apify-test-tools 0.10.2-beta.17 → 0.10.2-beta.18

package/dist/workflow-scripts-src/run-with-apify-tokens.d.ts

@@ -0,0 +1,3 @@
+#!/usr/bin/env node
+export {};
+//# sourceMappingURL=run-with-apify-tokens.d.ts.map

package/dist/workflow-scripts-src/run-with-apify-tokens.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"run-with-apify-tokens.d.ts","sourceRoot":"","sources":["../../workflow-scripts-src/run-with-apify-tokens.ts"],"names":[],"mappings":""}

package/dist/workflow-scripts-src/run-with-apify-tokens.js

@@ -0,0 +1,124 @@
+#!/usr/bin/env node
+// Runs apify-test-tools and passes it only secrets needed for the Actors, no other secrets are leaked.
+//
+//     jq ... | node .github/scripts/run-with-apify-tokens.mjs apify-test-tools build --version-number 0.99
+//
+// The step passes the reusable workflow's whole secrets map as WORKFLOW_SECRETS. The token names
+// come from `tokenEnvVar` in the repo's apify-test-tools.config.json, which is the same file
+// apify-test-tools itself reads, so the two can't drift. Everything else in the secrets map (npm,
+// Slack, GitHub, anything else the repo holds) is left out, and WORKFLOW_SECRETS itself is dropped,
+// so the blob never reaches the CLI or anything under node_modules.
+//
+// Each token is looked up in the CONFIG_SECRETS secret first, a JSON object of secret name -> value,
+// and then among the top-level secrets, which is where `secrets: inherit` puts them. The secrets the
+// workflows read by name (NPM_TOKEN, TESTER_APIFY_TOKEN, ...) never come from CONFIG_SECRETS.
+//
+// The command runs without a shell, so branch names and other interpolated arguments are passed
+// through as literal argv entries.
+import { spawnSync } from 'node:child_process';
+import fs from 'node:fs';
+import path from 'node:path';
+// Resolved against the working directory, matching how apify-test-tools' own readConfigFile
+// locates it.
+const CONFIG_FILE_NAME = 'apify-test-tools.config.json';
+function fail(message) {
+    console.error(message);
+    process.exit(1);
+}
+function isRecord(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+const [command, ...args] = process.argv.slice(2);
+if (!command)
+    fail('Usage: run-with-apify-tokens.mjs <command> [args...]');
+const { WORKFLOW_SECRETS, ...baseEnv } = process.env;
+if (!WORKFLOW_SECRETS) {
+    fail('WORKFLOW_SECRETS is not set. Add `WORKFLOW_SECRETS: ${{ toJSON(secrets) }}` to the step env.');
+}
+let workflowSecrets;
+try {
+    workflowSecrets = JSON.parse(WORKFLOW_SECRETS);
+}
+catch (error) {
+    fail(`WORKFLOW_SECRETS is not valid JSON: ${error instanceof Error ? error.message : String(error)}`);
+}
+const workflowSecretsMap = workflowSecrets;
+if (!isRecord(workflowSecretsMap)) {
+    fail('WORKFLOW_SECRETS must be a JSON object of secret names and values.');
+}
+// Never includes the parse error: Node quotes the input in it, and the input is a secret.
+const unpackConfigSecrets = () => {
+    const packed = workflowSecretsMap.CONFIG_SECRETS;
+    if (!packed)
+        return {};
+    if (typeof packed !== 'string')
+        fail('The CONFIG_SECRETS secret is not valid JSON.');
