apify-test-tools 0.10.2-beta.12 → 0.10.2-beta.14

package/.github/workflows/public_platform-tests-claude-investigate-and-fix.yaml

@@ -25,7 +25,7 @@ name: 'Platform tests: Claude failure investigation and fix'
 #             subtest: core
 #         secrets:
 #             TESTER_APIFY_TOKEN: ${{ secrets.TESTER_APIFY_TOKEN }}
-#             SLACK_TOKEN_TESTS_BOT: ${{ secrets.SLACK_TOKEN_TESTS_BOT }}
+#             SLACK_BOT_TOKEN: ${{ secrets.SLACK_BOT_TOKEN }}
 #
 #     handle-failure:
 #         needs: platformTestsCore

package/.github/workflows/public_platform-tests.yaml

@@ -13,7 +13,7 @@ on:
                 type: string
                 default: ''
                 required: false
-            # Defaults to #notif-<repo-name> when empty, matching the previous behavior.
+            # Defaults to #notif-<repo-name> when empty.
             report-slack-channel:
                 type: string
                 default: ''
@@ -26,7 +26,7 @@ on:
             TESTER_APIFY_TOKEN:
                 required: true
                 description: Apify token the platform tests run Actors with.
-            SLACK_TOKEN_TESTS_BOT:
+            SLACK_BOT_TOKEN:
                 required: false
                 description: Slack token for reporting test results.
 
@@ -55,32 +55,46 @@ jobs:
                       exit 1
                   fi
 
+            # Runs the repo's test code and its whole import graph, so it gets the tester token only.
+            # Fails on failing tests, but writes the report anyway for the notification below.
+            # Every Actor in the config, on its default build: the one users run
             - name: Test
+              id: test
+              # bash rather than the default shell, for pipefail
+              shell: bash
               env:
                   TESTER_APIFY_TOKEN: ${{ secrets.TESTER_APIFY_TOKEN }}
-                  SLACK_TOKEN_TESTS_BOT: ${{ secrets.SLACK_TOKEN_TESTS_BOT }}
               run: |
-                  set +e
-                  export RUN_ALL_PLATFORM_TESTS=1
-                  npx vitest ./test/platform/${{ inputs.test-files-glob || inputs.subtest }} \
-                    --run \
-                    --reporter=default \
-                    --reporter=json \
-                    --outputFile=./test-output.json \
-                    --maxConcurrency 20 \
-                    --fileParallelism=true \
-                    --maxWorkers 100
-                  return_code=$?
-                  apify-test-tools report-tests \
-                    --report-file ./test-output.json \
-                    --workflow-name "${{ github.workflow }}" \
-                    --job-url "${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}" \
-                    --report-slack-channel "${{ inputs.report-slack-channel || format('#notif-{0}', github.event.repository.name) }}"
-                  exit $return_code
+                  apify-test-tools get-actor-configs \
+                    | apify-test-tools test ./test/platform/${{ inputs.test-files-glob || inputs.subtest }} \
+                        --reporter github-actions --vitest-output-file ./test-output.json > test-report.json
 
-            - name: Upload Vitest JSON artifact
+            # Posts only when the tests failed, but checks the Slack token on every run. Runs whenever the tests
+            # did, also after a failure, but not when the token check stopped the job before them.
+            - name: Notify
+              if: ${{ !cancelled() && steps.test.outcome != 'skipped' }}
+              env:
+                  SLACK_BOT_TOKEN: ${{ secrets.SLACK_BOT_TOKEN }}
+                  # Passed through the environment, so a quote in the workflow name can't break the command
+                  WORKFLOW_NAME: ${{ github.workflow }}
+                  JOB_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
+              run: |
+                  # Empty when `test` itself failed before running vitest, its error is in the Test step
+                  if [ ! -s test-report.json ]; then
+                      echo "No test report, so there is nothing to notify about"
+                      exit 0
+                  fi
+                  apify-test-tools notify \
+                    --slack-channel "${{ inputs.report-slack-channel || format('#notif-{0}', github.event.repository.name) }}" \
+                    --title "$WORKFLOW_NAME" \
+                    --job-url "$JOB_URL" \
+                    < test-report.json
+
+            - name: Upload test reports
               uses: actions/upload-artifact@v6
               if: always()
               with:
                   name: vitest-results
-                  path: ./test-output.json
+                  path: |
+                      ./test-output.json
+                      ./test-report.json

