle')
-        expect(cache.saveCache).toHaveBeenCalled()
-        expect(core.warning).not.toHaveBeenCalled()
+        expect(spyCacheSave).toHaveBeenCalled()
+        expect(spyWarning).not.toHaveBeenCalled()
      })
      it('does not upload cache if no restore run before', async () => {
        createFile(join(workspace, 'build.gradle'))

        await save('gradle')
-        expect(cache.saveCache).not.toHaveBeenCalled()
-        expect(core.warning).toHaveBeenCalledWith('Error retrieving key from state.')
+        expect(spyCacheSave).not.toHaveBeenCalled()
+        expect(spyWarning).toHaveBeenCalledWith('Error retrieving key from state.')
      })
      it('uploads cache based on build.gradle', async () => {
        createFile(join(workspace, 'build.gradle'))
        createStateForSuccessfulRestore()

        await save('gradle')
-        expect(cache.saveCache).toHaveBeenCalled()
-        expect(core.warning).not.toHaveBeenCalled()
-        expect(core.info).toHaveBeenCalledWith(expect.stringMatching(/^Cache saved with the key:.*/))
+        expect(spyCacheSave).toHaveBeenCalled()
+        expect(spyWarning).not.toHaveBeenCalled()
+        expect(spyInfo).toHaveBeenCalledWith(expect.stringMatching(/^Cache saved with the key:.*/))
      })
      it('uploads cache based on build.gradle.kts', async () => {
        createFile(join(workspace, 'build.gradle.kts'))
        createStateForSuccessfulRestore()

        await save('gradle')
-        expect(cache.saveCache).toHaveBeenCalled()
-        expect(core.warning).not.toHaveBeenCalled()
-        expect(core.info).toHaveBeenCalledWith(expect.stringMatching(/^Cache saved with the key:.*/))
+        expect(spyCacheSave).toHaveBeenCalled()
+        expect(spyWarning).not.toHaveBeenCalled()
+        expect(spyInfo).toHaveBeenCalledWith(expect.stringMatching(/^Cache saved with the key:.*/))
      })
      it('uploads cache based on buildSrc/Versions.kt', async () => {
        createDirectory(join(workspace, 'buildSrc'))
@@ -251,47 +264,47 @@ describe('dependency cache', () => {
        createStateForSuccessfulRestore()

        await save('gradle')
-        expect(cache.saveCache).toHaveBeenCalled()
-        expect(core.warning).not.toHaveBeenCalled()
-        expect(core.info).toHaveBeenCalledWith(expect.stringMatching(/^Cache saved with the key:.*/))
+        expect(spyCacheSave).toHaveBeenCalled()
+        expect(spyWarning).not.toHaveBeenCalled()
+        expect(spyInfo).toHaveBeenCalledWith(expect.stringMatching(/^Cache saved with the key:.*/))
      })
    })
    describe('for sbt', () => {
      it('uploads cache even if no build.sbt found', async () => {
        createStateForMissingBuildFile()
        await save('sbt')
-        expect(cache.saveCache).toHaveBeenCalled()
-        expect(core.warning).not.toHaveBeenCalled()
+        expect(spyCacheSave).toHaveBeenCalled()
+        expect(spyWarning).not.toHaveBeenCalled()
      })
      it('does not upload cache if no restore run before', async () => {
        createFile(join(workspace, 'build.sbt'))

        await save('sbt')
-        expect(cache.saveCache).not.toHaveBeenCalled()
-        expect(core.warning).toHaveBeenCalledWith('Error retrieving key from state.')
+        expect(spyCacheSave).not.toHaveBeenCalled()
+        expect(spyWarning).toHaveBeenCalledWith('Error retrieving key from state.')
      })
      it('uploads cache', async () => {
        createFile(join(workspace, 'build.sbt'))
        createStateForSuccessfulRestore()

        await save('sbt')
-        expect(cache.saveCache).toHaveBeenCalled()
-        expect(core.warning).not.toHaveBeenCalled()
-        expect(core.info).toHaveBeenCalledWith(expect.stringMatching(/^Cache saved with the key:.*/))
+        expect(spyCacheSave).toHaveBeenCalled()
+        expect(spyWarning).not.toHaveBeenCalled()
+        expect(spyInfo).toHaveBeenCalledWith(expect.stringMatching(/^Cache saved with the key:.*/))
      })
    })
  })
 })

 function resetState() {
-  core.getState.mockReset()
+  jest.spyOn(core, 'getState').mockReset()
 }

 /**
 * Create states to emulate a restore process without build file.
 */
 function createStateForMissingBuildFile() {
-  core.getState.mockImplementation((name) => {
+  jest.spyOn(core, 'getState').mockImplementation((name) => {
    switch (name) {
      case 'cache-primary-key':
        return 'setup-graalvm-cache-'
@@ -305,7 +318,7 @@ function createStateForMissingBuildFile() {
 * Create states to emulate a successful restore process.
 */
 function createStateForSuccessfulRestore() {
-  core.getState.mockImplementation((name) => {
+  jest.spyOn(core, 'getState').mockImplementation((name) => {
    switch (name) {
      case 'cache-primary-key':
        return 'setup-graalvm-cache-primary-key'
--- a/tests/cleanup.test.ts
+++ b/tests/cleanup.test.ts
@@ -24,23 +24,21 @@
 * Forked from https://github.com/actions/setup-java/blob/5b36705a13905facb447b6812d613a06a07e371d/__tests__/cleanup-java.test.ts
 */

-import { jest } from '@jest/globals'
-import * as cache from '../__fixtures__/cache.js'
-import * as core from '../__fixtures__/core.js'
-
-// Mocks should be declared before the module being tested is imported.
-jest.unstable_mockModule('@actions/core', () => core)
-jest.unstable_mockModule('@actions/cache', () => cache)
-
-// The module being tested should be imported dynamically. This ensures that the
-// mocks are used in place of any actual dependencies.
-const { run } = await import('../src/cleanup.js')
+import { run as cleanup } from '../src/cleanup'
+import * as core from '@actions/core'
+import * as cache from '@actions/cache'

 describe('cleanup', () => {
+  let spyWarning: jest.SpyInstance<void, Parameters<typeof core.warning>>
+  let spyInfo: jest.SpyInstance<void, Parameters<typeof core.info>>
+  let spyCacheSave: jest.SpyInstance<ReturnType<typeof cache.saveCache>, Parameters<typeof cache.saveCache>>
+
  beforeEach(() => {
-    core.info.mockImplementation(() => null)
-    core.warning.mockImplementation(() => null)
-    core.debug.mockImplementation(() => null)
+    spyWarning = jest.spyOn(core, 'warning')
+    spyWarning.mockImplementation(() => null)
+    spyInfo = jest.spyOn(core, 'info')
+    spyInfo.mockImplementation(() => null)
+    spyCacheSave = jest.spyOn(cache, 'saveCache')
    createStateForSuccessfulRestore()
  })
  afterEach(() => {
@@ -48,40 +46,38 @@ describe('cleanup', () => {
  })

  it('does not fail nor warn even when the save process throws a ReserveCacheError', async () => {
-    cache.saveCache.mockImplementation((_paths: string[], _key: string) =>
+    spyCacheSave.mockImplementation((_paths: string[], _key: string) =>
      Promise.reject(
        new cache.ReserveCacheError('Unable to reserve cache with key, another job may be creating this cache.')
      )
    )
-    core.getInput.mockImplementation((name: string) => {
+    jest.spyOn(core, 'getInput').mockImplementation((name: string) => {
      return name === 'cache' ? 'gradle' : ''
    })
-    await run()
-    expect(cache.saveCache).toHaveBeenCalled()
-    expect(core.warning).not.toHaveBeenCalled()
+    await cleanup()
+    expect(spyCacheSave).toHaveBeenCalled()
+    expect(spyWarning).not.toHaveBeenCalled()
  })

  it('does not fail even though the save process throws error', async () => {
-    cache.saveCache.mockImplementation((_paths: string[], _key: string) =>
-      Promise.reject(new Error('Unexpected error'))
-    )
-    core.getInput.mockImplementation((name: string) => {
+    spyCacheSave.mockImplementation((_paths: string[], _key: string) => Promise.reject(new Error('Unexpected error')))
+    jest.spyOn(core, 'getInput').mockImplementation((name: string) => {
      return name === 'cache' ? 'gradle' : ''
    })
-    await run()
-    expect(cache.saveCache).toHaveBeenCalled()
+    await cleanup()
+    expect(spyCacheSave).toHaveBeenCalled()
  })
 })

 function resetState() {
-  core.getState.mockReset()
+  jest.spyOn(core, 'getState').mockReset()
 }

