apify-test-tools 0.10.2-beta.1 → 0.10.2-beta.11

package/.github/scripts/mask-config-secrets.sh

@@ -0,0 +1,17 @@
+#!/usr/bin/env bash
+# Registers every value inside the CONFIG_SECRETS secret as a mask.
+#
+#     CONFIG_SECRETS=... bash .github/scripts/mask-config-secrets.sh
+#
+# The runner masks a secret by its exact value, so a value packed inside a JSON secret is only
+# masked as part of that whole blob. Once a step takes it out, it would print in clear.
+# Multi-line values are registered line by line, the way the runner registers secrets.
+# CONFIG_SECRETS may be empty or unset.
+
+set -uo pipefail
+
+[ -n "${CONFIG_SECRETS:-}" ] || exit 0
+
+# jq's errors can quote the input, so they are dropped for our own message
+jq -r 'if type != "object" then error else . end | to_entries[] | .value | strings | split("\n")[] | select(. != "") | "::add-mask::" + .' <<< "$CONFIG_SECRETS" 2>/dev/null \
+    || { echo "::error::The CONFIG_SECRETS secret must be a JSON object."; exit 1; }

package/.github/scripts/run-with-apify-tokens.mjs

@@ -1,13 +1,17 @@
 #!/usr/bin/env node
 // Runs apify-test-tools and passes it only secrets needed for the Actors, no other secrets are leaked.
 //
-//     node .github/scripts/run-with-apify-tokens.mjs npx apify-test-tools build --target-branch ...
+//     jq ... | node .github/scripts/run-with-apify-tokens.mjs apify-test-tools build --version-number 0.99
 //
-// The step passes the whole secrets map as ALL_SECRETS. The token names come from `tokenEnvVar` in
-// the repo's apify-test-tools.config.json, which is the same file apify-test-tools itself reads, so
-// the two can't drift. Everything else in the secrets map (npm, Slack, GitHub, anything else the
-// repo holds) is left out, and ALL_SECRETS itself is dropped, so the blob never reaches npx or
-// anything under node_modules.
+// The step passes the reusable workflow's whole secrets map as WORKFLOW_SECRETS. The token names
+// come from `tokenEnvVar` in the repo's apify-test-tools.config.json, which is the same file
+// apify-test-tools itself reads, so the two can't drift. Everything else in the secrets map (npm,
+// Slack, GitHub, anything else the repo holds) is left out, and WORKFLOW_SECRETS itself is dropped,
+// so the blob never reaches the CLI or anything under node_modules.
+//
+// Each token is looked up in the CONFIG_SECRETS secret first, a JSON object of secret name -> value,
+// and then among the top-level secrets, which is where `secrets: inherit` puts them. The secrets the
+// workflows read by name (NPM_TOKEN, TESTER_APIFY_TOKEN, ...) never come from CONFIG_SECRETS.
 //
 // The command runs without a shell, so branch names and other interpolated arguments are passed
 // through as literal argv entries.
@@ -28,16 +32,36 @@ const fail = (message) => {
 const [command, ...args] = process.argv.slice(2);
 if (!command) fail('Usage: run-with-apify-tokens.mjs <command> [args...]');
 
-const { ALL_SECRETS, ...baseEnv } = process.env;
-if (!ALL_SECRETS) fail('ALL_SECRETS is not set. Add `ALL_SECRETS: ${{ toJSON(secrets) }}` to the step env.');
+const { WORKFLOW_SECRETS, ...baseEnv } = process.env;
+if (!WORKFLOW_SECRETS) {
+    fail('WORKFLOW_SECRETS is not set. Add `WORKFLOW_SECRETS: ${{ toJSON(secrets) }}` to the step env.');
+}
 
-let secrets;
+let workflowSecrets;
 try {
-    secrets = JSON.parse(ALL_SECRETS);
+    workflowSecrets = JSON.parse(WORKFLOW_SECRETS);
 } catch (error) {
-    fail(`ALL_SECRETS is not valid JSON: ${error.message}`);
+    fail(`WORKFLOW_SECRETS is not valid JSON: ${error.message}`);
 }
 
