Bump undici from 6.25.0 to 6.27.0 (#276)

Bumps [undici](https://github.com/nodejs/undici) from 6.25.0 to 6.27.0.
- [Release notes](https://github.com/nodejs/undici/releases)
- [Commits](https://github.com/nodejs/undici/compare/v6.25.0...v6.27.0)

---
updated-dependencies:
- dependency-name: undici
  dependency-version: 6.27.0
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

.github/CODEOWNERS

@@ -1 +1 @@
-* @Azure/aks-atlanta
+* @Azure/cloud-native-github-action-owners

.github/workflows/codeql.yml

@@ -55,11 +55,11 @@ jobs:
             # your codebase is analyzed, see https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/codeql-code-scanning-for-compiled-languages
       steps:
          - name: Checkout repository
-           uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+           uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
          # Initializes the CodeQL tools for scanning.
          - name: Initialize CodeQL
-           uses: github/codeql-action/init@ce28f5bb42b7a9f2c824e633a3f6ee835bab6858 # v3.29.0
+           uses: github/codeql-action/init@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
            with:
               languages: ${{ matrix.language }}
               build-mode: ${{ matrix.build-mode }}
@@ -86,6 +86,6 @@ jobs:
               echo '  make release'
               exit 1
          - name: Perform CodeQL Analysis
-           uses: github/codeql-action/analyze@ce28f5bb42b7a9f2c824e633a3f6ee835bab6858 # v3.29.0
+           uses: github/codeql-action/analyze@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
            with:
               category: '/language:${{matrix.language}}'

.github/workflows/defaultLabels.yml

@@ -8,7 +8,7 @@ jobs:
    label-issues:
       runs-on: ubuntu-latest
       steps:
-         - uses: actions/stale@5bef64f19d7facfb25b37b414482c7164d639639 # v9.1.0
+         - uses: actions/stale@eb5cf3af3ac0a1aa4c9c45633dd1ae542a27a899 # v10.3.0
            name: Setting issue as idle
            with:
               repo-token: ${{ secrets.GITHUB_TOKEN }}
@@ -19,7 +19,7 @@ jobs:
               operations-per-run: 100
               exempt-issue-labels: 'backlog'
 
-         - uses: actions/stale@5bef64f19d7facfb25b37b414482c7164d639639 # v9.1.0
+         - uses: actions/stale@eb5cf3af3ac0a1aa4c9c45633dd1ae542a27a899 # v10.3.0
            name: Setting PR as idle
            with:
               repo-token: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/integration-tests.yml

@@ -17,7 +17,7 @@ jobs:
          KUBECONFIG: /home/runner/.kube/config
          PR_BASE_REF: ${{ github.event.pull_request.base.ref }}
       steps:
-         - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+         - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
            name: Checkout from PR branch
 
          - id: action-npm-build
@@ -27,9 +27,11 @@ jobs:
               if [[ $PR_BASE_REF != releases/* ]]; then
                 npm install
                 npm run build
+                # remove node_modules to match production environment where only index.js is present
+                rm -rf node_modules 
               fi
 
-         - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
+         - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
            name: Install Python
            with:
               python-version: '3.x'

.github/workflows/prettify-code.yml

@@ -10,10 +10,10 @@ jobs:
       runs-on: ubuntu-latest
       steps:
          - name: Checkout Repository
-           uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+           uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
          - name: Setup Node.js
-           uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
+           uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
            with:
               node-version: 'lts/*'
               cache: 'npm'

.github/workflows/release-pr.yml

@@ -13,6 +13,6 @@ jobs:
       permissions:
          actions: read
          contents: write
-      uses: Azure/action-release-workflows/.github/workflows/release_js_project.yaml@v1
+      uses: Azure/action-release-workflows/.github/workflows/release_js_project.yaml@3c677ba5ab58f5c5c1a6f0cfb176b333b1f27405 # v1
       with:
          changelogPath: ./CHANGELOG.md