 /**
 * Create states to emulate a successful restore process.
 */
 function createStateForSuccessfulRestore() {
-  core.getState.mockImplementation((name) => {
+  jest.spyOn(core, 'getState').mockImplementation((name) => {
    switch (name) {
      case 'cache-primary-key':
        return 'setup-java-cache-primary-key'
--- a/tests/gds.test.ts
+++ b/tests/gds.test.ts
@@ -1,12 +1,10 @@
 import * as path from 'path'
 import { downloadGraalVM, downloadGraalVMEELegacy, fetchArtifact, fetchArtifactEE } from '../src/gds'
 import { expect, test } from '@jest/globals'
-import { fileURLToPath } from 'url'

 const TEST_USER_AGENT = 'GraalVMGitHubActionTest/1.0.4'

-const dirname = path.dirname(fileURLToPath(import.meta.url))
-process.env['RUNNER_TEMP'] = path.join(dirname, 'TEMP')
+process.env['RUNNER_TEMP'] = path.join(__dirname, 'TEMP')

 test('fetch artifacts', async () => {
  let artifact = await fetchArtifact(TEST_USER_AGENT, 'isBase:True', '17.0.12')
--- a/tests/graalvm.test.ts
+++ b/tests/graalvm.test.ts
@@ -4,11 +4,9 @@ import { expect, test } from '@jest/globals'
 import { getTaggedRelease } from '../src/utils'
 import { findGraalVMVersion, findHighestJavaVersion, findLatestEABuildDownloadUrl } from '../src/graalvm'
 import { GRAALVM_GH_USER, GRAALVM_RELEASES_REPO } from '../src/constants'
-import { fileURLToPath } from 'url'

-const dirname = path.dirname(fileURLToPath(import.meta.url))
-process.env['RUNNER_TOOL_CACHE'] = path.join(dirname, 'TOOL_CACHE')
-process.env['RUNNER_TEMP'] = path.join(dirname, 'TEMP')
+process.env['RUNNER_TOOL_CACHE'] = path.join(__dirname, 'TOOL_CACHE')
+process.env['RUNNER_TEMP'] = path.join(__dirname, 'TEMP')

 test('request invalid version/javaVersion', async () => {
  for (const combination of [
@@ -76,7 +74,7 @@ test('find version/javaVersion', async () => {
    }
    error = err
  }
-  expect(error.message).toContain('Could not find latest GraalVM release:')
+  expect(error.message).toContain('Could not find highest Java version.')
 })

 test('find EA version/javaVersion', async () => {
--- a/tests/liberica.test.ts
+++ b/tests/liberica.test.ts
@@ -3,11 +3,9 @@ import * as c from '../src/constants'
 import * as path from 'path'
 import * as semver from 'semver'
 import { expect, test } from '@jest/globals'
-import { fileURLToPath } from 'url'

-const dirname = path.dirname(fileURLToPath(import.meta.url))
-process.env['RUNNER_TOOL_CACHE'] = path.join(dirname, 'TOOL_CACHE')
-process.env['RUNNER_TEMP'] = path.join(dirname, 'TEMP')
+process.env['RUNNER_TOOL_CACHE'] = path.join(__dirname, 'TOOL_CACHE')
+process.env['RUNNER_TEMP'] = path.join(__dirname, 'TEMP')

 /* eslint jest/expect-expect: ["error", { "assertFunctionNames": ["expect", "expectLatestToBe", "expectURL"] }] */

--- a/tests/mandrel.test.ts
+++ b/tests/mandrel.test.ts
@@ -2,11 +2,9 @@ import * as path from 'path'
 import * as mandrel from '../src/mandrel'
 import { expect, test } from '@jest/globals'
 import { getLatestRelease } from '../src/utils'
-import { fileURLToPath } from 'url'

-const dirname = path.dirname(fileURLToPath(import.meta.url))
-process.env['RUNNER_TOOL_CACHE'] = path.join(dirname, 'TOOL_CACHE')
-process.env['RUNNER_TEMP'] = path.join(dirname, 'TEMP')
+process.env['RUNNER_TOOL_CACHE'] = path.join(__dirname, 'TOOL_CACHE')
+process.env['RUNNER_TEMP'] = path.join(__dirname, 'TEMP')

 test('request invalid version/javaVersion combination', async () => {
  for (const combination of [
--- a/tests/msvc.test.ts
+++ b/tests/msvc.test.ts
@@ -2,11 +2,9 @@ import * as path from 'path'
 import { expect, test } from '@jest/globals'
 import { needsWindowsEnvironmentSetup } from '../src/msvc'
 import { VERSION_DEV, VERSION_LATEST } from '../src/constants'
-import { fileURLToPath } from 'url'

-const dirname = path.dirname(fileURLToPath(import.meta.url))
-process.env['RUNNER_TOOL_CACHE'] = path.join(dirname, 'TOOL_CACHE')
-process.env['RUNNER_TEMP'] = path.join(dirname, 'TEMP')
+process.env['RUNNER_TOOL_CACHE'] = path.join(__dirname, 'TOOL_CACHE')
+process.env['RUNNER_TEMP'] = path.join(__dirname, 'TEMP')

 test('decide whether Window env must be set up for GraalVM for JDK', async () => {
  for (const javaVersion of ['17', '17.0.8', '17.0', '21', '22', '22-ea', '23-ea', VERSION_DEV]) {
--- a/tests/sbom.test.ts
+++ b/tests/sbom.test.ts
@@ -1,37 +1,55 @@
-/* eslint-disable @typescript-eslint/no-explicit-any */
-
 import * as c from '../src/constants'
+import { setUpSBOMSupport, processSBOM } from '../src/features/sbom'
+import * as core from '@actions/core'
+import * as github from '@actions/github'
+import * as glob from '@actions/glob'
 import { join } from 'path'
 import { tmpdir } from 'os'
-import { expect, jest } from '@jest/globals'
 import { mkdtempSync, writeFileSync, rmSync } from 'fs'
-import * as core from '../__fixtures__/core.js'
-import * as glob from '../__fixtures__/glob.js'
-import * as github from '../__fixtures__/github.js'

-// Mocks should be declared before the module being tested is imported.
-jest.unstable_mockModule('@actions/core', () => core)
-jest.unstable_mockModule('@actions/glob', () => glob)
-jest.unstable_mockModule('@actions/github', () => github)
-
-// The module being tested should be imported dynamically. This ensures that the
-// mocks are used in place of any actual dependencies.
-const { setUpSBOMSupport, processSBOM } = await import('../src/features/sbom.js')
+jest.mock('@actions/glob')
+jest.mock('@actions/github', () => ({
+  getOctokit: jest.fn(() => ({
+    request: jest.fn().mockResolvedValue(undefined)
+  })),
+  context: {
+    repo: {
+      owner: 'test-owner',
+      repo: 'test-repo'
+    },
+    sha: 'test-sha',
+    ref: 'test-ref',
+    workflow: 'test-workflow',
+    job: 'test-job',
+    runId: '12345'
+  }
+}))

 function mockFindSBOM(files: string[]) {
-  glob.create.mockImplementation(
-    jest.fn<() => Promise<any>>().mockResolvedValue({
-      glob: jest.fn<() => Promise<string[]>>().mockResolvedValue(files)
-    })
-  )
+  const mockCreate = jest.fn().mockResolvedValue({
+    glob: jest.fn().mockResolvedValue(files)
+  })
+  ;(glob.create as jest.Mock).mockImplementation(mockCreate)
 }