+// Never includes the parse error: Node quotes the input in it, and the input is a secret.
+const unpackConfigSecrets = () => {
+    const packed = workflowSecrets.CONFIG_SECRETS;
+    if (!packed) return {};
+    let value;
+    try {
+        value = JSON.parse(packed);
+    } catch {
+        fail('The CONFIG_SECRETS secret is not valid JSON.');
+    }
+    if (typeof value !== 'object' || value === null || Array.isArray(value)) {
+        fail('The CONFIG_SECRETS secret must be a JSON object.');
+    }
+    return value;
+};
+
+const secrets = { ...workflowSecrets, ...unpackConfigSecrets() };
+
 const configPath = path.resolve(process.cwd(), CONFIG_FILE_NAME);
 let config;
 try {
@@ -78,7 +102,8 @@ const missing = tokenNames.filter((name) => !(name in secrets));
 if (missing.length > 0) {
     console.error(
         `Warning: ${CONFIG_FILE_NAME} declares ${missing.join(', ')}, but no such secret was passed ` +
-            `to this workflow. Check the repository secrets if a build fails on a missing token.`,
+            `to this workflow, neither inside CONFIG_SECRETS nor inherited. Check the repository secrets ` +
+            `and the workflow's \`secrets:\` if a build fails on a missing token.`,
     );
 }
 

package/.github/workflows/_check_code.yaml

@@ -26,22 +26,6 @@ jobs:
     #         - name: Check spelling with typos
     #           uses: crate-ci/typos@v1
 
-    major_tag_refs:
-        name: Major tag refs
-        runs-on: ubuntu-latest
-        steps:
-            - name: Checkout repository
-              uses: actions/checkout@v6
-            - name: Use Node.js
-              uses: actions/setup-node@v6
-              with:
-                  node-version: 24
-            # `uses:` takes no expressions, so the major tag is repeated in every ref into this repo.
-            # Missing one during a bump is silent while both tags exist: the new workflows quietly
-            # run the old composite action.
-            - name: Check refs match MAJOR_TAG
-              run: node .github/scripts/check-major-tag-refs.mjs
-
     lint_check:
         name: Lint check
         runs-on: ubuntu-latest
@@ -92,3 +76,28 @@ jobs:
               run: npm ci
             - name: Build
               run: npm run build
+
+    # The composite action runs the CLI from .github/cli/apify-test-tools.mjs, which the pre-commit
+    # hook rebuilds. This catches commits that skipped the hook, so a stale bundle never ships.
+    cli_bundle:
+        name: CLI bundle
+        runs-on: ubuntu-latest
+        steps:
+            - name: Checkout repository
+              uses: actions/checkout@v6
+            - name: Use Node.js
+              uses: actions/setup-node@v6
+              with:
+                  node-version: 24
+                  cache: 'npm'
+                  cache-dependency-path: 'package-lock.json'
+            - name: Install dependencies
+              run: npm ci
+            - name: Check the bundle is up to date
+              run: |
+                  npm run bundle
+                  if ! git diff --quiet -- .github/cli/; then
+                      echo "::error::.github/cli/apify-test-tools.mjs is out of date. Run \`npm run bundle\` and commit the result."
+                      exit 1
+                  fi
+                  node .github/cli/apify-test-tools.mjs --help > /dev/null

package/.github/workflows/_move_major_tag.yaml

@@ -1,13 +1,8 @@
 name: Move major version tag
 
-# Consumer repos track a floating major tag (`...@v0`), not `master`, so merging to master does not
-# ship anything by itself. This workflow is what ships: it moves that tag forward, but only once the
-# package version the workflows pin in .github/workflows-package-version is actually on npm.
-#
-# That gate is the whole point. The workflows and the npm package release on their own schedules, so
-# the only combination that can break consumers is a workflow that calls a CLI feature which has not
-# been published yet. In that case the tag simply stays where it is and production keeps running the
-# previous workflows until someone cuts a release.
+# Consumer repos track a floating major tag (`...@workflows-v0`), not `master`. This workflow is what
+# ships: it moves that tag forward. The workflows and the CLI they call (bundled in .github/cli/)
+# live in the same commit, so whatever the tag points at is consistent on its own.
 