.github/workflows/unit-tests.yml

@@ -13,9 +13,10 @@ jobs:
    build: # make sure build/ci works properly
       runs-on: ubuntu-latest
       steps:
-         - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+         - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
          - name: Build and run L0 tests.
            run: |
               npm install
+              npm run build
               npm test

.husky/pre-commit

@@ -0,0 +1,32 @@
+set +e
+npm test
+npm run format-check || {
+  echo ""
+  echo "❌ Formatting check failed."
+  echo "💡 Run 'npm run format' or 'prettier --write .' to fix formatting issues."
+  exit 1
+}
+
+STAGED=$(git diff --cached --name-only)
+if echo "$STAGED" | grep -qE '^(package\.json|package-lock\.json|CHANGELOG\.md)$'; then
+  PKG_VERSION=$(node -p "require('./package.json').version")
+  LOCK_VERSION=$(node -p "require('./package-lock.json').version")
+  CHANGELOG_VERSION=$(sed -n 's/^## \[\([^]]*\)\].*/\1/p' CHANGELOG.md | head -1)
+
+  MISMATCH=""
+  if [ "$PKG_VERSION" != "$LOCK_VERSION" ]; then
+    MISMATCH="${MISMATCH}\n  package.json:      ${PKG_VERSION}\n  package-lock.json: ${LOCK_VERSION}"
+  fi
+  if [ "$PKG_VERSION" != "$CHANGELOG_VERSION" ]; then
+    MISMATCH="${MISMATCH}\n  package.json: ${PKG_VERSION}\n  CHANGELOG.md: ${CHANGELOG_VERSION}"
+  fi
+
+  if [ -n "$MISMATCH" ]; then
+    echo ""
+    echo "❌ Version mismatch detected:"
+    echo -e "$MISMATCH"
+    echo ""
+    echo "💡 Ensure package.json, package-lock.json, and CHANGELOG.md all have the same version."
+    exit 1
+  fi
+fi

CHANGELOG.md

@@ -1,5 +1,40 @@
 # Changelog
 
+## [5.1.0] - 2026-04-11
+
+### Changed
+
+- #243 [Migrate to ESM with esbuild and vitest](https://github.com/Azure/setup-kubectl/pull/243)
+   - Replaced `@vercel/ncc` with `esbuild` for ESM bundling
+   - Replaced `jest`/`ts-jest` with `vitest` for testing
+   - Upgraded `@actions/core` to `^3.0.0`, `@actions/exec` to `^3.0.0`, `@actions/tool-cache` to `^4.0.0`
+   - Updated `tsconfig.json` to `NodeNext` module resolution
+- Add `npm run build` step to CI unit-tests workflow
+
+### Security
+
+- #242 [Bump picomatch](https://github.com/Azure/setup-kubectl/pull/242)
+- #244 [Bump handlebars from 4.7.8 to 4.7.9](https://github.com/Azure/setup-kubectl/pull/244)
+- #247 [Bump vite from 8.0.3 to 8.0.5](https://github.com/Azure/setup-kubectl/pull/247)
+- #245 [Bump github/codeql-action in CI workflows](https://github.com/Azure/setup-kubectl/pull/245)
+
+## [5.0.0] - 2026-03-25
+
+### Changed
+
+- #233 [Update Node.js runtime from node20 to node24](https://github.com/Azure/setup-kubectl/pull/233)
+- #228 [Replace cdn.dl.k8s.io with dl.k8s.io](https://github.com/Azure/setup-kubectl/pull/228)
+- #219 [Remove download redirects, use cdn.dl.k8s.io domain](https://github.com/Azure/setup-kubectl/pull/219)
+- #190 [Update stableVersionUrl to dl.k8s.io](https://github.com/Azure/setup-kubectl/pull/190)
+- #235 [Bump undici from 6.23.0 to 6.24.1](https://github.com/Azure/setup-kubectl/pull/235)
+- #226 [Bump undici and @actions/http-client](https://github.com/Azure/setup-kubectl/pull/226)
+- #230 [Bump minimatch](https://github.com/Azure/setup-kubectl/pull/230)
+
+### Added
+
+- #172 [Enhance version handling: auto-resolve kubectl major.minor to latest patch](https://github.com/Azure/setup-kubectl/pull/172)
+- #171 [Add husky precommit check](https://github.com/Azure/setup-kubectl/pull/171)
+
 ## [4.0.1] - 2025-06-17
 