-const request = jest.fn<any>().mockResolvedValue(undefined)
+// Mocks the GitHub dependency submission API return value
+// 'undefined' is treated as a successful request
+function mockGithubAPIReturnValue(returnValue: Error | undefined = undefined) {
+  const mockOctokit = {
+    request:
+      returnValue === undefined ? jest.fn().mockResolvedValue(returnValue) : jest.fn().mockRejectedValue(returnValue)
+  }
+  ;(github.getOctokit as jest.Mock).mockReturnValue(mockOctokit)
+  return mockOctokit
+}

 describe('sbom feature', () => {
+  let spyInfo: jest.SpyInstance<void, Parameters<typeof core.info>>
+  let spyWarning: jest.SpyInstance<void, Parameters<typeof core.warning>>
+  let spyExportVariable: jest.SpyInstance<void, Parameters<typeof core.exportVariable>>
  let workspace: string
  let originalEnv: NodeJS.ProcessEnv
-  const javaVersion = '25.0.0'
+  const javaVersion = '24.0.0'
  const distribution = c.DISTRIBUTION_GRAALVM

  beforeEach(() => {
@@ -44,11 +62,12 @@ describe('sbom feature', () => {
    }

    workspace = mkdtempSync(join(tmpdir(), 'setup-graalvm-sbom-'))
+    mockGithubAPIReturnValue()

-    core.info.mockImplementation(() => null)
-    core.warning.mockImplementation(() => null)
-    core.debug.mockImplementation(() => null)
-    core.getInput.mockImplementation((name: string) => {
+    spyInfo = jest.spyOn(core, 'info').mockImplementation(() => null)
+    spyWarning = jest.spyOn(core, 'warning').mockImplementation(() => null)
+    spyExportVariable = jest.spyOn(core, 'exportVariable').mockImplementation(() => null)
+    jest.spyOn(core, 'getInput').mockImplementation((name: string) => {
      if (name === 'native-image-enable-sbom') {
        return 'true'
      }
@@ -57,17 +76,14 @@ describe('sbom feature', () => {
      }
      return ''
    })
-
-    github.getOctokit.mockImplementation(
-      jest.fn<any>(() => ({
-        request: request
-      }))
-    )
  })

  afterEach(() => {
    process.env = originalEnv
    jest.clearAllMocks()
+    spyInfo.mockRestore()
+    spyWarning.mockRestore()
+    spyExportVariable.mockRestore()
    rmSync(workspace, { recursive: true, force: true })
  })

@@ -92,7 +108,7 @@ describe('sbom feature', () => {
    })

    it('should not throw an error when the java-version is supported', () => {
-      const supported_versions = ['25', '26-ea', 'latest-ea']
+      const supported_versions = ['24', '24-ea', '24.0.2', 'latest-ea']
      for (const version of supported_versions) {
        expect(() => setUpSBOMSupport(version, distribution)).not.toThrow()
      }
@@ -101,35 +117,35 @@ describe('sbom feature', () => {
    it('should set the SBOM option when activated', () => {
      setUpSBOMSupport(javaVersion, distribution)

-      expect(core.exportVariable).toHaveBeenCalledWith(
+      expect(spyExportVariable).toHaveBeenCalledWith(
        c.NATIVE_IMAGE_OPTIONS_ENV,
        expect.stringContaining('--enable-sbom=export')
      )
-      expect(core.info).toHaveBeenCalledWith('Enabled SBOM generation for Native Image build')
-      expect(core.warning).not.toHaveBeenCalled()
+      expect(spyInfo).toHaveBeenCalledWith('Enabled SBOM generation for Native Image build')
+      expect(spyWarning).not.toHaveBeenCalled()
    })

    it('should not set the SBOM option when not activated', () => {
-      core.getInput.mockReturnValue('false')
+      jest.spyOn(core, 'getInput').mockReturnValue('false')
      setUpSBOMSupport(javaVersion, distribution)

-      expect(core.exportVariable).not.toHaveBeenCalled()
-      expect(core.info).not.toHaveBeenCalled()
-      expect(core.warning).not.toHaveBeenCalled()
+      expect(spyExportVariable).not.toHaveBeenCalled()
+      expect(spyInfo).not.toHaveBeenCalled()
+      expect(spyWarning).not.toHaveBeenCalled()
    })
  })

  describe('process', () => {
    async function setUpAndProcessSBOM(sbom: object): Promise<void> {
      setUpSBOMSupport(javaVersion, distribution)
-      core.info.mockClear()
+      spyInfo.mockClear()

      // Mock 'native-image' invocation by creating the SBOM file
      const sbomPath = join(workspace, 'test.sbom.json')
      writeFileSync(sbomPath, JSON.stringify(sbom, null, 2))

      mockFindSBOM([sbomPath])
-      core.getState.mockReturnValue(javaVersion)
+      jest.spyOn(core, 'getState').mockReturnValue(javaVersion)

      await processSBOM()
    }
@@ -144,13 +160,13 @@ describe('sbom feature', () => {
          type: 'library',
          group: 'org.json',
          name: 'json',
-          version: '20250517',
-          purl: 'pkg:maven/org.json/json@20250517',
-          'bom-ref': 'pkg:maven/org.json/json@20250517',
+          version: '20241224',
+          purl: 'pkg:maven/org.json/json@20241224',
+          'bom-ref': 'pkg:maven/org.json/json@20241224',
          properties: [
            {
              name: 'syft:cpe23',
-              value: 'cpe:2.3:a:json:json:20250517:*:*:*:*:*:*:*'
+              value: 'cpe:2.3:a:json:json:20241224:*:*:*:*:*:*:*'
            }
          ]
        },
@@ -166,10 +182,10 @@ describe('sbom feature', () => {
      dependencies: [
        {
          ref: 'pkg:maven/com.oracle/main-test-app@1.0-SNAPSHOT',
-          dependsOn: ['pkg:maven/org.json/json@20250517']
+          dependsOn: ['pkg:maven/org.json/json@20241224']
        },
        {
-          ref: 'pkg:maven/org.json/json@20250517',
+          ref: 'pkg:maven/org.json/json@20241224',
          dependsOn: []
        }
      ]
@@ -182,12 +198,12 @@ describe('sbom feature', () => {
    it('should process SBOM and display components', async () => {
      await setUpAndProcessSBOM(sampleSBOM)

-      expect(core.info).toHaveBeenCalledWith('Found SBOM: ' + join(workspace, 'test.sbom.json'))
-      expect(core.info).toHaveBeenCalledWith('=== SBOM Content ===')
-      expect(core.info).toHaveBeenCalledWith('- pkg:maven/org.json/json@20250517')
-      expect(core.info).toHaveBeenCalledWith('- pkg:maven/com.oracle/main-test-app@1.0-SNAPSHOT')
-      expect(core.info).toHaveBeenCalledWith('   depends on: pkg:maven/org.json/json@20250517')
-      expect(core.warning).not.toHaveBeenCalled()
+      expect(spyInfo).toHaveBeenCalledWith('Found SBOM: ' + join(workspace, 'test.sbom.json'))
+      expect(spyInfo).toHaveBeenCalledWith('=== SBOM Content ===')
+      expect(spyInfo).toHaveBeenCalledWith('- pkg:maven/org.json/json@20241224')
+      expect(spyInfo).toHaveBeenCalledWith('- pkg:maven/com.oracle/main-test-app@1.0-SNAPSHOT')
+      expect(spyInfo).toHaveBeenCalledWith('   depends on: pkg:maven/org.json/json@20241224')
+      expect(spyWarning).not.toHaveBeenCalled()
    })

    it('should handle components without purl', async () => {
@@ -204,14 +220,14 @@ describe('sbom feature', () => {
      }
      await setUpAndProcessSBOM(sbomWithoutPurl)