 on:
     workflow_call:
@@ -16,13 +11,6 @@ on:
                 description: Commit to move the tag to. Defaults to the commit that triggered the caller.
                 type: string
                 default: ''
-            wait_for_publish:
-                description: >-
-                    Set by a release that has just published the pinned version. npm accepts a publish
-                    before the version is readable, so the check waits instead of treating the gap as
-                    a held tag, and fails if the version never appears.
-                type: boolean
-                default: false
 
 permissions:
     contents: read
@@ -54,8 +42,8 @@ jobs:
             # it. Depending on a regex in another repo to keep releases working is not a dependency
             # worth having, and `v1` beside a package `v1.0.0` would be worse still.
             #
-            # `uses:` cannot take an expression, so every ref into this repo hardcodes this same tag;
-            # check-major-tag-refs.mjs fails the build if one of them drifts.
+            # The workflows load this repo with `$/`, so they never name the tag. Only the usage
+            # examples in the workflows, README and docs do: update them by hand when bumping it.
             MAJOR_TAG: workflows-v0
         steps:
             - name: Checkout repository
@@ -63,54 +51,7 @@ jobs:
               with:
                   ref: ${{ inputs.ref || github.sha }}
 
-            - name: Check the required package version is published
-              id: check
-              env:
-                  # npm accepts a publish and processes it asynchronously ("Your package is being
-                  # processed and may take a few minutes to become available"). Observed at ~19
-                  # minutes for a provenance-signed release, so the release path waits well past
-                  # npm's own estimate rather than shipping a tag consumers cannot install against.
-                  WAIT_SECONDS: ${{ inputs.wait_for_publish && 2400 || 0 }}
-              run: |
-                  pinned_version=$(cat .github/workflows-package-version)
-                  echo "pinned_version=$pinned_version" >> "$GITHUB_OUTPUT"
-
-                  deadline=$(( $(date +%s) + WAIT_SECONDS ))
-                  while :; do
-                      # --prefer-online so a 404 cached from an earlier attempt cannot outlive the
-                      # publish it was polling for.
-                      if output=$(npm view "apify-test-tools@$pinned_version" version --prefer-online 2>&1); then
-                          echo "apify-test-tools@$pinned_version is on npm"
-                          echo "published=true" >> "$GITHUB_OUTPUT"
-                          exit 0
-                      fi
-
-                      # Anything that is not "this version does not exist" is a registry, network or
-                      # auth problem. Sitting in the retry loop would hide it behind a held tag.
-                      if ! grep -q 'code E404' <<< "$output"; then
-                          echo "::error::npm view failed for a reason other than the version being absent."
-                          echo "$output"
-                          exit 1
-                      fi
-
-                      if [ "$(date +%s)" -ge "$deadline" ]; then
-                          break
-                      fi
-                      echo "apify-test-tools@$pinned_version is not on npm yet, retrying in 30s"
-                      sleep 30
-                  done
-
-                  echo "published=false" >> "$GITHUB_OUTPUT"
-
-                  # A release waited for its own publish and never saw it. That is a broken release,
-                  # not a held tag, and it has to be red so it can be re-run once npm catches up.
-                  if [ "$WAIT_SECONDS" -gt 0 ]; then
-                      echo "::error::apify-test-tools@$pinned_version was published by this run but is still not readable after $((WAIT_SECONDS / 60))m. Re-run this job once it appears on npm."
-                      exit 1
-                  fi
-
             - name: Move tag
-              if: steps.check.outputs.published == 'true'
               env:
                   TARGET_SHA: ${{ inputs.ref || github.sha }}
               run: |
@@ -120,23 +61,4 @@ jobs:
                       echo "### \`$MAJOR_TAG\` moved"
                       echo
                       echo "Now points at \`$TARGET_SHA\`."
-                      echo "Pins \`apify-test-tools@${{ steps.check.outputs.pinned_version }}\`, which is published."
-                  } >> "$GITHUB_STEP_SUMMARY"
-
-            # Not a failure. Holding the tag is the designed outcome of merging a workflow change
-            # that needs an unreleased package feature, and consumers are unaffected while it waits.
-            - name: Report held tag
-              if: steps.check.outputs.published != 'true'
-              env:
-                  TARGET_SHA: ${{ inputs.ref || github.sha }}
-              run: |
-                  {
-                      echo "### \`$MAJOR_TAG\` held"
-                      echo
-                      echo "\`$TARGET_SHA\` pins \`apify-test-tools@${{ steps.check.outputs.pinned_version }}\`, which is not on npm."
-                      echo "Consumers keep running the workflows \`$MAJOR_TAG\` already points at."
-                      echo
-                      echo "Publish that version with the **Stable release** workflow. The tag moves on the"
-                      echo "next master push, or immediately via the **Move major version tag** workflow."
                   } >> "$GITHUB_STEP_SUMMARY"
-                  echo "::warning::$MAJOR_TAG not moved: apify-test-tools@${{ steps.check.outputs.pinned_version }} is not published yet."