package/.github/workflows/public_pr-build-test.yaml

@@ -100,7 +100,6 @@ jobs:
             # and hands the build those secrets and nothing else, so the tokens stay in this one command instead of the whole job.
             # The library never sees secrets it doesn't need
             - name: Build
-              id: build
               # bash rather than the default shell, for pipefail
               shell: bash
               env:
@@ -108,17 +107,19 @@ jobs:
                   SCRIPTS_PATH: ${{ steps.setup.outputs.scripts-path }}
                   REQUIRE_ENV_VARS_IN_SYNC: ${{ inputs.require-env-vars-in-sync }}
               run: |
-                  actor_builds=$(jq '{ actors: .functionallyChangedActors }' affected.json \
+                  jq '{ actors: .functionallyChangedActors }' affected.json \
                     | node "$SCRIPTS_PATH/run-with-apify-tokens.mjs" apify-test-tools build --version-number 0.99 \
-                        --require-env-vars-in-sync="$REQUIRE_ENV_VARS_IN_SYNC")
-                  echo "actor_builds=$actor_builds" | tee -a "$GITHUB_OUTPUT"
+                        --require-env-vars-in-sync="$REQUIRE_ENV_VARS_IN_SYNC" \
+                    | tee builds.json
 
             # Runs the repo's test code and its whole import graph, so it gets the tester token only.
             - name: Test
               env:
-                  ACTOR_BUILDS: ${{ steps.build.outputs.actor_builds }}
                   TESTER_APIFY_TOKEN: ${{ secrets.TESTER_APIFY_TOKEN }}
-              run: npx vitest ./test/platform/${{ inputs.test-files-glob }} --run --maxConcurrency 20 --fileParallelism=true --maxWorkers 100
+              # The github-actions reporter annotates the PR with the failing tests
+              run: |
+                  apify-test-tools test ./test/platform/${{ inputs.test-files-glob }} --reporter github-actions \
+                    < builds.json > test-report.json
 
             # NOTE: This is an optimization that if we did functional changes and later only cosmetic changes (e.g. dev readme), we will compare changes files only for the last commit. This must run after tests because we want to cache the latest commit only if the tests are successful
             - name: Store last validated commit to cache

package/.github/workflows/public_push-build-latest.yaml

@@ -3,7 +3,7 @@ name: Build latest and report to slack
 on:
     workflow_call:
         inputs:
-            # Defaults to #notif-<repo-name> when empty, matching the previous behavior.
+            # Defaults to #notif-<repo-name> when empty.
             report-slack-channel:
                 type: string
                 default: ''
@@ -15,7 +15,7 @@ on:
             NPM_TOKEN:
                 required: false
                 description: Read-only token for installing private npm packages.
-            SLACK_TOKEN_RELEASES_BOT:
+            SLACK_BOT_TOKEN:
                 required: false
                 description: Slack token for announcing releases.
             CONFIG_SECRETS:
@@ -68,9 +68,11 @@ jobs:
             # Skips the announcement when the push brought no new commits
             - name: Announce the release on Slack
               env:
-                  SLACK_TOKEN_RELEASES_BOT: ${{ secrets.SLACK_TOKEN_RELEASES_BOT }}
+                  SLACK_BOT_TOKEN: ${{ secrets.SLACK_BOT_TOKEN }}
               run: |
-                  apify-test-tools notify-release --release-slack-channel "#delivery-public-actors" --report-slack-channel "${{ inputs.report-slack-channel || format('#notif-{0}', github.event.repository.name) }}" < affected.json
+                  apify-test-tools notify \
+                    --slack-channel "${{ inputs.report-slack-channel || format('#notif-{0}', github.event.repository.name) }}" \
+                    < affected.json
 