-      expect(core.info).toHaveBeenCalledWith('=== SBOM Content ===')
-      expect(core.info).toHaveBeenCalledWith('- no-purl-package@1.0.0')
-      expect(core.warning).not.toHaveBeenCalled()
+      expect(spyInfo).toHaveBeenCalledWith('=== SBOM Content ===')
+      expect(spyInfo).toHaveBeenCalledWith('- no-purl-package@1.0.0')
+      expect(spyWarning).not.toHaveBeenCalled()
    })

    it('should handle missing SBOM file', async () => {
      setUpSBOMSupport(javaVersion, distribution)
-      core.info.mockClear()
+      spyInfo.mockClear()

      mockFindSBOM([])

@@ -234,9 +250,10 @@ describe('sbom feature', () => {
    })

    it('should submit dependencies when processing valid SBOM', async () => {
+      const mockOctokit = mockGithubAPIReturnValue(undefined)
      await setUpAndProcessSBOM(sampleSBOM)

-      expect(request).toHaveBeenCalledWith(
+      expect(mockOctokit.request).toHaveBeenCalledWith(
        'POST /repos/{owner}/{repo}/dependency-graph/snapshots',
        expect.objectContaining({
          owner: 'test-owner',
@@ -253,27 +270,23 @@ describe('sbom feature', () => {
              name: 'test.sbom.json',
              resolved: expect.objectContaining({
                json: expect.objectContaining({
-                  package_url: 'pkg:maven/org.json/json@20250517',
+                  package_url: 'pkg:maven/org.json/json@20241224',
                  dependencies: []
                }),
                'main-test-app': expect.objectContaining({
                  package_url: 'pkg:maven/com.oracle/main-test-app@1.0-SNAPSHOT',
-                  dependencies: ['pkg:maven/org.json/json@20250517']
+                  dependencies: ['pkg:maven/org.json/json@20241224']
                })
              })
            })
          })
        })
      )
-      expect(core.info).toHaveBeenCalledWith('Dependency snapshot submitted successfully.')
+      expect(spyInfo).toHaveBeenCalledWith('Dependency snapshot submitted successfully.')
    })

    it('should handle GitHub API submission errors gracefully', async () => {
-      github.getOctokit.mockImplementation(
-        jest.fn<any>(() => ({
-          request: jest.fn<(a: any, b: any) => Promise<any>>().mockRejectedValue(new Error('API submission failed'))
-        }))
-      )
+      mockGithubAPIReturnValue(new Error('API submission failed'))

      await expect(setUpAndProcessSBOM(sampleSBOM)).rejects.toBeInstanceOf(Error)
    })
--- a/tests/sbom/main-test-app/pom.xml
+++ b/tests/sbom/main-test-app/pom.xml
@@ -17,7 +17,7 @@
        <dependency>
            <groupId>org.json</groupId>
            <artifactId>json</artifactId>
-            <version>20250517</version>
+            <version>20241224</version>
        </dependency>
    </dependencies>

@@ -29,7 +29,7 @@
                    <plugin>
                        <groupId>org.graalvm.buildtools</groupId>
                        <artifactId>native-maven-plugin</artifactId>
-                        <version>0.11.0</version>
+                        <version>0.10.3</version>
                        <executions>
                            <execution>
                                <goals>
--- a/tests/sbom/main-test-app/verify-sbom.cmd
+++ b/tests/sbom/main-test-app/verify-sbom.cmd
@@ -2,7 +2,7 @@
 set "SCRIPT_DIR=%~dp0"

 for %%p in (
-    "\"pkg:maven/org.json/json@20250517\""
+    "\"pkg:maven/org.json/json@20241224\""
    "\"main-test-app\""
    "\"svm\""
    "\"nativeimage\""
--- a/tests/sbom/main-test-app/verify-sbom.sh
+++ b/tests/sbom/main-test-app/verify-sbom.sh
@@ -2,7 +2,7 @@
 script_dir="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"

 required_patterns=(
-    '"pkg:maven/org.json/json@20250517"'
+    '"pkg:maven/org.json/json@20241224"'
    '"main-test-app"'
    '"svm"'
    '"nativeimage"'
--- a/action.yml
+++ b/action.yml
@@ -72,6 +72,6 @@ outputs:
    description: 'A boolean value to indicate an exact match was found for the primary key'
 runs:
  using: 'node20'
-  main: 'dist/main.js'
-  post: 'dist/cleanup.js'
+  main: 'dist/main/index.js'
+  post: 'dist/cleanup/index.js'
  post-if: 'success()'
--- a/dist/cleanup/index.js
+++ b/dist/cleanup/index.js
--- a/dist/main.js
+++ b/dist/main.js
--- a/dist/main/index.js
+++ b/dist/main/index.js
--- a/eslint.config.mjs
+++ b/eslint.config.mjs
@@ -9,9 +9,13 @@ import _import from 'eslint-plugin-import'
 import jest from 'eslint-plugin-jest'
 import prettier from 'eslint-plugin-prettier'
 import globals from 'globals'
+import path from 'node:path'
+import { fileURLToPath } from 'node:url'

+const __filename = fileURLToPath(import.meta.url)
+const __dirname = path.dirname(__filename)
 const compat = new FlatCompat({
-  baseDirectory: import.meta.dirname,
+  baseDirectory: __dirname,
  recommendedConfig: js.configs.recommended,
  allConfig: js.configs.all
 })
@@ -48,18 +52,8 @@ export default [
      sourceType: 'module',

      parserOptions: {
-        projectService: {
-          allowDefaultProject: [
-            '__fixtures__/*.ts',
-            '__tests__/*.ts',
-            'eslint.config.mjs',
-            'jest.config.js',
-            'rollup.cleanup.config.ts',
-            'rollup.main.config.ts'
-          ],
-          maximumDefaultProjectFileMatchCount_THIS_WILL_SLOW_DOWN_LINTING: 32
-        },
-        tsconfigRootDir: import.meta.dirname
+        project: ['tsconfig.eslint.json'],
+        tsconfigRootDir: '.'
      }
    },