package/.github/workflows/_tests.yaml

@@ -3,6 +3,10 @@ name: Tests
 on:
     workflow_dispatch:
     workflow_call:
+        secrets:
+            # Token of an isolated sandbox account that can only reach the e2e test's two dummy Actors.
+            E2E_TEST_APIFY_TOKEN_DBYPODOIHUZABNQTR:
+                required: false
 
 permissions:
     contents: read
@@ -33,3 +37,33 @@ jobs:
 
             - name: Unit tests
               run: npm test
+
+    # Runs the shipped CLI bundle against real Actors (test/e2e). Node 24 only, so one push builds
+    # and runs the sandbox Actors once rather than once per Node version.
+    e2e_tests:
+        name: E2E tests
+        runs-on: ubuntu-latest
+        steps:
+            - name: Checkout repository
+              uses: actions/checkout@v6
+
+            - name: Use Node.js
+              uses: actions/setup-node@v6
+              with:
+                  node-version: 24
+                  cache: 'npm'
+                  cache-dependency-path: 'package-lock.json'
+
+            - name: Install dependencies
+              run: npm ci
+
+            # The token is only on this step. Fork and Dependabot PRs don't get the secret, and the
+            # suite skips itself without it.
+            - name: E2E tests
+              env:
+                  E2E_TEST_APIFY_TOKEN_DBYPODOIHUZABNQTR: ${{ secrets.E2E_TEST_APIFY_TOKEN_DBYPODOIHUZABNQTR }}
+              run: |
+                  if [ -z "$E2E_TEST_APIFY_TOKEN_DBYPODOIHUZABNQTR" ]; then
+                      echo "::notice::E2E_TEST_APIFY_TOKEN_DBYPODOIHUZABNQTR is not available to this run, the e2e tests are skipped."
+                  fi
+                  npm run test:e2e

package/.github/workflows/_update_release_metadata.yaml

@@ -77,18 +77,6 @@ jobs:
                   write-mode: overwrite
                   contents: ${{ needs.release_metadata.outputs.changelog }}
 
