apify-test-tools 0.10.2-beta.17 → 0.10.2-beta.18

package/.gitattributes

@@ -1,2 +1,3 @@
 # Generated by `npm run bundle`: collapsed in GitHub diffs and shown as binary by git diff.
 .github/cli/apify-test-tools.mjs linguist-generated=true -diff
+.github/scripts/run-with-apify-tokens.mjs linguist-generated=true -diff

package/.github/scripts/run-with-apify-tokens.mjs

@@ -1,129 +1,3 @@
 #!/usr/bin/env node
-// Runs apify-test-tools and passes it only secrets needed for the Actors, no other secrets are leaked.
-//
-//     jq ... | node .github/scripts/run-with-apify-tokens.mjs apify-test-tools build --version-number 0.99
-//
-// The step passes the reusable workflow's whole secrets map as WORKFLOW_SECRETS. The token names
-// come from `tokenEnvVar` in the repo's apify-test-tools.config.json, which is the same file
-// apify-test-tools itself reads, so the two can't drift. Everything else in the secrets map (npm,
-// Slack, GitHub, anything else the repo holds) is left out, and WORKFLOW_SECRETS itself is dropped,
-// so the blob never reaches the CLI or anything under node_modules.
-//
-// Each token is looked up in the CONFIG_SECRETS secret first, a JSON object of secret name -> value,
-// and then among the top-level secrets, which is where `secrets: inherit` puts them. The secrets the
-// workflows read by name (NPM_TOKEN, TESTER_APIFY_TOKEN, ...) never come from CONFIG_SECRETS.
-//
-// The command runs without a shell, so branch names and other interpolated arguments are passed
-// through as literal argv entries.
-
-import { spawnSync } from 'node:child_process';
-import fs from 'node:fs';
-import path from 'node:path';
-
-// Resolved against the working directory, matching how apify-test-tools' own readConfigFile
-// locates it.
-const CONFIG_FILE_NAME = 'apify-test-tools.config.json';
-
-const fail = (message) => {
-    console.error(message);
-    process.exit(1);
-};
-
-const [command, ...args] = process.argv.slice(2);
-if (!command) fail('Usage: run-with-apify-tokens.mjs <command> [args...]');
-
-const { WORKFLOW_SECRETS, ...baseEnv } = process.env;
-if (!WORKFLOW_SECRETS) {
-    fail('WORKFLOW_SECRETS is not set. Add `WORKFLOW_SECRETS: ${{ toJSON(secrets) }}` to the step env.');
-}
-
-let workflowSecrets;
-try {
-    workflowSecrets = JSON.parse(WORKFLOW_SECRETS);
-} catch (error) {
-    fail(`WORKFLOW_SECRETS is not valid JSON: ${error.message}`);
-}
-
-// Never includes the parse error: Node quotes the input in it, and the input is a secret.
-const unpackConfigSecrets = () => {
-    const packed = workflowSecrets.CONFIG_SECRETS;
-    if (!packed) return {};
-    let value;
-    try {
-        value = JSON.parse(packed);
-    } catch {
-        fail('The CONFIG_SECRETS secret is not valid JSON.');
-    }
-    if (typeof value !== 'object' || value === null || Array.isArray(value)) {
-        fail('The CONFIG_SECRETS secret must be a JSON object.');
-    }
-    return value;
-};
-
-const secrets = { ...workflowSecrets, ...unpackConfigSecrets() };
-
-const configPath = path.resolve(process.cwd(), CONFIG_FILE_NAME);
-let config;
-try {
-    config = JSON.parse(fs.readFileSync(configPath, 'utf8'));
-} catch (error) {
-    fail(`Cannot read "${configPath}": ${error.message}`);
-}
-
-if (!Array.isArray(config.actors)) {
-    fail(`"${configPath}" must have an "actors" array at the top level.`);
-}
-
-const tokenNames = [];
-const entriesWithoutToken = [];
-
-for (const [index, actor] of config.actors.entries()) {
-    const tokenEnvVar = actor?.tokenEnvVar;
-    if (typeof tokenEnvVar !== 'string' || tokenEnvVar === '') {
-        entriesWithoutToken.push(actor?.actorFullName ?? `entry at index ${index}`);
-        continue;
-    }
-    if (!tokenNames.includes(tokenEnvVar)) tokenNames.push(tokenEnvVar);
-}
-
-tokenNames.sort();
-
-if (entriesWithoutToken.length > 0) {
-    console.error(
-        `Warning: no "tokenEnvVar" in ${CONFIG_FILE_NAME} for: ${entriesWithoutToken.join(', ')}. ` +
-            `Building those Actors will fail.`,
-    );
-}
-
-// Declared but absent is a warning, not an error. A repo can carry an Actor whose token isn't
-// configured and still build fine as long as that Actor never changes, and apify-test-tools raises
-// a precise error naming the Actor at the point it actually needs the token.
-const missing = tokenNames.filter((name) => !(name in secrets));
-if (missing.length > 0) {
-    console.error(
-        `Warning: ${CONFIG_FILE_NAME} declares ${missing.join(', ')}, but no such secret was passed ` +
-            `to this workflow, neither inside CONFIG_SECRETS nor inherited. Check the repository secrets ` +
-            `and the workflow's \`secrets:\` if a build fails on a missing token.`,
-    );
-}
-
-const present = tokenNames.filter((name) => name in secrets);
-
-// Names only. The values are secrets and must never be printed, even though the runner masks
-// registered secrets in logs.
-console.error(`Passing ${present.length} Actor token(s) to \`${command}\`: ${present.join(', ') || '(none)'}`);
-
-const env = { ...baseEnv };
-for (const name of present) {
-    env[name] = secrets[name];
-}
-
-const result = spawnSync(command, args, { stdio: 'inherit', env });
-
-if (result.error) {
-    fail(`Failed to run \`${command}\`: ${result.error.message}`);
-}
-
-// Preserve the child's exit code so the step fails exactly when the command does. A child killed
-// by a signal reports a null status, which would otherwise be read as success.
-process.exit(result.status ?? 1);
+import{createRequire as __createRequire}from'node:module';const require=__createRequire(import.meta.url);
+import{spawnSync as m}from"node:child_process";import k from"node:fs";import w from"node:path";var S="apify-test-tools.config.json";function t(e){console.error(e),process.exit(1)}function o(e){return typeof e=="object"&&e!==null&&!Array.isArray(e)}var[c,...C]=process.argv.slice(2);c||t("Usage: run-with-apify-tokens.mjs <command> [args...]");var{WORKFLOW_SECRETS:E,...v}=process.env;E||t("WORKFLOW_SECRETS is not set. Add `WORKFLOW_SECRETS: ${{ toJSON(secrets) }}` to the step env.");var h;try{h=JSON.parse(E)}catch(e){t(`WORKFLOW_SECRETS is not valid JSON: ${e instanceof Error?e.message:String(e)}`)}var d=h;o(d)||t("WORKFLOW_SECRETS must be a JSON object of secret names and values.");var y=()=>{let e=d.CONFIG_SECRETS;if(!e)return{};typeof e!="string"&&t("The CONFIG_SECRETS secret is not valid JSON.");let n;try{n=JSON.parse(e)}catch{t("The CONFIG_SECRETS secret is not valid JSON.")}return o(n)||t("The CONFIG_SECRETS secret must be a JSON object."),n},g={...d,...y()},a=w.resolve(process.cwd(),S),i;try{i=JSON.parse(k.readFileSync(a,"utf8"))}catch(e){t(`Cannot read "${a}": ${e instanceof Error?e.message:String(e)}`)}(!o(i)||!Array.isArray(i.actors))&&t(`"${a}" must have an "actors" array at the top level.`);var r=[],f=[],N=i.actors;for(let[e,n]of N.entries()){let s=o(n)?n.tokenEnvVar:void 0;if(typeof s!="string"||s===""){f.push((o(n)?n.actorFullName:void 0)??`entry at index ${e}`);continue}r.includes(s)||r.push(s)}r.sort();f.length>0&&console.error(`Warning: no "tokenEnvVar" in ${S} for: ${f.join(", ")}. Building those Actors will fail.`);var p=r.filter(e=>!(e in g));p.length>0&&console.error(`Warning: ${S} declares ${p.join(", ")}, but no such secret was passed to this workflow, neither inside CONFIG_SECRETS nor inherited. Check the repository secrets and the workflow's \`secrets:\` if a build fails on a missing token.`);var l=r.filter(e=>e in g);console.error(`Passing ${l.length} Actor token(s) to \`${c}\`: ${l.join(", ")||"(none)"}`);var O={...v};for(let e of l){let n=g[e];typeof n!="string"&&t(`Secret "${e}" must be a string.`),O[e]=n}var u=m(c,C,{stdio:"inherit",env:O});u.error&&t(`Failed to run \`${c}\`: ${u.error.message}`);process.exit(u.status??1);