@@ -67,7 +61,7 @@ export default [
      'import/resolver': {
        typescript: {
          alwaysTryTypes: true,
-          project: 'tsconfig.json'
+          project: 'tsconfig.eslint.json'
        }
      }
    },
--- a/jest.config.js
+++ b/jest.config.js
@@ -1,29 +1,14 @@
-// See: https://jestjs.io/docs/configuration
-
-/** @type {import('ts-jest').JestConfigWithTsJest} **/
-export default {
+module.exports = {
  clearMocks: true,
  collectCoverage: true,
  collectCoverageFrom: ['./src/**'],
  coverageDirectory: './coverage',
  coveragePathIgnorePatterns: ['/node_modules/', '/dist/'],
  coverageReporters: ['json-summary', 'text', 'lcov'],
-  extensionsToTreatAsEsm: ['.ts'],
-  moduleFileExtensions: ['ts', 'js'],
-  preset: 'ts-jest',
-  reporters: ['default'],
-  resolver: 'ts-jest-resolver',
-  testEnvironment: 'node',
+  moduleFileExtensions: ['js', 'ts'],
  testMatch: ['**/*.test.ts'],
-  testPathIgnorePatterns: ['/dist/', '/node_modules/'],
  transform: {
-    '^.+\\.ts$': [
-      'ts-jest',
-      {
-        tsconfig: 'tsconfig.json',
-        useESM: true
-      }
-    ]
+    '^.+\\.ts$': 'ts-jest'
  },
  verbose: true
 }
--- a/package-lock.json
+++ b/package-lock.json
--- a/package.json
+++ b/package.json
@@ -2,8 +2,7 @@
  "name": "setup-graalvm",
  "author": "GraalVM Community",
  "description": "GitHub Action for GraalVM",
-  "version": "1.4.4",
-  "type": "module",
+  "version": "1.3.3",
  "private": true,
  "repository": {
    "type": "git",
@@ -18,9 +17,6 @@
    "actions",
    "setup"
  ],
-  "exports": {
-    ".": "./dist/index.js"
-  },
  "engines": {
    "node": ">=20"
  },
@@ -30,61 +26,50 @@
    "format:check": "npx prettier --check .",
    "lint": "npx eslint .",
    "package": "npm run package:main && npm run package:cleanup",
-    "package:main": "npx rollup --config rollup.main.config.ts --configPlugin @rollup/plugin-typescript",
-    "package:cleanup": "npx rollup --config rollup.cleanup.config.ts --configPlugin @rollup/plugin-typescript",
-    "test": "NODE_OPTIONS=--experimental-vm-modules NODE_NO_WARNINGS=1 npx jest",
+    "package:main": "npx ncc build src/main.ts -o dist/main",
+    "package:cleanup": "npx ncc build src/cleanup.ts -o dist/cleanup",
+    "test": "npx jest",
    "all": "npm run format:write && npm run lint && npm run test && npm run package"
  },
  "license": "UPL",
  "dependencies": {
-    "@actions/cache": "^4.1.0",
+    "@actions/cache": "^4.0.3",
    "@actions/core": "^1.11.1",
    "@actions/exec": "^1.1.1",
    "@actions/github": "^6.0.1",
    "@actions/glob": "^0.5.0",
-    "@actions/http-client": "^3.0.0",
-    "@actions/io": "^2.0.0",
+    "@actions/http-client": "^2.2.3",
+    "@actions/io": "^1.1.3",
    "@actions/tool-cache": "^2.0.2",
-    "@octokit/types": "^16.0.0",
+    "@octokit/core": "^5.2.0",
+    "@octokit/types": "^14.1.0",
    "@github/dependency-submission-toolkit": "^2.0.5",
-    "semver": "^7.7.3",
-    "uuid": "^13.0.0"
+    "semver": "^7.7.2",
+    "uuid": "^11.1.0"
  },
  "devDependencies": {
-    "@eslint/compat": "^2.0.0",
-    "@rollup/plugin-commonjs": "^29.0.0",
-    "@rollup/plugin-json": "^6.1.0",
-    "@rollup/plugin-node-resolve": "^16.0.3",
-    "@rollup/plugin-typescript": "^12.3.0",
-    "@types/jest": "^30.0.0",
-    "@types/node": "^24.10.1",
-    "@types/semver": "^7.7.1",
-    "@typescript-eslint/eslint-plugin": "^8.48.0",
+    "@eslint/compat": "^1.2.9",
+    "@types/jest": "^29.5.14",
+    "@types/node": "^20.17.57",
+    "@types/semver": "^7.7.0",
+    "@types/uuid": "^10.0.0",
+    "@typescript-eslint/eslint-plugin": "^8.33.0",
    "@typescript-eslint/parser": "^8.31.1",
-    "eslint": "^9.39.1",
-    "eslint-config-prettier": "^10.1.8",
-    "eslint-import-resolver-typescript": "^4.4.4",
-    "eslint-plugin-import": "^2.32.0",
-    "eslint-plugin-jest": "^29.2.1",
-    "eslint-plugin-jsonc": "^2.21.0",
+    "@vercel/ncc": "^0.38.3",
+    "eslint": "^9.28.0",
+    "eslint-config-prettier": "^10.1.5",
+    "eslint-import-resolver-typescript": "^4.4.2",
+    "eslint-plugin-import": "^2.31.0",
+    "eslint-plugin-jest": "^28.12.0",
+    "eslint-plugin-jsonc": "^2.20.1",
    "eslint-plugin-node": "^11.1.0",
-    "eslint-plugin-prettier": "^5.5.4",
-    "jest": "^30.2.0",
-    "js-yaml": "^4.1.1",
-    "prettier": "^3.7.3",
+    "eslint-plugin-prettier": "^5.4.1",
+    "jest": "^29.7.0",
+    "js-yaml": "^4.1.0",
+    "prettier": "^3.5.3",
    "prettier-eslint": "^16.4.2",
-    "rollup": "^4.53.3",
-    "ts-jest": "^29.4.6",
-    "ts-jest-resolver": "^2.0.1",
+    "ts-jest": "^29.3.4",
    "ts-node": "^10.9.2",
-    "typescript": "^5.9.3"
-  },
-  "optionalDependencies": {
-    "@rollup/rollup-linux-x64-gnu": "*"
-  },
-  "overrides": {
-    "@actions/glob": {
-      "minimatch": "^10.0.1"
-    }
+    "typescript": "^5.8.3"
  }
 }
--- a/rollup.cleanup.config.ts
+++ b/rollup.cleanup.config.ts
@@ -1,19 +0,0 @@
-// See: https://rollupjs.org/introduction/
-
-import commonjs from '@rollup/plugin-commonjs'
-import json from '@rollup/plugin-json'
-import nodeResolve from '@rollup/plugin-node-resolve'
-import typescript from '@rollup/plugin-typescript'
-
-const config = {
-  input: 'src/cleanup.ts',
-  output: {
-    esModule: true,
-    file: 'dist/cleanup.js',
-    format: 'es',
-    sourcemap: false
-  },
-  plugins: [typescript(), nodeResolve({ preferBuiltins: true }), commonjs(), json()]
-}
-
-export default config
--- a/rollup.main.config.ts
+++ b/rollup.main.config.ts
@@ -1,19 +0,0 @@
-// See: https://rollupjs.org/introduction/
-
-import commonjs from '@rollup/plugin-commonjs'
-import json from '@rollup/plugin-json'
-import nodeResolve from '@rollup/plugin-node-resolve'
-import typescript from '@rollup/plugin-typescript'
-
-const config = {
-  input: 'src/main.ts',
-  output: {
-    esModule: true,
-    file: 'dist/main.js',
-    format: 'es',
-    sourcemap: false
-  },
-  plugins: [typescript(), nodeResolve({ preferBuiltins: true }), commonjs(), json()]
-}
-
-export default config
--- a/src/cleanup.ts
+++ b/src/cleanup.ts
@@ -25,10 +25,10 @@
 */

 import * as core from '@actions/core'
-import * as constants from './constants.js'
-import { save } from './features/cache.js'
-import { generateReports } from './features/reports.js'
-import { processSBOM } from './features/sbom.js'
+import * as constants from './constants'
+import { save } from './features/cache'
+import { generateReports } from './features/reports'
+import { processSBOM } from './features/sbom'

 /**
 * Check given input and run a save process for the specified package manager
--- a/src/constants.ts
+++ b/src/constants.ts
@@ -1,6 +1,6 @@
 import * as otypes from '@octokit/types'

-export const ACTION_VERSION = '1.4.4'
+export const ACTION_VERSION = '1.3.3'

 export const INPUT_VERSION = 'version'
 export const INPUT_GDS_TOKEN = 'gds-token'
@@ -53,13 +53,13 @@ export const ERROR_REQUEST = 'Please file an issue at: https://github.com/graalv
 export const ERROR_HINT =
  'If you think this is a mistake, please file an issue at: https://github.com/graalvm/setup-graalvm/issues.'

