apify-test-tools 0.10.2-beta.2 → 0.10.2-beta.21

package/.gitattributes

@@ -1,2 +1,3 @@
 # Generated by `npm run bundle`: collapsed in GitHub diffs and shown as binary by git diff.
 .github/cli/apify-test-tools.mjs linguist-generated=true -diff
+.github/scripts/run-with-apify-tokens.mjs linguist-generated=true -diff

package/.github/actionlint.yaml

@@ -10,3 +10,14 @@ paths:
         ignore:
             - 'input "display_report" is not defined in action "anthropics/claude-code-action@v1"'
             - 'property "conclusion" is not defined in object type'
+
+    # actionlint (v1.7.11, and v1.7.12 too) predates two newer GitHub features these workflows rely on:
+    # - `uses: $/path`, the self-repository syntax: this repo at the commit the workflow runs at.
+    #   actionlint only knows `./path`, `docker://` and `owner/repo@ref`, so it reports the ref as missing.
+    #   https://github.blog/changelog/2026-07-30-reference-same-repository-actions-with-self-repository-syntax/
+    # - `job.workflow_repository` and `job.workflow_sha`, the reusable workflow's own repo and commit.
+    #   https://docs.github.com/en/actions/reference/workflows-and-actions/contexts#job-context
+    .github/workflows/public_*.yaml:
+        ignore:
+            - 'specifying action "\$/[^"]*" in invalid format because ref is missing'
+            - 'property "workflow_(repository|sha)" is not defined in object type'

package/.github/actions/checkout-restore-dependencies/action.yaml

@@ -8,6 +8,11 @@ inputs:
             generated .npmrc references), and only on the dependency install steps, so it
             never reaches the build or test steps. Use a read-only token.
         required: false
+    config-secrets:
+        description: >-
+            The CONFIG_SECRETS workflow secret, if the caller passed one. Every value inside it is
+            registered as a mask, see .github/scripts/mask-config-secrets.sh.
+        required: false
 
 outputs:
     scripts-path:
@@ -18,12 +23,19 @@ outputs:
         value: ${{ steps.scripts-path.outputs.path }}
 
 # Sets common steps and ensure we use cached node_modules
-# To test a change here, repoint the `uses:` refs in the reusable workflows at your branch, and
-# change them back before merging. Consumers track the `workflows-v0` tag, which moves on every
-# push to master.
+# The reusable workflows load this with `uses: $/...`, which resolves to the same commit as the
+# workflow itself, so testing a change here only needs the caller pointed at your branch.
 runs:
     using: 'composite'
     steps:
+        # Runs before anything can use a packed secret, see the script for why.
+        - name: Mask config secrets
+          if: inputs.config-secrets != ''
+          shell: bash
+          env:
+              CONFIG_SECRETS: ${{ inputs.config-secrets }}
+          run: bash "${{ github.action_path }}/../../scripts/mask-config-secrets.sh"
+
         - name: Checkout Repository
           uses: actions/checkout@v5
           with:
@@ -49,7 +61,24 @@ runs:
           shell: bash
           run: echo "path=$(cd "${{ github.action_path }}/../../scripts" && pwd)" >> "$GITHUB_OUTPUT"
 
+        # A repo is on pnpm when it has a pnpm-lock.yaml and no package-lock.json.
+        - name: Detect package manager
+          id: package-manager
+          shell: bash
+          run: |
+              if [ -f pnpm-lock.yaml ] && [ ! -f package-lock.json ]; then
+                  echo "name=pnpm" >> "$GITHUB_OUTPUT"
+              else
+                  echo "name=npm" >> "$GITHUB_OUTPUT"
+              fi
+
+        # Takes the pnpm version from the `packageManager` field of the repo's package.json.
+        - name: Install pnpm
+          if: steps.package-manager.outputs.name == 'pnpm'
+          uses: pnpm/action-setup@v6
+
         - name: Cache dependencies npm
+          if: steps.package-manager.outputs.name == 'npm'
           id: check-dependencies-cache
           uses: actions/cache@v5
           with:
@@ -57,16 +86,39 @@ runs:
               key: modules-npm-${{ hashFiles('package-lock.json') }}
 
         - name: install npm dependencies
-          if: steps.check-dependencies-cache.outputs.cache-hit != 'true'
+          if: steps.package-manager.outputs.name == 'npm' && steps.check-dependencies-cache.outputs.cache-hit != 'true'
           shell: bash
           env:
               NPM_TOKEN: ${{ inputs.npm-token }}
               NODE_AUTH_TOKEN: ${{ inputs.npm-token }}
           run: npm ci
 
+        # Caching node_modules would miss each workspace package's own node_modules, so we cache the
+        # store and always install; with a warm store that only links files.
+        - name: Resolve pnpm store path
+          if: steps.package-manager.outputs.name == 'pnpm'
+          id: pnpm-store
+          shell: bash
+          run: echo "path=$(pnpm store path --silent)" >> "$GITHUB_OUTPUT"
+
+        - name: Cache pnpm store
+          if: steps.package-manager.outputs.name == 'pnpm'
+          uses: actions/cache@v5
+          with:
+              path: ${{ steps.pnpm-store.outputs.path }}
+              key: pnpm-store-${{ hashFiles('pnpm-lock.yaml') }}
+
+        - name: install pnpm dependencies
+          if: steps.package-manager.outputs.name == 'pnpm'
+          shell: bash
+          env:
+              NPM_TOKEN: ${{ inputs.npm-token }}
+              NODE_AUTH_TOKEN: ${{ inputs.npm-token }}
+          run: pnpm install --frozen-lockfile
+
         # The CLI the workflows call ships with this action as one bundled file (npm run bundle), so
-        # nothing is installed for it. The repo's node_modules stays exactly what package-lock.json
-        # says, and its tests import the lib from the version they locked.
+        # nothing is installed for it. The repo's node_modules stays exactly what its lockfile says,
+        # and its tests import the lib from the version they locked.
         # Steps call `apify-test-tools` without npx: npx would pick the repo's own copy in node_modules/.bin first.
         - name: Put apify-test-tools CLI on PATH
           shell: bash