-            # The reusable workflows install this exact version, so the commit that releases a
-            # version is the commit that pins it. That is what lets a frozen major tag keep
-            # installing the library it was tested against instead of drifting to whatever is
-            # newest.
-            #
-            # Skipped for prereleases: master pushes release a `-beta` that consumer repos must
-            # never install. Their pin stays on the last stable, and the beta stays reachable
-            # through the lockfile path in the setup action, which is how branch testing works.
-            - name: Update the version the workflows pin
-              if: inputs.release_type != 'prerelease'
-              run: echo "${{ needs.release_metadata.outputs.version_number }}" > .github/workflows-package-version
-
             - name: Commit changes
               id: commit
               uses: apify/actions/signed-commit@v1.0.0

package/.github/workflows/manual_move_major_tag.yaml

@@ -1,8 +1,8 @@
 name: Move major version tag
 
-# Escape hatch for the two cases the automatic move does not cover: shipping a workflow change right
-# after the release that unblocked it, without waiting for the next master push, and rolling the tag
-# back to an earlier commit when a shipped workflow turns out to be broken.
+# Escape hatch for what the automatic move on master pushes does not cover: rolling the tag back to
+# an earlier commit when a shipped workflow or CLI turns out to be broken, or moving it after a push
+# whose checks failed for an unrelated reason.
 
 on:
     workflow_dispatch:

package/.github/workflows/manual_release_stable.yaml

@@ -36,6 +36,9 @@ jobs:
     tests:
         name: Tests
         uses: ./.github/workflows/_tests.yaml
+        # Only the sandbox token, not `secrets: inherit`: the test job runs test code.
+        secrets:
+            E2E_TEST_APIFY_TOKEN_DBYPODOIHUZABNQTR: ${{ secrets.E2E_TEST_APIFY_TOKEN_DBYPODOIHUZABNQTR }}
 
     release_metadata:
         name: Update release metadata
@@ -79,16 +82,3 @@ jobs:
                           "ref": "${{ needs.release_metadata.outputs.changelog_commitish }}",
                           "tag": "latest"
                       }
-
-    # This release is what unblocks a major tag being held for an unpublished package version, so
-    # try the move again now rather than making someone wait for the next master push. A no-op when
-    # the tag was not being held.
-    move_major_tag:
-        name: Move major version tag
-        needs: [release_metadata, npm_publish]
-        permissions:
-            contents: write
-        uses: ./.github/workflows/_move_major_tag.yaml
-        with:
-            ref: ${{ needs.release_metadata.outputs.changelog_commitish }}
-            wait_for_publish: true

package/.github/workflows/on_master.yaml

@@ -24,14 +24,18 @@ jobs:
         if: "!startsWith(github.event.head_commit.message, 'docs')"
         name: Tests
         uses: ./.github/workflows/_tests.yaml
+        # Only the sandbox token, not `secrets: inherit`: the test job runs test code.
+        secrets:
+            E2E_TEST_APIFY_TOKEN_DBYPODOIHUZABNQTR: ${{ secrets.E2E_TEST_APIFY_TOKEN_DBYPODOIHUZABNQTR }}
 
-    # Ships any workflow change in this push to consumer repos. Deliberately independent of the npm
-    # release below: a workflow-only change needs no release, and a package-only release leaves the
-    # workflows byte-identical. `code_checks` runs actionlint, which is what validates the workflows;
-    # `tests` covers the npm package and is skipped for docs commits, so it is not a dependency here.
+    # Ships this push to consumer repos: the workflows and the CLI bundled in .github/cli/ go live
+    # together. Independent of the npm release below, which only matters to people importing the lib.
+    # `code_checks` runs actionlint and checks the bundle is up to date. `tests` cover the CLI but are
+    # skipped for docs commits, so a skipped run does not hold the tag; a failed one does.
     move_major_tag:
         name: Move major version tag
-        needs: [code_checks]
+        needs: [code_checks, tests]
+        if: ${{ !failure() && !cancelled() }}
         permissions:
             contents: write
         uses: ./.github/workflows/_move_major_tag.yaml

