apify-test-tools 0.10.2-beta.17 → 0.10.2-beta.19

package/dist/workflow-scripts-src/run-with-apify-tokens.d.ts

@@ -0,0 +1,3 @@
+#!/usr/bin/env node
+export {};
+//# sourceMappingURL=run-with-apify-tokens.d.ts.map

package/dist/workflow-scripts-src/run-with-apify-tokens.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"run-with-apify-tokens.d.ts","sourceRoot":"","sources":["../../workflow-scripts-src/run-with-apify-tokens.ts"],"names":[],"mappings":""}

package/dist/workflow-scripts-src/run-with-apify-tokens.js

@@ -0,0 +1,100 @@
+#!/usr/bin/env node
+// Runs apify-test-tools and passes it only secrets needed for the Actors, no other secrets are leaked.
+//
+//     jq ... | node .github/scripts/run-with-apify-tokens.mjs apify-test-tools build --version-number 0.99
+//
+// The step passes the reusable workflow's whole secrets map as WORKFLOW_SECRETS. The token names
+// come from `tokenEnvVar` in the repo's apify-test-tools.config.json, which is the same file
+// apify-test-tools itself reads, so the two can't drift. Everything else in the secrets map (npm,
+// Slack, GitHub, anything else the repo holds) is left out, and WORKFLOW_SECRETS itself is dropped,
+// so the blob never reaches the CLI or anything under node_modules.
+//
+// Each token is looked up in the CONFIG_SECRETS secret first, a JSON object of secret name -> value,
+// and then among the top-level secrets, which is where `secrets: inherit` puts them. The secrets the
+// workflows read by name (NPM_TOKEN, TESTER_APIFY_TOKEN, ...) never come from CONFIG_SECRETS.
+//
+// The command runs without a shell, so branch names and other interpolated arguments are passed
+// through as literal argv entries.
+import { spawnSync } from 'node:child_process';
+import { CONFIG_FILE_NAME, readBaseConfigFile } from '../bin/utils/config/load-config.js';
+function fail(message) {
+    console.error(message);
+    process.exit(1);
+}
+function isRecord(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+const [command, ...args] = process.argv.slice(2);
+if (!command)
+    fail('Usage: run-with-apify-tokens.mjs <command> [args...]');
+const { WORKFLOW_SECRETS, ...baseEnv } = process.env;
+if (!WORKFLOW_SECRETS) {
+    fail('WORKFLOW_SECRETS is not set. Add `WORKFLOW_SECRETS: ${{ toJSON(secrets) }}` to the step env.');
+}
+let workflowSecrets;
+try {
+    workflowSecrets = JSON.parse(WORKFLOW_SECRETS);
+}
+catch (error) {
+    fail(`WORKFLOW_SECRETS is not valid JSON: ${error instanceof Error ? error.message : String(error)}`);
+}
+const workflowSecretsMap = workflowSecrets;
+if (!isRecord(workflowSecretsMap)) {
+    fail('WORKFLOW_SECRETS must be a JSON object of secret names and values.');
+}
+// Never includes the parse error: Node quotes the input in it, and the input is a secret.
+const unpackConfigSecrets = () => {
+    const packed = workflowSecretsMap.CONFIG_SECRETS;
+    if (!packed)
+        return {};
+    if (typeof packed !== 'string')
+        fail('The CONFIG_SECRETS secret is not valid JSON.');
+    let value;
+    try {
+        value = JSON.parse(packed);
+    }
+    catch {
+        fail('The CONFIG_SECRETS secret is not valid JSON.');
+    }
+    if (!isRecord(value)) {
+        fail('The CONFIG_SECRETS secret must be a JSON object.');
+    }
+    return value;
+};
+const secrets = { ...workflowSecretsMap, ...unpackConfigSecrets() };
+let actorConfigs;
+try {
+    actorConfigs = await readBaseConfigFile();
+}
+catch (error) {
+    fail(error instanceof Error ? error.message : String(error));
+}
+const tokenNames = [...new Set(actorConfigs.map(({ tokenEnvVar }) => tokenEnvVar))].sort();
+// Declared but absent is a warning, not an error. A repo can carry an Actor whose token isn't
+// configured and still build fine as long as that Actor never changes, and apify-test-tools raises
+// a precise error naming the Actor at the point it actually needs the token.
+const missing = tokenNames.filter((name) => !(name in secrets));
+if (missing.length > 0) {
+    console.error(`Warning: ${CONFIG_FILE_NAME} declares ${missing.join(', ')}, but no such secret was passed ` +
+        `to this workflow, neither inside CONFIG_SECRETS nor inherited. Check the repository secrets ` +
+        `and the workflow's \`secrets:\` if a build fails on a missing token.`);
+}
+const present = tokenNames.filter((name) => name in secrets);
+// Names only. The values are secrets and must never be printed, even though the runner masks
+// registered secrets in logs.
+console.error(`Passing ${present.length} Actor token(s) to \`${command}\`: ${present.join(', ') || '(none)'}`);
+const env = { ...baseEnv };
+for (const name of present) {
+    const value = secrets[name];
+    if (typeof value !== 'string')
+        fail(`Secret "${name}" must be a string.`);
+    env[name] = value;
+}
+const result = spawnSync(command, args, { stdio: 'inherit', env });
+if (result.error) {
+    fail(`Failed to run \`${command}\`: ${result.error.message}`);
+}
+// Preserve the child's exit code so the step fails exactly when the command does. A child killed
+// by a signal reports a null status, which would otherwise be read as success.
+process.exit(result.status ?? 1);
+//# sourceMappingURL=run-with-apify-tokens.js.map

