apify-test-tools 0.10.2-beta.18 → 0.10.2-beta.19

package/dist/workflow-scripts-src/run-with-apify-tokens.js

@@ -16,11 +16,7 @@
 // The command runs without a shell, so branch names and other interpolated arguments are passed
 // through as literal argv entries.
 import { spawnSync } from 'node:child_process';
-import fs from 'node:fs';
-import path from 'node:path';
-// Resolved against the working directory, matching how apify-test-tools' own readConfigFile
-// locates it.
-const CONFIG_FILE_NAME = 'apify-test-tools.config.json';
+import { CONFIG_FILE_NAME, readBaseConfigFile } from '../bin/utils/config/load-config.js';
 function fail(message) {
     console.error(message);
     process.exit(1);
@@ -66,34 +62,14 @@ const unpackConfigSecrets = () => {
     return value;
 };
 const secrets = { ...workflowSecretsMap, ...unpackConfigSecrets() };
-const configPath = path.resolve(process.cwd(), CONFIG_FILE_NAME);
-let config;
+let actorConfigs;
 try {
-    config = JSON.parse(fs.readFileSync(configPath, 'utf8'));
+    actorConfigs = await readBaseConfigFile();
 }
 catch (error) {
-    fail(`Cannot read "${configPath}": ${error instanceof Error ? error.message : String(error)}`);
-}
-if (!isRecord(config) || !Array.isArray(config.actors)) {
-    fail(`"${configPath}" must have an "actors" array at the top level.`);
-}
-const tokenNames = [];
-const entriesWithoutToken = [];
-const actors = config.actors;
-for (const [index, actor] of actors.entries()) {
-    const tokenEnvVar = isRecord(actor) ? actor.tokenEnvVar : undefined;
-    if (typeof tokenEnvVar !== 'string' || tokenEnvVar === '') {
-        entriesWithoutToken.push((isRecord(actor) ? actor.actorFullName : undefined) ?? `entry at index ${index}`);
-        continue;
-    }
-    if (!tokenNames.includes(tokenEnvVar))
-        tokenNames.push(tokenEnvVar);
-}
-tokenNames.sort();
-if (entriesWithoutToken.length > 0) {
-    console.error(`Warning: no "tokenEnvVar" in ${CONFIG_FILE_NAME} for: ${entriesWithoutToken.join(', ')}. ` +
-        `Building those Actors will fail.`);
+    fail(error instanceof Error ? error.message : String(error));
 }
+const tokenNames = [...new Set(actorConfigs.map(({ tokenEnvVar }) => tokenEnvVar))].sort();
 // Declared but absent is a warning, not an error. A repo can carry an Actor whose token isn't
 // configured and still build fine as long as that Actor never changes, and apify-test-tools raises
 // a precise error naming the Actor at the point it actually needs the token.