-export type LatestReleaseResponseData =
-  otypes.Endpoints['GET /repos/{owner}/{repo}/releases/latest']['response']['data']
+export type LatestReleaseResponse = otypes.Endpoints['GET /repos/{owner}/{repo}/releases/latest']['response']

-export type MatchingRefsResponseData =
-  otypes.Endpoints['GET /repos/{owner}/{repo}/git/matching-refs/{ref}']['response']['data']
+export type MatchingRefsResponse = otypes.Endpoints['GET /repos/{owner}/{repo}/git/matching-refs/{ref}']['response']

-export type ContentsResponseData = otypes.Endpoints['GET /repos/{owner}/{repo}/contents/{path}']['response']['data']
+export type ReleasesResponse = otypes.Endpoints['GET /repos/{owner}/{repo}/releases']['response']
+
+export type ContentsResponse = otypes.Endpoints['GET /repos/{owner}/{repo}/contents/{path}']['response']

 export interface OracleGraalVMEAFile {
  filename: string
--- a/src/dependencies.ts
+++ b/src/dependencies.ts
@@ -1,6 +1,6 @@
 import * as core from '@actions/core'
-import { GRAALVM_PLATFORM } from './constants.js'
-import { exec } from './utils.js'
+import { GRAALVM_PLATFORM } from './constants'
+import { exec } from './utils'

 const APT_GET_INSTALL_BASE = 'sudo apt-get -y --no-upgrade install'
 const COMPONENT_TO_DEPS = new Map<string, Map<string, string>>([
--- a/src/features/musl.ts
+++ b/src/features/musl.ts
@@ -1,11 +1,11 @@
-import * as c from '../constants.js'
+import * as c from '../constants'
 import * as core from '@actions/core'
 import * as tc from '@actions/tool-cache'
+import { exec } from '../utils'
 import { join } from 'path'
-import { downloadFile } from '../utils.js'

-const MUSL_NAME = 'musl-toolchain'
-const MUSL_VERSION = '1.2.5-oracle-00001'
+const MUSL_NAME = 'x86_64-linux-musl-native'
+const MUSL_VERSION = '10.2.1'

 export async function setUpNativeImageMusl(): Promise<void> {
  if (!c.IS_LINUX) {
@@ -17,11 +17,27 @@ export async function setUpNativeImageMusl(): Promise<void> {
    core.info(`Found ${MUSL_NAME} ${MUSL_VERSION} in tool-cache @ ${toolPath}`)
  } else {
    core.startGroup(`Setting up musl for GraalVM Native Image...`)
-    const muslDownloadPath = await downloadFile(
-      `https://gds.oracle.com/download/bfs/archive/musl-toolchain-${MUSL_VERSION}-linux-amd64.tar.gz`
+    const muslDownloadPath = await tc.downloadTool(
+      `https://github.com/graalvm/setup-graalvm/releases/download/x86_64-linux-musl-${MUSL_VERSION}/${MUSL_NAME}.tgz`
    )
    const muslExtractPath = await tc.extractTar(muslDownloadPath)
    const muslPath = join(muslExtractPath, MUSL_NAME)
+
+    const zlibCommit = 'ec3df00224d4b396e2ac6586ab5d25f673caa4c2'
+    const zlibDownloadPath = await tc.downloadTool(`https://github.com/madler/zlib/archive/${zlibCommit}.tar.gz`)
+    const zlibExtractPath = await tc.extractTar(zlibDownloadPath)
+    const zlibPath = join(zlibExtractPath, `zlib-${zlibCommit}`)
+    const zlibBuildOptions = {
+      cwd: zlibPath,
+      env: {
+        ...process.env,
+        CC: join(muslPath, 'bin', 'gcc')
+      }
+    }
+    await exec('./configure', [`--prefix=${muslPath}`, '--static'], zlibBuildOptions)
+    await exec('make', [], zlibBuildOptions)
+    await exec('make', ['install'], { cwd: zlibPath })
+
    core.info(`Adding ${MUSL_NAME} ${MUSL_VERSION} to tool-cache ...`)
    toolPath = await tc.cacheDir(muslPath, MUSL_NAME, MUSL_VERSION)
    core.endGroup()
--- a/src/features/reports.ts
+++ b/src/features/reports.ts
@@ -1,4 +1,4 @@
-import * as c from '../constants.js'
+import * as c from '../constants'
 import * as core from '@actions/core'
 import * as fs from 'fs'
 import * as github from '@actions/github'
@@ -11,7 +11,7 @@ import {
  updatePRComment,
  tmpfile,
  setNativeImageOption
-} from '../utils.js'
+} from '../utils'

 const BUILD_OUTPUT_JSON_PATH = tmpfile('native-image-build-output.json')
 const BYTES_TO_KiB = 1024
--- a/src/features/sbom.ts
+++ b/src/features/sbom.ts
@@ -1,11 +1,11 @@
-import * as c from '../constants.js'
+import * as c from '../constants'
 import * as core from '@actions/core'
 import * as fs from 'fs'
 import * as github from '@actions/github'
 import * as glob from '@actions/glob'
 import { basename } from 'path'
 import * as semver from 'semver'
-import { setNativeImageOption } from '../utils.js'
+import { setNativeImageOption } from '../utils'

 const INPUT_NI_SBOM = 'native-image-enable-sbom'
 const SBOM_FILE_SUFFIX = '.sbom.json'
--- a/src/gds.ts
+++ b/src/gds.ts
@@ -1,4 +1,4 @@
-import * as c from './constants.js'
+import * as c from './constants'
 import * as core from '@actions/core'
 import * as fs from 'fs'
 import * as httpClient from '@actions/http-client'
@@ -8,8 +8,8 @@ import * as stream from 'stream'
 import * as util from 'util'
 import * as semver from 'semver'
 import { IncomingHttpHeaders, OutgoingHttpHeaders } from 'http'
-import { RetryHelper } from '@actions/tool-cache/lib/retry-helper.js'
-import { calculateSHA256 } from './utils.js'
+import { RetryHelper } from '@actions/tool-cache/lib/retry-helper'
+import { calculateSHA256 } from './utils'
 import { ok } from 'assert'
 import { v4 as uuidv4 } from 'uuid'

--- a/src/graalvm.ts
+++ b/src/graalvm.ts
@@ -1,16 +1,16 @@
-import * as c from './constants.js'
+import * as c from './constants'
 import * as core from '@actions/core'
 import * as semver from 'semver'
 import {
-  downloadFile,
  downloadAndExtractJDK,
  downloadExtractAndCacheJDK,
  getContents,
  getLatestRelease,
  getMatchingTags,
  getTaggedRelease
-} from './utils.js'
-import { downloadGraalVM, downloadGraalVMEELegacy } from './gds.js'
+} from './utils'
+import { downloadGraalVM, downloadGraalVMEELegacy } from './gds'
+import { downloadTool } from '@actions/tool-cache'
 import { basename } from 'path'

 const GRAALVM_DL_BASE = 'https://download.oracle.com/graalvm'
@@ -153,7 +153,7 @@ function determineToolName(javaVersion: string, isCommunity: boolean) {

 async function downloadGraalVMJDK(downloadUrl: string, javaVersion: string): Promise<string> {
  try {
-    return await downloadFile(downloadUrl)
+    return await downloadTool(downloadUrl)
  } catch (error) {
    if (error instanceof Error && error.message.includes('404')) {
      // Not Found
@@ -174,7 +174,7 @@ export async function setUpGraalVMJDKDevBuild(): Promise<string> {
  return downloadAndExtractJDK(downloadUrl)
 }

-export function findHighestJavaVersion(release: c.LatestReleaseResponseData, version: string): string | undefined {
+export function findHighestJavaVersion(release: c.LatestReleaseResponse['data'], version: string): string {
  const graalVMIdentifierPattern = determineGraalVMLegacyIdentifier(false, version, '(\\d+)')
  const expectedFileNameRegExp = new RegExp(
    `^${graalVMIdentifierPattern}${c.GRAALVM_FILE_EXTENSION.replace(/\./g, '\\.')}$`
@@ -192,7 +192,9 @@ export function findHighestJavaVersion(release: c.LatestReleaseResponseData, ver
  if (highestJavaVersion > 0) {
    return String(highestJavaVersion)
  } else {
-    return undefined
+    throw new Error(
+      'Could not find highest Java version. Please file an issue at: https://github.com/graalvm/setup-graalvm/issues.'
+    )
  }
 }

@@ -212,7 +214,7 @@ export async function setUpGraalVMLatest_22_X(gdsToken: string, javaVersion: str
  return setUpGraalVMRelease(gdsToken, version, javaVersion)
 }