             - name: Delete old builds
               env:

package/.prettierignore

@@ -1,5 +1,5 @@
 CHANGELOG.md
-
+.cli-test-*
 # Operating instructions read by Claude, not prose for humans. Prettier collapses the nested bullet
 # list under "do not visit, fetch, infer, or evaluate the following external links" into one run-on
 # line, which changes what the model is told. Keeping it byte-identical also makes re-syncing it

package/CHANGELOG.md

@@ -23,10 +23,13 @@ All notable changes to this project will be documented in this file.
 - Build and test on test-only changes even when .dockerignore lists the tests ([#177](https://github.com/apify/apify-test-tools/pull/177)) ([5cb1b5a](https://github.com/apify/apify-test-tools/commit/5cb1b5ab5f6f43ec279f9624b402e73d55a5974a)) by [@artogahr](https://github.com/artogahr), closes [#145](https://github.com/apify/apify-test-tools/issues/145)
 - **git:** List both paths of moved files when detecting changes ([#215](https://github.com/apify/apify-test-tools/pull/215)) ([44ba565](https://github.com/apify/apify-test-tools/commit/44ba565242c1ac3daea281a648acb28712bb4363)) by [@metalwarrior665](https://github.com/metalwarrior665)
 - **workflows:** Load setup action and review prompt from the called commit ([#226](https://github.com/apify/apify-test-tools/pull/226)) ([7524711](https://github.com/apify/apify-test-tools/commit/752471135d4d147f6f6492a26c08af388d7ccf72)) by [@metalwarrior665](https://github.com/metalwarrior665)
+- **test:** Clean up compiled CLI dir when build fails ([#224](https://github.com/apify/apify-test-tools/pull/224)) ([f9f2f5c](https://github.com/apify/apify-test-tools/commit/f9f2f5c64cfe936ee0b72a0fbe7408282c68fbac)) by [@JuanGalilea](https://github.com/JuanGalilea)
+- **cli-test:** Look up actor raw IDs for tests that reference them ([#234](https://github.com/apify/apify-test-tools/pull/234)) ([315baf4](https://github.com/apify/apify-test-tools/commit/315baf495dae984cbcd7056a101935536d7b0011)) by [@metalwarrior665](https://github.com/metalwarrior665)
 
 ### 🚜 Refactor
 
 - [**breaking**] Remove build-for-test and release composite commands ([#203](https://github.com/apify/apify-test-tools/pull/203)) ([85efc54](https://github.com/apify/apify-test-tools/commit/85efc54697e98208c827c4f450906e00eebcd9ca)) by [@metalwarrior665](https://github.com/metalwarrior665)
+- [**breaking**] Remove legacy get-commits, get-latest-commit and get-changed-files ([#228](https://github.com/apify/apify-test-tools/pull/228)) ([d254a6d](https://github.com/apify/apify-test-tools/commit/d254a6dd14ac9cb027a26ec73ca20a6ee10460ec)) by [@metalwarrior665](https://github.com/metalwarrior665)
 
 
 <!-- git-cliff-unreleased-end -->

package/CONTRIBUTING.md

@@ -11,8 +11,10 @@ The package consists of three parts:
 - `bin/build.ts` actor building
 - `bin/git.ts` git wrappers for getting relevant git commits and changed files
 - `bin/main.ts` entrypoing
-- `bin/slack.ts` sending notifications to slack
-- `bin/test-report.ts` processing vitest's test reports
+- `bin/run-tests.ts` running the repository's vitest for the `test` command
+- `bin/test-report.ts` turning vitest's JSON report into the report `test` prints
+- `bin/notify.ts` the `notify` command: what it says about test runs and releases, and its targets (Slack for now)
+- `bin/slack.ts` the Slack client
 
 CLI command results use `writeJson` from `bin/output.ts` to write newline-terminated JSON to stdout.
 Use the CLI `logger` from `bin/logger.ts` for diagnostics; every level writes to stderr.
@@ -53,7 +55,7 @@ To work on the library, run the cli from the root of your testing repo:
 ```sh
 cd /path/to/testing-repo-for-github-actions
 npx tsx /path/to/apify-test-tools/bin/main.ts --help
-npx tsx /path/to/apify-test-tools/bin/main.ts get-commits --target-branch master --source-branch feat/testing-feature-branch
+npx tsx /path/to/apify-test-tools/bin/main.ts get-affected-actors --base master
 ```
 
 Or clone a test repo into `local-clone/` inside this repo and run `npm run start:dev -- <command>`.
@@ -84,7 +86,7 @@ renaming one is a breaking change that needs a major tag bump, not a tidy-up.
 The tag is not semver, so `git-cliff` would abort on it. It is skipped only because
 `apify/actions`' cliff.toml sets `tag_pattern = "v[0-9]+\."` — a release failing with
 `Semver error: unexpected character` means that pattern changed, not that anything here is wrong.
-The action's "Nothing to release" guard resolves to this tag and no longer fires, so an empty stable
+The action's "Nothing to release" guard resolves to this tag and never fires, so an empty stable
 release fails at `npm publish` instead of erroring cleanly.
 