package/dist/workflow-scripts-src/run-with-apify-tokens.js.map

@@ -1 +1 @@
-{"version":3,"file":"run-with-apify-tokens.js","sourceRoot":"","sources":["../../workflow-scripts-src/run-with-apify-tokens.ts"],"names":[],"mappings":";AACA,uGAAuG;AACvG,EAAE;AACF,2GAA2G;AAC3G,EAAE;AACF,iGAAiG;AACjG,6FAA6F;AAC7F,kGAAkG;AAClG,oGAAoG;AACpG,oEAAoE;AACpE,EAAE;AACF,qGAAqG;AACrG,qGAAqG;AACrG,8FAA8F;AAC9F,EAAE;AACF,gGAAgG;AAChG,mCAAmC;AAEnC,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,4FAA4F;AAC5F,cAAc;AACd,MAAM,gBAAgB,GAAG,8BAA8B,CAAC;AAExD,SAAS,IAAI,CAAC,OAAe;IACzB,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACvB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AACpB,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC5B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAChF,CAAC;AAED,MAAM,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AACjD,IAAI,CAAC,OAAO;IAAE,IAAI,CAAC,sDAAsD,CAAC,CAAC;AAE3E,MAAM,EAAE,gBAAgB,EAAE,GAAG,OAAO,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC;AACrD,IAAI,CAAC,gBAAgB,EAAE,CAAC;IACpB,IAAI,CAAC,8FAA8F,CAAC,CAAC;AACzG,CAAC;AAED,IAAI,eAAwB,CAAC;AAC7B,IAAI,CAAC;IACD,eAAe,GAAG,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;AACnD,CAAC;AAAC,OAAO,KAAK,EAAE,CAAC;IACb,IAAI,CAAC,uCAAuC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;AAC1G,CAAC;AACD,MAAM,kBAAkB,GAAG,eAAe,CAAC;AAC3C,IAAI,CAAC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,CAAC;IAChC,IAAI,CAAC,oEAAoE,CAAC,CAAC;AAC/E,CAAC;AAED,0FAA0F;AAC1F,MAAM,mBAAmB,GAAG,GAA4B,EAAE;IACtD,MAAM,MAAM,GAAG,kBAAkB,CAAC,cAAc,CAAC;IACjD,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,CAAC;IACvB,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,IAAI,CAAC,8CAA8C,CAAC,CAAC;IACrF,IAAI,KAAc,CAAC;IACnB,IAAI,CAAC;QACD,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACL,IAAI,CAAC,8CAA8C,CAAC,CAAC;IACzD,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACnB,IAAI,CAAC,kDAAkD,CAAC,CAAC;IAC7D,CAAC;IACD,OAAO,KAAK,CAAC;AACjB,CAAC,CAAC;AAEF,MAAM,OAAO,GAAG,EAAE,GAAG,kBAAkB,EAAE,GAAG,mBAAmB,EAAE,EAAE,CAAC;AAEpE,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,gBAAgB,CAAC,CAAC;AACjE,IAAI,MAAe,CAAC;AACpB,IAAI,CAAC;IACD,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC;AAC7D,CAAC;AAAC,OAAO,KAAK,EAAE,CAAC;IACb,IAAI,CAAC,gBAAgB,UAAU,MAAM,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;AACnG,CAAC;AAED,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;IACrD,IAAI,CAAC,IAAI,UAAU,iDAAiD,CAAC,CAAC;AAC1E,CAAC;AAED,MAAM,UAAU,GAAa,EAAE,CAAC;AAChC,MAAM,mBAAmB,GAAc,EAAE,CAAC;AAE1C,MAAM,MAAM,GAAc,MAAM,CAAC,MAAM,CAAC;AACxC,KAAK,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,EAAE,EAAE,CAAC;IAC5C,MAAM,WAAW,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC;IACpE,IAAI,OAAO,WAAW,KAAK,QAAQ,IAAI,WAAW,KAAK,EAAE,EAAE,CAAC;QACxD,mBAAmB,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,kBAAkB,KAAK,EAAE,CAAC,CAAC;QAC3G,SAAS;IACb,CAAC;IACD,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,WAAW,CAAC;QAAE,UAAU,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;AACxE,CAAC;AAED,UAAU,CAAC,IAAI,EAAE,CAAC;AAElB,IAAI,mBAAmB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;IACjC,OAAO,CAAC,KAAK,CACT,gCAAgC,gBAAgB,SAAS,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;QACvF,kCAAkC,CACzC,CAAC;AACN,CAAC;AAED,8FAA8F;AAC9F,mGAAmG;AACnG,6EAA6E;AAC7E,MAAM,OAAO,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,OAAO,CAAC,CAAC,CAAC;AAChE,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;IACrB,OAAO,CAAC,KAAK,CACT,YAAY,gBAAgB,aAAa,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,kCAAkC;QACzF,8FAA8F;QAC9F,sEAAsE,CAC7E,CAAC;AACN,CAAC;AAED,MAAM,OAAO,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,IAAI,OAAO,CAAC,CAAC;AAE7D,6FAA6F;AAC7F,8BAA8B;AAC9B,OAAO,CAAC,KAAK,CAAC,WAAW,OAAO,CAAC,MAAM,wBAAwB,OAAO,OAAO,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,QAAQ,EAAE,CAAC,CAAC;AAE/G,MAAM,GAAG,GAAG,EAAE,GAAG,OAAO,EAAE,CAAC;AAC3B,KAAK,MAAM,IAAI,IAAI,OAAO,EAAE,CAAC;IACzB,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5B,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,IAAI,CAAC,WAAW,IAAI,qBAAqB,CAAC,CAAC;IAC1E,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;AACtB,CAAC;AAED,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC;AAEnE,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;IACf,IAAI,CAAC,mBAAmB,OAAO,OAAO,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;AAClE,CAAC;AAED,iGAAiG;AACjG,+EAA+E;AAC/E,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC"}
