apify-test-tools 0.10.2-beta.1 → 0.10.2-beta.10

package/.github/scripts/check-major-tag-refs.mjs

@@ -18,7 +18,7 @@ const TAG_SOURCE = '.github/workflows/_move_major_tag.yaml';
 const REVIEW_WORKFLOW = '.github/workflows/public_review.yaml';
 
 // Every place a ref into this repo can appear: live `uses:`, commented examples, README snippets.
-const SEARCH_PATHS = ['.github', 'README.md', 'CONTRIBUTING.md'];
+const SEARCH_PATHS = ['.github', 'README.md', 'CONTRIBUTING.md', 'docs'];
 
 const read = (rel) => fs.readFileSync(path.join(ROOT, rel), 'utf8');
 

package/.github/scripts/mask-config-secrets.sh

@@ -0,0 +1,17 @@
+#!/usr/bin/env bash
+# Registers every value inside the CONFIG_SECRETS secret as a mask.
+#
+#     CONFIG_SECRETS=... bash .github/scripts/mask-config-secrets.sh
+#
+# The runner masks a secret by its exact value, so a value packed inside a JSON secret is only
+# masked as part of that whole blob. Once a step takes it out, it would print in clear.
+# Multi-line values are registered line by line, the way the runner registers secrets.
+# CONFIG_SECRETS may be empty or unset.
+
+set -uo pipefail
+
+[ -n "${CONFIG_SECRETS:-}" ] || exit 0
+
+# jq's errors can quote the input, so they are dropped for our own message
+jq -r 'if type != "object" then error else . end | to_entries[] | .value | strings | split("\n")[] | select(. != "") | "::add-mask::" + .' <<< "$CONFIG_SECRETS" 2>/dev/null \
+    || { echo "::error::The CONFIG_SECRETS secret must be a JSON object."; exit 1; }

package/.github/scripts/run-with-apify-tokens.mjs

@@ -1,13 +1,17 @@
 #!/usr/bin/env node
 // Runs apify-test-tools and passes it only secrets needed for the Actors, no other secrets are leaked.
 //
-//     node .github/scripts/run-with-apify-tokens.mjs npx apify-test-tools build --target-branch ...
+//     jq ... | node .github/scripts/run-with-apify-tokens.mjs apify-test-tools build --version-number 0.99
 //
-// The step passes the whole secrets map as ALL_SECRETS. The token names come from `tokenEnvVar` in
-// the repo's apify-test-tools.config.json, which is the same file apify-test-tools itself reads, so
-// the two can't drift. Everything else in the secrets map (npm, Slack, GitHub, anything else the
-// repo holds) is left out, and ALL_SECRETS itself is dropped, so the blob never reaches npx or
-// anything under node_modules.
+// The step passes the reusable workflow's whole secrets map as WORKFLOW_SECRETS. The token names
+// come from `tokenEnvVar` in the repo's apify-test-tools.config.json, which is the same file
+// apify-test-tools itself reads, so the two can't drift. Everything else in the secrets map (npm,
+// Slack, GitHub, anything else the repo holds) is left out, and WORKFLOW_SECRETS itself is dropped,
+// so the blob never reaches the CLI or anything under node_modules.
+//
+// Each token is looked up in the CONFIG_SECRETS secret first, a JSON object of secret name -> value,
+// and then among the top-level secrets, which is where `secrets: inherit` puts them. The secrets the
+// workflows read by name (NPM_TOKEN, TESTER_APIFY_TOKEN, ...) never come from CONFIG_SECRETS.
 //
 // The command runs without a shell, so branch names and other interpolated arguments are passed
 // through as literal argv entries.
@@ -28,16 +32,36 @@ const fail = (message) => {
 const [command, ...args] = process.argv.slice(2);
 if (!command) fail('Usage: run-with-apify-tokens.mjs <command> [args...]');
 