 Consumers pin `@workflows-v0`, not `@master`. See [Versioning and releases](#versioning-and-releases) below.
@@ -130,7 +132,7 @@ that commit. The consumer's own `node_modules` is left alone, so their tests kee
   `apify-test-tools`.
 
 The CLI and the lib in one job can be different versions now, so the formats between them are a contract: the
-`ACTOR_BUILDS` JSON that `build` writes and the lib reads, and the vitest JSON report `report-tests` reads. Add
+`ACTOR_BUILDS` JSON that `build` writes and the lib reads, and the vitest JSON report (with the run each test started on its `meta`) that `test` reads. Add
 fields freely; renaming or removing one needs a new major tag.
 
 `workflows-v0` moving on every master push means `@workflows-v0` is as live as `@master` was — there's no staging
@@ -195,7 +197,7 @@ again. The caller's workspace holds the caller's repo, not this one.
 Two tidier-looking alternatives don't work, so don't reach for them:
 
 - **Exporting to `$GITHUB_ENV`** would let the steps call the CLI directly with no wrapper, but `$GITHUB_ENV`
-  applies to every later step in the job. In `pr-build-test` the vitest step runs after the build, so it would
+  applies to every later step in the job. In `pr-build-test` the test step runs after the build, so it would
   inherit Actor tokens it has no use for.
 - **Returning the tokens as a step output** would be scoped correctly, but the runner refuses to set an output whose
   value contains a registered secret. It logs `Skip output <name> since it may contain secret` and leaves the output

package/README.md

@@ -248,7 +248,7 @@ jobs:
     buildLatest:
         uses: apify/apify-test-tools/.github/workflows/public_push-build-latest.yaml@workflows-v0
         secrets:
-            SLACK_TOKEN_RELEASES_BOT: ${{ secrets.SLACK_TOKEN_RELEASES_BOT }}
+            SLACK_BOT_TOKEN: ${{ secrets.SLACK_BOT_TOKEN }}
             # One entry per secret apify-test-tools.config.json names, today each `tokenEnvVar`
             CONFIG_SECRETS: |
                 {
@@ -275,7 +275,7 @@ jobs:
         uses: apify/apify-test-tools/.github/workflows/public_platform-tests.yaml@workflows-v0
         secrets:
             TESTER_APIFY_TOKEN: ${{ secrets.TESTER_APIFY_TOKEN }}
-            SLACK_TOKEN_TESTS_BOT: ${{ secrets.SLACK_TOKEN_TESTS_BOT }}
+            SLACK_BOT_TOKEN: ${{ secrets.SLACK_BOT_TOKEN }}
 ```
 
 and a few critical tests, kept in e.g. `test/platform/hourly`, every hour:
@@ -296,7 +296,7 @@ jobs:
             test-files-glob: hourly
         secrets:
             TESTER_APIFY_TOKEN: ${{ secrets.TESTER_APIFY_TOKEN }}
-            SLACK_TOKEN_TESTS_BOT: ${{ secrets.SLACK_TOKEN_TESTS_BOT }}
+            SLACK_BOT_TOKEN: ${{ secrets.SLACK_BOT_TOKEN }}
 ```
 
 ### Secrets
@@ -304,13 +304,12 @@ jobs:
 Set these as repository or organization secrets and pass them in each job's `secrets:` block, as in the examples
 above. The Actor tokens go packed in one JSON object, `CONFIG_SECRETS`, because their names differ per repo:
 