+{"version":3,"file":"run-with-apify-tokens.js","sourceRoot":"","sources":["../../workflow-scripts-src/run-with-apify-tokens.ts"],"names":[],"mappings":";AACA,uGAAuG;AACvG,EAAE;AACF,2GAA2G;AAC3G,EAAE;AACF,iGAAiG;AACjG,6FAA6F;AAC7F,kGAAkG;AAClG,oGAAoG;AACpG,oEAAoE;AACpE,EAAE;AACF,qGAAqG;AACrG,qGAAqG;AACrG,8FAA8F;AAC9F,EAAE;AACF,gGAAgG;AAChG,mCAAmC;AAEnC,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAE/C,OAAO,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,MAAM,oCAAoC,CAAC;AAE1F,SAAS,IAAI,CAAC,OAAe;IACzB,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACvB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AACpB,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC5B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAChF,CAAC;AAED,MAAM,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AACjD,IAAI,CAAC,OAAO;IAAE,IAAI,CAAC,sDAAsD,CAAC,CAAC;AAE3E,MAAM,EAAE,gBAAgB,EAAE,GAAG,OAAO,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC;AACrD,IAAI,CAAC,gBAAgB,EAAE,CAAC;IACpB,IAAI,CAAC,8FAA8F,CAAC,CAAC;AACzG,CAAC;AAED,IAAI,eAAwB,CAAC;AAC7B,IAAI,CAAC;IACD,eAAe,GAAG,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;AACnD,CAAC;AAAC,OAAO,KAAK,EAAE,CAAC;IACb,IAAI,CAAC,uCAAuC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;AAC1G,CAAC;AACD,MAAM,kBAAkB,GAAG,eAAe,CAAC;AAC3C,IAAI,CAAC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,CAAC;IAChC,IAAI,CAAC,oEAAoE,CAAC,CAAC;AAC/E,CAAC;AAED,0FAA0F;AAC1F,MAAM,mBAAmB,GAAG,GAA4B,EAAE;IACtD,MAAM,MAAM,GAAG,kBAAkB,CAAC,cAAc,CAAC;IACjD,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,CAAC;IACvB,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,IAAI,CAAC,8CAA8C,CAAC,CAAC;IACrF,IAAI,KAAc,CAAC;IACnB,IAAI,CAAC;QACD,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACL,IAAI,CAAC,8CAA8C,CAAC,CAAC;IACzD,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACnB,IAAI,CAAC,kDAAkD,CAAC,CAAC;IAC7D,CAAC;IACD,OAAO,KAAK,CAAC;AACjB,CAAC,CAAC;AAEF,MAAM,OAAO,GAAG,EAAE,GAAG,kBAAkB,EAAE,GAAG,mBAAmB,EAAE,EAAE,CAAC;AAEpE,IAAI,YAA4D,CAAC;AACjE,IAAI,CAAC;IACD,YAAY,GAAG,MAAM,kBAAkB,EAAE,CAAC;AAC9C,CAAC;AAAC,OAAO,KAAK,EAAE,CAAC;IACb,IAAI,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;AACjE,CAAC;AAED,MAAM,UAAU,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;AAE3F,8FAA8F;AAC9F,mGAAmG;AACnG,6EAA6E;AAC7E,MAAM,OAAO,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,OAAO,CAAC,CAAC,CAAC;AAChE,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;IACrB,OAAO,CAAC,KAAK,CACT,YAAY,gBAAgB,aAAa,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,kCAAkC;QACzF,8FAA8F;QAC9F,sEAAsE,CAC7E,CAAC;AACN,CAAC;AAED,MAAM,OAAO,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,IAAI,OAAO,CAAC,CAAC;AAE7D,6FAA6F;AAC7F,8BAA8B;AAC9B,OAAO,CAAC,KAAK,CAAC,WAAW,OAAO,CAAC,MAAM,wBAAwB,OAAO,OAAO,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,QAAQ,EAAE,CAAC,CAAC;AAE/G,MAAM,GAAG,GAAG,EAAE,GAAG,OAAO,EAAE,CAAC;AAC3B,KAAK,MAAM,IAAI,IAAI,OAAO,EAAE,CAAC;IACzB,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5B,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,IAAI,CAAC,WAAW,IAAI,qBAAqB,CAAC,CAAC;IAC1E,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;AACtB,CAAC;AAED,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC;AAEnE,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;IACf,IAAI,CAAC,mBAAmB,OAAO,OAAO,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;AAClE,CAAC;AAED,iGAAiG;AACjG,+EAA+E;AAC/E,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC"}

