apify-test-tools 0.10.2-beta.4 → 0.10.2-beta.6

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "apify-test-tools",
-  "version": "0.10.2-beta.4",
+  "version": "0.10.2-beta.6",
   "type": "module",
   "description": "TBD",
   "repository": {

package/test/bundle/cli-bundle.test.ts

@@ -98,8 +98,6 @@ describe('CLI bundle', () => {
             'get-affected-actors',
             'report-tests',
             'build',
-            'build-for-test',
-            'release',
             'notify-release',
             'build-from-local',
             'delete-old-builds',
@@ -181,35 +179,27 @@ describe('CLI bundle', () => {
         expect(stderr).toContain('got nothing');
     });
 
-    it('build-for-test --dry-run with nothing to build needs no token', () => {
-        const { status, stdout, stderr } = runCli(
-            'build-for-test',
-            '--target-branch',
-            'main',
-            '--actors',
-            'tester/bar',
-            '--dry-run',
-        );
+    it('get-affected-actors --since HEAD reports nothing', () => {
+        const { status, stdout, stderr } = runCli('get-affected-actors', '--since', headSha);
         expect(status, stderr).toBe(0);
-        expect(JSON.parse(stdout)).toEqual({ dryRun: true, builds: [] });
-    });
-
-    it('build-for-test --dry-run fails cleanly when the Actor token is missing', () => {
-        const { status, stderr } = runCli('build-for-test', '--target-branch', 'main', '--dry-run');
-        expect(status).toBe(1);
-        expect(stderr).toContain('Env var FOO_TOKEN is not set (needed for actor "tester/foo")');
+        expect(JSON.parse(stdout)).toMatchObject({
+            commits: [],
+            functionallyChangedActors: [],
+            cosmeticallyChangedActors: [],
+        });
     });
 
-    it('release --dry-run stops when HEAD is the base commit', () => {
-        const { status, stderr } = runCli('release', '--base-commit', headSha, '--dry-run');
+    it('notify-release announces nothing, and needs no token, when there are no new commits', () => {
+        const affected = runCli('get-affected-actors', '--since', headSha).stdout;
+        const { status, stderr } = runCliWithInput(affected, 'notify-release', '--release-slack-channel', '#releases');
         expect(status, stderr).toBe(0);
-        expect(stderr).toContain(`HEAD is the base commit ${headSha}, there is nothing new to release`);
+        expect(stderr).toContain('No new commits, so there is no release to announce');
     });
 
-    it('release --dry-run with nothing to build skips Slack without a token', () => {
-        const { status, stderr } = runCli('release', '--base-commit', baseSha, '--actors', 'tester/bar', '--dry-run');
+    it('notify-release skips Slack without a channel', () => {
+        const affected = runCli('get-affected-actors', '--since', baseSha).stdout;
+        const { status, stderr } = runCliWithInput(affected, 'notify-release', '--dry-run');
         expect(status, stderr).toBe(0);
-        expect(stderr).toContain('{"dryRun":true,"builds":[]}');
         expect(stderr).toContain('Skipping slack notification');
     });
 

package/test/e2e/cli-bundle.e2e.test.ts

@@ -1,48 +1,37 @@
-import { execFileSync, spawnSync } from 'node:child_process';
+import { execFileSync } from 'node:child_process';
 import { mkdir, mkdtemp, readFile, rm, symlink, writeFile } from 'node:fs/promises';
 import os from 'node:os';
 import path from 'node:path';
 import process from 'node:process';
-import { fileURLToPath } from 'node:url';
 
 import { ApifyClient } from 'apify-client';
 import { afterAll, beforeAll, describe, expect, it } from 'vitest';
 