package/.github/workflows/on_pull_request.yaml

@@ -21,51 +21,6 @@ jobs:
     tests:
         name: Tests
         uses: ./.github/workflows/_tests.yaml
-
-    # Catches the one combination that breaks consumers: a workflow starting to use a CLI feature
-    # from the same PR. Merging ships the workflow immediately, so the pinned version has to move in
-    # the same change or the workflow goes live calling something that is not published.
-    package_version_bump_needed:
-        name: Package version bump needed
-        runs-on: ubuntu-latest
-        steps:
-            - name: Checkout repository
-              uses: actions/checkout@v6
-              with:
-                  fetch-depth: 0
-                  ref: ${{ github.event.pull_request.head.sha }}
-
-            - name: Check whether this PR needs a version bump
-              env:
-                  BASE_REF: ${{ github.base_ref }}
-                  PR_LABELS: ${{ join(github.event.pull_request.labels.*.name, ',') }}
-              run: |
-                  git fetch --no-tags origin "$BASE_REF"
-                  git diff --name-only FETCH_HEAD...HEAD | node .github/scripts/check-package-version-bump.mjs
-
-    # Reports whether merging this PR will ship the workflows or hold the major tag until a release.
-    # Never fails: pinning a version ahead of the release that publishes it is a supported way to
-    # land the package change and the workflow change that needs it in one PR.
-    workflows_package_version:
-        name: Workflows package version
-        runs-on: ubuntu-latest
-        steps:
-            - name: Checkout repository
-              uses: actions/checkout@v6
-
-            - name: Check the pinned package version is published
-              run: |
-                  pinned_version=$(cat .github/workflows-package-version)
-                  if npm view "apify-test-tools@$pinned_version" version >/dev/null 2>&1; then
-                      echo "Workflows pin apify-test-tools@$pinned_version, which is published."
-                      echo "The major tag moves on merge and these workflows go live." >> "$GITHUB_STEP_SUMMARY"
-                  else
-                      {
-                          echo "### Major tag will be held on merge"
-                          echo
-                          echo "These workflows pin \`apify-test-tools@$pinned_version\`, which is not on npm yet."
-                          echo "Merging is fine: consumers keep running the current workflows until you cut a"
-                          echo "stable release, and the tag moves once that version is published."
-                      } >> "$GITHUB_STEP_SUMMARY"
-                      echo "::notice::Merging will not ship these workflows until apify-test-tools $pinned_version is released."
-                  fi
+        # Only the sandbox token, not `secrets: inherit`: the test job runs test code.
+        secrets:
+            E2E_TEST_APIFY_TOKEN_DBYPODOIHUZABNQTR: ${{ secrets.E2E_TEST_APIFY_TOKEN_DBYPODOIHUZABNQTR }}

package/.github/workflows/public_platform-tests-claude-investigate-and-fix.yaml

@@ -23,13 +23,17 @@ name: 'Platform tests: Claude failure investigation and fix'
 #         uses: apify/apify-test-tools/.github/workflows/public_platform-tests.yaml@workflows-v0
 #         with:
 #             subtest: core
-#         secrets: inherit
+#         secrets:
+#             TESTER_APIFY_TOKEN: ${{ secrets.TESTER_APIFY_TOKEN }}
+#             SLACK_TOKEN_TESTS_BOT: ${{ secrets.SLACK_TOKEN_TESTS_BOT }}
 #
 #     handle-failure:
 #         needs: platformTestsCore
 #         if: ${{ failure() }}
 #         uses: apify/apify-test-tools/.github/workflows/public_platform-tests-claude-investigate-and-fix.yaml@workflows-v0
-#         secrets: inherit
+#         secrets:
+#             ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
+#             TESTER_APIFY_TOKEN: ${{ secrets.TESTER_APIFY_TOKEN }}
 
 on:
     workflow_call:
@@ -39,6 +43,11 @@ on:
                 type: string
                 default: sonnet
                 description: Claude model to use for investigation and fix
+            effort:
+                required: false
+                type: string
+                default: ''
+                description: Claude effort level (low, medium, high, xhigh, max) to use for investigation and fix. Uses the Claude Code default when empty.
             max_flakiness_runs:
                 required: false
                 type: number
@@ -115,6 +124,7 @@ jobs:
                   claude_args: |
                       --mcp-config '{"mcpServers":{"apify":{"type":"http","url":"https://mcp.apify.com/?tools=get-actor-run,get-actor-run-log,get-dataset-list,get-dataset,get-dataset-items,get-key-value-store-list,get-key-value-store,get-key-value-store-keys,get-key-value-store-record","headers":{"Authorization":"Bearer ${TESTER_APIFY_TOKEN}"}}}}'
                       --model ${{ inputs.model }}
+                      ${{ inputs.effort && format('--effort {0}', inputs.effort) || '' }}
                       --dangerously-skip-permissions
 