package/.github/workflows/_check_code.yaml

@@ -77,10 +77,10 @@ jobs:
             - name: Build
               run: npm run build
 
-    # The composite action runs the CLI from .github/cli/apify-test-tools.mjs, which the pre-commit
-    # hook rebuilds. This catches commits that skipped the hook, so a stale bundle never ships.
+    # The composite action runs the CLI and workflow helper bundles, which the pre-commit hook rebuilds.
+    # This catches commits that skipped the hook, so stale bundles never ship.
     cli_bundle:
-        name: CLI bundle
+        name: CLI and workflow bundles
         runs-on: ubuntu-latest
         steps:
             - name: Checkout repository
@@ -96,8 +96,8 @@ jobs:
             - name: Check the bundle is up to date
               run: |
                   npm run bundle
-                  if ! git diff --quiet -- .github/cli/; then
-                      echo "::error::.github/cli/apify-test-tools.mjs is out of date. Run \`npm run bundle\` and commit the result."
+                  if ! git diff --quiet -- .github/cli/ .github/scripts/run-with-apify-tokens.mjs; then
+                      echo "::error::A CLI or workflow script bundle is out of date. Run \`npm run bundle\` and commit the result."
                       exit 1
                   fi
                   node .github/cli/apify-test-tools.mjs --help > /dev/null

package/.husky/pre-commit

@@ -1,10 +1,10 @@
 echo "pre-commit: typechecking, linting, testing, checking code formatting, checking for unused exports & validating schemas"
 
 
-# The workflows run the CLI from this bundle, so it ships with every commit that changes bin/ or its
-# dependencies. Rebuilding takes well under a second.
+# The workflows run the CLI and token wrapper from these bundles, so they ship with every commit
+# that changes their sources or dependencies.
 npm run -s bundle
-git add .github/cli/apify-test-tools.mjs
+git add .github/cli/apify-test-tools.mjs .github/scripts/run-with-apify-tokens.mjs
 
 npm test
 npm run format:check
@@ -15,4 +15,4 @@ npx lint-staged
 # Activate once we resolv unused delete old builds
 # npm run check-unused
 
-echo "pre-commit: passed"
+echo "pre-commit: passed"

package/.prettierignore

@@ -11,3 +11,4 @@ test/fixtures
 
 # Generated by `npm run bundle`
 .github/cli/
+.github/scripts/run-with-apify-tokens.mjs