package/dist/workflow-scripts-src/run-with-apify-tokens.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"run-with-apify-tokens.js","sourceRoot":"","sources":["../../workflow-scripts-src/run-with-apify-tokens.ts"],"names":[],"mappings":";AACA,uGAAuG;AACvG,EAAE;AACF,2GAA2G;AAC3G,EAAE;AACF,iGAAiG;AACjG,6FAA6F;AAC7F,kGAAkG;AAClG,oGAAoG;AACpG,oEAAoE;AACpE,EAAE;AACF,qGAAqG;AACrG,qGAAqG;AACrG,8FAA8F;AAC9F,EAAE;AACF,gGAAgG;AAChG,mCAAmC;AAEnC,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAE/C,OAAO,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,MAAM,oCAAoC,CAAC;AAE1F,SAAS,IAAI,CAAC,OAAe;IACzB,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACvB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AACpB,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC5B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAChF,CAAC;AAED,MAAM,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AACjD,IAAI,CAAC,OAAO;IAAE,IAAI,CAAC,sDAAsD,CAAC,CAAC;AAE3E,MAAM,EAAE,gBAAgB,EAAE,GAAG,OAAO,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC;AACrD,IAAI,CAAC,gBAAgB,EAAE,CAAC;IACpB,IAAI,CAAC,8FAA8F,CAAC,CAAC;AACzG,CAAC;AAED,IAAI,eAAwB,CAAC;AAC7B,IAAI,CAAC;IACD,eAAe,GAAG,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;AACnD,CAAC;AAAC,OAAO,KAAK,EAAE,CAAC;IACb,IAAI,CAAC,uCAAuC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;AAC1G,CAAC;AACD,MAAM,kBAAkB,GAAG,eAAe,CAAC;AAC3C,IAAI,CAAC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,CAAC;IAChC,IAAI,CAAC,oEAAoE,CAAC,CAAC;AAC/E,CAAC;AAED,0FAA0F;AAC1F,MAAM,mBAAmB,GAAG,GAA4B,EAAE;IACtD,MAAM,MAAM,GAAG,kBAAkB,CAAC,cAAc,CAAC;IACjD,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,CAAC;IACvB,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,IAAI,CAAC,8CAA8C,CAAC,CAAC;IACrF,IAAI,KAAc,CAAC;IACnB,IAAI,CAAC;QACD,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACL,IAAI,CAAC,8CAA8C,CAAC,CAAC;IACzD,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACnB,IAAI,CAAC,kDAAkD,CAAC,CAAC;IAC7D,CAAC;IACD,OAAO,KAAK,CAAC;AACjB,CAAC,CAAC;AAEF,MAAM,OAAO,GAAG,EAAE,GAAG,kBAAkB,EAAE,GAAG,mBAAmB,EAAE,EAAE,CAAC;AAEpE,IAAI,YAA4D,CAAC;AACjE,IAAI,CAAC;IACD,YAAY,GAAG,MAAM,kBAAkB,EAAE,CAAC;AAC9C,CAAC;AAAC,OAAO,KAAK,EAAE,CAAC;IACb,IAAI,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;AACjE,CAAC;AAED,MAAM,UAAU,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;AAE3F,8FAA8F;AAC9F,mGAAmG;AACnG,6EAA6E;AAC7E,MAAM,OAAO,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,OAAO,CAAC,CAAC,CAAC;AAChE,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;IACrB,OAAO,CAAC,KAAK,CACT,YAAY,gBAAgB,aAAa,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,kCAAkC;QACzF,8FAA8F;QAC9F,sEAAsE,CAC7E,CAAC;AACN,CAAC;AAED,MAAM,OAAO,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,IAAI,OAAO,CAAC,CAAC;AAE7D,6FAA6F;AAC7F,8BAA8B;AAC9B,OAAO,CAAC,KAAK,CAAC,WAAW,OAAO,CAAC,MAAM,wBAAwB,OAAO,OAAO,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,QAAQ,EAAE,CAAC,CAAC;AAE/G,MAAM,GAAG,GAAG,EAAE,GAAG,OAAO,EAAE,CAAC;AAC3B,KAAK,MAAM,IAAI,IAAI,OAAO,EAAE,CAAC;IACzB,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5B,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,IAAI,CAAC,WAAW,IAAI,qBAAqB,CAAC,CAAC;IAC1E,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;AACtB,CAAC;AAED,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC;AAEnE,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;IACf,IAAI,CAAC,mBAAmB,OAAO,OAAO,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;AAClE,CAAC;AAED,iGAAiG;AACjG,+EAA+E;AAC/E,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC"}

