test.yml

name: Test

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]
  merge_group:
  workflow_dispatch:
    inputs:
      pr_version:
        description: "pkg.pr.new PR number or commit SHA to test an unreleased Vite+ build (e.g. 1569). Leave empty to test the latest published release."
        required: false
        default: ""

# Push / PR / merge_group runs always test the latest published Vite+. A manual
# workflow_dispatch can set pr_version to a PR number or commit SHA; the install
# script picks it up via VP_PR_VERSION, which overrides VP_VERSION and pulls the
# matching build from pkg.pr.new — so a new Vite+ release can be verified across
# the whole matrix before it ships. The value is empty on every other event,
# which the install script treats as "unset" and falls back to the latest release.
env:
  VP_PR_VERSION: ${{ github.event.inputs.pr_version }}

jobs:
  test:
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest, macos-latest, windows-latest]
    runs-on: ${{ matrix.os }}
    steps:
      - uses: taiki-e/checkout-action@7d1e50e93dc4fb3bba58f85018fadf77898aee8b # v1.4.2

      - name: Setup Vite+
        uses: ./
        with:
          run-install: false
          cache: false

      - name: Verify installation
        run: vp --version

  test-node-version:
    strategy:
      fail-fast: false
      matrix:
        node-version: ["lts", "22", "24"]
    runs-on: ubuntu-latest
    steps:
      - uses: taiki-e/checkout-action@7d1e50e93dc4fb3bba58f85018fadf77898aee8b # v1.4.2

      - name: Setup Vite+ with Node.js ${{ matrix.node-version }}
        uses: ./
        with:
          node-version: ${{ matrix.node-version }}
          run-install: false
          cache: false

      - name: Verify installation
        run: vp --version

      - name: Verify Node.js version
        shell: bash
        run: |
          ACTUAL=$(node --version)
          echo "Node.js version: $ACTUAL"
          if [ "${{ matrix.node-version }}" != "lts" ]; then
            echo "$ACTUAL" | grep -q "^v${{ matrix.node-version }}\." || (echo "Expected Node.js v${{ matrix.node-version }}.x but got $ACTUAL" && exit 1)
          fi

  test-cache-pnpm:
    runs-on: ubuntu-latest
    steps:
      - uses: taiki-e/checkout-action@7d1e50e93dc4fb3bba58f85018fadf77898aee8b # v1.4.2

      - name: Create test project with pnpm-lock.yaml
        run: |
          mkdir -p test-project
          cd test-project
          echo '{"name":"test-project","private":true}' > package.json
          touch pnpm-lock.yaml

      - name: Setup Vite+ with pnpm cache
        uses: ./
        id: setup
        with:
          run-install: false
          cache: true
          cache-dependency-path: test-project/pnpm-lock.yaml

      - name: Verify installation
        run: |
          vp --version
          echo "Installed version: ${{ steps.setup.outputs.version }}"
          echo "Cache hit: ${{ steps.setup.outputs.cache-hit }}"

  test-cache-npm:
    runs-on: ubuntu-latest
    steps:
      - uses: taiki-e/checkout-action@7d1e50e93dc4fb3bba58f85018fadf77898aee8b # v1.4.2

      - name: Create test project with package-lock.json
        run: |
          mkdir -p test-project
          cd test-project
          echo '{"name":"test-project","private":true}' > package.json
          echo '{"name":"test-project","lockfileVersion":3}' > package-lock.json

      - name: Setup Vite+ with npm cache
        uses: ./
        id: setup
        with:
          run-install: false
          cache: true
          cache-dependency-path: test-project/package-lock.json

      - name: Verify installation
        run: |
          vp --version
          echo "Installed version: ${{ steps.setup.outputs.version }}"
          echo "Cache hit: ${{ steps.setup.outputs.cache-hit }}"

  test-cache-yarn:
    runs-on: ubuntu-latest
    steps:
      - uses: taiki-e/checkout-action@7d1e50e93dc4fb3bba58f85018fadf77898aee8b # v1.4.2

      - name: Create test project with yarn.lock
        run: |
          mkdir -p test-project
          cd test-project
          echo '{"name":"test-project","private":true}' > package.json
          touch yarn.lock