-export function findGraalVMVersion(release: c.LatestReleaseResponseData) {
+export function findGraalVMVersion(release: c.LatestReleaseResponse['data']) {
  const tag_name = release.tag_name
  if (!tag_name.startsWith(GRAALVM_TAG_PREFIX)) {
    throw new Error(`Could not find latest GraalVM release: ${tag_name}`)
@@ -232,10 +234,8 @@ export async function setUpGraalVMRelease(gdsToken: string, version: string, jav
  return downloadExtractAndCacheJDK(downloader, toolName, version)
 }

-function findDownloadUrl(release: c.LatestReleaseResponseData, javaVersion?: string): string {
-  const graalVMIdentifier = javaVersion
-    ? determineGraalVMLegacyIdentifier(false, c.VERSION_DEV, javaVersion)
-    : determineGraalVMIdentifier(false, c.VERSION_DEV)
+function findDownloadUrl(release: c.LatestReleaseResponse['data'], javaVersion: string): string {
+  const graalVMIdentifier = determineGraalVMLegacyIdentifier(false, c.VERSION_DEV, javaVersion)
  const expectedFileName = `${graalVMIdentifier}${c.GRAALVM_FILE_EXTENSION}`
  for (const asset of release.assets) {
    if (asset.name === expectedFileName) {
@@ -247,11 +247,6 @@ function findDownloadUrl(release: c.LatestReleaseResponseData, javaVersion?: str
  )
 }

-function determineGraalVMIdentifier(isEE: boolean, version: string): string {
-  const infix = isEE ? 'ee' : version === c.VERSION_DEV ? 'community' : 'ce'
-  return `graalvm-${infix}-${version}-${c.GRAALVM_PLATFORM}-${c.GRAALVM_ARCH}`
-}
-
 function determineGraalVMLegacyIdentifier(isEE: boolean, version: string, javaVersion: string): string {
  return `${determineLegacyToolName(isEE, version, javaVersion)}-${c.GRAALVM_ARCH}-${version}`
 }
@@ -265,7 +260,7 @@ async function downloadGraalVMCELegacy(version: string, javaVersion: string): Pr
  const graalVMIdentifier = determineGraalVMLegacyIdentifier(false, version, javaVersion)
  const downloadUrl = `${GRAALVM_CE_DL_BASE}/${GRAALVM_TAG_PREFIX}${version}/${graalVMIdentifier}${c.GRAALVM_FILE_EXTENSION}`
  try {
-    return await downloadFile(downloadUrl)
+    return await downloadTool(downloadUrl)
  } catch (error) {
    if (error instanceof Error && error.message.includes('404')) {
      // Not Found
--- a/src/gu.ts
+++ b/src/gu.ts
@@ -1,8 +1,8 @@
-import * as c from './constants.js'
+import * as c from './constants'
 import * as core from '@actions/core'
 import * as semver from 'semver'
-import { GRAALVM_PLATFORM } from './constants.js'
-import { exec } from './utils.js'
+import { GRAALVM_PLATFORM } from './constants'
+import { exec } from './utils'
 import { join } from 'path'

 const BASE_FLAGS = ['--non-interactive', 'install', '--no-progress']
--- a/src/liberica.ts
+++ b/src/liberica.ts
@@ -1,6 +1,7 @@
-import * as c from './constants.js'
+import * as c from './constants'
 import * as semver from 'semver'
-import { downloadFile, downloadExtractAndCacheJDK, getTaggedRelease, getMatchingTags } from './utils.js'
+import { downloadExtractAndCacheJDK, getTaggedRelease, getMatchingTags } from './utils'
+import { downloadTool } from '@actions/tool-cache'
 import { spawnSync } from 'child_process'

 const LIBERICA_GH_USER = 'bell-sw'
@@ -12,7 +13,7 @@ export async function setUpLiberica(javaVersion: string, javaPackage: string): P
  const resolvedJavaVersion = await findLatestLibericaJavaVersion(javaVersion)
  const downloadUrl = await findLibericaURL(resolvedJavaVersion, javaPackage)
  const toolName = determineToolName(javaVersion, javaPackage)
-  return downloadExtractAndCacheJDK(async () => downloadFile(downloadUrl), toolName, javaVersion)
+  return downloadExtractAndCacheJDK(async () => downloadTool(downloadUrl), toolName, javaVersion)
 }

 export async function findLatestLibericaJavaVersion(javaVersion: string): Promise<string> {
--- a/src/main.ts
+++ b/src/main.ts
@@ -1,20 +1,20 @@
-import * as c from './constants.js'
+import * as c from './constants'
 import * as core from '@actions/core'
-import * as graalvm from './graalvm.js'
+import * as graalvm from './graalvm'
 import * as semver from 'semver'
 import { isFeatureAvailable as isCacheAvailable } from '@actions/cache'
 import { basename, join } from 'path'
-import { restore } from './features/cache.js'
-import { setUpDependencies } from './dependencies.js'
-import { setUpGUComponents } from './gu.js'
-import { setUpMandrel } from './mandrel.js'
-import { setUpLiberica } from './liberica.js'
-import { checkForUpdates } from './features/check-for-updates.js'
-import { setUpNativeImageMusl } from './features/musl.js'
-import { setUpWindowsEnvironment } from './msvc.js'
-import { setUpNativeImageBuildReports } from './features/reports.js'
+import { restore } from './features/cache'
+import { setUpDependencies } from './dependencies'
+import { setUpGUComponents } from './gu'
+import { setUpMandrel } from './mandrel'
+import { setUpLiberica } from './liberica'
+import { checkForUpdates } from './features/check-for-updates'
+import { setUpNativeImageMusl } from './features/musl'
+import { setUpWindowsEnvironment } from './msvc'
+import { setUpNativeImageBuildReports } from './features/reports'
 import { exec } from '@actions/exec'
-import { setUpSBOMSupport } from './features/sbom.js'
+import { setUpSBOMSupport } from './features/sbom'

 async function run(): Promise<void> {
  try {
--- a/src/mandrel.ts
+++ b/src/mandrel.ts
@@ -1,6 +1,6 @@
-import * as c from './constants.js'
+import * as c from './constants'
 import * as httpClient from '@actions/http-client'
-import { downloadExtractAndCacheJDK } from './utils.js'
+import { downloadExtractAndCacheJDK } from './utils'
 import { downloadTool } from '@actions/tool-cache'
 import { basename } from 'path'

--- a/src/msvc.ts
+++ b/src/msvc.ts
@@ -1,7 +1,7 @@
 import * as core from '@actions/core'
 import { execSync } from 'child_process'
 import { existsSync } from 'fs'
-import { VERSION_DEV } from './constants.js'
+import { VERSION_DEV } from './constants'

 // Keep in sync with https://github.com/actions/virtual-environments
 const KNOWN_VISUAL_STUDIO_INSTALLATIONS = [
--- a/src/utils.ts
+++ b/src/utils.ts
@@ -1,16 +1,25 @@
-import * as c from './constants.js'
+import * as c from './constants'
 import * as core from '@actions/core'
 import * as github from '@actions/github'
+import * as httpClient from '@actions/http-client'
 import * as semver from 'semver'
 import * as tc from '@actions/tool-cache'
 import * as fs from 'fs'
 import { ExecOptions, exec as e } from '@actions/exec'
-import { ok } from 'assert'
 import { readFileSync, readdirSync } from 'fs'
+import { Octokit } from '@octokit/core'
 import { createHash } from 'crypto'
-import { extname, join } from 'path'
+import { join } from 'path'
 import { tmpdir } from 'os'
-import { GitHub } from '@actions/github/lib/utils.js'
+
+// Set up Octokit for github.com only and in the same way as @actions/github (see https://git.io/Jy9YP)
+const baseUrl = 'https://api.github.com'
+const GitHubDotCom = Octokit.defaults({
+  baseUrl,
+  request: {
+    agent: new httpClient.HttpClient().getAgent(baseUrl)
+  }
+})

 export async function exec(commandLine: string, args?: string[], options?: ExecOptions | undefined): Promise<void> {
  const exitCode = await e(commandLine, args, options)
@@ -19,18 +28,22 @@ export async function exec(commandLine: string, args?: string[], options?: ExecO
  }
 }