             - name: Upload Claude output (for debugging)
@@ -177,7 +187,9 @@ jobs:
             actions: read
         steps:
             - name: Setup repository and dependencies
-              uses: apify/apify-test-tools/.github/actions/checkout-restore-dependencies@workflows-v0
+              # `$/` loads the action from this repo at the commit this workflow was called at, so a caller
+              # pinned to a SHA or a branch gets that commit's action and CLI, not whatever the major tag is on.
+              uses: $/.github/actions/checkout-restore-dependencies
               with:
                   npm-token: ${{ secrets.NPM_TOKEN }}
 
@@ -190,6 +202,7 @@ jobs:
                   prompt: 'Open a pull request to address GitHub issue #${{ needs.investigate.outputs.issue_number }}. Use `gh issue view ${{ needs.investigate.outputs.issue_number }}` to read the issue details first, then implement the fix and create a PR.'
                   claude_args: |
                       --model ${{ inputs.model }}
+                      ${{ inputs.effort && format('--effort {0}', inputs.effort) || '' }}
                       --dangerously-skip-permissions
 
             - name: Upload Claude output (for debugging)

package/.github/workflows/public_platform-tests.yaml

@@ -18,6 +18,17 @@ on:
                 type: string
                 default: ''
                 required: false
+        # Only TESTER_APIFY_TOKEN is required, every test needs it. See the Secrets section of docs/workflows.md.
+        secrets:
+            NPM_TOKEN:
+                required: false
+                description: Read-only token for installing private npm packages.
+            TESTER_APIFY_TOKEN:
+                required: true
+                description: Apify token the platform tests run Actors with.
+            SLACK_TOKEN_TESTS_BOT:
+                required: false
+                description: Slack token for reporting test results.
 
 jobs:
     scheduledPlatformTests:
@@ -26,11 +37,24 @@ jobs:
         runs-on: ubuntu-latest
         steps:
             - name: Setup repository and dependencies
-              # For testing, you have to temporarily change the branch
-              uses: apify/apify-test-tools/.github/actions/checkout-restore-dependencies@workflows-v0
+              # `$/` loads the action from this repo at the commit this workflow was called at, so a caller
+              # pinned to a SHA or a branch gets that commit's action and CLI, not whatever the major tag is on.
+              uses: $/.github/actions/checkout-restore-dependencies
               with:
                   npm-token: ${{ secrets.NPM_TOKEN }}
 
+            # Fails here with a clear message rather than deep in vitest. `required: true` alone doesn't
+            # catch it: a caller can list the secret while the repo doesn't have it, and PRs from forks
+            # never get secrets.
+            - name: Check TESTER_APIFY_TOKEN
+              env:
+                  TESTER_APIFY_TOKEN: ${{ secrets.TESTER_APIFY_TOKEN }}
+              run: |
+                  if [ -z "$TESTER_APIFY_TOKEN" ]; then
+                      echo "::error::TESTER_APIFY_TOKEN is empty. Pass it in the secrets: block of the job that calls this workflow."
+                      exit 1
+                  fi
+
             - name: Test
               env:
                   TESTER_APIFY_TOKEN: ${{ secrets.TESTER_APIFY_TOKEN }}
@@ -47,7 +71,7 @@ jobs:
                     --fileParallelism=true \
                     --maxWorkers 100
                   return_code=$?
-                  npx apify-test-tools report-tests \
+                  apify-test-tools report-tests \
                     --report-file ./test-output.json \
                     --workflow-name "${{ github.workflow }}" \
                     --job-url "${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}" \