-const { ALL_SECRETS, ...baseEnv } = process.env;
-if (!ALL_SECRETS) fail('ALL_SECRETS is not set. Add `ALL_SECRETS: ${{ toJSON(secrets) }}` to the step env.');
+const { WORKFLOW_SECRETS, ...baseEnv } = process.env;
+if (!WORKFLOW_SECRETS) {
+    fail('WORKFLOW_SECRETS is not set. Add `WORKFLOW_SECRETS: ${{ toJSON(secrets) }}` to the step env.');
+}
 
-let secrets;
+let workflowSecrets;
 try {
-    secrets = JSON.parse(ALL_SECRETS);
+    workflowSecrets = JSON.parse(WORKFLOW_SECRETS);
 } catch (error) {
-    fail(`ALL_SECRETS is not valid JSON: ${error.message}`);
+    fail(`WORKFLOW_SECRETS is not valid JSON: ${error.message}`);
 }
 
+// Never includes the parse error: Node quotes the input in it, and the input is a secret.
+const unpackConfigSecrets = () => {
+    const packed = workflowSecrets.CONFIG_SECRETS;
+    if (!packed) return {};
+    let value;
+    try {
+        value = JSON.parse(packed);
+    } catch {
+        fail('The CONFIG_SECRETS secret is not valid JSON.');
+    }
+    if (typeof value !== 'object' || value === null || Array.isArray(value)) {
+        fail('The CONFIG_SECRETS secret must be a JSON object.');
+    }
+    return value;
+};
+
+const secrets = { ...workflowSecrets, ...unpackConfigSecrets() };
+
 const configPath = path.resolve(process.cwd(), CONFIG_FILE_NAME);
 let config;
 try {
@@ -78,7 +102,8 @@ const missing = tokenNames.filter((name) => !(name in secrets));
 if (missing.length > 0) {
     console.error(
         `Warning: ${CONFIG_FILE_NAME} declares ${missing.join(', ')}, but no such secret was passed ` +
-            `to this workflow. Check the repository secrets if a build fails on a missing token.`,
+            `to this workflow, neither inside CONFIG_SECRETS nor inherited. Check the repository secrets ` +
+            `and the workflow's \`secrets:\` if a build fails on a missing token.`,
     );
 }
 

package/.github/workflows/_check_code.yaml

@@ -92,3 +92,28 @@ jobs:
               run: npm ci
             - name: Build
               run: npm run build
+
+    # The composite action runs the CLI from .github/cli/apify-test-tools.mjs, which the pre-commit
+    # hook rebuilds. This catches commits that skipped the hook, so a stale bundle never ships.
+    cli_bundle:
+        name: CLI bundle
+        runs-on: ubuntu-latest
+        steps:
+            - name: Checkout repository
+              uses: actions/checkout@v6
+            - name: Use Node.js
+              uses: actions/setup-node@v6
+              with:
+                  node-version: 24
+                  cache: 'npm'
+                  cache-dependency-path: 'package-lock.json'
+            - name: Install dependencies
+              run: npm ci
+            - name: Check the bundle is up to date
+              run: |
+                  npm run bundle
+                  if ! git diff --quiet -- .github/cli/; then
+                      echo "::error::.github/cli/apify-test-tools.mjs is out of date. Run \`npm run bundle\` and commit the result."
+                      exit 1
+                  fi
+                  node .github/cli/apify-test-tools.mjs --help > /dev/null

package/.github/workflows/_move_major_tag.yaml

@@ -1,13 +1,8 @@
 name: Move major version tag
 
-# Consumer repos track a floating major tag (`...@v0`), not `master`, so merging to master does not
-# ship anything by itself. This workflow is what ships: it moves that tag forward, but only once the
-# package version the workflows pin in .github/workflows-package-version is actually on npm.
-#
-# That gate is the whole point. The workflows and the npm package release on their own schedules, so
-# the only combination that can break consumers is a workflow that calls a CLI feature which has not
-# been published yet. In that case the tag simply stays where it is and production keeps running the
-# previous workflows until someone cuts a release.
+# Consumer repos track a floating major tag (`...@workflows-v0`), not `master`. This workflow is what
+# ships: it moves that tag forward. The workflows and the CLI they call (bundled in .github/cli/)
+# live in the same commit, so whatever the tag points at is consistent on its own.
 