 - Remove erronious 'v' prefix on previous changelog for v4.0.0 that led to "vv4.0.0" tag issue

action.yml

@@ -1,5 +1,5 @@
 name: 'Kubectl tool installer'
-description: 'Install a specific version of kubectl binary. Acceptable values are latest or any semantic version string like 1.15.0'
+description: 'Install a specific version of kubectl binary. Acceptable values are latest or any semantic version string like "v1.15.0"'
 inputs:
    version:
       description: 'Version of kubectl'
@@ -11,5 +11,5 @@ outputs:
 branding:
    color: 'blue'
 runs:
-   using: 'node20'
+   using: 'node24'
    main: 'lib/index.js'

jest.config.js

@@ -1,18 +0,0 @@
-module.exports = {
-   clearMocks: true,
-   moduleFileExtensions: ['js', 'ts'],
-   testEnvironment: 'node',
-   testMatch: ['**/*.test.ts'],
-   transform: {
-      '^.+\\.ts$': 'ts-jest'
-   },
-   verbose: true,
-   coverageThreshold: {
-      global: {
-         branches: 0,
-         functions: 14,
-         lines: 27,
-         statements: 27
-      }
-   }
-}

package.json

@@ -1,14 +1,17 @@
 {
    "name": "setup-kubectl-action",
-   "version": "0.0.0",
+   "version": "5.1.0",
    "private": true,
    "main": "lib/index.js",
+   "type": "module",
    "scripts": {
-      "build": "npm i ncc && npx ncc build src/index.ts -o lib",
-      "test": "jest",
-      "test-coverage": "jest --coverage",
+      "build": "tsc --noEmit && esbuild src/index.ts --bundle --platform=node --target=node20 --format=esm --outfile=lib/index.js --banner:js=\"import { createRequire } from 'module';const require = createRequire(import.meta.url);\"",
+      "typecheck": "tsc --noEmit",
+      "test": "vitest run",
+      "test-coverage": "vitest run --coverage",
       "format": "prettier --write .",
-      "format-check": "prettier --check ."
+      "format-check": "prettier --check .",
+      "prepare": "husky"
    },
    "keywords": [
       "actions",
@@ -18,17 +21,16 @@
    "author": "GitHub",
    "license": "MIT",
    "dependencies": {
-      "@actions/core": "^1.11.1",
-      "@actions/exec": "^1.0.0",
-      "@actions/tool-cache": "^2.0.2"
+      "@actions/core": "^3.0.1",
+      "@actions/exec": "^3.0.0",
+      "@actions/tool-cache": "^4.0.0"
    },
    "devDependencies": {
-      "@types/jest": "^30.0.0",
-      "@types/node": "^24.0.2",
-      "@vercel/ncc": "^0.38.3",
-      "jest": "^30.0.0",
-      "prettier": "3.5.3",
-      "ts-jest": "^29.4.0",
-      "typescript": "5.8.3"
+      "@types/node": "^26.0.0",
+      "esbuild": "^0.28.1",
+      "husky": "^9.1.7",
+      "prettier": "3.8.4",
+      "typescript": "6.0.3",
+      "vitest": "^4.1.9"
    }
 }

src/helpers.ts

@@ -1,6 +1,8 @@
 import * as os from 'os'
 import * as util from 'util'
-
+import * as fs from 'fs'
+import * as core from '@actions/core'
+import * as toolCache from '@actions/tool-cache'
 export function getKubectlArch(): string {
    const arch = os.arch()
    if (arch === 'x64') {
@@ -23,6 +25,29 @@ export function getkubectlDownloadURL(version: string, arch: string): string {
    }
 }
 