package/docs/workflows.md

@@ -396,6 +396,9 @@ token is not passed on. A token the config declares but the repo hasn't set is a
 carry an Actor whose token isn't configured and still build fine as long as that Actor never changes. The build fails
 with an error naming the Actor once it actually needs the token.
 
+The wrapper validates the config with the CLI's parser. Each Actor must declare a nonempty `tokenEnvVar` or inherit
+one from its group. An empty name or a missing required `tokenEnvVar` fails during config validation.
+
 The `unitTest` job runs static checks and needs `NPM_TOKEN` only. No job runs `npm ci` or `pnpm install` with Apify
 or Slack credentials in scope, so a postinstall script in the dependency tree cannot read them.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "apify-test-tools",
-  "version": "0.10.2-beta.18",
+  "version": "0.10.2-beta.19",
   "type": "module",
   "description": "TBD",
   "repository": {

package/test/bundle/token-wrapper.test.ts

@@ -0,0 +1,110 @@
+import { spawnSync } from 'node:child_process';
+import { mkdtemp, rm, writeFile } from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import process from 'node:process';
+import { fileURLToPath } from 'node:url';
+
+import { afterAll, beforeAll, describe, expect, it } from 'vitest';
+
+const wrapperPath = fileURLToPath(new URL('../../.github/scripts/run-with-apify-tokens.mjs', import.meta.url));
+const configFileName = 'apify-test-tools.config.json';
+
+let repoDir: string;
+
+describe('token wrapper bundle', () => {
+    beforeAll(async () => {
+        repoDir = await mkdtemp(path.join(os.tmpdir(), 'apify-token-wrapper-'));
+    });
+
+    afterAll(async () => {
+        if (repoDir) await rm(repoDir, { recursive: true, force: true });
+    });
+
+    const actorSecrets = {
+        GROUP_TOKEN: 'group-value',
+        OVERRIDE_TOKEN: 'override-value',
+        OTHER: 'hidden',
+    };
+
+    const runWrapper = (workflowSecrets: Record<string, string> = actorSecrets) =>
+        spawnSync(process.execPath, [wrapperPath, process.execPath, '-e', 'console.log(JSON.stringify(process.env))'], {
+            cwd: repoDir,
+            env: {
+                PATH: process.env.PATH ?? '',
+                WORKFLOW_SECRETS: JSON.stringify(workflowSecrets),
+            },
+            encoding: 'utf8',
+        });
+
+    it.each(['inherited secrets', 'CONFIG_SECRETS'])(
+        'passes grouped tokens and actor overrides from %s without unrelated secrets',
+        async (source) => {
+            await writeFile(
+                path.join(repoDir, configFileName),
+                JSON.stringify({
+                    mode: 'grouped',
+                    groups: {
+                        example: {
+                            tokenEnvVar: 'GROUP_TOKEN',
+                            actors: [
+                                { folder: 'actors/one', actorFullName: 'example/one' },
+                                { folder: 'actors/two', actorFullName: 'example/two', tokenEnvVar: 'OVERRIDE_TOKEN' },
+                            ],
+                        },
+                    },
+                }),
+            );
+
+            const { status, stdout, stderr } = runWrapper(
+                source === 'CONFIG_SECRETS' ? { CONFIG_SECRETS: JSON.stringify(actorSecrets) } : actorSecrets,
+            );
+            expect(status, stderr).toBe(0);
+            const childEnv: Record<string, string> = JSON.parse(stdout);
+            expect(childEnv).toMatchObject({ GROUP_TOKEN: 'group-value', OVERRIDE_TOKEN: 'override-value' });
+            expect(childEnv).not.toHaveProperty('OTHER');
+            expect(childEnv).not.toHaveProperty('WORKFLOW_SECRETS');
+            expect(childEnv).not.toHaveProperty('CONFIG_SECRETS');
+            expect(stderr).toContain('Passing 2 Actor token(s)');
+        },
+    );
+
+    it('does not start the child when config validation fails', async () => {
+        await writeFile(path.join(repoDir, configFileName), JSON.stringify({ mode: 'grouped', groups: {} }));
+
+        const { status, stdout, stderr } = runWrapper();
+        expect(status).toBe(1);
+        expect(stdout).toBe('');
+        expect(stderr).toContain('At least one configuration group is required');
+        expect(stderr).not.toContain('Cannot read');
+    });
+
+    it.each(['', undefined])(
+        'rejects an empty or missing token name (%s) before starting the child',
+        async (tokenEnvVar) => {
+            await writeFile(
+                path.join(repoDir, configFileName),
+                JSON.stringify({ actors: [{ folder: 'actors/one', actorFullName: 'example/one', tokenEnvVar }] }),
+            );
+
+            const { status, stdout, stderr } = runWrapper();
+            expect(status).toBe(1);
+            expect(stdout).toBe('');
+            expect(stderr).toContain('actors[0].tokenEnvVar');
+            expect(stderr).not.toContain('Warning:');
+            expect(stderr).not.toContain('Cannot read');
+        },
+    );
+
+    it('reports a missing config file without a duplicate error prefix', async () => {
+        await rm(path.join(repoDir, configFileName), { force: true });
+
+        const { status, stdout, stderr } = runWrapper();
+        expect(status).toBe(1);
+        expect(stdout).toBe('');
+        expect(stderr).toBe(
+            `Config file "${configFileName}" not found in the current directory. ` +
+                'Please create one with the required actor entries.\n',
+        );
+    });
+});