package/docs/workflows.md

@@ -396,6 +396,9 @@ token is not passed on. A token the config declares but the repo hasn't set is a
 carry an Actor whose token isn't configured and still build fine as long as that Actor never changes. The build fails
 with an error naming the Actor once it actually needs the token.
 
+The wrapper validates the config with the CLI's parser. Each Actor must declare a nonempty `tokenEnvVar` or inherit
+one from its group. An empty name or a missing required `tokenEnvVar` fails during config validation.
+
 The `unitTest` job runs static checks and needs `NPM_TOKEN` only. No job runs `npm ci` or `pnpm install` with Apify
 or Slack credentials in scope, so a postinstall script in the dependency tree cannot read them.
 

package/eslint.config.mjs

@@ -37,4 +37,13 @@ export default [
             'no-console': ['error', { allow: ['warn', 'error'] }],
         },
     },
+    {
+        files: ['workflow-scripts-src/**/*.ts'],
+        rules: {
+            // Workflow helpers preserve the existing standalone scripts' console output and GitHub expression text.
+            'no-console': 'off',
+            'no-template-curly-in-string': 'off',
+            'prefer-destructuring': 'off',
+        },
+    },
 ];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "apify-test-tools",
-  "version": "0.10.2-beta.17",
+  "version": "0.10.2-beta.19",
   "type": "module",
   "description": "TBD",
   "repository": {
@@ -59,7 +59,9 @@
     "start": "npm run dist/bin/main.js",
     "start:dev": "cd local-clone && tsx ../bin/main.ts",
     "build": "tsc && chmod +x ./dist/bin/main.js",
-    "bundle": "esbuild bin/main.ts --bundle --minify --platform=node --format=esm --target=node24 --log-level=warning --banner:js=\"import{createRequire as __createRequire}from'node:module';const require=__createRequire(import.meta.url);\" --outfile=.github/cli/apify-test-tools.mjs",
+    "bundle": "npm run bundle:cli && npm run bundle:workflow-scripts",
+    "bundle:cli": "esbuild bin/main.ts --bundle --minify --platform=node --format=esm --target=node24 --log-level=warning --banner:js=\"import{createRequire as __createRequire}from'node:module';const require=__createRequire(import.meta.url);\" --outfile=.github/cli/apify-test-tools.mjs",
+    "bundle:workflow-scripts": "esbuild workflow-scripts-src/run-with-apify-tokens.ts --bundle --minify --platform=node --format=esm --target=node24 --log-level=warning --banner:js=\"import{createRequire as __createRequire}from'node:module';const require=__createRequire(import.meta.url);\" --outfile=.github/scripts/run-with-apify-tokens.mjs",
     "lint": "eslint",
     "lint:fix": "eslint --fix",
     "format": "prettier --write .",