+export async function getLatestPatchVersion(
+   major: string,
+   minor: string
+): Promise<string> {
+   const version = `${major}.${minor}`
+   const sourceURL = `https://dl.k8s.io/release/stable-${version}.txt`
+   try {
+      const downloadPath = await toolCache.downloadTool(sourceURL)
+      const latestPatch = fs
+         .readFileSync(downloadPath, 'utf8')
+         .toString()
+         .trim()
+      if (!latestPatch) {
+         throw new Error(`No patch version found for ${version}`)
+      }
+      return latestPatch
+   } catch (error) {
+      core.debug(String(error))
+      core.warning('GetLatestPatchVersionFailed')
+      throw new Error(`Failed to get latest patch version for ${version}`)
+   }
+}
+
 export function getExecutableExtension(): string {
    if (os.type().match(/^Win/)) {
       return '.exe'

src/index.ts

@@ -1,4 +1,4 @@
-import {run} from './run'
+import {run} from './run.js'
 import * as core from '@actions/core'
 
 run().catch(core.setFailed)

src/run.test.ts

@@ -1,24 +1,43 @@
-import * as run from './run'
-import {
-   getkubectlDownloadURL,
-   getKubectlArch,
-   getExecutableExtension
-} from './helpers'
-import * as os from 'os'
-import * as toolCache from '@actions/tool-cache'
-import * as fs from 'fs'
+import {vi, describe, test, expect, beforeEach} from 'vitest'
 import * as path from 'path'
-import * as core from '@actions/core'
 import * as util from 'util'
 