package/test/unit/bin/utils/config/load-config.test.ts

@@ -4,7 +4,12 @@ import path from 'node:path';
 
 import { afterEach, beforeEach, describe, expect, it } from 'vitest';
 
-import { CONFIG_FILE_NAME, loadActorConfig, readConfigFile } from '../../../../../bin/utils/config/load-config.js';
+import {
+    CONFIG_FILE_NAME,
+    loadActorConfig,
+    readBaseConfigFile,
+    readConfigFile,
+} from '../../../../../bin/utils/config/load-config.js';
 import type { ResolvedActorConfig } from '../../../../../bin/utils/config/structures/base.js';
 import { ExistingDir, ExistingFile, RelativeDir, RelativeFile } from '../../../../../bin/utils/path/repo-relative.js';
 
@@ -265,3 +270,23 @@ describe('readConfigFile', () => {
         await expect(readConfigFile(emptyActorSelection)).rejects.toThrow(/at actors/);
     });
 });
+
+describe('readBaseConfigFile', () => {
+    it('returns non-file settings without checking Actor paths or reading actor.json', async () => {
+        await writeFiles({
+            [CONFIG_FILE_NAME]: validConfig([
+                {
+                    folder: 'missing-actor-dir',
+                    actorFullName: 'myteam/shopify',
+                    tokenEnvVar: 'APIFY_TOKEN',
+                    overrideActorContext: ['../outside'],
+                },
+            ]),
+        });
+
+        await expect(readBaseConfigFile()).resolves.toEqual([
+            { actorFullName: 'myteam/shopify', tokenEnvVar: 'APIFY_TOKEN' },
+        ]);
+        await expect(readConfigFile(emptyActorSelection)).rejects.toThrow();
+    });
+});

package/test/unit/bin/utils/config/parser.test.ts

@@ -4,13 +4,18 @@ import path from 'node:path';
 
 import { afterAll, beforeAll, describe, expect, it } from 'vitest';
 
