[Alex079]

Closes #16

Root cause

dist/index.js is an ESM bundle, but @rollup/plugin-commonjs leaves require calls inside try/catch untouched by default (ignoreTryCatch: true). minimatch@3 loads the path module exactly that way:

var path = (function () { try { return require('path') } catch (e) {}}()) || { sep: '/' };

In an ES module require is undefined, the ReferenceError is swallowed and path.sep becomes '/'. On Windows this disables minimatch's separator normalisation, so @actions/glob gets item paths with backslashes that never match the forward-slash pattern, globber.glob() returns nothing, no directory is added to PATH, and the action still reports success.

Changes

• rollup.config.js: commonjs({ ignoreTryCatch: false }) so the guarded require() calls are converted to real imports. This also fixes the other silently broken guarded requires (node:crypto, node:http2) that were falling back to their catch branches in the ESM bundle.
• .github/workflows/ci.yml: new Verify the extracted directory was added to PATH step in the run job, so CI fails if nothing actually lands on PATH instead of only checking that the action exits 0.
• dist/index.js + sourcemap: rebuilt.

Verification

• Reproduced the mechanism locally with minimatch@3: with path.sep === '/' the pattern D:/a/_temp/*/content does not match D:\a\_temp\guid\content; with path.sep === '\\' it does.
• npm test — all 25 tests pass.
• Ran the packaged dist/index.js against the sample zip; it appended the extracted content directory to GITHUB_PATH.
• The new CI step runs on ubuntu-latest, windows-latest and macos-latest for each archive type.