+    let value;
+    try {
+        value = JSON.parse(packed);
+    }
+    catch {
+        fail('The CONFIG_SECRETS secret is not valid JSON.');
+    }
+    if (!isRecord(value)) {
+        fail('The CONFIG_SECRETS secret must be a JSON object.');
+    }
+    return value;
+};
+const secrets = { ...workflowSecretsMap, ...unpackConfigSecrets() };
+const configPath = path.resolve(process.cwd(), CONFIG_FILE_NAME);
+let config;
+try {
+    config = JSON.parse(fs.readFileSync(configPath, 'utf8'));
+}
+catch (error) {
+    fail(`Cannot read "${configPath}": ${error instanceof Error ? error.message : String(error)}`);
+}
+if (!isRecord(config) || !Array.isArray(config.actors)) {
+    fail(`"${configPath}" must have an "actors" array at the top level.`);
+}
+const tokenNames = [];
+const entriesWithoutToken = [];
+const actors = config.actors;
+for (const [index, actor] of actors.entries()) {
+    const tokenEnvVar = isRecord(actor) ? actor.tokenEnvVar : undefined;
+    if (typeof tokenEnvVar !== 'string' || tokenEnvVar === '') {
+        entriesWithoutToken.push((isRecord(actor) ? actor.actorFullName : undefined) ?? `entry at index ${index}`);
+        continue;
+    }
+    if (!tokenNames.includes(tokenEnvVar))
+        tokenNames.push(tokenEnvVar);
+}
+tokenNames.sort();
+if (entriesWithoutToken.length > 0) {
+    console.error(`Warning: no "tokenEnvVar" in ${CONFIG_FILE_NAME} for: ${entriesWithoutToken.join(', ')}. ` +
+        `Building those Actors will fail.`);
+}
+// Declared but absent is a warning, not an error. A repo can carry an Actor whose token isn't
+// configured and still build fine as long as that Actor never changes, and apify-test-tools raises
+// a precise error naming the Actor at the point it actually needs the token.
+const missing = tokenNames.filter((name) => !(name in secrets));
+if (missing.length > 0) {
+    console.error(`Warning: ${CONFIG_FILE_NAME} declares ${missing.join(', ')}, but no such secret was passed ` +
+        `to this workflow, neither inside CONFIG_SECRETS nor inherited. Check the repository secrets ` +
+        `and the workflow's \`secrets:\` if a build fails on a missing token.`);
+}
+const present = tokenNames.filter((name) => name in secrets);
+// Names only. The values are secrets and must never be printed, even though the runner masks
+// registered secrets in logs.
+console.error(`Passing ${present.length} Actor token(s) to \`${command}\`: ${present.join(', ') || '(none)'}`);
+const env = { ...baseEnv };
+for (const name of present) {
+    const value = secrets[name];
+    if (typeof value !== 'string')
+        fail(`Secret "${name}" must be a string.`);
+    env[name] = value;
+}
+const result = spawnSync(command, args, { stdio: 'inherit', env });
+if (result.error) {
+    fail(`Failed to run \`${command}\`: ${result.error.message}`);
+}
+// Preserve the child's exit code so the step fails exactly when the command does. A child killed
+// by a signal reports a null status, which would otherwise be read as success.
+process.exit(result.status ?? 1);
+//# sourceMappingURL=run-with-apify-tokens.js.map