 on:
     workflow_call:
@@ -16,13 +11,6 @@ on:
                 description: Commit to move the tag to. Defaults to the commit that triggered the caller.
                 type: string
                 default: ''
-            wait_for_publish:
-                description: >-
-                    Set by a release that has just published the pinned version. npm accepts a publish
-                    before the version is readable, so the check waits instead of treating the gap as
-                    a held tag, and fails if the version never appears.
-                type: boolean
-                default: false
 
 permissions:
     contents: read
@@ -63,54 +51,7 @@ jobs:
               with:
                   ref: ${{ inputs.ref || github.sha }}
 
-            - name: Check the required package version is published
-              id: check
-              env:
-                  # npm accepts a publish and processes it asynchronously ("Your package is being
-                  # processed and may take a few minutes to become available"). Observed at ~19
-                  # minutes for a provenance-signed release, so the release path waits well past
-                  # npm's own estimate rather than shipping a tag consumers cannot install against.
-                  WAIT_SECONDS: ${{ inputs.wait_for_publish && 2400 || 0 }}
-              run: |
-                  pinned_version=$(cat .github/workflows-package-version)
-                  echo "pinned_version=$pinned_version" >> "$GITHUB_OUTPUT"
-
-                  deadline=$(( $(date +%s) + WAIT_SECONDS ))
-                  while :; do
-                      # --prefer-online so a 404 cached from an earlier attempt cannot outlive the
-                      # publish it was polling for.
-                      if output=$(npm view "apify-test-tools@$pinned_version" version --prefer-online 2>&1); then
-                          echo "apify-test-tools@$pinned_version is on npm"
-                          echo "published=true" >> "$GITHUB_OUTPUT"
-                          exit 0
-                      fi
-
-                      # Anything that is not "this version does not exist" is a registry, network or
-                      # auth problem. Sitting in the retry loop would hide it behind a held tag.
-                      if ! grep -q 'code E404' <<< "$output"; then
-                          echo "::error::npm view failed for a reason other than the version being absent."
-                          echo "$output"
-                          exit 1
-                      fi
-
-                      if [ "$(date +%s)" -ge "$deadline" ]; then
-                          break
-                      fi
-                      echo "apify-test-tools@$pinned_version is not on npm yet, retrying in 30s"
-                      sleep 30
-                  done
-
-                  echo "published=false" >> "$GITHUB_OUTPUT"
-
-                  # A release waited for its own publish and never saw it. That is a broken release,
-                  # not a held tag, and it has to be red so it can be re-run once npm catches up.
-                  if [ "$WAIT_SECONDS" -gt 0 ]; then
-                      echo "::error::apify-test-tools@$pinned_version was published by this run but is still not readable after $((WAIT_SECONDS / 60))m. Re-run this job once it appears on npm."
-                      exit 1
-                  fi
-
             - name: Move tag
-              if: steps.check.outputs.published == 'true'
               env:
                   TARGET_SHA: ${{ inputs.ref || github.sha }}
               run: |
@@ -120,23 +61,4 @@ jobs:
                       echo "### \`$MAJOR_TAG\` moved"
                       echo
                       echo "Now points at \`$TARGET_SHA\`."
-                      echo "Pins \`apify-test-tools@${{ steps.check.outputs.pinned_version }}\`, which is published."
-                  } >> "$GITHUB_STEP_SUMMARY"
-
-            # Not a failure. Holding the tag is the designed outcome of merging a workflow change
-            # that needs an unreleased package feature, and consumers are unaffected while it waits.
-            - name: Report held tag
-              if: steps.check.outputs.published != 'true'
-              env:
-                  TARGET_SHA: ${{ inputs.ref || github.sha }}
-              run: |
-                  {
-                      echo "### \`$MAJOR_TAG\` held"
-                      echo
-                      echo "\`$TARGET_SHA\` pins \`apify-test-tools@${{ steps.check.outputs.pinned_version }}\`, which is not on npm."
-                      echo "Consumers keep running the workflows \`$MAJOR_TAG\` already points at."
-                      echo
-                      echo "Publish that version with the **Stable release** workflow. The tag moves on the"
-                      echo "next master push, or immediately via the **Move major version tag** workflow."
                   } >> "$GITHUB_STEP_SUMMARY"
-                  echo "::warning::$MAJOR_TAG not moved: apify-test-tools@${{ steps.check.outputs.pinned_version }} is not published yet."

