try to fix

Signed-off-by: Jason Hall <jason@chainguard.dev>

.github/workflows/use-action.yaml

@@ -18,10 +18,15 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
+      - name: Read service account key
+        id: sa-key
+        run: echo "content=$(cat github-actions-metrics-key.json | jq -c)" >> $GITHUB_OUTPUT
+
       - uses: ./
         with:
           github-token: ${{ github.token }}
-          gcp-service-account-key: github-actions-metrics-key.json
+          gcp-project-id: jason-chainguard
+          gcp-service-account-key: ${{ steps.sa-key.outputs.content }}
 
       - uses: actions/setup-node@v4
         with:

.gitignore

@@ -28,3 +28,7 @@ coverage/
 *.log
 tmp/
 temp/
+
+# Service account keys (do not commit)
+*-key.json
+*.key.json

README.md

@@ -228,13 +228,31 @@ npm install
 npm test
 ```
 
+### Build
+
+The action uses [@vercel/ncc](https://github.com/vercel/ncc) to compile the JavaScript and dependencies into a single file for distribution.
+
+```bash
+npm run build
+```
+
+This creates:
+- `dist/index.js` - Main entry point
+- `dist/post/index.js` - Post-action with all dependencies
+
+**Important:** Always run `npm run build` before committing changes. The `dist/` directory must be committed for the action to work in GitHub Actions.
+
 ### Project Structure
 
 ```
 otel-action/
 ├── action.yml           # Action definition
-├── index.js             # Main entry point (no-op)
-├── post.js              # Post-action (collects & exports metrics)
+├── index.js             # Main entry point (source)
+├── post.js              # Post-action (source)
+├── dist/                # Compiled action (committed)
+│   ├── index.js         # Built main entry
+│   └── post/
+│       └── index.js     # Built post-action
 ├── lib/
 │   ├── config.js        # Configuration parsing
 │   ├── collector.js     # GitHub API metrics collection

action.yml

@@ -34,6 +34,6 @@ inputs:
 
 runs:
   using: 'node20'
-  main: 'index.js'
-  post: 'post.js'
+  main: 'dist/index.js'
+  post: 'dist/post/index.js'
   post-if: 'always()'

package-lock.json

@@ -17,7 +17,9 @@
         "@opentelemetry/sdk-metrics": "^1.28.0",
         "@opentelemetry/semantic-conventions": "^1.28.0"
       },
-      "devDependencies": {}
+      "devDependencies": {
+        "@vercel/ncc": "^0.38.1"
+      }
     },
     "node_modules/@actions/core": {
       "version": "1.11.1",
@@ -335,6 +337,15 @@
         "node": ">=14"
       }
     },
+    "node_modules/@vercel/ncc": {
+      "version": "0.38.4",
+      "resolved": "https://registry.npmjs.org/@vercel/ncc/-/ncc-0.38.4.tgz",
+      "integrity": "sha512-8LwjnlP39s08C08J5NstzriPvW1SP8Zfpp1BvC2sI35kPeZnHfxVkCwu4/+Wodgnd60UtT1n8K8zw+Mp7J9JmQ==",
+      "dev": true,
+      "bin": {
+        "ncc": "dist/ncc/cli.js"
+      }
+    },
     "node_modules/agent-base": {
       "version": "7.1.4",
       "resolved": "https://registry.npmjs.org/agent-base/-/agent-base-7.1.4.tgz",

package.json

@@ -4,7 +4,8 @@
   "description": "GitHub Action that collects workflow step metrics and exports them to OpenTelemetry/Google Cloud Monitoring",
   "main": "index.js",
   "scripts": {
-    "test": "node --test test/collector.test.js test/exporter.test.js"
+    "test": "node --test test/collector.test.js test/exporter.test.js",
+    "build": "ncc build index.js -o dist && ncc build post.js -o dist/post"
   },
   "keywords": [
     "github-actions",
@@ -23,5 +24,7 @@
     "@opentelemetry/sdk-metrics": "^1.28.0",
     "@opentelemetry/semantic-conventions": "^1.28.0"
   },
-  "devDependencies": {}
+  "devDependencies": {
+    "@vercel/ncc": "^0.38.1"
+  }
 }