package/dist/workflow-scripts-src/run-with-apify-tokens.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"run-with-apify-tokens.js","sourceRoot":"","sources":["../../workflow-scripts-src/run-with-apify-tokens.ts"],"names":[],"mappings":";AACA,uGAAuG;AACvG,EAAE;AACF,2GAA2G;AAC3G,EAAE;AACF,iGAAiG;AACjG,6FAA6F;AAC7F,kGAAkG;AAClG,oGAAoG;AACpG,oEAAoE;AACpE,EAAE;AACF,qGAAqG;AACrG,qGAAqG;AACrG,8FAA8F;AAC9F,EAAE;AACF,gGAAgG;AAChG,mCAAmC;AAEnC,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,4FAA4F;AAC5F,cAAc;AACd,MAAM,gBAAgB,GAAG,8BAA8B,CAAC;AAExD,SAAS,IAAI,CAAC,OAAe;IACzB,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACvB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AACpB,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC5B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAChF,CAAC;AAED,MAAM,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AACjD,IAAI,CAAC,OAAO;IAAE,IAAI,CAAC,sDAAsD,CAAC,CAAC;AAE3E,MAAM,EAAE,gBAAgB,EAAE,GAAG,OAAO,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC;AACrD,IAAI,CAAC,gBAAgB,EAAE,CAAC;IACpB,IAAI,CAAC,8FAA8F,CAAC,CAAC;AACzG,CAAC;AAED,IAAI,eAAwB,CAAC;AAC7B,IAAI,CAAC;IACD,eAAe,GAAG,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;AACnD,CAAC;AAAC,OAAO,KAAK,EAAE,CAAC;IACb,IAAI,CAAC,uCAAuC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;AAC1G,CAAC;AACD,MAAM,kBAAkB,GAAG,eAAe,CAAC;AAC3C,IAAI,CAAC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,CAAC;IAChC,IAAI,CAAC,oEAAoE,CAAC,CAAC;AAC/E,CAAC;AAED,0FAA0F;AAC1F,MAAM,mBAAmB,GAAG,GAA4B,EAAE;IACtD,MAAM,MAAM,GAAG,kBAAkB,CAAC,cAAc,CAAC;IACjD,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,CAAC;IACvB,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,IAAI,CAAC,8CAA8C,CAAC,CAAC;IACrF,IAAI,KAAc,CAAC;IACnB,IAAI,CAAC;QACD,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACL,IAAI,CAAC,8CAA8C,CAAC,CAAC;IACzD,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACnB,IAAI,CAAC,kDAAkD,CAAC,CAAC;IAC7D,CAAC;IACD,OAAO,KAAK,CAAC;AACjB,CAAC,CAAC;AAEF,MAAM,OAAO,GAAG,EAAE,GAAG,kBAAkB,EAAE,GAAG,mBAAmB,EAAE,EAAE,CAAC;AAEpE,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,gBAAgB,CAAC,CAAC;AACjE,IAAI,MAAe,CAAC;AACpB,IAAI,CAAC;IACD,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC;AAC7D,CAAC;AAAC,OAAO,KAAK,EAAE,CAAC;IACb,IAAI,CAAC,gBAAgB,UAAU,MAAM,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;AACnG,CAAC;AAED,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;IACrD,IAAI,CAAC,IAAI,UAAU,iDAAiD,CAAC,CAAC;AAC1E,CAAC;AAED,MAAM,UAAU,GAAa,EAAE,CAAC;AAChC,MAAM,mBAAmB,GAAc,EAAE,CAAC;AAE1C,MAAM,MAAM,GAAc,MAAM,CAAC,MAAM,CAAC;AACxC,KAAK,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,EAAE,EAAE,CAAC;IAC5C,MAAM,WAAW,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC;IACpE,IAAI,OAAO,WAAW,KAAK,QAAQ,IAAI,WAAW,KAAK,EAAE,EAAE,CAAC;QACxD,mBAAmB,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,kBAAkB,KAAK,EAAE,CAAC,CAAC;QAC3G,SAAS;IACb,CAAC;IACD,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,WAAW,CAAC;QAAE,UAAU,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;AACxE,CAAC;AAED,UAAU,CAAC,IAAI,EAAE,CAAC;AAElB,IAAI,mBAAmB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;IACjC,OAAO,CAAC,KAAK,CACT,gCAAgC,gBAAgB,SAAS,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;QACvF,kCAAkC,CACzC,CAAC;AACN,CAAC;AAED,8FAA8F;AAC9F,mGAAmG;AACnG,6EAA6E;AAC7E,MAAM,OAAO,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,OAAO,CAAC,CAAC,CAAC;AAChE,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;IACrB,OAAO,CAAC,KAAK,CACT,YAAY,gBAAgB,aAAa,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,kCAAkC;QACzF,8FAA8F;QAC9F,sEAAsE,CAC7E,CAAC;AACN,CAAC;AAED,MAAM,OAAO,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,IAAI,OAAO,CAAC,CAAC;AAE7D,6FAA6F;AAC7F,8BAA8B;AAC9B,OAAO,CAAC,KAAK,CAAC,WAAW,OAAO,CAAC,MAAM,wBAAwB,OAAO,OAAO,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,QAAQ,EAAE,CAAC,CAAC;AAE/G,MAAM,GAAG,GAAG,EAAE,GAAG,OAAO,EAAE,CAAC;AAC3B,KAAK,MAAM,IAAI,IAAI,OAAO,EAAE,CAAC;IACzB,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5B,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,IAAI,CAAC,WAAW,IAAI,qBAAqB,CAAC,CAAC;IAC1E,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;AACtB,CAAC;AAED,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC;AAEnE,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;IACf,IAAI,CAAC,mBAAmB,OAAO,OAAO,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;AAClE,CAAC;AAED,iGAAiG;AACjG,+EAA+E;AAC/E,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC"}