package/test/bundle/token-wrapper.test.ts

@@ -0,0 +1,110 @@
+import { spawnSync } from 'node:child_process';
+import { mkdtemp, rm, writeFile } from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import process from 'node:process';
+import { fileURLToPath } from 'node:url';
+
+import { afterAll, beforeAll, describe, expect, it } from 'vitest';
+
+const wrapperPath = fileURLToPath(new URL('../../.github/scripts/run-with-apify-tokens.mjs', import.meta.url));
+const configFileName = 'apify-test-tools.config.json';
+
+let repoDir: string;
+
+describe('token wrapper bundle', () => {
+    beforeAll(async () => {
+        repoDir = await mkdtemp(path.join(os.tmpdir(), 'apify-token-wrapper-'));
+    });
+
+    afterAll(async () => {
+        if (repoDir) await rm(repoDir, { recursive: true, force: true });
+    });
+
+    const actorSecrets = {
+        GROUP_TOKEN: 'group-value',
+        OVERRIDE_TOKEN: 'override-value',
+        OTHER: 'hidden',
+    };
+
+    const runWrapper = (workflowSecrets: Record<string, string> = actorSecrets) =>
+        spawnSync(process.execPath, [wrapperPath, process.execPath, '-e', 'console.log(JSON.stringify(process.env))'], {
+            cwd: repoDir,
+            env: {
+                PATH: process.env.PATH ?? '',
+                WORKFLOW_SECRETS: JSON.stringify(workflowSecrets),
+            },
+            encoding: 'utf8',
+        });
+
+    it.each(['inherited secrets', 'CONFIG_SECRETS'])(
+        'passes grouped tokens and actor overrides from %s without unrelated secrets',
+        async (source) => {
+            await writeFile(
+                path.join(repoDir, configFileName),
+                JSON.stringify({
+                    mode: 'grouped',
+                    groups: {
+                        example: {
+                            tokenEnvVar: 'GROUP_TOKEN',
+                            actors: [
+                                { folder: 'actors/one', actorFullName: 'example/one' },
+                                { folder: 'actors/two', actorFullName: 'example/two', tokenEnvVar: 'OVERRIDE_TOKEN' },
+                            ],
+                        },
+                    },
+                }),
+            );
+
+            const { status, stdout, stderr } = runWrapper(
+                source === 'CONFIG_SECRETS' ? { CONFIG_SECRETS: JSON.stringify(actorSecrets) } : actorSecrets,
+            );
+            expect(status, stderr).toBe(0);
+            const childEnv: Record<string, string> = JSON.parse(stdout);
+            expect(childEnv).toMatchObject({ GROUP_TOKEN: 'group-value', OVERRIDE_TOKEN: 'override-value' });
+            expect(childEnv).not.toHaveProperty('OTHER');
+            expect(childEnv).not.toHaveProperty('WORKFLOW_SECRETS');
+            expect(childEnv).not.toHaveProperty('CONFIG_SECRETS');
+            expect(stderr).toContain('Passing 2 Actor token(s)');
+        },
+    );
+
+    it('does not start the child when config validation fails', async () => {
+        await writeFile(path.join(repoDir, configFileName), JSON.stringify({ mode: 'grouped', groups: {} }));
+
+        const { status, stdout, stderr } = runWrapper();
+        expect(status).toBe(1);
+        expect(stdout).toBe('');
+        expect(stderr).toContain('At least one configuration group is required');
+        expect(stderr).not.toContain('Cannot read');
+    });
+
+    it.each(['', undefined])(
+        'rejects an empty or missing token name (%s) before starting the child',
+        async (tokenEnvVar) => {
+            await writeFile(
+                path.join(repoDir, configFileName),
+                JSON.stringify({ actors: [{ folder: 'actors/one', actorFullName: 'example/one', tokenEnvVar }] }),
+            );
+
+            const { status, stdout, stderr } = runWrapper();
+            expect(status).toBe(1);
+            expect(stdout).toBe('');
+            expect(stderr).toContain('actors[0].tokenEnvVar');
+            expect(stderr).not.toContain('Warning:');
+            expect(stderr).not.toContain('Cannot read');
+        },
+    );
+
+    it('reports a missing config file without a duplicate error prefix', async () => {
+        await rm(path.join(repoDir, configFileName), { force: true });
+
+        const { status, stdout, stderr } = runWrapper();
+        expect(status).toBe(1);
+        expect(stdout).toBe('');
+        expect(stderr).toBe(
+            `Config file "${configFileName}" not found in the current directory. ` +
+                'Please create one with the required actor entries.\n',
+        );
+    });
+});

package/test/unit/bin/utils/config/load-config.test.ts

@@ -4,7 +4,12 @@ import path from 'node:path';
 
 import { afterEach, beforeEach, describe, expect, it } from 'vitest';
 