package/.github/workflows/_tests.yaml

@@ -3,6 +3,10 @@ name: Tests
 on:
     workflow_dispatch:
     workflow_call:
+        secrets:
+            # Token of an isolated sandbox account that can only reach the e2e test's two dummy Actors.
+            E2E_TEST_APIFY_TOKEN_DBYPODOIHUZABNQTR:
+                required: false
 
 permissions:
     contents: read
@@ -33,3 +37,33 @@ jobs:
 
             - name: Unit tests
               run: npm test
+
+    # Runs the shipped CLI bundle against real Actors (test/e2e). Node 24 only, so one push builds
+    # and runs the sandbox Actors once rather than once per Node version.
+    e2e_tests:
+        name: E2E tests
+        runs-on: ubuntu-latest
+        steps:
+            - name: Checkout repository
+              uses: actions/checkout@v6
+
+            - name: Use Node.js
+              uses: actions/setup-node@v6
+              with:
+                  node-version: 24
+                  cache: 'npm'
+                  cache-dependency-path: 'package-lock.json'
+
+            - name: Install dependencies
+              run: npm ci
+
+            # The token is only on this step. Fork and Dependabot PRs don't get the secret, and the
+            # suite skips itself without it.
+            - name: E2E tests
+              env:
+                  E2E_TEST_APIFY_TOKEN_DBYPODOIHUZABNQTR: ${{ secrets.E2E_TEST_APIFY_TOKEN_DBYPODOIHUZABNQTR }}
+              run: |
+                  if [ -z "$E2E_TEST_APIFY_TOKEN_DBYPODOIHUZABNQTR" ]; then
+                      echo "::notice::E2E_TEST_APIFY_TOKEN_DBYPODOIHUZABNQTR is not available to this run, the e2e tests are skipped."
+                  fi
+                  npm run test:e2e

package/.github/workflows/_update_release_metadata.yaml

@@ -77,18 +77,6 @@ jobs:
                   write-mode: overwrite
                   contents: ${{ needs.release_metadata.outputs.changelog }}
 
-            # The reusable workflows install this exact version, so the commit that releases a
-            # version is the commit that pins it. That is what lets a frozen major tag keep
-            # installing the library it was tested against instead of drifting to whatever is
-            # newest.
-            #
-            # Skipped for prereleases: master pushes release a `-beta` that consumer repos must
-            # never install. Their pin stays on the last stable, and the beta stays reachable
-            # through the lockfile path in the setup action, which is how branch testing works.
-            - name: Update the version the workflows pin
-              if: inputs.release_type != 'prerelease'
-              run: echo "${{ needs.release_metadata.outputs.version_number }}" > .github/workflows-package-version
-
             - name: Commit changes
               id: commit
               uses: apify/actions/signed-commit@v1.0.0

package/.github/workflows/manual_move_major_tag.yaml

@@ -1,8 +1,8 @@
 name: Move major version tag
 
-# Escape hatch for the two cases the automatic move does not cover: shipping a workflow change right
-# after the release that unblocked it, without waiting for the next master push, and rolling the tag
-# back to an earlier commit when a shipped workflow turns out to be broken.
+# Escape hatch for what the automatic move on master pushes does not cover: rolling the tag back to
+# an earlier commit when a shipped workflow or CLI turns out to be broken, or moving it after a push
+# whose checks failed for an unrelated reason.
 