package/eslint.config.mjs

@@ -37,4 +37,13 @@ export default [
             'no-console': ['error', { allow: ['warn', 'error'] }],
         },
     },
+    {
+        files: ['workflow-scripts-src/**/*.ts'],
+        rules: {
+            // Workflow helpers preserve the existing standalone scripts' console output and GitHub expression text.
+            'no-console': 'off',
+            'no-template-curly-in-string': 'off',
+            'prefer-destructuring': 'off',
+        },
+    },
 ];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "apify-test-tools",
-  "version": "0.10.2-beta.17",
+  "version": "0.10.2-beta.18",
   "type": "module",
   "description": "TBD",
   "repository": {
@@ -59,7 +59,9 @@
     "start": "npm run dist/bin/main.js",
     "start:dev": "cd local-clone && tsx ../bin/main.ts",
     "build": "tsc && chmod +x ./dist/bin/main.js",
-    "bundle": "esbuild bin/main.ts --bundle --minify --platform=node --format=esm --target=node24 --log-level=warning --banner:js=\"import{createRequire as __createRequire}from'node:module';const require=__createRequire(import.meta.url);\" --outfile=.github/cli/apify-test-tools.mjs",
+    "bundle": "npm run bundle:cli && npm run bundle:workflow-scripts",
+    "bundle:cli": "esbuild bin/main.ts --bundle --minify --platform=node --format=esm --target=node24 --log-level=warning --banner:js=\"import{createRequire as __createRequire}from'node:module';const require=__createRequire(import.meta.url);\" --outfile=.github/cli/apify-test-tools.mjs",
+    "bundle:workflow-scripts": "esbuild workflow-scripts-src/run-with-apify-tokens.ts --bundle --minify --platform=node --format=esm --target=node24 --log-level=warning --banner:js=\"import{createRequire as __createRequire}from'node:module';const require=__createRequire(import.meta.url);\" --outfile=.github/scripts/run-with-apify-tokens.mjs",
     "lint": "eslint",
     "lint:fix": "eslint --fix",
     "format": "prettier --write .",

package/tsconfig.json

@@ -12,5 +12,5 @@
         "lib": ["DOM", "es2021"],
         "skipLibCheck": true
     },
-    "include": ["./index.ts", "./bin/**/*", "./lib/**/*", "./test/**/*"]
+    "include": ["./index.ts", "./bin/**/*", "./lib/**/*", "./test/**/*", "./workflow-scripts-src/**/*"]
 }