+import type { ActorBuild } from './helpers.js';
+import {
+    cliEnv,
+    gitEnv,
+    projectRoot,
+    runCli as runCliIn,
+    runCliWithInput as runCliWithInputIn,
+    runProcess,
+    token,
+    TOKEN_ENV_VAR,
+} from './helpers.js';
+
 // End-to-end run of the shipped CLI bundle against two dummy Actors in an isolated sandbox account:
 // dry-run plans read the real Actors, `build-from-local` really builds them, the lib runs them
 // through `testActor` on exactly those builds (the ACTOR_BUILDS handoff), `report-tests` reads the
-// result, and `delete-old-builds` cleans up. Git builds (`build`/`release` without --dry-run) are
-// not covered: the Apify builder would have to clone the fixture repo, which only exists locally.
+// result, and `delete-old-builds` cleans up. Git builds of a real repository are in
+// git-build-release.e2e.test.ts.
 //
 // Runs with `npm run test:e2e`, kept out of `npm test`. Skipped without the token, e.g. on fork PRs.
-const TOKEN_ENV_VAR = 'E2E_TEST_APIFY_TOKEN_DBYPODOIHUZABNQTR';
-const token = process.env[TOKEN_ENV_VAR];
-
 const ACTORS = ['test-tools-testing-sandbox/dummy-for-testing-1', 'test-tools-testing-sandbox/dummy-for-testing-2'];
 // Only used as the source URL in dry-run plans; nothing is cloned from it.
 const REPO_URL = 'https://github.com/apify/apify-test-tools-e2e-fixture';
 
-const projectRoot = fileURLToPath(new URL('../../', import.meta.url));
-const bundlePath = path.join(projectRoot, '.github/cli/apify-test-tools.mjs');
 const vitestPath = path.join(projectRoot, 'node_modules/vitest/vitest.mjs');
 
-// Proxy and CA settings pass through so the API is reachable behind a proxy; no other variable does.
-const networkEnv = Object.fromEntries(
-    ['HTTPS_PROXY', 'https_proxy', 'HTTP_PROXY', 'http_proxy', 'NO_PROXY', 'no_proxy', 'NODE_EXTRA_CA_CERTS']
-        .filter((name) => process.env[name] !== undefined)
-        .map((name) => [name, process.env[name]!]),
-);
-const baseEnv = { PATH: process.env.PATH ?? '', HOME: os.tmpdir() };
-// The CLI gets only the sandbox token, under the name the fixture config points at.
-const cliEnv = { ...baseEnv, ...networkEnv, [TOKEN_ENV_VAR]: token ?? '' };
-const gitEnv = {
-    ...baseEnv,
-    GIT_AUTHOR_NAME: 'Tester',
-    GIT_AUTHOR_EMAIL: 'tester@example.com',
-    GIT_COMMITTER_NAME: 'Tester',
-    GIT_COMMITTER_EMAIL: 'tester@example.com',
-};
-
 let repoDir: string;
 let baseSha: string;
 
@@ -53,30 +42,8 @@ const writeRepoFile = async (file: string, content: string) => {
     await writeFile(path.join(repoDir, file), content);
 };
 
-// Spawned processes are blocking, so vitest's own timeouts can't stop one that hangs. apify-client
-// retries an unreachable API for minutes, so a hang is killed here and fails with a clear error.
-const PROCESS_TIMEOUT_MS = 8 * 60_000;
-
-const runCliWithInput = (input: string, ...args: string[]) => {
-    const result = spawnSync(process.execPath, [bundlePath, ...args], {
-        cwd: repoDir,
-        env: cliEnv,
-        encoding: 'utf8',
-        timeout: PROCESS_TIMEOUT_MS,
-        input,
-    });
-    const error = result.error ? `\n${result.error.message}` : '';
-    return { status: result.status, stdout: result.stdout, stderr: result.stderr + error };
-};
-
-const runCli = (...args: string[]) => runCliWithInput('', ...args);
-
-interface ActorBuild {
-    buildId: string;
-    actorRawId: string;
-    buildNumber: string;
-    actorFullName: string;
-}
+const runCli = async (...args: string[]) => runCliIn(repoDir, ...args);
+const runCliWithInput = async (input: string, ...args: string[]) => runCliWithInputIn(repoDir, input, ...args);
 
 describe.runIf(token)('CLI bundle against real Actors', { timeout: 2 * 60_000 }, () => {
     let builds: ActorBuild[];
@@ -120,8 +87,8 @@ describe.runIf(token)('CLI bundle against real Actors', { timeout: 2 * 60_000 },
         if (repoDir) await rm(repoDir, { recursive: true, force: true });
     });
 