      - name: Setup Vite+ with yarn cache
        uses: ./
        id: setup
        with:
          run-install: false
          cache: true
          cache-dependency-path: test-project/yarn.lock

      - name: Verify installation
        run: |
          vp --version
          echo "Installed version: ${{ steps.setup.outputs.version }}"
          echo "Cache hit: ${{ steps.setup.outputs.cache-hit }}"

  test-cache-bun:
    strategy:
      fail-fast: false
      matrix:
        lockfile: [bun.lock, bun.lockb]
    runs-on: ubuntu-latest
    steps:
      - uses: taiki-e/checkout-action@7d1e50e93dc4fb3bba58f85018fadf77898aee8b # v1.4.2

      - name: Create test project with ${{ matrix.lockfile }}
        run: |
          mkdir -p test-project
          cd test-project
          echo '{"name":"test-project","private":true}' > package.json
          touch ${{ matrix.lockfile }}

      - name: Setup Vite+ with bun cache (${{ matrix.lockfile }})
        uses: ./
        id: setup
        with:
          run-install: false
          cache: true
          cache-dependency-path: test-project/${{ matrix.lockfile }}

      - name: Verify installation
        run: |
          vp --version
          echo "Installed version: ${{ steps.setup.outputs.version }}"
          echo "Cache hit: ${{ steps.setup.outputs.cache-hit }}"

  test-vp-exec:
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest, macos-latest, windows-latest]
    runs-on: ${{ matrix.os }}
    steps:
      - uses: taiki-e/checkout-action@7d1e50e93dc4fb3bba58f85018fadf77898aee8b # v1.4.2

      - name: Setup Vite+
        uses: ./
        with:
          run-install: false
          cache: false

      - name: Verify vp exec works
        run: vp exec node -e "console.log('vp exec works')"

  test-vp-install-and-exec:
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest, macos-latest, windows-latest]
    runs-on: ${{ matrix.os }}
    steps:
      - uses: taiki-e/checkout-action@7d1e50e93dc4fb3bba58f85018fadf77898aee8b # v1.4.2

      - name: Create test project
        shell: bash
        run: |
          mkdir -p test-project
          cd test-project
          echo '{"name":"test-project","private":true,"scripts":{"hello":"node -e \"console.log(1+1)\""}}' > package.json

      - name: Setup Vite+ with install
        uses: ./
        with:
          run-install: |
            - cwd: test-project
          cache: false

      - name: Verify vp exec in project
        working-directory: test-project
        run: vp exec node -e "console.log('vp exec in project works')"

      - name: Verify vp run in project
        working-directory: test-project
        run: vp run hello

  test-registry-url:
    runs-on: ubuntu-latest
    steps:
      - uses: taiki-e/checkout-action@7d1e50e93dc4fb3bba58f85018fadf77898aee8b # v1.4.2

      - name: Setup Vite+ with registry-url
        uses: ./
        with:
          run-install: false
          cache: false
          registry-url: "https://npm.pkg.github.com"
          scope: "@voidzero-dev"

      - name: Verify .npmrc was created
        run: |
          echo "NPM_CONFIG_USERCONFIG=$NPM_CONFIG_USERCONFIG"
          cat "$NPM_CONFIG_USERCONFIG"
          grep -q "@voidzero-dev:registry=https://npm.pkg.github.com/" "$NPM_CONFIG_USERCONFIG"
          grep -q "_authToken=\${NODE_AUTH_TOKEN}" "$NPM_CONFIG_USERCONFIG"

      - name: Verify NODE_AUTH_TOKEN is exported
        run: |
          echo "NODE_AUTH_TOKEN is set: ${NODE_AUTH_TOKEN:+yes}"

  test-alpine-container:
    runs-on: ubuntu-latest
    container:
      image: alpine:3.23
    steps:
      - name: Install Alpine dependencies
        run: apk add --no-cache bash curl gcompat libstdc++

      - uses: taiki-e/checkout-action@7d1e50e93dc4fb3bba58f85018fadf77898aee8b # v1.4.2

      - name: Setup Vite+
        uses: ./
        with:
          run-install: false
          cache: false