-import { _privates, parseConfigFile } from '../../../../../bin/utils/config/parser.js';
-import { CONFIG_FILE_STRATEGY } from '../../../../../bin/utils/config/structures/base.js';
+import { _privates, parseConfigFile, parseResolvedConfigFile } from '../../../../../bin/utils/config/parser.js';
+import { CONFIG_FILE_STRATEGY, type ResolvedActorConfig } from '../../../../../bin/utils/config/structures/base.js';
 import { GROUPED_PARSER } from '../../../../../bin/utils/config/structures/grouped.js';
 import { LEGACY_PARSER } from '../../../../../bin/utils/config/structures/legacy.js';
 import { ExistingDir, RelativeDir } from '../../../../../bin/utils/path/repo-relative.js';
 
-const { selectStrategy, verifyConfiguration } = _privates;
+const { selectStrategy, initializePaths, verifyConfiguration: verifyInitializedConfiguration } = _privates;
+const verifyConfiguration = (body: ResolvedActorConfig[]) => {
+    const initialized = initializePaths(body);
+    verifyInitializedConfiguration(initialized);
+    return initialized;
+};
 
 let repoDir: string;
 const originalCwd = process.cwd();
@@ -95,13 +100,13 @@ describe('verifyConfiguration', () => {
         ).toThrow(/Duplicate folder/);
     });
 
-    it('quotes a duplicate folder the way it was written, not the way it normalized', () => {
+    it('reports the normalized path for a duplicate folder', () => {
         expect(() =>
             verifyConfiguration([
                 actor({ folder: '.', actorFullName: 'myteam/actor-a' }),
                 actor({ folder: './', actorFullName: 'myteam/actor-b' }),
             ]),
-        ).toThrow('Duplicate folder "./"');
+        ).toThrow('Duplicate folder "."');
     });
 
     it('rejects two entries pointing at the same actor', () => {
@@ -150,6 +155,19 @@ describe('verifyConfiguration', () => {
 });
 
 describe('parseConfigFile', () => {
+    it('shares strategy resolution with parsing that does not initialize paths', () => {
+        const body = { actors: [actor({ folder: 'missing-actor-dir', overrideActorContext: ['../outside'] })] };
+        expect(parseResolvedConfigFile(body)).toEqual([
+            {
+                actorFullName: 'myteam/shopify',
+                folder: 'missing-actor-dir',
+                tokenEnvVar: 'APIFY_TOKEN',
+                overrideActorContext: ['../outside'],
+            },
+        ]);
+        expect(() => parseConfigFile(body)).toThrow();
+    });
+
     it('validates and normalizes paths after resolving the config', () => {
         const [parsed] = parseConfigFile({ actors: [actor({ folder: './bin/', overrideActorContext: ['test/'] })] });
         expect(parsed.folder).toBeInstanceOf(ExistingDir);

package/test/unit/bin/utils/config/structures/grouped.test.ts

@@ -68,6 +68,18 @@ describe('GROUPED_PARSER', () => {
         expect(() => GROUPED_PARSER.parse({})).toThrow();
     });
 
+    it('rejects an empty group token name', () => {
+        expect(() => GROUPED_PARSER.parse({ groups: { myteam: group({ tokenEnvVar: '' }) } })).toThrow(
+            /at groups\.myteam\.tokenEnvVar/,
+        );
+    });
+
+    it('rejects an empty actor token override instead of falling back to the group token', () => {
+        expect(() =>
+            GROUPED_PARSER.parse({ groups: { myteam: group({ actors: [actor({ tokenEnvVar: '' })] }) } }),
+        ).toThrow(/at groups\.myteam\.actors\[0\]\.tokenEnvVar/);
+    });
+
     it('reports problems from every group at once instead of only the first', () => {
         const message = (() => {
             try {

package/test/unit/bin/utils/config/structures/legacy.test.ts

@@ -32,6 +32,7 @@ describe('LEGACY_PARSER', () => {
         ['folder is missing', { folder: undefined }, /at actors\[0\]\.folder/],
         ['folder is not a string', { folder: 123 }, /at actors\[0\]\.folder/],
         ['tokenEnvVar is missing', { tokenEnvVar: undefined }, /at actors\[0\]\.tokenEnvVar/],
+        ['tokenEnvVar is empty', { tokenEnvVar: '' }, /at actors\[0\]\.tokenEnvVar/],
         ['overrideActorContext is not an array', { overrideActorContext: 'packages' }, /expected array/],
         ['overrideActorContext holds non-strings', { overrideActorContext: [123] }, /overrideActorContext\[0\]/],
     ])('rejects an entry where %s', (_name, fields, expected) => {