-    it('build --dry-run plans a test build of the Actors it is given', () => {
-        const { status, stdout, stderr } = runCliWithInput(
+    it('build --dry-run plans a test build of the Actors it is given', async () => {
+        const { status, stdout, stderr } = await runCliWithInput(
             JSON.stringify({ actors: [{ actorFullName: ACTORS[0] }] }),
             'build',
             '--version-number',
@@ -139,35 +106,28 @@ describe.runIf(token)('CLI bundle against real Actors', { timeout: 2 * 60_000 },
         });
     });
 
-    it('build-for-test --dry-run plans a test build of the changed Actor only', () => {
-        const { status, stdout, stderr } = runCli(
-            'build-for-test',
-            '--target-branch',
-            'main',
+    it('a release pipeline plans a build of the default version of every changed Actor', async () => {
+        const affected = await runCli('get-affected-actors', '--since', baseSha);
+        expect(affected.status, affected.stderr).toBe(0);
+        const { functionallyChangedActors, cosmeticallyChangedActors } = JSON.parse(affected.stdout);
+
+        const { status, stderr } = await runCliWithInput(
+            JSON.stringify({ actors: [...functionallyChangedActors, ...cosmeticallyChangedActors] }),
+            'build',
+            '--version-number',
+            'default',
             '--repo-url',
             REPO_URL,
             '--dry-run',
         );
         expect(status, stderr).toBe(0);
-        expect(JSON.parse(stdout)).toEqual({
-            dryRun: true,
-            builds: [
-                { actorFullName: ACTORS[0], versionNumber: '0.99', gitRepoUrl: `${REPO_URL}#feature:actors/dummy-1` },
-            ],
-        });
-    });
-
-    it('release --dry-run plans a build of the default version and tag', () => {
-        const { status, stderr } = runCli('release', '--base-commit', baseSha, '--repo-url', REPO_URL, '--dry-run');
-        expect(status, stderr).toBe(0);
         expect(stderr).toContain(
             `[DRY RUN] Would build:\n  ${ACTORS[0]} (0.0) from ${REPO_URL}#feature:actors/dummy-1`,
         );
-        expect(stderr).toContain('Skipping slack notification');
     });
 
-    it('build-from-local --dry-run plans both Actors from the working tree', () => {
-        const { status, stdout, stderr } = runCli('build-from-local', '--dry-run');
+    it('build-from-local --dry-run plans both Actors from the working tree', async () => {
+        const { status, stdout, stderr } = await runCli('build-from-local', '--dry-run');
         expect(status, stderr).toBe(0);
         expect(JSON.parse(stdout)).toMatchObject({
             dryRun: true,
@@ -175,8 +135,8 @@ describe.runIf(token)('CLI bundle against real Actors', { timeout: 2 * 60_000 },
         });
     });
 
-    it('build-from-local builds both Actors', { timeout: 10 * 60_000 }, () => {
-        const { status, stdout, stderr } = runCli('build-from-local');
+    it('build-from-local builds both Actors', { timeout: 10 * 60_000 }, async () => {
+        const { status, stdout, stderr } = await runCli('build-from-local');
         expect(status, stderr).toBe(0);
         builds = JSON.parse(stdout);
         expect(builds.map((build) => build.actorFullName)).toEqual(ACTORS);
@@ -206,20 +166,15 @@ describe('sandbox dummies', () => {${actorTests}
 `,
         );
 
-        const vitest = spawnSync(
+        const vitest = await runProcess(
             process.execPath,
             [vitestPath, 'run', 'test/platform', '--reporter=json', '--outputFile=./test-output.json'],
             {
                 cwd: repoDir,
-                encoding: 'utf8',
-                timeout: PROCESS_TIMEOUT_MS,
-                env: { ...cliEnv, TESTER_APIFY_TOKEN: token, ACTOR_BUILDS: JSON.stringify(builds) },
+                env: { ...cliEnv, TESTER_APIFY_TOKEN: token!, ACTOR_BUILDS: JSON.stringify(builds) },
             },
         );
-        expect(
-            vitest.status,
-            `${vitest.stdout}\n${vitest.stderr}${vitest.error ? `\n${vitest.error.message}` : ''}`,
-        ).toBe(0);
+        expect(vitest.status, `${vitest.stdout}\n${vitest.stderr}`).toBe(0);
 