+vi.mock('os')
+vi.mock('fs')
+vi.mock('@actions/tool-cache', async (importOriginal) => {
+   const actual = await importOriginal<typeof import('@actions/tool-cache')>()
+   return {
+      ...actual,
+      downloadTool: vi.fn(),
+      find: vi.fn(),
+      cacheFile: vi.fn()
+   }
+})
+vi.mock('@actions/core')
+
+const os = await import('os')
+const fs = await import('fs')
+const toolCache = await import('@actions/tool-cache')
+const core = await import('@actions/core')
+const run = await import('./run.js')
+const {
+   getkubectlDownloadURL,
+   getKubectlArch,
+   getExecutableExtension,
+   getLatestPatchVersion
+} = await import('./helpers.js')
+
 describe('Testing all functions in run file.', () => {
+   beforeEach(() => {
+      vi.clearAllMocks()
+   })
    test('getExecutableExtension() - return .exe when os is Windows', () => {
-      jest.spyOn(os, 'type').mockReturnValue('Windows_NT')
+      vi.mocked(os.type).mockReturnValue('Windows_NT')
       expect(getExecutableExtension()).toBe('.exe')
       expect(os.type).toHaveBeenCalled()
    })
    test('getExecutableExtension() - return empty string for non-windows OS', () => {
-      jest.spyOn(os, 'type').mockReturnValue('Darwin')
+      vi.mocked(os.type).mockReturnValue('Darwin')
       expect(getExecutableExtension()).toBe('')
       expect(os.type).toHaveBeenCalled()
    })
@@ -29,7 +48,7 @@ describe('Testing all functions in run file.', () => {
    ])(
       'getKubectlArch() - return on %s os arch %s kubectl arch',
       (osArch, kubectlArch) => {
-         jest.spyOn(os, 'arch').mockReturnValue(osArch as NodeJS.Architecture)
+         vi.mocked(os.arch).mockReturnValue(osArch as NodeJS.Architecture)
          expect(getKubectlArch()).toBe(kubectlArch)
          expect(os.arch).toHaveBeenCalled()
       }
@@ -37,7 +56,7 @@ describe('Testing all functions in run file.', () => {
    test.each([['arm'], ['arm64'], ['amd64']])(
       'getkubectlDownloadURL() - return the URL to download %s kubectl for Linux',
       (arch) => {
-         jest.spyOn(os, 'type').mockReturnValue('Linux')
+         vi.mocked(os.type).mockReturnValue('Linux')
          const kubectlLinuxUrl = util.format(
             'https://dl.k8s.io/release/v1.15.0/bin/linux/%s/kubectl',
             arch
@@ -49,7 +68,7 @@ describe('Testing all functions in run file.', () => {
    test.each([['arm'], ['arm64'], ['amd64']])(
       'getkubectlDownloadURL() - return the URL to download %s kubectl for Darwin',
       (arch) => {
-         jest.spyOn(os, 'type').mockReturnValue('Darwin')
+         vi.mocked(os.type).mockReturnValue('Darwin')
          const kubectlDarwinUrl = util.format(
             'https://dl.k8s.io/release/v1.15.0/bin/darwin/%s/kubectl',
             arch
@@ -61,7 +80,7 @@ describe('Testing all functions in run file.', () => {
    test.each([['arm'], ['arm64'], ['amd64']])(
       'getkubectlDownloadURL() - return the URL to download %s kubectl for Windows',
       (arch) => {
-         jest.spyOn(os, 'type').mockReturnValue('Windows_NT')
+         vi.mocked(os.type).mockReturnValue('Windows_NT')
          const kubectlWindowsUrl = util.format(
             'https://dl.k8s.io/release/v1.15.0/bin/windows/%s/kubectl.exe',
             arch
@@ -71,40 +90,30 @@ describe('Testing all functions in run file.', () => {
       }
    )
    test('getStableKubectlVersion() - download stable version file, read version and return it', async () => {
-      jest
-         .spyOn(toolCache, 'downloadTool')
-         .mockReturnValue(Promise.resolve('pathToTool'))
-      jest.spyOn(fs, 'readFileSync').mockReturnValue('v1.20.4')
+      vi.mocked(toolCache.downloadTool).mockResolvedValue('pathToTool')
+      vi.mocked(fs.readFileSync).mockReturnValue('v1.20.4')
       expect(await run.getStableKubectlVersion()).toBe('v1.20.4')
       expect(toolCache.downloadTool).toHaveBeenCalled()
       expect(fs.readFileSync).toHaveBeenCalledWith('pathToTool', 'utf8')
    })
    test('getStableKubectlVersion() - return default v1.15.0 if version read is empty', async () => {
-      jest
-         .spyOn(toolCache, 'downloadTool')
-         .mockReturnValue(Promise.resolve('pathToTool'))
-      jest.spyOn(fs, 'readFileSync').mockReturnValue('')
+      vi.mocked(toolCache.downloadTool).mockResolvedValue('pathToTool')
+      vi.mocked(fs.readFileSync).mockReturnValue('')
       expect(await run.getStableKubectlVersion()).toBe('v1.15.0')
       expect(toolCache.downloadTool).toHaveBeenCalled()
