apify-test-tools 0.10.2-beta.10 → 0.10.2-beta.11

package/.github/actionlint.yaml

@@ -10,3 +10,14 @@ paths:
         ignore:
             - 'input "display_report" is not defined in action "anthropics/claude-code-action@v1"'
             - 'property "conclusion" is not defined in object type'
+
+    # actionlint (v1.7.11, and v1.7.12 too) predates two newer GitHub features these workflows rely on:
+    # - `uses: $/path`, the self-repository syntax: this repo at the commit the workflow runs at.
+    #   actionlint only knows `./path`, `docker://` and `owner/repo@ref`, so it reports the ref as missing.
+    #   https://github.blog/changelog/2026-07-30-reference-same-repository-actions-with-self-repository-syntax/
+    # - `job.workflow_repository` and `job.workflow_sha`, the reusable workflow's own repo and commit.
+    #   https://docs.github.com/en/actions/reference/workflows-and-actions/contexts#job-context
+    .github/workflows/public_*.yaml:
+        ignore:
+            - 'specifying action "\$/[^"]*" in invalid format because ref is missing'
+            - 'property "workflow_(repository|sha)" is not defined in object type'

package/.github/actions/checkout-restore-dependencies/action.yaml

@@ -23,9 +23,8 @@ outputs:
         value: ${{ steps.scripts-path.outputs.path }}
 
 # Sets common steps and ensure we use cached node_modules
-# To test a change here, repoint the `uses:` refs in the reusable workflows at your branch, and
-# change them back before merging. Consumers track the `workflows-v0` tag, which moves on every
-# push to master.
+# The reusable workflows load this with `uses: $/...`, which resolves to the same commit as the
+# workflow itself, so testing a change here only needs the caller pointed at your branch.
 runs:
     using: 'composite'
     steps:

package/.github/workflows/_check_code.yaml

@@ -26,22 +26,6 @@ jobs:
     #         - name: Check spelling with typos
     #           uses: crate-ci/typos@v1
 
-    major_tag_refs:
-        name: Major tag refs
-        runs-on: ubuntu-latest
-        steps:
-            - name: Checkout repository
-              uses: actions/checkout@v6
-            - name: Use Node.js
-              uses: actions/setup-node@v6
-              with:
-                  node-version: 24
-            # `uses:` takes no expressions, so the major tag is repeated in every ref into this repo.
-            # Missing one during a bump is silent while both tags exist: the new workflows quietly
-            # run the old composite action.
-            - name: Check refs match MAJOR_TAG
-              run: node .github/scripts/check-major-tag-refs.mjs
-
     lint_check:
         name: Lint check
         runs-on: ubuntu-latest

package/.github/workflows/_move_major_tag.yaml

@@ -42,8 +42,8 @@ jobs:
             # it. Depending on a regex in another repo to keep releases working is not a dependency
             # worth having, and `v1` beside a package `v1.0.0` would be worse still.
             #
-            # `uses:` cannot take an expression, so every ref into this repo hardcodes this same tag;
-            # check-major-tag-refs.mjs fails the build if one of them drifts.
+            # The workflows load this repo with `$/`, so they never name the tag. Only the usage
+            # examples in the workflows, README and docs do: update them by hand when bumping it.
             MAJOR_TAG: workflows-v0
         steps:
             - name: Checkout repository

package/.github/workflows/public_platform-tests-claude-investigate-and-fix.yaml

@@ -187,7 +187,9 @@ jobs:
             actions: read
         steps:
             - name: Setup repository and dependencies
-              uses: apify/apify-test-tools/.github/actions/checkout-restore-dependencies@workflows-v0
+              # `$/` loads the action from this repo at the commit this workflow was called at, so a caller
+              # pinned to a SHA or a branch gets that commit's action and CLI, not whatever the major tag is on.
+              uses: $/.github/actions/checkout-restore-dependencies
               with:
                   npm-token: ${{ secrets.NPM_TOKEN }}
 

package/.github/workflows/public_platform-tests.yaml

@@ -37,8 +37,9 @@ jobs:
         runs-on: ubuntu-latest
         steps:
             - name: Setup repository and dependencies
-              # For testing, you have to temporarily change the branch
-              uses: apify/apify-test-tools/.github/actions/checkout-restore-dependencies@workflows-v0
+              # `$/` loads the action from this repo at the commit this workflow was called at, so a caller
+              # pinned to a SHA or a branch gets that commit's action and CLI, not whatever the major tag is on.
+              uses: $/.github/actions/checkout-restore-dependencies
               with:
                   npm-token: ${{ secrets.NPM_TOKEN }}
 