         // Each run used the build from ACTOR_BUILDS, not the Actor's default build.
         const report = JSON.parse(await readFile(path.join(repoDir, 'test-output.json'), 'utf8'));
@@ -235,15 +190,15 @@ describe('sandbox dummies', () => {${actorTests}
         );
         expect(runBuildIds.sort()).toEqual(builds.map((build) => build.buildId).sort());
 
-        const { status, stderr } = runCli('report-tests', '--report-file', 'test-output.json', '--dry-run');
+        const { status, stderr } = await runCli('report-tests', '--report-file', 'test-output.json', '--dry-run');
         expect(status, stderr).toBe(0);
         expect(stderr).toContain(`PASSED: ${ACTORS.length}, FAILED: 0`);
         expect(stderr).toContain('https://console.apify.com/view/runs/');
     });
 
     // Last, so builds from earlier runs of this suite don't pile up in the sandbox.
-    it('delete-old-builds keeps the default builds', () => {
-        const { status, stderr } = runCli('delete-old-builds');
+    it('delete-old-builds keeps the default builds', async () => {
+        const { status, stderr } = await runCli('delete-old-builds');
         expect(status, stderr).toBe(0);
         for (const actorFullName of ACTORS) {
             expect(stderr).toContain(`[DELETE OLD BUILDS][${actorFullName}]: Skipping default build`);