       expect(fs.readFileSync).toHaveBeenCalledWith('pathToTool', 'utf8')
    })
    test('getStableKubectlVersion() - return default v1.15.0 if unable to download file', async () => {
-      jest
-         .spyOn(toolCache, 'downloadTool')
-         .mockRejectedValue('Unable to download.')
+      vi.mocked(toolCache.downloadTool).mockRejectedValue('Unable to download.')
       expect(await run.getStableKubectlVersion()).toBe('v1.15.0')
       expect(toolCache.downloadTool).toHaveBeenCalled()
    })
    test('downloadKubectl() - download kubectl, add it to toolCache and return path to it', async () => {
-      jest.spyOn(toolCache, 'find').mockReturnValue('')
-      jest
-         .spyOn(toolCache, 'downloadTool')
-         .mockReturnValue(Promise.resolve('pathToTool'))
-      jest
-         .spyOn(toolCache, 'cacheFile')
-         .mockReturnValue(Promise.resolve('pathToCachedTool'))
-      jest.spyOn(os, 'type').mockReturnValue('Windows_NT')
-      jest.spyOn(fs, 'chmodSync').mockImplementation(() => {})
+      vi.mocked(toolCache.find).mockReturnValue('')
+      vi.mocked(toolCache.downloadTool).mockResolvedValue('pathToTool')
+      vi.mocked(toolCache.cacheFile).mockResolvedValue('pathToCachedTool')
+      vi.mocked(os.type).mockReturnValue('Windows_NT')
+      vi.mocked(fs.chmodSync).mockImplementation(() => {})
       expect(await run.downloadKubectl('v1.15.0')).toBe(
          path.join('pathToCachedTool', 'kubectl.exe')
       )
@@ -118,10 +127,10 @@ describe('Testing all functions in run file.', () => {
       )
    })
    test('downloadKubectl() - throw DownloadKubectlFailed error when unable to download kubectl', async () => {
-      jest.spyOn(toolCache, 'find').mockReturnValue('')
-      jest
-         .spyOn(toolCache, 'downloadTool')
-         .mockRejectedValue('Unable to download kubectl.')
+      vi.mocked(toolCache.find).mockReturnValue('')
+      vi.mocked(toolCache.downloadTool).mockRejectedValue(
+         'Unable to download kubectl.'
+      )
       await expect(run.downloadKubectl('v1.15.0')).rejects.toThrow(
          'DownloadKubectlFailed'
       )
@@ -131,9 +140,9 @@ describe('Testing all functions in run file.', () => {
    test('downloadKubectl() - throw kubectl not found error when receive 404 response', async () => {
       const kubectlVersion = 'v1.15.0'
       const arch = 'arm128'
-      jest.spyOn(os, 'arch').mockReturnValue(arch as any)
-      jest.spyOn(toolCache, 'find').mockReturnValue('')
-      jest.spyOn(toolCache, 'downloadTool').mockImplementation((_) => {
+      vi.mocked(os.arch).mockReturnValue(arch as NodeJS.Architecture)
+      vi.mocked(toolCache.find).mockReturnValue('')
+      vi.mocked(toolCache.downloadTool).mockImplementation((_) => {
          throw new toolCache.HTTPError(404)
       })
       await expect(run.downloadKubectl(kubectlVersion)).rejects.toThrow(
@@ -148,11 +157,10 @@ describe('Testing all functions in run file.', () => {
       expect(toolCache.downloadTool).toHaveBeenCalled()
    })
    test('downloadKubectl() - return path to existing cache of kubectl', async () => {
-      jest.spyOn(core, 'getInput').mockImplementation(() => 'v1.15.5')
-      jest.spyOn(toolCache, 'find').mockReturnValue('pathToCachedTool')
-      jest.spyOn(os, 'type').mockReturnValue('Windows_NT')
-      jest.spyOn(fs, 'chmodSync').mockImplementation(() => {})
-      jest.spyOn(toolCache, 'downloadTool')
+      vi.mocked(core.getInput).mockImplementation(() => 'v1.15.5')
+      vi.mocked(toolCache.find).mockReturnValue('pathToCachedTool')
+      vi.mocked(os.type).mockReturnValue('Windows_NT')
+      vi.mocked(fs.chmodSync).mockImplementation(() => {})
       expect(await run.downloadKubectl('v1.15.0')).toBe(
          path.join('pathToCachedTool', 'kubectl.exe')
       )
@@ -164,14 +172,67 @@ describe('Testing all functions in run file.', () => {
       )
       expect(toolCache.downloadTool).not.toHaveBeenCalled()
    })
+   test('getLatestPatchVersion() - download and return latest patch version', async () => {
+      vi.mocked(toolCache.downloadTool).mockResolvedValue('pathToTool')
+      vi.mocked(fs.readFileSync).mockReturnValue('v1.27.15')
+
+      const result = await getLatestPatchVersion('1', '27')
+
+      expect(result).toBe('v1.27.15')
+      expect(toolCache.downloadTool).toHaveBeenCalledWith(
+         'https://dl.k8s.io/release/stable-1.27.txt'
+      )
+   })
+
+   test('getLatestPatchVersion() - throw error when patch version is empty', async () => {