package/.github/workflows/public_pr-build-test.yaml

@@ -45,8 +45,9 @@ jobs:
         steps:
             - name: Setup repository and dependencies
               id: setup
-              # For testing, you have to temporarily change the branch
-              uses: apify/apify-test-tools/.github/actions/checkout-restore-dependencies@workflows-v0
+              # `$/` loads the action from this repo at the commit this workflow was called at, so a caller
+              # pinned to a SHA or a branch gets that commit's action and CLI, not whatever the major tag is on.
+              uses: $/.github/actions/checkout-restore-dependencies
               with:
                   # Some repos use private npm packages, they need to pass NPM_TOKEN secret to this workflow
                   npm-token: ${{ secrets.NPM_TOKEN }}
@@ -134,8 +135,9 @@ jobs:
         runs-on: ubuntu-latest
         steps:
             - name: Setup repository and dependencies
-              # For testing, you have to temporarily change the branch
-              uses: apify/apify-test-tools/.github/actions/checkout-restore-dependencies@workflows-v0
+              # `$/` loads the action from this repo at the commit this workflow was called at, so a caller
+              # pinned to a SHA or a branch gets that commit's action and CLI, not whatever the major tag is on.
+              uses: $/.github/actions/checkout-restore-dependencies
               with:
                   npm-token: ${{ secrets.NPM_TOKEN }}
 

package/.github/workflows/public_push-build-latest.yaml

@@ -36,8 +36,9 @@ jobs:
         steps:
             - name: Setup repository and dependencies
               id: setup
-              # For testing, you have to temporarily change the branch
-              uses: apify/apify-test-tools/.github/actions/checkout-restore-dependencies@workflows-v0
+              # `$/` loads the action from this repo at the commit this workflow was called at, so a caller
+              # pinned to a SHA or a branch gets that commit's action and CLI, not whatever the major tag is on.
+              uses: $/.github/actions/checkout-restore-dependencies
               with:
                   npm-token: ${{ secrets.NPM_TOKEN }}
                   config-secrets: ${{ secrets.CONFIG_SECRETS }}

package/.github/workflows/public_review.yaml

@@ -14,12 +14,12 @@ on:
                 description: Label added after a successful review and never removed. Set to an empty string to disable.
                 required: false
             prompt-ref:
-                default: workflows-v0
+                default: ''
                 type: string
                 description: >-
                     Ref of this repository to fetch the review instructions from. Defaults to the
-                    major tag, matching the ref consumers call this workflow at. Override it only to
-                    test a prompt change from a branch.
+                    commit this workflow was called at, so the instructions always match it. Override
+                    it only to test a prompt change from a branch.
                 required: false
             model:
                 default: sonnet
@@ -55,10 +55,11 @@ jobs:
                   # head_ref must be used for pull_request but for push and schedule events we have to use ref to get the branch name
                   ref: ${{ github.head_ref || github.ref }}
 
+            # job.workflow_* is this reusable workflow's own repo and commit; the github context is the caller's.
             - name: 'Fetch review instructions'
               run: |
                   curl -sfL \
-                    "https://raw.githubusercontent.com/apify/apify-test-tools/${{ inputs.prompt-ref }}/.github/review-prompt.md" \
+                    "https://raw.githubusercontent.com/${{ job.workflow_repository }}/${{ inputs.prompt-ref || job.workflow_sha }}/.github/review-prompt.md" \
                     -o "${{ github.workspace }}/.claude-review-prompt.md"
 
             - name: 'Review PR against guidelines'

package/CHANGELOG.md

@@ -21,6 +21,7 @@ All notable changes to this project will be documented in this file.
 - **toBeObject:** Reject null ([#191](https://github.com/apify/apify-test-tools/pull/191)) ([6bdae49](https://github.com/apify/apify-test-tools/commit/6bdae4905756e0ae8dd6146942e6fc04dbead48e)) by [@JuanGalilea](https://github.com/JuanGalilea), closes [#88](https://github.com/apify/apify-test-tools/issues/88)
 - Build and test on test-only changes even when .dockerignore lists the tests ([#177](https://github.com/apify/apify-test-tools/pull/177)) ([5cb1b5a](https://github.com/apify/apify-test-tools/commit/5cb1b5ab5f6f43ec279f9624b402e73d55a5974a)) by [@artogahr](https://github.com/artogahr), closes [#145](https://github.com/apify/apify-test-tools/issues/145)
 - **git:** List both paths of moved files when detecting changes ([#215](https://github.com/apify/apify-test-tools/pull/215)) ([44ba565](https://github.com/apify/apify-test-tools/commit/44ba565242c1ac3daea281a648acb28712bb4363)) by [@metalwarrior665](https://github.com/metalwarrior665)
+- **workflows:** Load setup action and review prompt from the called commit ([#226](https://github.com/apify/apify-test-tools/pull/226)) ([7524711](https://github.com/apify/apify-test-tools/commit/752471135d4d147f6f6492a26c08af388d7ccf72)) by [@metalwarrior665](https://github.com/metalwarrior665)
 
 ### 🚜 Refactor
 

package/CONTRIBUTING.md

@@ -99,10 +99,16 @@ Consumers pin `@workflows-v0`, not `@master`. See [Versioning and releases](#ver
 `npm run lint` and `actionlint` (via the `Code checks` workflow) both gate master, so run them before
 pushing workflow changes.
 