-import { CONFIG_FILE_NAME, loadActorConfig, readConfigFile } from '../../../../../bin/utils/config/load-config.js';
+import {
+    CONFIG_FILE_NAME,
+    loadActorConfig,
+    readBaseConfigFile,
+    readConfigFile,
+} from '../../../../../bin/utils/config/load-config.js';
 import type { ResolvedActorConfig } from '../../../../../bin/utils/config/structures/base.js';
 import { ExistingDir, ExistingFile, RelativeDir, RelativeFile } from '../../../../../bin/utils/path/repo-relative.js';
 
@@ -265,3 +270,23 @@ describe('readConfigFile', () => {
         await expect(readConfigFile(emptyActorSelection)).rejects.toThrow(/at actors/);
     });
 });
+
+describe('readBaseConfigFile', () => {
+    it('returns non-file settings without checking Actor paths or reading actor.json', async () => {
+        await writeFiles({
+            [CONFIG_FILE_NAME]: validConfig([
+                {
+                    folder: 'missing-actor-dir',
+                    actorFullName: 'myteam/shopify',
+                    tokenEnvVar: 'APIFY_TOKEN',
+                    overrideActorContext: ['../outside'],
+                },
+            ]),
+        });
+
+        await expect(readBaseConfigFile()).resolves.toEqual([
+            { actorFullName: 'myteam/shopify', tokenEnvVar: 'APIFY_TOKEN' },
+        ]);
+        await expect(readConfigFile(emptyActorSelection)).rejects.toThrow();
+    });
+});

package/test/unit/bin/utils/config/parser.test.ts

@@ -4,13 +4,18 @@ import path from 'node:path';
 
 import { afterAll, beforeAll, describe, expect, it } from 'vitest';
 
-import { _privates, parseConfigFile } from '../../../../../bin/utils/config/parser.js';
-import { CONFIG_FILE_STRATEGY } from '../../../../../bin/utils/config/structures/base.js';
+import { _privates, parseConfigFile, parseResolvedConfigFile } from '../../../../../bin/utils/config/parser.js';
+import { CONFIG_FILE_STRATEGY, type ResolvedActorConfig } from '../../../../../bin/utils/config/structures/base.js';
 import { GROUPED_PARSER } from '../../../../../bin/utils/config/structures/grouped.js';
 import { LEGACY_PARSER } from '../../../../../bin/utils/config/structures/legacy.js';
 import { ExistingDir, RelativeDir } from '../../../../../bin/utils/path/repo-relative.js';
 
-const { selectStrategy, verifyConfiguration } = _privates;
+const { selectStrategy, initializePaths, verifyConfiguration: verifyInitializedConfiguration } = _privates;
+const verifyConfiguration = (body: ResolvedActorConfig[]) => {
+    const initialized = initializePaths(body);
+    verifyInitializedConfiguration(initialized);
+    return initialized;
+};
 
 let repoDir: string;
 const originalCwd = process.cwd();
@@ -95,13 +100,13 @@ describe('verifyConfiguration', () => {
         ).toThrow(/Duplicate folder/);
     });
 
-    it('quotes a duplicate folder the way it was written, not the way it normalized', () => {
+    it('reports the normalized path for a duplicate folder', () => {
         expect(() =>
             verifyConfiguration([
                 actor({ folder: '.', actorFullName: 'myteam/actor-a' }),
                 actor({ folder: './', actorFullName: 'myteam/actor-b' }),
             ]),
-        ).toThrow('Duplicate folder "./"');
+        ).toThrow('Duplicate folder "."');
     });
 
     it('rejects two entries pointing at the same actor', () => {
@@ -150,6 +155,19 @@ describe('verifyConfiguration', () => {
 });
 
 describe('parseConfigFile', () => {
+    it('shares strategy resolution with parsing that does not initialize paths', () => {
+        const body = { actors: [actor({ folder: 'missing-actor-dir', overrideActorContext: ['../outside'] })] };
+        expect(parseResolvedConfigFile(body)).toEqual([
+            {
+                actorFullName: 'myteam/shopify',
+                folder: 'missing-actor-dir',
+                tokenEnvVar: 'APIFY_TOKEN',
+                overrideActorContext: ['../outside'],
+            },
+        ]);
+        expect(() => parseConfigFile(body)).toThrow();
+    });
+
     it('validates and normalizes paths after resolving the config', () => {
         const [parsed] = parseConfigFile({ actors: [actor({ folder: './bin/', overrideActorContext: ['test/'] })] });
         expect(parsed.folder).toBeInstanceOf(ExistingDir);