-| Secret                                                                    | Needed for                                                       |
-| ------------------------------------------------------------------------- | ---------------------------------------------------------------- |
-| the Actor tokens named by `tokenEnvVar` in `apify-test-tools.config.json` | building Actors and deleting their old builds                    |
-| `TESTER_APIFY_TOKEN`                                                      | running the platform tests                                       |
-| `SLACK_TOKEN_RELEASES_BOT`                                                | announcing releases on Slack                                     |
-| `SLACK_TOKEN_TESTS_BOT`                                                   | reporting scheduled test results to Slack                        |
-| `NPM_TOKEN`                                                               | optional, installing private npm packages. Use a read-only token |
+| Secret                                                                    | Needed for                                                        |
+| ------------------------------------------------------------------------- | ----------------------------------------------------------------- |
+| the Actor tokens named by `tokenEnvVar` in `apify-test-tools.config.json` | building Actors and deleting their old builds                     |
+| `TESTER_APIFY_TOKEN`                                                      | running the platform tests                                        |
+| `SLACK_BOT_TOKEN`                                                         | announcing releases and reporting scheduled test results to Slack |
+| `NPM_TOKEN`                                                               | optional, installing private npm packages. Use a read-only token  |
 
 Repos in the `apify` org can pass `secrets: inherit` instead. Each secret only reaches the step that needs it. See
 [Secrets](docs/workflows.md#secrets) for both, and for passing `CONFIG_SECRETS` without listing the tokens.
@@ -342,7 +341,7 @@ Platform tests are skipped unless `TESTER_APIFY_TOKEN` is set, so your regular u
 To run them locally against the Actors' current default builds:
 
 ```bash
-RUN_ALL_PLATFORM_TESTS=1 TESTER_APIFY_TOKEN=<token> npx vitest --run test/platform
+npx apify-test-tools get-actor-configs | TESTER_APIFY_TOKEN=<token> npx apify-test-tools test
 ```
 
 The [Vitest library API](docs/lib.md) covers everything `toFinishWith` checks, the other matchers, standby Actors,

package/bin/actor-ids.ts

@@ -0,0 +1,38 @@
+import { ApifyClient } from 'apify-client';
+
+import type { TestTarget } from './stdin-input.js';
+
+type ActorGetter = Pick<ApifyClient, 'actor'>;
+
+/** A test target with both IDs of its Actor */
+export type ResolvedTestTarget = TestTarget & { actorFullName: string; actorRawId: string };
+
+/**
+ * Adds the ID each target is missing: the raw ID to those listed by full name, e.g. by `get-actor-configs`, and the
+ * full name to those listed by raw ID. The lib matches a test to its Actor by the ID the test names, so a target
+ * without either ID would skip the tests that name its Actor by the other one.
+ */
+export const withActorIds = async (
+    targets: TestTarget[],
+    client: ActorGetter = new ApifyClient({ token: process.env.TESTER_APIFY_TOKEN }),
+): Promise<ResolvedTestTarget[]> =>
+    Promise.all(
+        targets.map(async (target) => {
+            const { actorFullName, actorRawId } = target;
+            if (actorFullName && actorRawId) return { ...target, actorFullName, actorRawId };
+            // The parser lets no target through without either ID
+            const actorId = (actorFullName ?? actorRawId)!;
+            const actor = await client.actor(actorId).get();
+            if (!actor) {
+                throw new Error(
+                    `Actor ${actorId} not found, or TESTER_APIFY_TOKEN can't access it. ` +
+                        'Both its full name and its raw ID are needed to run the tests that name it by either.',
+                );
+            }
+            return {
+                ...target,
+                actorFullName: actorFullName ?? `${actor.username}/${actor.name}`,
+                actorRawId: actorRawId ?? actor.id,
+            };
+        }),
+    );

package/bin/build.ts

@@ -243,7 +243,7 @@ export class ApifyBuilder {
 
         const actorInfo = await this.getActorInfo();
 