+The reusable workflows load the composite action with `uses: $/.github/actions/checkout-restore-dependencies`, never
+`apify/apify-test-tools/...@workflows-v0`. `$/` is the
+[self-repository syntax](https://github.blog/changelog/2026-07-30-reference-same-repository-actions-with-self-repository-syntax/):
+it resolves to this repo at the commit the workflow was called at. A hardcoded tag would hand a caller pinned to an
+older SHA, or to a branch, the action and CLI from the tag instead of from the commit they asked for.
+
 `public_review` is the odd one out: it fetches `.github/review-prompt.md` over HTTP at run time, because a
-reusable workflow runs with the caller's repo checked out and never gets its own. Its `prompt-ref`
-input defaults to `workflows-v0` so the instructions come from the same release as the workflow — leaving it
-at `master` would run released workflows against unreleased instructions.
+reusable workflow runs with the caller's repo checked out and never gets its own. With `prompt-ref` left empty it
+fetches from `job.workflow_repository` at `job.workflow_sha`, the commit the workflow itself came from, so the
+instructions always match the workflow.
 
 ## Versioning and releases
 
@@ -135,17 +141,15 @@ freezes where it is and keeps working, CLI included, since the bundle is part of
 
 The tag tracks the **workflows'** contract, not the npm package version. They move independently on purpose, so
 `@workflows-v0` is expected to stay `@workflows-v0` after the package reaches 1.0 — bump it when a workflow breaks
-its callers, not when the package does. Because `uses:` cannot take an expression, every ref into this repo repeats
-the tag literally; `check-major-tag-refs.mjs` fails the build if `MAJOR_TAG` and those refs disagree, which is the
-mistake that would otherwise ship silently during a bump.
+its callers, not when the package does. The usage examples in the workflows, README and docs repeat the tag
+literally, so update them by hand when you bump it.
 
 ## Testing workflow changes
 
 - Point [testing-repo-for-github-actions](https://github.com/apify-store/testing-repo-for-github-actions) at your
-  branch (`uses: ...@your-branch`). It has real attached Actors and tests. The branch carries its own CLI bundle, so
-  one branch tests the workflows and the CLI together.
-- To change the composite action itself, repoint the `uses:` refs inside the reusable workflows at your branch as
-  well, and change them back before merging.
+  branch (`uses: ...@your-branch`). It has real attached Actors and tests. The workflows load the composite action
+  with `$/` and the branch carries its own CLI bundle, so one branch tests the workflows, the action and the CLI
+  together, with nothing to repoint.
 - Make sure the shell code actually works on your laptop first.
 - After merging, watch the workflow on a real project before moving on.
 

package/docs/workflows.md

@@ -199,7 +199,7 @@ that label is on. The trigger label is removed once the review finishes, so re-a
 | ---------------- | ------ | ------------------- | --------------------------------------------------------------------------------------------- |
 | `label`          | string | `Ask claude review` | Label that triggers a review                                                                  |
 | `reviewed-label` | string | `claude reviewed`   | Label added after a successful review and never removed. Set to `''` to disable               |
-| `prompt-ref`     | string | `workflows-v0`      | Ref of this repo to fetch the review instructions from. Override only to test a prompt change |
+| `prompt-ref`     | string | `''`                | Ref of this repo to fetch the review instructions from. Override only to test a prompt change |
 | `model`          | string | `sonnet`            | Claude Code model (`best`, `sonnet`, `opus`, `haiku`, `sonnet[1m]`, `opus[1m]`, `opusplan`)   |
 