      - name: Verify installation
        run: vp --version

      - name: Verify vp exec works
        run: vp exec node -e "console.log('vp exec works in Alpine')"

  test-sfw:
    # sfw wraps vp install end-to-end on all OSes (macOS / Windows supported
    # since vite-plus v0.1.23). On Linux we verify across every package
    # manager vp auto-detects via lockfile (pnpm/npm/yarn/bun); macOS / Windows
    # run pnpm only because the PM choice doesn't change the sfw wrap path —
    # those cells exist to prove the cross-platform sfw download + wrap works.
    # vp version follows the workflow default (`latest`, or the pr_version
    # pkg.pr.new build on manual dispatch via VP_PR_VERSION) — sfw is decoupled
    # from vp's release channel, so it just rides whatever vp the rest of the
    # matrix is testing.
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest, macos-latest, windows-latest]
        package-manager: [pnpm, npm, yarn, bun]
        exclude:
          # Non-Linux runs pnpm only — PM diversity adds no sfw-wrap coverage.
          - { os: macos-latest, package-manager: npm }
          - { os: macos-latest, package-manager: yarn }
          - { os: macos-latest, package-manager: bun }
          - { os: windows-latest, package-manager: npm }
          - { os: windows-latest, package-manager: yarn }
          - { os: windows-latest, package-manager: bun }
    runs-on: ${{ matrix.os }}
    steps:
      - uses: taiki-e/checkout-action@7d1e50e93dc4fb3bba58f85018fadf77898aee8b # v1.4.2

      - name: Create test project for ${{ matrix.package-manager }}
        shell: bash
        run: |
          case "${{ matrix.package-manager }}" in
            pnpm) LOCKFILE=pnpm-lock.yaml; CONTENTS='' ;;
            npm)  LOCKFILE=package-lock.json; CONTENTS='{"name":"test-project","lockfileVersion":3}' ;;
            yarn) LOCKFILE=yarn.lock; CONTENTS='' ;;
            bun)  LOCKFILE=bun.lock; CONTENTS='' ;;
            *)    echo "Unsupported package-manager: ${{ matrix.package-manager }}" >&2; exit 1 ;;
          esac
          mkdir -p test-project
          cd test-project
          echo '{"name":"test-project","private":true,"dependencies":{"is-odd":"^3.0.1"}}' > package.json
          printf '%s' "$CONTENTS" > "$LOCKFILE"

      - name: Configure Yarn .yarnrc.yml (Linux + yarn only)
        if: matrix.package-manager == 'yarn' && runner.os == 'Linux'
        # nodeLinker=node-modules: Yarn Berry defaults to Plug'n'Play, which
        #   makes plain `require()` from a non-yarn-wrapped node process fail.
        # enableImmutableInstalls=false: Yarn Berry auto-enables immutable
        #   installs under CI, which makes the bootstrap from an empty
        #   yarn.lock fail with YN0028. Setting it here (instead of via the
        #   YARN_ENABLE_IMMUTABLE_INSTALLS env var) survives any future
        #   env-sanitization vp might apply to spawned subprocesses.
        shell: bash
        run: |
          {
            echo "nodeLinker: node-modules"
            echo "enableImmutableInstalls: false"
          } > test-project/.yarnrc.yml

      - name: Setup Vite+ with sfw + ${{ matrix.package-manager }}
        uses: ./
        with:
          sfw: true
          run-install: |
            - cwd: test-project
          cache: false

      - name: Verify sfw is on PATH
        run: sfw --version

      - name: Verify dependency installed via ${{ matrix.package-manager }}
        working-directory: test-project
        run: vp exec node -e "console.log(require('is-odd')(3))"

  test-sfw-alpine:
    # vp version follows the workflow default (`latest`, or a pr_version
    # pkg.pr.new build on manual dispatch) — sfw's musl asset selection is
    # decoupled from vp's release channel.
    # NOTE: if this job is later re-matrixed (multiple vp builds, multiple
    # alpine versions, etc.), restore `strategy: { fail-fast: false }` so a
    # flake in one shard doesn't cancel the others.
    runs-on: ubuntu-latest
    container:
      image: alpine:3.23
    steps:
      - name: Install Alpine dependencies
        run: apk add --no-cache bash curl gcompat libstdc++

      - uses: taiki-e/checkout-action@7d1e50e93dc4fb3bba58f85018fadf77898aee8b # v1.4.2