package/test/e2e/git-build-release.e2e.test.ts

@@ -0,0 +1,113 @@
+import { execFileSync } from 'node:child_process';
+import { mkdtemp, rm } from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+
+import { ApifyClient } from 'apify-client';
+import { afterAll, beforeAll, describe, expect, it } from 'vitest';
+
+import type { ActorBuild } from './helpers.js';
+import { gitEnv, runCli as runCliIn, runCliWithInput as runCliWithInputIn, token } from './helpers.js';
+
+// Real git builds of a real repository: the shipped CLI bundle builds an Actor from a clone of
+// apify-store/testing-repo-for-github-actions, and the Apify builder clones the same repository
+// (over SSH, with the sandbox org's deploy key installed on it).
+//
+// The repo's `e2e/base` and `e2e/feature` branches are fixtures and never change: `e2e/feature`
+// adds one commit touching only dummy-for-testing-1. Like the reusable workflows, the commands run
+// with `e2e/feature` checked out and compare it with `origin/e2e/base`. The release pipeline rebuilds
+// dummy-for-testing-1 under `latest` on every run, which is fine for a sandbox Actor nobody else uses.
+//
+// Runs with `npm run test:e2e`, kept out of `npm test`. Skipped without the token, e.g. on fork PRs.
+const FIXTURE_REPO = 'https://github.com/apify-store/testing-repo-for-github-actions';
+const BASE_BRANCH = 'e2e/base';
+const FEATURE_BRANCH = 'e2e/feature';
+const CHANGED_ACTOR = 'test-tools-testing-sandbox/dummy-for-testing-1';
+const CHANGED_ACTOR_FOLDER = 'actors/dummy-for-testing-1';
+// The CLI builds from the SSH form of the origin URL, which is what lets a deploy key work.
+const BUILD_SOURCE = `git@github.com:apify-store/testing-repo-for-github-actions#${FEATURE_BRANCH}:${CHANGED_ACTOR_FOLDER}`;
+
+let repoDir: string;
+
+const git = (...args: string[]) => execFileSync('git', args, { cwd: repoDir, env: gitEnv, encoding: 'utf8' }).trim();
+const runCli = async (...args: string[]) => runCliIn(repoDir, ...args);
+const runCliWithInput = async (input: string, ...args: string[]) => runCliWithInputIn(repoDir, input, ...args);
+
+const getAffectedActors = async () => {
+    const { status, stdout, stderr } = await runCli('get-affected-actors', '--base', `origin/${BASE_BRANCH}`);
+    expect(status, stderr).toBe(0);
+    return JSON.parse(stdout);
+};
+
+describe.runIf(token)('CLI bundle building a real repository', { timeout: 2 * 60_000 }, () => {
+    const client = new ApifyClient({ token });
+
+    const versionSource = async (versionNumber: string) => {
+        const actor = await client.actor(CHANGED_ACTOR).get();
+        const version = actor?.versions.find(({ versionNumber: number }) => number === versionNumber);
+        return version && 'gitRepoUrl' in version ? version.gitRepoUrl : undefined;
+    };
+
+    // A full clone checked out on the feature branch, like actions/checkout with fetch-depth: 0.
+    beforeAll(async () => {
+        repoDir = await mkdtemp(path.join(os.tmpdir(), 'apify-cli-e2e-git-'));
+        execFileSync('git', ['clone', '-q', FIXTURE_REPO, repoDir], { env: gitEnv });
+        git('checkout', '-q', '-b', FEATURE_BRANCH, `origin/${FEATURE_BRANCH}`);
+    }, 5 * 60_000);
+
+    afterAll(async () => {
+        if (repoDir) await rm(repoDir, { recursive: true, force: true });
+    });
+
+    it('get-affected-actors finds only the Actor the feature branch changed', async () => {
+        expect(await getAffectedActors()).toMatchObject({
+            functionallyChangedActors: [{ actorFullName: CHANGED_ACTOR }],
+            cosmeticallyChangedActors: [],
+        });
+    });
+
+    it('build builds the changed Actor from the feature branch', { timeout: 10 * 60_000 }, async () => {
+        // What the PR workflow does: the functionally changed Actors, piped into a test build
+        const { functionallyChangedActors } = await getAffectedActors();
+        const { status, stdout, stderr } = await runCliWithInput(
+            JSON.stringify({ actors: functionallyChangedActors }),
+            'build',
+            '--version-number',
+            '0.99',
+        );
+        expect(status, stderr).toBe(0);
+        const builds: ActorBuild[] = JSON.parse(stdout);
+        expect(builds).toMatchObject([
+            { actorFullName: CHANGED_ACTOR, buildNumber: expect.stringMatching(/^0\.99\.\d+$/) },
+        ]);
+
+        // The version builds the checked-out branch, as it is on the remote.
+        expect(await versionSource('0.99')).toBe(BUILD_SOURCE);
+        expect((await client.build(builds[0].buildId).get())?.status).toBe('SUCCEEDED');
+    });
+
+    it('the release pipeline rebuilds the default version of the changed Actor', { timeout: 10 * 60_000 }, async () => {
+        // What the release workflow does: every Actor changed since the last release, built into its default version
+        const baseSha = git('rev-parse', `origin/${BASE_BRANCH}`);
+        const affected = await runCli('get-affected-actors', '--since', baseSha);
+        expect(affected.status, affected.stderr).toBe(0);
+        const { functionallyChangedActors, cosmeticallyChangedActors } = JSON.parse(affected.stdout);
+
+        const { status, stderr } = await runCliWithInput(
+            JSON.stringify({ actors: [...functionallyChangedActors, ...cosmeticallyChangedActors] }),
+            'build',
+            '--version-number',
+            'default',
+        );
+        expect(status, stderr).toBe(0);
+        expect(stderr).toMatch(new RegExp(`\\[${CHANGED_ACTOR}\\]: 0\\.0\\.\\d+`));
+
+        // Releasing builds the default version from the branch being released.
+        expect(await versionSource('0.0')).toBe(BUILD_SOURCE);
+
+        // Without a channel the announcement is skipped, so it needs no Slack token
+        const notify = await runCliWithInput(affected.stdout, 'notify-release');
+        expect(notify.status, notify.stderr).toBe(0);
+        expect(notify.stderr).toContain('Skipping slack notification');
+    });
+});