package/test/unit/bin/utils/config/structures/grouped.test.ts

@@ -68,6 +68,18 @@ describe('GROUPED_PARSER', () => {
         expect(() => GROUPED_PARSER.parse({})).toThrow();
     });
 
+    it('rejects an empty group token name', () => {
+        expect(() => GROUPED_PARSER.parse({ groups: { myteam: group({ tokenEnvVar: '' }) } })).toThrow(
+            /at groups\.myteam\.tokenEnvVar/,
+        );
+    });
+
+    it('rejects an empty actor token override instead of falling back to the group token', () => {
+        expect(() =>
+            GROUPED_PARSER.parse({ groups: { myteam: group({ actors: [actor({ tokenEnvVar: '' })] }) } }),
+        ).toThrow(/at groups\.myteam\.actors\[0\]\.tokenEnvVar/);
+    });
+
     it('reports problems from every group at once instead of only the first', () => {
         const message = (() => {
             try {

package/test/unit/bin/utils/config/structures/legacy.test.ts

@@ -32,6 +32,7 @@ describe('LEGACY_PARSER', () => {
         ['folder is missing', { folder: undefined }, /at actors\[0\]\.folder/],
         ['folder is not a string', { folder: 123 }, /at actors\[0\]\.folder/],
         ['tokenEnvVar is missing', { tokenEnvVar: undefined }, /at actors\[0\]\.tokenEnvVar/],
+        ['tokenEnvVar is empty', { tokenEnvVar: '' }, /at actors\[0\]\.tokenEnvVar/],
         ['overrideActorContext is not an array', { overrideActorContext: 'packages' }, /expected array/],
         ['overrideActorContext holds non-strings', { overrideActorContext: [123] }, /overrideActorContext\[0\]/],
     ])('rejects an entry where %s', (_name, fields, expected) => {

package/test/unit/github-scripts/run-with-apify-tokens.test.ts

@@ -12,9 +12,9 @@ const SCRIPT = fileURLToPath(new URL('../../../.github/scripts/run-with-apify-to
 // Three Actors, each with its own token, so a test can leave any of them out.
 const CONFIG = {
     actors: [
-        { actorFullName: 'team/one', tokenEnvVar: 'TOKEN_ONE' },
-        { actorFullName: 'team/two', tokenEnvVar: 'TOKEN_TWO' },
-        { actorFullName: 'team/three', tokenEnvVar: 'TOKEN_THREE' },
+        { folder: 'actors/one', actorFullName: 'team/one', tokenEnvVar: 'TOKEN_ONE' },
+        { folder: 'actors/two', actorFullName: 'team/two', tokenEnvVar: 'TOKEN_TWO' },
+        { folder: 'actors/three', actorFullName: 'team/three', tokenEnvVar: 'TOKEN_THREE' },
     ],
 };
 

package/tsconfig.json

@@ -12,5 +12,5 @@
         "lib": ["DOM", "es2021"],
         "skipLibCheck": true
     },
-    "include": ["./index.ts", "./bin/**/*", "./lib/**/*", "./test/**/*"]
+    "include": ["./index.ts", "./bin/**/*", "./lib/**/*", "./test/**/*", "./workflow-scripts-src/**/*"]
 }