-        // 'devel' used to be hardcoded for testing version 0.99, once we get rid of this tag everywhere, we can remove this code
+        // A build tagged 'devel' is kept for DEFAULT_DAYS_BACK_DEVEL only. Remove this once no Actor has the tag
         const taggedDevelBuildNumber: string | undefined = actorInfo.taggedBuilds!.devel?.buildNumber;
 
         const allTags = Object.keys(actorInfo.taggedBuilds ?? {});

package/bin/git.ts

@@ -1,5 +1,5 @@
 import { logger } from './logger.js';
-import type { Commit, Config } from './types.js';
+import type { Commit } from './types.js';
 import { GitCommandError, runGitCommand } from './utils.js';
 
 export const GIT_FORMAT_SEPARATOR = '»¦«';
@@ -9,19 +9,6 @@ const GIT_LOG_FORMAT = ['%H', '%aN<%aE>', '%aD', '%s'].join(GIT_FORMAT_SEPARATOR
 // so the Actor whose context it left wouldn't count as changed. --no-renames lists it as deleted and added instead.
 const LIST_CHANGED_PATHS = ['--name-only', '--no-renames'];
 
-/**
- * Gets the list of changed files between the given commits (inclusive), so it diffs from the parent of the oldest.
- */
-export const getChangedFiles = async (commits: Commit[]) => {
-    // getCommits never returns an empty list (it throws on an empty range, and the rerun check returns all
-    // commits when the base commit is the branch HEAD), so this signals a programmer error
-    if (commits.length === 0) {
-        throw new Error('Cannot get changed files: the commit list is empty. This should never happen.');
-    }
-
-    return getChangedFilesBetween(`${commits[0].sha}~`, commits[commits.length - 1].sha);
-};
-
 /**
  * Files that differ between two commits, i.e. changed by the commits in the range (fromRef, toRef]. fromRef's own
  * changes are not included: to include them, pass its parent, `${sha}~` (as getChangedFiles does).
@@ -56,29 +43,6 @@ export const findCommitSha = async (ref: string): Promise<string | undefined> =>
         throw error;
     });
 
-const SHA_REGEX = /^[0-9a-f]{40}$/i;
-
-/**
- *
- * @param shaOrCommit Supports both a SHA string or a Commit object in JSON format. Can be empty.
- * @returns The SHA string if valid, otherwise throws an error.
- */
-export const parseBaseCommit = (shaOrCommit: string | undefined): string | undefined => {
-    if (!shaOrCommit) return undefined;
-    let sha: string;
-    if (shaOrCommit.startsWith('{')) {
-        sha = (JSON.parse(shaOrCommit) as Commit).sha;
-    } else {
-        sha = shaOrCommit;
-    }
-    if (!SHA_REGEX.test(sha)) {
-        throw new Error(
-            `Invalid base commit SHA: "${sha}". It should be a 40-character hexadecimal string, instead got input: "${shaOrCommit}".`,
-        );
-    }
-    return sha;
-};
-
 /**
  * Commits reachable from toRef but not from fromRef, oldest first: the range (fromRef, toRef], so fromRef itself is
  * not included. To include it, pass its parent, `${sha}~`.
@@ -93,49 +57,6 @@ export const getCommitsBetween = async (fromRef: string, toRef: string): Promise
     return commits;
 };
 
-/**
- * Gets the commits between sourceBranch and targetBranch (exclusive).
- * - If baseCommit is provided, only returns commits after the baseCommit.
- */
-export const getCommits = async ({
-    sourceBranch,
-    targetBranch,
-    baseCommit,
-}: Pick<Config, 'sourceBranch' | 'targetBranch' | 'baseCommit'>): Promise<Commit[]> => {
-    const baseCommitSha = parseBaseCommit(baseCommit);
-    const commits = await getCommitsBetween(targetBranch, sourceBranch);
-    if (commits.length === 0) {
-        throw new Error(`${sourceBranch} has no commits that are not on ${targetBranch}.`);
-    }
-
-    // The last validated (base) commit being the branch HEAD means nothing new was pushed since the last
-    // validation — the dev reran the workflow (or force-pushed to the same state) to trigger a clean test
-    const headSha = commits[commits.length - 1]?.sha;
-    if (baseCommitSha !== undefined && baseCommitSha === headSha) {
-        logger.info(
-            `Detected rerun with the same commit that we already validated. This usually means the user wants to rerun the Action from scratch, ignoring last validated commit ${baseCommitSha} and returning all commits`,
-        );
-        logger.info(`Commits being returned: ${commits.map((c) => c.sha).join(', ')}`);
-        return commits;
-    }
-
-    const baseCommitIndex = commits.findIndex((commit) => commit.sha === baseCommitSha);
-
-    const hasBaseCommit = baseCommitIndex !== -1;
-    if (hasBaseCommit) {
-        const commitsUpToBaseCommit = commits.slice(baseCommitIndex + 1);
-        logger.info(
-            `Found base commit ${baseCommitSha} at index ${baseCommitIndex}, returning ${commitsUpToBaseCommit.length} commits after it`,
-        );
-        logger.info(`Commits being returned: ${commitsUpToBaseCommit.map((c) => c.sha).join(', ')}`);
-        return commitsUpToBaseCommit;
-    }
-
-    logger.info(`Base commit ${baseCommitSha} not found in the commit range, returning all ${commits.length} commits`);
-    logger.info(`Commits being returned: ${commits.map((c) => c.sha).join(', ')}`);
-    return commits;
-};
-
 export const parseCommit = (commitString: string): Commit => {
     const splits = commitString.split(GIT_FORMAT_SEPARATOR);
     if (splits.length !== 4) {
@@ -209,11 +130,22 @@ export const normalizeRepoUrl = (repoUrl: string): string => {
         .toLowerCase();
 };
 