package/workflow-scripts-src/run-with-apify-tokens.ts

@@ -0,0 +1,141 @@
+#!/usr/bin/env node
+// Runs apify-test-tools and passes it only secrets needed for the Actors, no other secrets are leaked.
+//
+//     jq ... | node .github/scripts/run-with-apify-tokens.mjs apify-test-tools build --version-number 0.99
+//
+// The step passes the reusable workflow's whole secrets map as WORKFLOW_SECRETS. The token names
+// come from `tokenEnvVar` in the repo's apify-test-tools.config.json, which is the same file
+// apify-test-tools itself reads, so the two can't drift. Everything else in the secrets map (npm,
+// Slack, GitHub, anything else the repo holds) is left out, and WORKFLOW_SECRETS itself is dropped,
+// so the blob never reaches the CLI or anything under node_modules.
+//
+// Each token is looked up in the CONFIG_SECRETS secret first, a JSON object of secret name -> value,
+// and then among the top-level secrets, which is where `secrets: inherit` puts them. The secrets the
+// workflows read by name (NPM_TOKEN, TESTER_APIFY_TOKEN, ...) never come from CONFIG_SECRETS.
+//
+// The command runs without a shell, so branch names and other interpolated arguments are passed
+// through as literal argv entries.
+
+import { spawnSync } from 'node:child_process';
+import fs from 'node:fs';
+import path from 'node:path';
+
+// Resolved against the working directory, matching how apify-test-tools' own readConfigFile
+// locates it.
+const CONFIG_FILE_NAME = 'apify-test-tools.config.json';
+
+function fail(message: string): never {
+    console.error(message);
+    process.exit(1);
+}
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+
+const [command, ...args] = process.argv.slice(2);
+if (!command) fail('Usage: run-with-apify-tokens.mjs <command> [args...]');
+
+const { WORKFLOW_SECRETS, ...baseEnv } = process.env;
+if (!WORKFLOW_SECRETS) {
+    fail('WORKFLOW_SECRETS is not set. Add `WORKFLOW_SECRETS: ${{ toJSON(secrets) }}` to the step env.');
+}
+
+let workflowSecrets: unknown;
+try {
+    workflowSecrets = JSON.parse(WORKFLOW_SECRETS);
+} catch (error) {
+    fail(`WORKFLOW_SECRETS is not valid JSON: ${error instanceof Error ? error.message : String(error)}`);
+}
+const workflowSecretsMap = workflowSecrets;
+if (!isRecord(workflowSecretsMap)) {
+    fail('WORKFLOW_SECRETS must be a JSON object of secret names and values.');
+}
+
+// Never includes the parse error: Node quotes the input in it, and the input is a secret.
+const unpackConfigSecrets = (): Record<string, unknown> => {
+    const packed = workflowSecretsMap.CONFIG_SECRETS;
+    if (!packed) return {};
+    if (typeof packed !== 'string') fail('The CONFIG_SECRETS secret is not valid JSON.');
+    let value: unknown;
+    try {
+        value = JSON.parse(packed);
+    } catch {
+        fail('The CONFIG_SECRETS secret is not valid JSON.');
+    }
+    if (!isRecord(value)) {
+        fail('The CONFIG_SECRETS secret must be a JSON object.');
+    }
+    return value;
+};
+
+const secrets = { ...workflowSecretsMap, ...unpackConfigSecrets() };
+
+const configPath = path.resolve(process.cwd(), CONFIG_FILE_NAME);
+let config: unknown;
+try {
+    config = JSON.parse(fs.readFileSync(configPath, 'utf8'));
+} catch (error) {
+    fail(`Cannot read "${configPath}": ${error instanceof Error ? error.message : String(error)}`);
+}
+
+if (!isRecord(config) || !Array.isArray(config.actors)) {
+    fail(`"${configPath}" must have an "actors" array at the top level.`);
+}
+
+const tokenNames: string[] = [];
+const entriesWithoutToken: unknown[] = [];
+
+const actors: unknown[] = config.actors;
+for (const [index, actor] of actors.entries()) {
+    const tokenEnvVar = isRecord(actor) ? actor.tokenEnvVar : undefined;
+    if (typeof tokenEnvVar !== 'string' || tokenEnvVar === '') {
+        entriesWithoutToken.push((isRecord(actor) ? actor.actorFullName : undefined) ?? `entry at index ${index}`);
+        continue;
+    }
+    if (!tokenNames.includes(tokenEnvVar)) tokenNames.push(tokenEnvVar);
+}
+
+tokenNames.sort();
+
+if (entriesWithoutToken.length > 0) {
+    console.error(
+        `Warning: no "tokenEnvVar" in ${CONFIG_FILE_NAME} for: ${entriesWithoutToken.join(', ')}. ` +
+            `Building those Actors will fail.`,
+    );
+}
+
+// Declared but absent is a warning, not an error. A repo can carry an Actor whose token isn't
+// configured and still build fine as long as that Actor never changes, and apify-test-tools raises
+// a precise error naming the Actor at the point it actually needs the token.
+const missing = tokenNames.filter((name) => !(name in secrets));
+if (missing.length > 0) {
+    console.error(
+        `Warning: ${CONFIG_FILE_NAME} declares ${missing.join(', ')}, but no such secret was passed ` +
+            `to this workflow, neither inside CONFIG_SECRETS nor inherited. Check the repository secrets ` +
+            `and the workflow's \`secrets:\` if a build fails on a missing token.`,
+    );
+}
+
+const present = tokenNames.filter((name) => name in secrets);
+
+// Names only. The values are secrets and must never be printed, even though the runner masks
+// registered secrets in logs.
+console.error(`Passing ${present.length} Actor token(s) to \`${command}\`: ${present.join(', ') || '(none)'}`);
+
+const env = { ...baseEnv };
+for (const name of present) {
+    const value = secrets[name];
+    if (typeof value !== 'string') fail(`Secret "${name}" must be a string.`);
+    env[name] = value;
+}
+
+const result = spawnSync(command, args, { stdio: 'inherit', env });
+
+if (result.error) {
+    fail(`Failed to run \`${command}\`: ${result.error.message}`);
+}
+
+// Preserve the child's exit code so the step fails exactly when the command does. A child killed
+// by a signal reports a null status, which would otherwise be read as success.
+process.exit(result.status ?? 1);