+      vi.mocked(toolCache.downloadTool).mockResolvedValue('pathToTool')
+      vi.mocked(fs.readFileSync).mockReturnValue('')
+
+      await expect(getLatestPatchVersion('1', '27')).rejects.toThrow(
+         'Failed to get latest patch version for 1.27'
+      )
+   })
+
+   test('getLatestPatchVersion() - throw error when download fails', async () => {
+      vi.mocked(toolCache.downloadTool).mockRejectedValue(
+         new Error('Network error')
+      )
+
+      await expect(getLatestPatchVersion('1', '27')).rejects.toThrow(
+         'Failed to get latest patch version for 1.27'
+      )
+   })
+   test('resolveKubectlVersion() - expands major.minor to latest patch', async () => {
+      vi.mocked(toolCache.downloadTool).mockResolvedValue('pathToTool')
+      vi.mocked(fs.readFileSync).mockReturnValue('v1.27.15')
+
+      const result = await run.resolveKubectlVersion('1.27')
+      expect(result).toBe('v1.27.15')
+   })
+
+   test('resolveKubectlVersion() - returns full version unchanged', async () => {
+      const result = await run.resolveKubectlVersion('v1.27.15')
+      expect(result).toBe('v1.27.15')
+   })
+   test('resolveKubectlVersion() - adds v prefix to full version', async () => {
+      const result = await run.resolveKubectlVersion('1.27.15')
+      expect(result).toBe('v1.27.15')
+   })
+   test('resolveKubectlVersion() - expands v-prefixed major.minor to latest patch', async () => {
+      vi.mocked(toolCache.downloadTool).mockResolvedValue('pathToTool')
+      vi.mocked(fs.readFileSync).mockReturnValue('v1.27.15')
+
+      const result = await run.resolveKubectlVersion('v1.27')
+      expect(result).toBe('v1.27.15')
+   })
    test('run() - download specified version and set output', async () => {
-      jest.spyOn(core, 'getInput').mockReturnValue('v1.15.5')
-      jest.spyOn(toolCache, 'find').mockReturnValue('pathToCachedTool')
-      jest.spyOn(os, 'type').mockReturnValue('Windows_NT')
-      jest.spyOn(fs, 'chmodSync').mockImplementation()
-      jest.spyOn(core, 'addPath').mockImplementation()
-      jest.spyOn(console, 'log').mockImplementation()
-      jest.spyOn(core, 'setOutput').mockImplementation()
+      vi.mocked(core.getInput).mockReturnValue('v1.15.5')
+      vi.mocked(toolCache.find).mockReturnValue('pathToCachedTool')
+      vi.mocked(os.type).mockReturnValue('Windows_NT')
+      vi.mocked(fs.chmodSync).mockImplementation()
+      vi.mocked(core.addPath).mockImplementation()
+      vi.spyOn(console, 'log').mockImplementation()
+      vi.mocked(core.setOutput).mockImplementation()
       expect(await run.run()).toBeUndefined()
       expect(core.getInput).toHaveBeenCalledWith('version', {required: true})
       expect(core.addPath).toHaveBeenCalledWith('pathToCachedTool')
@@ -181,20 +242,18 @@ describe('Testing all functions in run file.', () => {
       )
    })
    test('run() - get latest version, download it and set output', async () => {
-      jest.spyOn(core, 'getInput').mockReturnValue('latest')
-      jest
-         .spyOn(toolCache, 'downloadTool')
-         .mockReturnValue(Promise.resolve('pathToTool'))
-      jest.spyOn(fs, 'readFileSync').mockReturnValue('v1.20.4')
-      jest.spyOn(toolCache, 'find').mockReturnValue('pathToCachedTool')
-      jest.spyOn(os, 'type').mockReturnValue('Windows_NT')
-      jest.spyOn(fs, 'chmodSync').mockImplementation()
-      jest.spyOn(core, 'addPath').mockImplementation()
-      jest.spyOn(console, 'log').mockImplementation()
-      jest.spyOn(core, 'setOutput').mockImplementation()
+      vi.mocked(core.getInput).mockReturnValue('latest')
+      vi.mocked(toolCache.downloadTool).mockResolvedValue('pathToTool')
+      vi.mocked(fs.readFileSync).mockReturnValue('v1.20.4')
+      vi.mocked(toolCache.find).mockReturnValue('pathToCachedTool')
+      vi.mocked(os.type).mockReturnValue('Windows_NT')
+      vi.mocked(fs.chmodSync).mockImplementation()
+      vi.mocked(core.addPath).mockImplementation()
+      vi.spyOn(console, 'log').mockImplementation()
+      vi.mocked(core.setOutput).mockImplementation()
       expect(await run.run()).toBeUndefined()
       expect(toolCache.downloadTool).toHaveBeenCalledWith(
-         'https://storage.googleapis.com/kubernetes-release/release/stable.txt'
+         'https://dl.k8s.io/release/stable.txt'
       )
       expect(core.getInput).toHaveBeenCalledWith('version', {required: true})
       expect(core.addPath).toHaveBeenCalledWith('pathToCachedTool')