      - name: Create test project with a real dependency
        run: |
          mkdir -p test-project
          cd test-project
          echo '{"name":"test-project","private":true,"dependencies":{"is-odd":"^3.0.1"}}' > package.json

      - name: Setup Vite+ with sfw (musl)
        uses: ./
        with:
          sfw: true
          run-install: |
            - cwd: test-project
          cache: false

      - name: Verify sfw is on PATH (musl)
        run: sfw --version

      - name: Verify dependency installed under sfw (musl)
        working-directory: test-project
        run: vp exec node -e "console.log(require('is-odd')(3))"

  test-sfw-blocks-malicious:
    # Verifies sfw actually intercepts a known-malicious package, not just
    # that it wraps the install. Uses `lodahs` (lodash typosquat), the same
    # canary SocketDev's own workflows use:
    # https://github.com/SocketDev/bun-security-scanner/blob/main/.github/workflows/test.yml
    # If this job ever stops blocking, either sfw is misconfigured or the
    # canary itself has been delisted — swap it for another Socket-flagged
    # package from https://socket.dev/blog/category/threat-research.
    # vp version follows the workflow default (`latest`, or a pr_version
    # pkg.pr.new build on manual dispatch) — sfw block behavior is decoupled
    # from vp's release channel.
    # Runs on all three OSes: a fail-open regression in vp/sfw's proxy or CA
    # handling can be platform-specific (the #73 rustls cert-trust class of
    # bug was), so each OS needs its own block assertion — benign-install
    # success (the test-sfw job) is not enough proof.
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest, macos-latest, windows-latest]
    runs-on: ${{ matrix.os }}
    steps:
      - uses: taiki-e/checkout-action@7d1e50e93dc4fb3bba58f85018fadf77898aee8b # v1.4.2

      - name: Create test project with a benign dependency
        shell: bash
        run: |
          mkdir -p test-project
          cd test-project
          echo '{"name":"test-project","private":true,"dependencies":{"is-odd":"^3.0.1"}}' > package.json

      - name: Setup Vite+ with sfw and install benign dep
        uses: ./
        with:
          sfw: true
          run-install: |
            - cwd: test-project
          cache: false

      - name: Assert sfw blocks malicious package (lodahs typosquat of lodash)
        shell: bash
        working-directory: test-project
        # Exit code alone isn't sufficient: a non-zero exit from npm 404,
        # network blip, or vp crash would also produce a false positive. We
        # also require the literal sfw block-line for lodahs in the combined
        # output so an unrelated failure doesn't get reported as "sfw blocked
        # it". The block-line format observed in CI is:
        #   " - blocked npm package: name: lodahs; version: ...; reason: ..."
        # The banner "Protected by Socket Firewall" and the "=== Socket
        # Firewall ===" header are emitted on EVERY sfw invocation, so neither
        # of those is a usable marker — use the unique "blocked npm package:
        # name: lodahs" line instead.
        run: |
          set +e
          OUTPUT=$(sfw vp install lodahs 2>&1)
          CODE=$?
          set -e
          printf '%s\n' "$OUTPUT"
          if [ "$CODE" -eq 0 ]; then
            echo "::error::sfw failed to block lodahs on ${{ matrix.os }} — install exited 0"
            exit 1
          fi
          if ! printf '%s' "$OUTPUT" | grep -qF -- "blocked npm package: name: lodahs"; then
            echo "::error::sfw vp install exited $CODE on ${{ matrix.os }} but the lodahs block-line was not in the output — likely failed for a non-sfw reason (canary delisted, network blip, vp crash, or sfw output format changed). Swap the canary if Socket has delisted lodahs, or update the marker grep if sfw's block-line format changed."
            exit 1
          fi
          echo "OK: sfw blocked lodahs on ${{ matrix.os }} (exit $CODE, block-line found)"

  test-sfw-with-socketdev-action:
    # Exercises the composition path: install sfw via the upstream
    # `socketdev/action@<sha>` step first, then call setup-vp with `sfw:
    # true`. setup-vp should DETECT the pre-installed sfw on PATH (via
    # findSfwOnPath()) and SKIP its bundled download. We assert that by
    # checking $RUNNER_TEMP/sfw-bin/sfw[.exe] — the exact path
    # installSfw() would have created — was NOT created. We also assert the
    # composed sfw actually BLOCKS a malicious package (lodahs), so this path
    # is proven to enforce, not just to be wired up.
    # See README "Advanced: stricter supply chain via socketdev/action".
    runs-on: ubuntu-latest
    steps:
      - uses: taiki-e/checkout-action@7d1e50e93dc4fb3bba58f85018fadf77898aee8b # v1.4.2