package/test/e2e/helpers.ts

@@ -0,0 +1,82 @@
+import { execFile, type ExecFileException } from 'node:child_process';
+import os from 'node:os';
+import path from 'node:path';
+import process from 'node:process';
+import { fileURLToPath } from 'node:url';
+import { promisify } from 'node:util';
+
+// Shared by the e2e suites. They run the shipped CLI bundle against Actors in the isolated
+// `test-tools-testing-sandbox` org, whose token can reach nothing else.
+export const TOKEN_ENV_VAR = 'E2E_TEST_APIFY_TOKEN_DBYPODOIHUZABNQTR';
+export const token = process.env[TOKEN_ENV_VAR];
+
+export const projectRoot = fileURLToPath(new URL('../../', import.meta.url));
+export const bundlePath = path.join(projectRoot, '.github/cli/apify-test-tools.mjs');
+
+// Proxy and CA settings pass through so the API is reachable behind a proxy; no other variable does.
+const networkEnv = Object.fromEntries(
+    ['HTTPS_PROXY', 'https_proxy', 'HTTP_PROXY', 'http_proxy', 'NO_PROXY', 'no_proxy', 'NODE_EXTRA_CA_CERTS']
+        .filter((name) => process.env[name] !== undefined)
+        .map((name) => [name, process.env[name]!]),
+);
+const baseEnv = { PATH: process.env.PATH ?? '', HOME: os.tmpdir() };
+// The CLI gets only the sandbox token, under the name the fixture configs point at.
+export const cliEnv = { ...baseEnv, ...networkEnv, [TOKEN_ENV_VAR]: token ?? '' };
+export const gitEnv = {
+    ...baseEnv,
+    ...networkEnv,
+    GIT_AUTHOR_NAME: 'Tester',
+    GIT_AUTHOR_EMAIL: 'tester@example.com',
+    GIT_COMMITTER_NAME: 'Tester',
+    GIT_COMMITTER_EMAIL: 'tester@example.com',
+};
+
+// Processes are spawned asynchronously: a blocking spawn would stall the test worker for the length
+// of a build, long enough for vitest's own worker RPC to time out. The kill timeout still applies on
+// top of vitest's, since apify-client retries an unreachable API for minutes.
+export const PROCESS_TIMEOUT_MS = 8 * 60_000;
+const execFileAsync = promisify(execFile);
+
+export interface ProcessResult {
+    status: number | null;
+    stdout: string;
+    stderr: string;
+}
+
+export const runProcess = async (
+    command: string,
+    args: string[],
+    { input = '', ...options }: { cwd: string; env: Record<string, string>; input?: string },
+): Promise<ProcessResult> => {
+    try {
+        const promise = execFileAsync(command, args, {
+            ...options,
+            encoding: 'utf8',
+            timeout: PROCESS_TIMEOUT_MS,
+            maxBuffer: 100 * 1024 * 1024,
+        });
+        // Closing stdin hands a command that reads it (e.g. `build`) the input, and one that doesn't never waits
+        promise.child.stdin?.end(input);
+        const { stdout, stderr } = await promise;
+        return { status: 0, stdout, stderr };
+    } catch (error) {
+        // A non-zero exit rejects too, with the output on the error.
+        const { code, stdout = '', stderr = '', message } = error as ExecFileException;
+        // Without an exit code (killed by the timeout, or never started) the message says why.
+        return typeof code === 'number'
+            ? { status: code, stdout, stderr }
+            : { status: null, stdout, stderr: `${stderr}\n${message}` };
+    }
+};
+
+export const runCliWithInput = async (cwd: string, input: string, ...args: string[]) =>
+    runProcess(process.execPath, [bundlePath, ...args], { cwd, env: cliEnv, input });
+
+export const runCli = async (cwd: string, ...args: string[]) => runCliWithInput(cwd, '', ...args);
+
+export interface ActorBuild {
+    buildId: string;
+    actorRawId: string;
+    buildNumber: string;
+    actorFullName: string;
+}