 Secrets: `ANTHROPIC_API_KEY`.
@@ -219,8 +219,8 @@ jobs:
 ```
 
 The review instructions live in `.github/review-prompt.md` in this repo and are fetched at run time, because a
-reusable workflow doesn't get its own repo checked out. `prompt-ref` defaults to `workflows-v0`, so the
-instructions match the workflow you're calling — point it at a branch only to test a prompt change.
+reusable workflow doesn't get its own repo checked out. When `prompt-ref` is empty they come from the same commit as
+the workflow you're calling — point it at a branch only to test a prompt change.
 
 ## `public_claude.yaml`
 
@@ -362,6 +362,9 @@ The workflows and the vitest library ship separately:
 The workflows bring their own copy of the CLI, so they don't use or change the `apify-test-tools` version in your
 `node_modules`, and your tests keep the library version you locked.
 
+Whatever ref you call a workflow at, it runs the setup action and the CLI from that same commit. Pinning a commit SHA
+or pointing at a branch of this repo therefore gets you that commit's workflows as a whole.
+
 `@workflows-v0` always points at the latest workflows, so fixes and new features reach you without any change on your
 side. Changes that would break callers go to a new tag (`@workflows-v1`), and `@workflows-v0` keeps working, so you
 can migrate when it suits you.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "apify-test-tools",
-  "version": "0.10.2-beta.10",
+  "version": "0.10.2-beta.11",
   "type": "module",
   "description": "TBD",
   "repository": {

package/.github/scripts/check-major-tag-refs.mjs

@@ -1,72 +0,0 @@
-#!/usr/bin/env node
-// Fails if any reference to this repo's own reusable workflows or composite actions points at a
-// different tag than MAJOR_TAG in _move_major_tag.yaml.
-//
-// `uses:` cannot take an expression ("You cannot use contexts or expressions in this keyword"), so
-// the tag consumers pin is repeated literally in every self-reference, in the commented examples,
-// and in the README snippets people copy. Bumping the major means editing all of them by hand.
-//
-// Missing one is quiet in the worst case: right after a bump both the old and new tags exist, so a
-// workflow called at the new tag happily pulls the composite action from the old one and runs a
-// stale version of it. Nothing fails, the behaviour is just wrong.
-
-import fs from 'node:fs';
-import path from 'node:path';
-
-const ROOT = path.resolve(import.meta.dirname, '../..');
-const TAG_SOURCE = '.github/workflows/_move_major_tag.yaml';
-const REVIEW_WORKFLOW = '.github/workflows/public_review.yaml';
-
-// Every place a ref into this repo can appear: live `uses:`, commented examples, README snippets.
-const SEARCH_PATHS = ['.github', 'README.md', 'CONTRIBUTING.md', 'docs'];
-
-const read = (rel) => fs.readFileSync(path.join(ROOT, rel), 'utf8');
-
-const expected = read(TAG_SOURCE).match(/^\s*MAJOR_TAG:\s*(\S+)\s*$/m)?.[1];
-if (!expected) {
-    console.error(`Could not find MAJOR_TAG in ${TAG_SOURCE}.`);
-    process.exit(1);
-}
-
-const walk = (rel) => {
-    const abs = path.join(ROOT, rel);
-    if (!fs.statSync(abs).isDirectory()) return [rel];
-    return fs.readdirSync(abs).flatMap((entry) => walk(path.join(rel, entry)));
-};
-
-const problems = [];
-
-// Self-references, e.g. `uses: apify/apify-test-tools/.github/workflows/public_pr-build-test.yaml@workflows-v0`.
-// The ref charset stops at a backtick or quote so a ref quoted in prose isn't captured with its
-// punctuation; git refnames cannot end in a dot, so a sentence-final one is trimmed.
-const SELF_REF = /apify\/apify-test-tools\/\.github\/\S*?@([A-Za-z0-9._/-]+)/g;
-for (const file of SEARCH_PATHS.flatMap(walk)) {
-    read(file)
-        .split('\n')
-        .forEach((line, i) => {
-            for (const [match, rawRef] of line.matchAll(SELF_REF)) {
-                const ref = rawRef.replace(/\.+$/, '');
-                if (ref !== expected) {
-                    problems.push(`${file}:${i + 1}: ${match.trim()} — expected @${expected}`);
-                }
-            }
-        });
-}
-
-// review.yaml fetches its prompt from this repo by ref rather than by `uses:`, so it drifts the
-// same way: released workflows would read instructions from some other commit.
-const promptRef = read(REVIEW_WORKFLOW).match(/prompt-ref:\s*\n\s*default:\s*(\S+)/)?.[1];
-if (!promptRef) {
-    problems.push(`${REVIEW_WORKFLOW}: could not read the prompt-ref default.`);
-} else if (promptRef !== expected) {
-    problems.push(`${REVIEW_WORKFLOW}: prompt-ref default is ${promptRef} — expected ${expected}`);
-}
-
-if (problems.length > 0) {
-    console.error(`MAJOR_TAG is ${expected}, but these disagree:\n`);
-    for (const problem of problems) console.error(`  ${problem}`);
-    console.error(`\nUpdate them, or change MAJOR_TAG in ${TAG_SOURCE}.`);
-    process.exit(1);
-}
-
-console.log(`All references to this repo point at @${expected}.`);