 on:
     workflow_dispatch:

package/.github/workflows/manual_release_stable.yaml

@@ -36,6 +36,9 @@ jobs:
     tests:
         name: Tests
         uses: ./.github/workflows/_tests.yaml
+        # Only the sandbox token, not `secrets: inherit`: the test job runs test code.
+        secrets:
+            E2E_TEST_APIFY_TOKEN_DBYPODOIHUZABNQTR: ${{ secrets.E2E_TEST_APIFY_TOKEN_DBYPODOIHUZABNQTR }}
 
     release_metadata:
         name: Update release metadata
@@ -79,16 +82,3 @@ jobs:
                           "ref": "${{ needs.release_metadata.outputs.changelog_commitish }}",
                           "tag": "latest"
                       }
-
-    # This release is what unblocks a major tag being held for an unpublished package version, so
-    # try the move again now rather than making someone wait for the next master push. A no-op when
-    # the tag was not being held.
-    move_major_tag:
-        name: Move major version tag
-        needs: [release_metadata, npm_publish]
-        permissions:
-            contents: write
-        uses: ./.github/workflows/_move_major_tag.yaml
-        with:
-            ref: ${{ needs.release_metadata.outputs.changelog_commitish }}
-            wait_for_publish: true

package/.github/workflows/on_master.yaml

@@ -24,14 +24,18 @@ jobs:
         if: "!startsWith(github.event.head_commit.message, 'docs')"
         name: Tests
         uses: ./.github/workflows/_tests.yaml
+        # Only the sandbox token, not `secrets: inherit`: the test job runs test code.
+        secrets:
+            E2E_TEST_APIFY_TOKEN_DBYPODOIHUZABNQTR: ${{ secrets.E2E_TEST_APIFY_TOKEN_DBYPODOIHUZABNQTR }}
 
-    # Ships any workflow change in this push to consumer repos. Deliberately independent of the npm
-    # release below: a workflow-only change needs no release, and a package-only release leaves the
-    # workflows byte-identical. `code_checks` runs actionlint, which is what validates the workflows;
-    # `tests` covers the npm package and is skipped for docs commits, so it is not a dependency here.
+    # Ships this push to consumer repos: the workflows and the CLI bundled in .github/cli/ go live
+    # together. Independent of the npm release below, which only matters to people importing the lib.
+    # `code_checks` runs actionlint and checks the bundle is up to date. `tests` cover the CLI but are
+    # skipped for docs commits, so a skipped run does not hold the tag; a failed one does.
     move_major_tag:
         name: Move major version tag
-        needs: [code_checks]
+        needs: [code_checks, tests]
+        if: ${{ !failure() && !cancelled() }}
         permissions:
             contents: write
         uses: ./.github/workflows/_move_major_tag.yaml

package/.github/workflows/on_pull_request.yaml

@@ -21,51 +21,6 @@ jobs:
     tests:
         name: Tests
         uses: ./.github/workflows/_tests.yaml
-
-    # Catches the one combination that breaks consumers: a workflow starting to use a CLI feature
-    # from the same PR. Merging ships the workflow immediately, so the pinned version has to move in
-    # the same change or the workflow goes live calling something that is not published.
-    package_version_bump_needed:
-        name: Package version bump needed
-        runs-on: ubuntu-latest
-        steps:
-            - name: Checkout repository
-              uses: actions/checkout@v6
-              with:
-                  fetch-depth: 0
-                  ref: ${{ github.event.pull_request.head.sha }}
-
-            - name: Check whether this PR needs a version bump
-              env:
-                  BASE_REF: ${{ github.base_ref }}
-                  PR_LABELS: ${{ join(github.event.pull_request.labels.*.name, ',') }}
-              run: |
-                  git fetch --no-tags origin "$BASE_REF"
-                  git diff --name-only FETCH_HEAD...HEAD | node .github/scripts/check-package-version-bump.mjs
-
-    # Reports whether merging this PR will ship the workflows or hold the major tag until a release.
-    # Never fails: pinning a version ahead of the release that publishes it is a supported way to
-    # land the package change and the workflow change that needs it in one PR.
-    workflows_package_version:
-        name: Workflows package version
-        runs-on: ubuntu-latest
-        steps:
-            - name: Checkout repository
-              uses: actions/checkout@v6
-
-            - name: Check the pinned package version is published
-              run: |
-                  pinned_version=$(cat .github/workflows-package-version)
-                  if npm view "apify-test-tools@$pinned_version" version >/dev/null 2>&1; then
-                      echo "Workflows pin apify-test-tools@$pinned_version, which is published."
-                      echo "The major tag moves on merge and these workflows go live." >> "$GITHUB_STEP_SUMMARY"
-                  else
-                      {
-                          echo "### Major tag will be held on merge"
-                          echo
-                          echo "These workflows pin \`apify-test-tools@$pinned_version\`, which is not on npm yet."
-                          echo "Merging is fine: consumers keep running the current workflows until you cut a"
-                          echo "stable release, and the tag moves once that version is published."
-                      } >> "$GITHUB_STEP_SUMMARY"
-                      echo "::notice::Merging will not ship these workflows until apify-test-tools $pinned_version is released."
-                  fi
+        # Only the sandbox token, not `secrets: inherit`: the test job runs test code.
+        secrets:
+            E2E_TEST_APIFY_TOKEN_DBYPODOIHUZABNQTR: ${{ secrets.E2E_TEST_APIFY_TOKEN_DBYPODOIHUZABNQTR }}