      - name: Create test project with a real dependency
        shell: bash
        run: |
          mkdir -p test-project
          cd test-project
          echo '{"name":"test-project","private":true,"dependencies":{"is-odd":"^3.0.1"}}' > package.json

      - name: Install sfw via socketdev/action
        uses: socketdev/action@ba6de6cc0565af1f42295590380973573297e31f
        with:
          mode: firewall-free

      - name: Setup Vite+ with sfw (composition path)
        uses: ./
        id: setup-vp
        with:
          sfw: true
          run-install: |
            - cwd: test-project
          cache: false

      - name: Verify setup-vp used the composed sfw (no bundled download)
        shell: bash
        # Negative assertion: if setup-vp had downloaded its own sfw, it
        # would land at $RUNNER_TEMP/sfw-bin/sfw[.exe] (per
        # getSfwBinDir() in install-sfw.ts). On the composition path the
        # PATH-detection branch should fire FIRST and skip the download
        # entirely, so neither file should exist.
        run: |
          if [ -e "$RUNNER_TEMP/sfw-bin/sfw" ] || [ -e "$RUNNER_TEMP/sfw-bin/sfw.exe" ]; then
            echo "::error::setup-vp downloaded its own sfw binary even though one was pre-installed via socketdev/action. The PATH-detection branch in setupSfw() regressed."
            exit 1
          fi
          echo "OK: setup-vp used the pre-installed sfw (no bundled download at \$RUNNER_TEMP/sfw-bin/)"

      - name: Verify dependency installed under composed sfw
        working-directory: test-project
        run: vp exec node -e "console.log(require('is-odd')(3))"

      - name: Assert composed sfw blocks malicious package (lodahs)
        shell: bash
        working-directory: test-project
        # Proves the composition path actually enforces, not just that sfw is
        # present. socketdev/action exports SFW_JSON_REPORT_PATH into the env,
        # which makes sfw write its block report to JSON instead of stdout —
        # we unset it here so the block-line goes to stdout, matching the
        # marker check used by test-sfw-blocks-malicious.
        run: |
          unset SFW_JSON_REPORT_PATH
          set +e
          OUTPUT=$(sfw vp install lodahs 2>&1)
          CODE=$?
          set -e
          printf '%s\n' "$OUTPUT"
          if [ "$CODE" -eq 0 ]; then
            echo "::error::composed sfw failed to block lodahs — install exited 0"
            exit 1
          fi
          if ! printf '%s' "$OUTPUT" | grep -qF -- "blocked npm package: name: lodahs"; then
            echo "::error::composed sfw vp install exited $CODE but the lodahs block-line was not in the output (canary delisted, network blip, or sfw output format changed)."
            exit 1
          fi
          echo "OK: composed sfw blocked lodahs (exit $CODE, block-line found)"

  build:
    runs-on: ubuntu-latest
    # This job verifies the action's own artifacts (dist/ committed and up to
    # date, types, unit tests). Pin it to the latest published Vite+ even on a
    # pr_version dispatch: a pre-release bundler could shift dist/ output and
    # fail the "dist is up to date" diff for reasons unrelated to the change.
    env:
      VP_PR_VERSION: ""
    steps:
      - uses: taiki-e/checkout-action@7d1e50e93dc4fb3bba58f85018fadf77898aee8b # v1.4.2

      - name: Setup Vite+ with cache
        uses: ./
        id: setup
        with:
          cache: true
          node-version-file: .node-version

      - name: Type check
        run: vp run typecheck

      - name: Check
        run: vp run check

      - name: Unit tests
        run: vp run test

      - name: Build
        run: vp run build

      - name: Verify dist is up to date
        run: |
          git diff --exit-code dist/ || (echo "dist/ is out of date. Run 'vp run build' and commit." && exit 1)