apify-test-tools 0.10.2-beta.0 → 0.10.2-beta.10

package/.gitattributes

@@ -0,0 +1,2 @@
+# Generated by `npm run bundle`: collapsed in GitHub diffs and shown as binary by git diff.
+.github/cli/apify-test-tools.mjs linguist-generated=true -diff

package/.github/actions/checkout-restore-dependencies/action.yaml

@@ -8,6 +8,11 @@ inputs:
             generated .npmrc references), and only on the dependency install steps, so it
             never reaches the build or test steps. Use a read-only token.
         required: false
+    config-secrets:
+        description: >-
+            The CONFIG_SECRETS workflow secret, if the caller passed one. Every value inside it is
+            registered as a mask, see .github/scripts/mask-config-secrets.sh.
+        required: false
 
 outputs:
     scripts-path:
@@ -19,11 +24,19 @@ outputs:
 
 # Sets common steps and ensure we use cached node_modules
 # To test a change here, repoint the `uses:` refs in the reusable workflows at your branch, and
-# change them back before merging. Merging to master no longer ships it: consumers track the `workflows-v0`
-# tag, which only moves once the package version in .github/workflows-package-version is on npm.
+# change them back before merging. Consumers track the `workflows-v0` tag, which moves on every
+# push to master.
 runs:
     using: 'composite'
     steps:
+        # Runs before anything can use a packed secret, see the script for why.
+        - name: Mask config secrets
+          if: inputs.config-secrets != ''
+          shell: bash
+          env:
+              CONFIG_SECRETS: ${{ inputs.config-secrets }}
+          run: bash "${{ github.action_path }}/../../scripts/mask-config-secrets.sh"
+
         - name: Checkout Repository
           uses: actions/checkout@v5
           with:
@@ -49,7 +62,24 @@ runs:
           shell: bash
           run: echo "path=$(cd "${{ github.action_path }}/../../scripts" && pwd)" >> "$GITHUB_OUTPUT"
 
+        # A repo is on pnpm when it has a pnpm-lock.yaml and no package-lock.json.
+        - name: Detect package manager
+          id: package-manager
+          shell: bash
+          run: |
+              if [ -f pnpm-lock.yaml ] && [ ! -f package-lock.json ]; then
+                  echo "name=pnpm" >> "$GITHUB_OUTPUT"
+              else
+                  echo "name=npm" >> "$GITHUB_OUTPUT"
+              fi
+
+        # Takes the pnpm version from the `packageManager` field of the repo's package.json.
+        - name: Install pnpm
+          if: steps.package-manager.outputs.name == 'pnpm'
+          uses: pnpm/action-setup@v6
+
         - name: Cache dependencies npm
+          if: steps.package-manager.outputs.name == 'npm'
           id: check-dependencies-cache
           uses: actions/cache@v5
           with:
@@ -57,39 +87,46 @@ runs:
               key: modules-npm-${{ hashFiles('package-lock.json') }}
 
         - name: install npm dependencies
-          if: steps.check-dependencies-cache.outputs.cache-hit != 'true'
+          if: steps.package-manager.outputs.name == 'npm' && steps.check-dependencies-cache.outputs.cache-hit != 'true'
           shell: bash
           env:
               NPM_TOKEN: ${{ inputs.npm-token }}
               NODE_AUTH_TOKEN: ${{ inputs.npm-token }}
           run: npm ci
 
-        # Repos can still have older version locally but on cloud we enforce uniformity.
-        # --no-save swaps the package in node_modules only and leaves the repo's package.json and
-        # package-lock.json untouched, so node_modules is ahead of the lockfile but the checkout stays clean.
-        - name: Enforce test tools version required by these workflows
-          # We don't override beta so we can use it to test branch-specific versions of apify-test-tools
-          # Needs the npm token too: a repo whose .npmrc routes all traffic through a private
-          # registry has to authenticate even for public packages.
+        # Caching node_modules would miss each workspace package's own node_modules, so we cache the
+        # store and always install; with a warm store that only links files.
+        - name: Resolve pnpm store path
+          if: steps.package-manager.outputs.name == 'pnpm'
+          id: pnpm-store
+          shell: bash
+          run: echo "path=$(pnpm store path --silent)" >> "$GITHUB_OUTPUT"
+
+        - name: Cache pnpm store
+          if: steps.package-manager.outputs.name == 'pnpm'
+          uses: actions/cache@v5
+          with:
+              path: ${{ steps.pnpm-store.outputs.path }}
+              key: pnpm-store-${{ hashFiles('pnpm-lock.yaml') }}
+
+        - name: install pnpm dependencies
+          if: steps.package-manager.outputs.name == 'pnpm'
           shell: bash
           env:
               NPM_TOKEN: ${{ inputs.npm-token }}
               NODE_AUTH_TOKEN: ${{ inputs.npm-token }}
+          run: pnpm install --frozen-lockfile
+
+        # The CLI the workflows call ships with this action as one bundled file (npm run bundle), so
+        # nothing is installed for it. The repo's node_modules stays exactly what its lockfile says,
+        # and its tests import the lib from the version they locked.
+        # Steps call `apify-test-tools` without npx: npx would pick the repo's own copy in node_modules/.bin first.
+        - name: Put apify-test-tools CLI on PATH
+          shell: bash
           run: |
-              locked_version=$(jq -r '.packages["node_modules/apify-test-tools"].version' package-lock.json)
-              echo "Package-lock version of apify-test-tools: $locked_version"
-              if [[ "$locked_version" == *"-beta"* ]]; then
-                echo "Beta version detected, reinstalling $locked_version to ensure cache consistency"
-                npm install "apify-test-tools@$locked_version" --no-save --audit=false --no-fund;
-              else
-                # The workflows name the exact package version they ship with, so a tag is a complete
-                # statement: these workflows and this library. A frozen major tag then keeps
-                # installing what it was tested against however far the package moves on. A `>=`
-                # floor could not do that — being open-ended, it resolves to the newest release
-                # forever, so freezing the tag would freeze the workflow files but not their
-                # dependency. The stable release writes this file, so it always names a published
-                # version; the release that publishes X is the commit that pins X.
-                pinned_version=$(cat "${{ github.action_path }}/../../workflows-package-version")
-                echo "Installing apify-test-tools@$pinned_version (pinned by these workflows)"
-                npm install "apify-test-tools@$pinned_version" --no-save --audit=false --no-fund;
-              fi
+              bundle="$(cd "${{ github.action_path }}/../../cli" && pwd)/apify-test-tools.mjs"
+              bin_dir="$RUNNER_TEMP/apify-test-tools-bin"
+              mkdir -p "$bin_dir"
+              printf '#!/bin/sh\nexec node --no-warnings "%s" "$@"\n' "$bundle" > "$bin_dir/apify-test-tools"
+              chmod +x "$bin_dir/apify-test-tools"
+              echo "$bin_dir" >> "$GITHUB_PATH"