package/.github/workflows/public_platform-tests-claude-investigate-and-fix.yaml

@@ -23,13 +23,17 @@ name: 'Platform tests: Claude failure investigation and fix'
 #         uses: apify/apify-test-tools/.github/workflows/public_platform-tests.yaml@workflows-v0
 #         with:
 #             subtest: core
-#         secrets: inherit
+#         secrets:
+#             TESTER_APIFY_TOKEN: ${{ secrets.TESTER_APIFY_TOKEN }}
+#             SLACK_TOKEN_TESTS_BOT: ${{ secrets.SLACK_TOKEN_TESTS_BOT }}
 #
 #     handle-failure:
 #         needs: platformTestsCore
 #         if: ${{ failure() }}
 #         uses: apify/apify-test-tools/.github/workflows/public_platform-tests-claude-investigate-and-fix.yaml@workflows-v0
-#         secrets: inherit
+#         secrets:
+#             ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
+#             TESTER_APIFY_TOKEN: ${{ secrets.TESTER_APIFY_TOKEN }}
 
 on:
     workflow_call:
@@ -39,6 +43,11 @@ on:
                 type: string
                 default: sonnet
                 description: Claude model to use for investigation and fix
+            effort:
+                required: false
+                type: string
+                default: ''
+                description: Claude effort level (low, medium, high, xhigh, max) to use for investigation and fix. Uses the Claude Code default when empty.
             max_flakiness_runs:
                 required: false
                 type: number
@@ -115,6 +124,7 @@ jobs:
                   claude_args: |
                       --mcp-config '{"mcpServers":{"apify":{"type":"http","url":"https://mcp.apify.com/?tools=get-actor-run,get-actor-run-log,get-dataset-list,get-dataset,get-dataset-items,get-key-value-store-list,get-key-value-store,get-key-value-store-keys,get-key-value-store-record","headers":{"Authorization":"Bearer ${TESTER_APIFY_TOKEN}"}}}}'
                       --model ${{ inputs.model }}
+                      ${{ inputs.effort && format('--effort {0}', inputs.effort) || '' }}
                       --dangerously-skip-permissions
 
             - name: Upload Claude output (for debugging)
@@ -190,6 +200,7 @@ jobs:
                   prompt: 'Open a pull request to address GitHub issue #${{ needs.investigate.outputs.issue_number }}. Use `gh issue view ${{ needs.investigate.outputs.issue_number }}` to read the issue details first, then implement the fix and create a PR.'
                   claude_args: |
                       --model ${{ inputs.model }}
+                      ${{ inputs.effort && format('--effort {0}', inputs.effort) || '' }}
                       --dangerously-skip-permissions
 
             - name: Upload Claude output (for debugging)

package/.github/workflows/public_platform-tests.yaml

@@ -18,6 +18,17 @@ on:
                 type: string
                 default: ''
                 required: false
+        # Only TESTER_APIFY_TOKEN is required, every test needs it. See the Secrets section of docs/workflows.md.
+        secrets:
+            NPM_TOKEN:
+                required: false
+                description: Read-only token for installing private npm packages.
+            TESTER_APIFY_TOKEN:
+                required: true
+                description: Apify token the platform tests run Actors with.
+            SLACK_TOKEN_TESTS_BOT:
+                required: false
+                description: Slack token for reporting test results.
 