-export async function getLatestRelease(repo: string): Promise<c.LatestReleaseResponseData> {
-  const octokit = getOctokit()
+export async function getLatestRelease(repo: string): Promise<c.LatestReleaseResponse['data']> {
+  const githubToken = getGitHubToken()
+  const options = githubToken.length > 0 ? { auth: githubToken } : {}
+  const octokit = new GitHubDotCom(options)
  return (
    await octokit.request('GET /repos/{owner}/{repo}/releases/latest', {
      owner: c.GRAALVM_GH_USER,
      repo
    })
-  ).data as c.LatestReleaseResponseData /** missing digest property */
+  ).data
 }

-export async function getContents(repo: string, path: string): Promise<c.ContentsResponseData> {
-  const octokit = getOctokit()
+export async function getContents(repo: string, path: string): Promise<c.ContentsResponse['data']> {
+  const githubToken = getGitHubToken()
+  const options = githubToken.length > 0 ? { auth: githubToken } : {}
+  const octokit = new GitHubDotCom(options)
  return (
    await octokit.request('GET /repos/{owner}/{repo}/contents/{path}', {
      owner: c.GRAALVM_GH_USER,
@@ -40,23 +53,31 @@ export async function getContents(repo: string, path: string): Promise<c.Content
  ).data
 }

-export async function getTaggedRelease(owner: string, repo: string, tag: string): Promise<c.LatestReleaseResponseData> {
-  const octokit = getOctokit()
+export async function getTaggedRelease(
+  owner: string,
+  repo: string,
+  tag: string
+): Promise<c.LatestReleaseResponse['data']> {
+  const githubToken = getGitHubToken()
+  const options = githubToken.length > 0 ? { auth: githubToken } : {}
+  const octokit = new GitHubDotCom(options)
  return (
    await octokit.request('GET /repos/{owner}/{repo}/releases/tags/{tag}', {
      owner,
      repo,
      tag
    })
-  ).data as c.LatestReleaseResponseData /** missing digest property */
+  ).data
 }

 export async function getMatchingTags(
  owner: string,
  repo: string,
  tagPrefix: string
-): Promise<c.MatchingRefsResponseData> {
-  const octokit = getOctokit()
+): Promise<c.MatchingRefsResponse['data']> {
+  const githubToken = getGitHubToken()
+  const options = githubToken.length > 0 ? { auth: githubToken } : {}
+  const octokit = new GitHubDotCom(options)
  return (
    await octokit.request('GET /repos/{owner}/{repo}/git/matching-refs/tags/{tagPrefix}', {
      owner,
@@ -87,22 +108,6 @@ export async function downloadExtractAndCacheJDK(
  return findJavaHomeInSubfolder(toolPath)
 }

-/**
- * This copy of tc.downloadTool() preserves the file extension in the dest.
- * The file extension is required on Windows runners without .NET to extract zip files correctly.
- * See #195 and https://github.com/actions/toolkit/blob/6b63a2bfc339a753a113d2266323a4d52d84dee0/packages/tool-cache/src/tool-cache.ts#L44
- */
-export async function downloadFile(downloadUrl: string): Promise<string> {
-  const dest = join(_getTempDirectory(), crypto.randomUUID(), extname(downloadUrl))
-  return tc.downloadTool(downloadUrl, dest)
-}
-
-function _getTempDirectory(): string {
-  const tempDirectory = process.env['RUNNER_TEMP'] || ''
-  ok(tempDirectory, 'Expected RUNNER_TEMP to be defined')
-  return tempDirectory
-}
-
 export function calculateSHA256(filePath: string): string {
  const hashSum = createHash('sha256')
  hashSum.update(readFileSync(filePath))
@@ -151,15 +156,8 @@ export function isPREvent(): boolean {
  return process.env[c.ENV_GITHUB_EVENT_NAME] === c.EVENT_NAME_PULL_REQUEST
 }

-function getOctokit(): InstanceType<typeof GitHub> {
-  /* Set up GitHub instance manually because @actions/github does not allow unauthenticated access */
-  const GitHubWithPlugins = GitHub.plugin()
-  const token = core.getInput(c.INPUT_GITHUB_TOKEN)
-  if (token) {
-    return new GitHubWithPlugins({ auth: `token ${token}` })
-  } else {
-    return new GitHubWithPlugins() /* unauthenticated */
-  }
+function getGitHubToken(): string {
+  return core.getInput(c.INPUT_GITHUB_TOKEN)
 }

 export async function findExistingPRCommentId(bodyStartsWith: string): Promise<number | undefined> {
@@ -168,7 +166,7 @@ export async function findExistingPRCommentId(bodyStartsWith: string): Promise<n
  }

  const context = github.context
-  const octokit = getOctokit()
+  const octokit = github.getOctokit(getGitHubToken())
  try {
    const comments = await octokit.paginate(octokit.rest.issues.listComments, {
      ...context.repo,
@@ -191,7 +189,7 @@ export async function updatePRComment(content: string, commentId: number): Promi
  }

  try {
-    await getOctokit().rest.issues.updateComment({
+    await github.getOctokit(getGitHubToken()).rest.issues.updateComment({
      ...github.context.repo,
      comment_id: commentId,
      body: content
@@ -209,7 +207,7 @@ export async function createPRComment(content: string): Promise<void> {
  }
  const context = github.context
  try {
-    await getOctokit().rest.issues.createComment({
+    await github.getOctokit(getGitHubToken()).rest.issues.createComment({
      ...context.repo,
      issue_number: context.payload.pull_request?.number as number,
      body: content
--- a/tsconfig.base.json
+++ b/tsconfig.base.json
@@ -0,0 +1,23 @@
+{
+  "$schema": "https://json.schemastore.org/tsconfig",
+  "compilerOptions": {
+    "allowSyntheticDefaultImports": true,
+    "declaration": false,
+    "declarationMap": false,
+    "esModuleInterop": true,
+    "forceConsistentCasingInFileNames": true,
+    "lib": ["ES2022"],
+    "module": "NodeNext",
+    "moduleResolution": "NodeNext",
+    "newLine": "lf",
+    "noImplicitAny": true,
+    "noUnusedLocals": true,
+    "noUnusedParameters": false,
+    "pretty": true,
+    "resolveJsonModule": true,
+    "sourceMap": true,
+    "strict": true,
+    "strictNullChecks": true,
+    "target": "ES2022"
+  }
+}
--- a/tsconfig.eslint.json
+++ b/tsconfig.eslint.json
@@ -0,0 +1,10 @@
+{
+  "$schema": "https://json.schemastore.org/tsconfig",
+  "extends": "./tsconfig.base.json",
+  "compilerOptions": {
+    "allowJs": true,
+    "noEmit": true
+  },
+  "exclude": ["dist", "node_modules"],
+  "include": ["__tests__", "src", "eslint.config.mjs", "jest.config.js"]
+}
--- a/tsconfig.json
+++ b/tsconfig.json
@@ -1,25 +1,10 @@
 {
  "$schema": "https://json.schemastore.org/tsconfig",
+  "extends": "./tsconfig.base.json",
  "compilerOptions": {
-    "allowSyntheticDefaultImports": true,
-    "declaration": false,
-    "declarationMap": false,
-    "esModuleInterop": true,
-    "forceConsistentCasingInFileNames": true,
-    "isolatedModules": true,
-    "lib": ["ES2022"],
    "module": "NodeNext",
    "moduleResolution": "NodeNext",
-    "newLine": "lf",
-    "noImplicitAny": true,
-    "noUnusedLocals": true,
-    "noUnusedParameters": false,
-    "outDir": "./dist",
-    "pretty": true,
-    "resolveJsonModule": true,
-    "strict": true,
-    "strictNullChecks": true,
-    "target": "ES2022"
+    "outDir": "./dist"
  },
  "exclude": ["__fixtures__", "__tests__", "coverage", "dist", "node_modules"],
  "include": ["src"]