src/run.ts

@@ -1,25 +1,25 @@
 import * as path from 'path'
 import * as util from 'util'
 import * as fs from 'fs'
-
 import * as toolCache from '@actions/tool-cache'
 import * as core from '@actions/core'
-
 import {
    getkubectlDownloadURL,
    getKubectlArch,
-   getExecutableExtension
-} from './helpers'
+   getExecutableExtension,
+   getLatestPatchVersion
+} from './helpers.js'
 
 const kubectlToolName = 'kubectl'
 const stableKubectlVersion = 'v1.15.0'
-const stableVersionUrl =
-   'https://storage.googleapis.com/kubernetes-release/release/stable.txt'
+const stableVersionUrl = 'https://dl.k8s.io/release/stable.txt'
 
 export async function run() {
    let version = core.getInput('version', {required: true})
    if (version.toLocaleLowerCase() === 'latest') {
       version = await getStableKubectlVersion()
+   } else {
+      version = await resolveKubectlVersion(version)
    }
    const cachedPath = await downloadKubectl(version)
 
@@ -89,3 +89,28 @@ export async function downloadKubectl(version: string): Promise<string> {
    fs.chmodSync(kubectlPath, '775')
    return kubectlPath
 }
+
+export async function resolveKubectlVersion(version: string): Promise<string> {
+   const cleanedVersion = version.trim()
+   const versionMatch = cleanedVersion.match(
+      /^v?(?<major>\d+)\.(?<minor>\d+)(?:\.(?<patch>\d+))?$/
+   )
+
+   if (!versionMatch?.groups) {
+      throw new Error(
+         `Invalid version format: "${version}". Version must be in "major.minor" or "major.minor.patch" format (e.g., "1.27" or "v1.27.15").`
+      )
+   }
+
+   const {major, minor, patch} = versionMatch.groups
+
+   if (patch) {
+      // Full version was provided, just ensure it has a 'v' prefix
+      return cleanedVersion.startsWith('v')
+         ? cleanedVersion
+         : `v${cleanedVersion}`
+   }
+
+   // Patch version is missing, fetch the latest
+   return await getLatestPatchVersion(major, minor)
+}

test/validate-kubectl.py

@@ -10,7 +10,7 @@ def get_latest_version():
     time_to_sleep = 2
     for _ in range(10):
         response = requests.get(
-            'https://storage.googleapis.com/kubernetes-release/release/stable.txt')
+            'https://dl.k8s.io/release/stable.txt')
         if response.status_code == 200:
             break
         print('Failed to obtain latest version info, retrying.')

tsconfig.json

@@ -1,7 +1,14 @@
 {
    "compilerOptions": {
-      "target": "ES6",
-      "module": "commonjs"
+      "target": "ES2020",
+      "module": "NodeNext",
+      "moduleResolution": "NodeNext",
+      "rootDir": "./src",
+      "outDir": "./lib",
+      "types": ["node"],
+      "skipLibCheck": true,
+      "noEmit": true
    },
-   "exclude": ["node_modules", "test"]
+   "include": ["src"],
+   "exclude": ["node_modules", "**/*.test.ts", "vitest.config.ts"]
 }

vitest.config.ts

@@ -0,0 +1,10 @@
+import {defineConfig} from 'vitest/config'
+
+export default defineConfig({
+   test: {
+      globals: true,
+      environment: 'node',
+      include: ['**/*.test.ts'],
+      clearMocks: true
+   }
+})