 jobs:
     scheduledPlatformTests:
@@ -31,6 +42,18 @@ jobs:
               with:
                   npm-token: ${{ secrets.NPM_TOKEN }}
 
+            # Fails here with a clear message rather than deep in vitest. `required: true` alone doesn't
+            # catch it: a caller can list the secret while the repo doesn't have it, and PRs from forks
+            # never get secrets.
+            - name: Check TESTER_APIFY_TOKEN
+              env:
+                  TESTER_APIFY_TOKEN: ${{ secrets.TESTER_APIFY_TOKEN }}
+              run: |
+                  if [ -z "$TESTER_APIFY_TOKEN" ]; then
+                      echo "::error::TESTER_APIFY_TOKEN is empty. Pass it in the secrets: block of the job that calls this workflow."
+                      exit 1
+                  fi
+
             - name: Test
               env:
                   TESTER_APIFY_TOKEN: ${{ secrets.TESTER_APIFY_TOKEN }}
@@ -47,7 +70,7 @@ jobs:
                     --fileParallelism=true \
                     --maxWorkers 100
                   return_code=$?
-                  npx apify-test-tools report-tests \
+                  apify-test-tools report-tests \
                     --report-file ./test-output.json \
                     --workflow-name "${{ github.workflow }}" \
                     --job-url "${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}" \

package/.github/workflows/public_pr-build-test.yaml

@@ -12,6 +12,27 @@ on:
                 type: string
                 default: ''
                 required: false
+            # Fail the build unless the env var names of version 0.99 match the default version's
+            require-env-vars-in-sync:
+                type: boolean
+                default: true
+                required: false
+        # Every secret is optional. The ones this workflow reads are declared by name. The secrets that
+        # apify-test-tools.config.json names (e.g. each Actor's `tokenEnvVar`) differ per repo, so they
+        # come packed in CONFIG_SECRETS. See the Secrets section of docs/workflows.md.
+        secrets:
+            NPM_TOKEN:
+                required: false
+                description: Read-only token for installing private npm packages.
+            TESTER_APIFY_TOKEN:
+                required: false
+                description: Apify token the platform tests run Actors with.
+            CONFIG_SECRETS:
+                required: false
+                description: >-
+                    JSON object of the secrets apify-test-tools.config.json names, secret name -> value.
+                    Today that is each Actor's `tokenEnvVar`. Passing `toJSON(secrets)` works too, only
+                    the names the config declares are used.
 
 concurrency:
     group: ${{ github.workflow }}-${{ github.ref }}
@@ -29,6 +50,19 @@ jobs:
               with:
                   # Some repos use private npm packages, they need to pass NPM_TOKEN secret to this workflow
                   npm-token: ${{ secrets.NPM_TOKEN }}
+                  config-secrets: ${{ secrets.CONFIG_SECRETS }}
+
+            # Fails here with a clear message rather than deep in vitest. `required: true` alone doesn't
+            # catch it: a caller can list the secret while the repo doesn't have it, and PRs from forks
+            # never get secrets.
+            - name: Check TESTER_APIFY_TOKEN
+              env:
+                  TESTER_APIFY_TOKEN: ${{ secrets.TESTER_APIFY_TOKEN }}
+              run: |
+                  if [ -z "$TESTER_APIFY_TOKEN" ]; then
+                      echo "::error::TESTER_APIFY_TOKEN is empty. Pass it in the secrets: block of the job that calls this workflow."
+                      exit 1
+                  fi
 
             - name: Pick last validated commit from cache
               id: base_commit
@@ -41,31 +75,41 @@ jobs:
                   # This is needed to force overriding the cache with new entry at the end
                   restore-keys: base_commit-
 