package/test/unit/bin/affected-actors-cli.test.ts

@@ -0,0 +1,193 @@
+import { execFileSync, spawnSync } from 'node:child_process';
+import { mkdir, mkdtemp, rm, writeFile } from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import process from 'node:process';
+
+import { afterAll, afterEach, beforeAll, beforeEach, describe, expect, it } from 'vitest';
+
+import { compileCli } from './compiled-cli.js';
+
+// `get-affected-actors --base` on real git histories. Actors a and c share `src/`, b is standalone.
+// `main` is the base branch and `feature` the PR branch, checked out like in the PR workflow.
+const CONFIG = {
+    actors: [
+        {
+            folder: 'actors/a',
+            actorFullName: 'owner/actor-a',
+            tokenEnvVar: 'T',
+            overrideActorContext: ['actors/a', 'src'],
+        },
+        {
+            folder: 'actors/c',
+            actorFullName: 'owner/actor-c',
+            tokenEnvVar: 'T',
+            overrideActorContext: ['actors/c', 'src'],
+        },
+        { folder: 'actors/b', actorFullName: 'owner/actor-b', tokenEnvVar: 'T' },
+    ],
+};
+
+// Only what node and git need, so nothing from the developer's git config leaks in
+const env = { PATH: process.env.PATH ?? '', HOME: os.tmpdir() };
+const gitEnv = {
+    ...env,
+    GIT_AUTHOR_NAME: 'Tester',
+    GIT_AUTHOR_EMAIL: 'tester@example.com',
+    GIT_COMMITTER_NAME: 'Tester',
+    GIT_COMMITTER_EMAIL: 'tester@example.com',
+};
+
+let cliPath: string;
+let cleanup: (() => Promise<void>) | undefined;
+let repoDir: string;
+
+const git = (...args: string[]) => execFileSync('git', args, { cwd: repoDir, env: gitEnv, encoding: 'utf8' }).trim();
+
+const writeFiles = async (content: string, files: string[]) => {
+    for (const file of files) {
+        await mkdir(path.dirname(path.join(repoDir, file)), { recursive: true });
+        await writeFile(path.join(repoDir, file), `${content}\n`);
+    }
+};
+
+/** Commits a change to each file and returns the commit. */
+const commit = async (message: string, ...files: string[]) => {
+    await writeFiles(message, files);
+    git('add', '-A');
+    git('commit', '-q', '-m', message);
+    return git('rev-parse', 'HEAD');
+};
+
+/** Commits on `main`, then checks `feature` out again. */
+const commitOnMain = async (message: string, ...files: string[]) => {
+    git('checkout', '-q', 'main');
+    await commit(message, ...files);
+    git('checkout', '-q', 'feature');
+};
+
+const runGetAffectedActors = (...args: string[]) => {
+    const result = spawnSync(cliPath, ['get-affected-actors', ...args], { cwd: repoDir, env, encoding: 'utf8' });
+    expect(result.status, result.stderr).toBe(0);
+    return JSON.parse(result.stdout);
+};
+
+const getAffectedActors = (...args: string[]) => {
+    const document = runGetAffectedActors(...args);
+    const names = (actors: { actorFullName: string }[]) =>
+        actors.map(({ actorFullName }) => actorFullName.replace('owner/actor-', '')).sort();
+    return {
+        functional: names(document.functionallyChangedActors),
+        cosmetic: names(document.cosmeticallyChangedActors),
+    };
+};
+
+describe('get-affected-actors CLI on real git histories', () => {
+    beforeAll(async () => {
+        ({ cliPath, cleanup } = await compileCli());
+    });
+
+    afterAll(async () => {
+        await cleanup?.();
+    });
+
+    beforeEach(async () => {
+        repoDir = await mkdtemp(path.join(os.tmpdir(), 'apify-affected-actors-'));
+        git('init', '-q', '-b', 'main');
+        await writeFile(path.join(repoDir, 'apify-test-tools.config.json'), JSON.stringify(CONFIG));
+        for (const { folder } of CONFIG.actors) {
+            await mkdir(path.join(repoDir, folder, '.actor'), { recursive: true });
+            await writeFile(
+                path.join(repoDir, folder, '.actor/actor.json'),
+                JSON.stringify({ actorSpecification: 1, name: `actor-${path.basename(folder)}`, version: '0.1' }),
+            );
+        }
+        await commit('chore: init', 'src/shared.ts', 'actors/a/main.ts', 'actors/b/main.ts', 'actors/c/main.ts');
+        git('checkout', '-q', '-b', 'feature');