package/test/unit/github-scripts/run-with-apify-tokens.test.ts

@@ -12,9 +12,9 @@ const SCRIPT = fileURLToPath(new URL('../../../.github/scripts/run-with-apify-to
 // Three Actors, each with its own token, so a test can leave any of them out.
 const CONFIG = {
     actors: [
-        { actorFullName: 'team/one', tokenEnvVar: 'TOKEN_ONE' },
-        { actorFullName: 'team/two', tokenEnvVar: 'TOKEN_TWO' },
-        { actorFullName: 'team/three', tokenEnvVar: 'TOKEN_THREE' },
+        { folder: 'actors/one', actorFullName: 'team/one', tokenEnvVar: 'TOKEN_ONE' },
+        { folder: 'actors/two', actorFullName: 'team/two', tokenEnvVar: 'TOKEN_TWO' },
+        { folder: 'actors/three', actorFullName: 'team/three', tokenEnvVar: 'TOKEN_THREE' },
     ],
 };
 

package/workflow-scripts-src/run-with-apify-tokens.ts

@@ -17,12 +17,8 @@
 // through as literal argv entries.
 
 import { spawnSync } from 'node:child_process';
-import fs from 'node:fs';
-import path from 'node:path';
 
-// Resolved against the working directory, matching how apify-test-tools' own readConfigFile
-// locates it.
-const CONFIG_FILE_NAME = 'apify-test-tools.config.json';
+import { CONFIG_FILE_NAME, readBaseConfigFile } from '../bin/utils/config/load-config.js';
 
 function fail(message: string): never {
     console.error(message);
@@ -71,39 +67,14 @@ const unpackConfigSecrets = (): Record<string, unknown> => {
 
 const secrets = { ...workflowSecretsMap, ...unpackConfigSecrets() };
 
-const configPath = path.resolve(process.cwd(), CONFIG_FILE_NAME);
-let config: unknown;
+let actorConfigs: Awaited<ReturnType<typeof readBaseConfigFile>>;
 try {
-    config = JSON.parse(fs.readFileSync(configPath, 'utf8'));
+    actorConfigs = await readBaseConfigFile();
 } catch (error) {
-    fail(`Cannot read "${configPath}": ${error instanceof Error ? error.message : String(error)}`);
+    fail(error instanceof Error ? error.message : String(error));
 }
 
-if (!isRecord(config) || !Array.isArray(config.actors)) {
-    fail(`"${configPath}" must have an "actors" array at the top level.`);
-}
-
-const tokenNames: string[] = [];
-const entriesWithoutToken: unknown[] = [];
-
-const actors: unknown[] = config.actors;
-for (const [index, actor] of actors.entries()) {
-    const tokenEnvVar = isRecord(actor) ? actor.tokenEnvVar : undefined;
-    if (typeof tokenEnvVar !== 'string' || tokenEnvVar === '') {
-        entriesWithoutToken.push((isRecord(actor) ? actor.actorFullName : undefined) ?? `entry at index ${index}`);
-        continue;
-    }
-    if (!tokenNames.includes(tokenEnvVar)) tokenNames.push(tokenEnvVar);
-}
-
-tokenNames.sort();
-
-if (entriesWithoutToken.length > 0) {
-    console.error(
-        `Warning: no "tokenEnvVar" in ${CONFIG_FILE_NAME} for: ${entriesWithoutToken.join(', ')}. ` +
-            `Building those Actors will fail.`,
-    );
-}
+const tokenNames = [...new Set(actorConfigs.map(({ tokenEnvVar }) => tokenEnvVar))].sort();
 
 // Declared but absent is a warning, not an error. A repo can carry an Actor whose token isn't
 // configured and still build fine as long as that Actor never changes, and apify-test-tools raises