-            # run-with-apify-tokens.mjs reads the token names from in apify-test-tools.config.json
-            # and hands the build those secrets and nothing else, so the tokens stay in this one command instead of the whole job.
-            # The library never sees secrets it doesn't need
-            - name: Build
-              id: build
+            # Needs no tokens, it only reads git and apify-test-tools.config.json. The setup action checks out
+            # the PR branch itself (not GitHub's merge commit), so the range ends at the branch's HEAD.
+            - name: Find affected Actors
               env:
-                  ALL_SECRETS: ${{ toJSON(secrets) }}
                   # Branch names are attacker-controlled on fork PRs, so they reach the script as
                   # environment variables rather than being interpolated into it.
-                  HEAD_REF: ${{ github.head_ref }}
                   BASE_REF: ${{ github.base_ref }}
-                  SCRIPTS_PATH: ${{ steps.setup.outputs.scripts-path }}
               run: |
                   base_commit=$(cat base_commit.txt 2>/dev/null || echo "")
                   echo "Last validated (base) commit to be used for build & test: $base_commit"
                   args=(
-                    --source-branch "origin/$HEAD_REF"
-                    --target-branch "origin/$BASE_REF"
+                    --base "origin/$BASE_REF"
                     # TODO: Temporary hotfix until build glob matching aligns with Vitest's test selection glob.
                     --test-files-glob 'test/platform/**'
-                    --use-docker-cache
                   )
-                  [ -n "$base_commit" ] && args+=(--base-commit "$base_commit")
-                  actor_builds=$(node "$SCRIPTS_PATH/run-with-apify-tokens.mjs" \
-                    npx apify-test-tools build "${args[@]}")
+                  [ -n "$base_commit" ] && args+=(--since "$base_commit")
+                  apify-test-tools get-affected-actors "${args[@]}" > affected.json
+
+            # Cosmetic-only changes need no tests, so only the functionally changed Actors are built, into the
+            # test version 0.99 that users never run.
+            # run-with-apify-tokens.mjs reads the token names from in apify-test-tools.config.json
+            # and hands the build those secrets and nothing else, so the tokens stay in this one command instead of the whole job.
+            # The library never sees secrets it doesn't need
+            - name: Build
+              id: build
+              # bash rather than the default shell, for pipefail
+              shell: bash
+              env:
+                  WORKFLOW_SECRETS: ${{ toJSON(secrets) }}
+                  SCRIPTS_PATH: ${{ steps.setup.outputs.scripts-path }}
+                  REQUIRE_ENV_VARS_IN_SYNC: ${{ inputs.require-env-vars-in-sync }}
+              run: |
+                  actor_builds=$(jq '{ actors: .functionallyChangedActors }' affected.json \
+                    | node "$SCRIPTS_PATH/run-with-apify-tokens.mjs" apify-test-tools build --version-number 0.99 \
+                        --require-env-vars-in-sync="$REQUIRE_ENV_VARS_IN_SYNC")
                   echo "actor_builds=$actor_builds" | tee -a "$GITHUB_OUTPUT"
 
             # Runs the repo's test code and its whole import graph, so it gets the tester token only.
@@ -77,18 +121,10 @@ jobs:
 
             # NOTE: This is an optimization that if we did functional changes and later only cosmetic changes (e.g. dev readme), we will compare changes files only for the last commit. This must run after tests because we want to cache the latest commit only if the tests are successful
             - name: Store last validated commit to cache
-              env:
-                  HEAD_REF: ${{ github.head_ref }}
-                  BASE_REF: ${{ github.base_ref }}
               run: |
-                  base_commit=$(cat base_commit.txt 2>/dev/null || echo "")
-                  echo "Old last validated (base) commit: $base_commit"
-                  args=(
-                    --source-branch "origin/$HEAD_REF"
-                    --target-branch "origin/$BASE_REF"
-                  )
-                  [ -n "$base_commit" ] && args+=(--base-commit "$base_commit")
-                  npx apify-test-tools get-latest-commit "${args[@]}" > ./base_commit.txt
+                  echo "Old last validated (base) commit: $(cat base_commit.txt 2>/dev/null || echo "")"
+                  # The HEAD that was just built and tested
+                  jq -r .head affected.json > base_commit.txt
                   echo "New last validated (base) commit: $(cat base_commit.txt)"
 
     # Pure static checks against the repo. Needs no Apify or Slack credentials, only the npm