+    });
+
+    afterEach(async () => {
+        if (repoDir) await rm(repoDir, { recursive: true, force: true });
+    });
+
+    it("tests only what changed since the last validated commit, on the branch's own commits", async () => {
+        const validated = await commit('feat(a): validated change', 'actors/a/main.ts');
+        await commit('feat(c): new change, docs for a', 'actors/c/main.ts', 'actors/a/README.md');
+
+        // A is still the validated code, only its README changed since
+        expect(getAffectedActors('--base', 'main', '--since', validated)).toStrictEqual({
+            functional: ['c'],
+            cosmetic: ['a'],
+        });
+    });
+
+    it('tests nothing after merging cosmetic changes from base', async () => {
+        const validated = await commit('feat(a): validated change', 'actors/a/main.ts');
+        await commitOnMain('docs: readme and changelog', 'actors/a/README.md', 'CHANGELOG.md');
+        git('merge', '-q', '--no-edit', 'main');
+
+        expect(getAffectedActors('--base', 'main', '--since', validated)).toStrictEqual({
+            functional: [],
+            cosmetic: ['a'],
+        });
+    });
+
+    it("tests the Actors where base's functional change meets the branch's after a merge", async () => {
+        const validated = await commit('feat(a): validated change', 'actors/a/main.ts');
+        await commitOnMain('feat: shared change', 'src/shared.ts');
+        git('merge', '-q', '--no-edit', 'main');
+
+        // Base changed A and C. A can interact with the branch's change, C only has base's, which base validated
+        expect(getAffectedActors('--base', 'main', '--since', validated)).toStrictEqual({
+            functional: ['a'],
+            cosmetic: [],
+        });
+    });
+
+    it('leaves out Actors that only base changed', async () => {
+        await commit('feat: shared change', 'src/shared.ts');
+        await commitOnMain('feat(b): base change', 'actors/b/main.ts');
+        git('merge', '-q', '--no-edit', 'main');
+
+        expect(getAffectedActors('--base', 'main')).toStrictEqual({ functional: ['a', 'c'], cosmetic: [] });
+    });
+
+    it('counts code changed in the merge commit itself', async () => {
+        await commit('docs(a): readme', 'actors/a/README.md');
+        await commitOnMain('feat(b): base change', 'actors/b/main.ts');
+        git('merge', '-q', '--no-commit', '--no-ff', 'main');
+        await writeFiles('changed while merging', ['actors/c/main.ts']);
+        git('add', '-A');
+        git('commit', '-q', '--no-edit');
+
+        expect(getAffectedActors('--base', 'main')).toStrictEqual({ functional: ['c'], cosmetic: ['a'] });
+    });
+
+    it('tests nothing after a rebase onto base changes to other Actors', async () => {
+        const validated = await commit('feat(a): validated change', 'actors/a/main.ts');
+        await commitOnMain('feat(b): base change', 'actors/b/main.ts');
+        git('rebase', '-q', 'main');
+
+        expect(getAffectedActors('--base', 'main', '--since', validated)).toStrictEqual({
+            functional: [],
+            cosmetic: [],
+        });
+    });
+
+    it('checks the whole branch on a rerun or when --since is not in the history', async () => {
+        await commit('feat(a): validated change', 'actors/a/main.ts');
+        const head = await commit('docs(a): readme', 'actors/a/README.md');
+
+        const wholeBranch = { functional: ['a'], cosmetic: [] };
+        expect(getAffectedActors('--base', 'main', '--since', head)).toStrictEqual(wholeBranch);
+        expect(getAffectedActors('--base', 'main', '--since', 'e'.repeat(40))).toStrictEqual(wholeBranch);
+    });
+
+    it('reports nothing for an empty range', async () => {
+        const nothing = { commits: [], changedFiles: [], functionallyChangedActors: [], cosmeticallyChangedActors: [] };
+        // The branch has no commits of its own yet
+        expect(runGetAffectedActors('--base', 'main')).toMatchObject(nothing);
+        // A release with nothing new since the last one
+        expect(runGetAffectedActors('--since', git('rev-parse', 'HEAD'))).toMatchObject(nothing);
+    });
+});