+/**
+ * Web link to a commit, e.g. https://github.com/apify-store/google-maps/commit/<sha>. Null for hosts other than
+ * GitHub, whose commit pages live under other paths.
+ */
+export const getCommitUrl = (repoUrl: string, sha: string): string | null => {
+    const repository = normalizeRepoUrl(repoUrl);
+    return repository.startsWith('github.com/') ? `https://${repository}/commit/${sha}` : null;
+};
+
 /** Repository name from its URL, e.g. `google-maps` for git@github.com:apify-store/google-maps.git */
 export const getRepoName = (repoUrl: string): string => {
     return normalizeRepoUrl(repoUrl).split('/').pop()!;
 };
 
+const SHA_REGEX = /^[0-9a-f]{40}$/i;
+
 // Sent by e.g. GitHub as the "before" commit of a push that created the branch
 const ZERO_SHA_REGEX = /^0{40}$/;
 
@@ -223,31 +155,27 @@ const ZERO_SHA_REGEX = /^0{40}$/;
  * would rebuild the latest build of every Actor and post it to Slack, so every problem is an error.
  */
 export const resolveReleaseBaseCommit = async (baseCommit: string, head = 'HEAD'): Promise<string> => {
-    const sha = parseBaseCommit(baseCommit);
-    if (!sha) {
-        throw new Error('A base commit is required for release. See the "Releasing Actors" section of docs/cli.md.');
+    if (!SHA_REGEX.test(baseCommit)) {
+        throw new Error(
+            `Invalid base commit SHA: "${baseCommit}". It should be a 40-character hexadecimal string. ` +
+                'See the "Releasing Actors" section of docs/cli.md.',
+        );
     }
+    const sha = baseCommit;
     if (ZERO_SHA_REGEX.test(sha)) {
         throw new Error(
             `Base commit is ${sha}, which means the branch was just created and there is no previous release to diff against. ` +
                 `Rerun with the base commit set to the last commit before the changes you want to release.`,
         );
     }
-    // --quiet suppresses Git's error text for a missing commit, but Git still exits with code 1.
-    const verifiedSha = await runGitCommand(['rev-parse', '--verify', '--quiet', `${sha}^{commit}`], {
-        operation: 'verify the release base commit in local Git history',
-    }).catch((error: unknown) => {
-        if (error instanceof GitCommandError && error.exitCode === 1) return '';
-        throw error;
-    });
-    if (!verifiedSha) {
+    if (!(await findCommitSha(sha))) {
         throw new Error(
             `Base commit ${sha} is not in the local git history. Either the checkout is shallow ` +
                 `(fetch the full history, e.g. fetch-depth: 0 in actions/checkout) or the branch was force-pushed.`,
         );
     }
     // git merge-base A B outputs the common ancestor. If that equals A, then A is an ancestor of B.
-    const mergeBase = await runGitCommand(['merge-base', verifiedSha, head], {
+    const mergeBase = await runGitCommand(['merge-base', sha, head], {
         operation: `check whether the release base commit is an ancestor of ${head}`,
     }).catch((error: unknown) => {
         if (error instanceof GitCommandError && error.exitCode === 1) return '';