package/workflow-scripts-src/run-with-apify-tokens.ts

@@ -0,0 +1,112 @@
+#!/usr/bin/env node
+// Runs apify-test-tools and passes it only secrets needed for the Actors, no other secrets are leaked.
+//
+//     jq ... | node .github/scripts/run-with-apify-tokens.mjs apify-test-tools build --version-number 0.99
+//
+// The step passes the reusable workflow's whole secrets map as WORKFLOW_SECRETS. The token names
+// come from `tokenEnvVar` in the repo's apify-test-tools.config.json, which is the same file
+// apify-test-tools itself reads, so the two can't drift. Everything else in the secrets map (npm,
+// Slack, GitHub, anything else the repo holds) is left out, and WORKFLOW_SECRETS itself is dropped,
+// so the blob never reaches the CLI or anything under node_modules.
+//
+// Each token is looked up in the CONFIG_SECRETS secret first, a JSON object of secret name -> value,
+// and then among the top-level secrets, which is where `secrets: inherit` puts them. The secrets the
+// workflows read by name (NPM_TOKEN, TESTER_APIFY_TOKEN, ...) never come from CONFIG_SECRETS.
+//
+// The command runs without a shell, so branch names and other interpolated arguments are passed
+// through as literal argv entries.
+
+import { spawnSync } from 'node:child_process';
+
+import { CONFIG_FILE_NAME, readBaseConfigFile } from '../bin/utils/config/load-config.js';
+
+function fail(message: string): never {
+    console.error(message);
+    process.exit(1);
+}
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+
+const [command, ...args] = process.argv.slice(2);
+if (!command) fail('Usage: run-with-apify-tokens.mjs <command> [args...]');
+
+const { WORKFLOW_SECRETS, ...baseEnv } = process.env;
+if (!WORKFLOW_SECRETS) {
+    fail('WORKFLOW_SECRETS is not set. Add `WORKFLOW_SECRETS: ${{ toJSON(secrets) }}` to the step env.');
+}
+
+let workflowSecrets: unknown;
+try {
+    workflowSecrets = JSON.parse(WORKFLOW_SECRETS);
+} catch (error) {
+    fail(`WORKFLOW_SECRETS is not valid JSON: ${error instanceof Error ? error.message : String(error)}`);
+}
+const workflowSecretsMap = workflowSecrets;
+if (!isRecord(workflowSecretsMap)) {
+    fail('WORKFLOW_SECRETS must be a JSON object of secret names and values.');
+}
+
+// Never includes the parse error: Node quotes the input in it, and the input is a secret.
+const unpackConfigSecrets = (): Record<string, unknown> => {
+    const packed = workflowSecretsMap.CONFIG_SECRETS;
+    if (!packed) return {};
+    if (typeof packed !== 'string') fail('The CONFIG_SECRETS secret is not valid JSON.');
+    let value: unknown;
+    try {
+        value = JSON.parse(packed);
+    } catch {
+        fail('The CONFIG_SECRETS secret is not valid JSON.');
+    }
+    if (!isRecord(value)) {
+        fail('The CONFIG_SECRETS secret must be a JSON object.');
+    }
+    return value;
+};
+
+const secrets = { ...workflowSecretsMap, ...unpackConfigSecrets() };
+
+let actorConfigs: Awaited<ReturnType<typeof readBaseConfigFile>>;
+try {
+    actorConfigs = await readBaseConfigFile();
+} catch (error) {
+    fail(error instanceof Error ? error.message : String(error));
+}
+
+const tokenNames = [...new Set(actorConfigs.map(({ tokenEnvVar }) => tokenEnvVar))].sort();
+
+// Declared but absent is a warning, not an error. A repo can carry an Actor whose token isn't
+// configured and still build fine as long as that Actor never changes, and apify-test-tools raises
+// a precise error naming the Actor at the point it actually needs the token.
+const missing = tokenNames.filter((name) => !(name in secrets));
+if (missing.length > 0) {
+    console.error(
+        `Warning: ${CONFIG_FILE_NAME} declares ${missing.join(', ')}, but no such secret was passed ` +
+            `to this workflow, neither inside CONFIG_SECRETS nor inherited. Check the repository secrets ` +
+            `and the workflow's \`secrets:\` if a build fails on a missing token.`,
+    );
+}
+
+const present = tokenNames.filter((name) => name in secrets);
+
+// Names only. The values are secrets and must never be printed, even though the runner masks
+// registered secrets in logs.
+console.error(`Passing ${present.length} Actor token(s) to \`${command}\`: ${present.join(', ') || '(none)'}`);
+
+const env = { ...baseEnv };
+for (const name of present) {
+    const value = secrets[name];
+    if (typeof value !== 'string') fail(`Secret "${name}" must be a string.`);
+    env[name] = value;
+}
+
+const result = spawnSync(command, args, { stdio: 'inherit', env });
+
+if (result.error) {
+    fail(`Failed to run \`${command}\`: ${result.error.message}`);
+}
+
+// Preserve the child's exit code so the step fails exactly when the command does. A child killed
+// by a signal reports a null status, which would otherwise be read as success.
+process.exit(result.status ?? 1);