test.yml

name: Test

on:
  push:
    branches: [main]
  pull_request:
  merge_group:
  workflow_dispatch:
    inputs:
      pr_version:
        description: "pkg.pr.new PR number or commit SHA to test an unreleased Vite+ build (e.g. 1569). Leave empty to test the latest published release."
        required: false
        default: ""

permissions:
  contents: read

# Push / PR / merge_group runs always test the latest published Vite+. A manual
# workflow_dispatch can set pr_version to a PR number or commit SHA; the install
# script picks it up via VP_PR_VERSION, which overrides VP_VERSION and pulls the
# matching build from pkg.pr.new — so a new Vite+ release can be verified across
# the whole matrix before it ships. The value is empty on every other event,
# which the install script treats as "unset" and falls back to the latest release.
env:
  VP_PR_VERSION: ${{ github.event.inputs.pr_version }}

jobs:
  zizmor:
    name: Audit GitHub Actions
    runs-on: ubuntu-latest
    timeout-minutes: 5
    steps:
      - name: Checkout repository
        uses: taiki-e/checkout-action@7d1e50e93dc4fb3bba58f85018fadf77898aee8b # v1.4.2
      - name: Run zizmor
        uses: zizmorcore/zizmor-action@85b2b9fb8e3325e7a23d7d0a9d7ba5ae0f999e3e # v0.7.1
        with:
          advanced-security: false
          annotations: true

  test:
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest, macos-latest, windows-latest]
    runs-on: ${{ matrix.os }}
    steps:
      - uses: taiki-e/checkout-action@7d1e50e93dc4fb3bba58f85018fadf77898aee8b # v1.4.2

      - name: Setup Vite+
        uses: $/.
        with:
          run-install: false
          cache: false

      - name: Verify installation
        run: vp --version

  test-reuse-installed-version:
    # Reproduces https://github.com/voidzero-dev/setup-vp/issues/145. Two setup
    # steps share an installation, as jobs on a persistent runner would.
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest, macos-latest, windows-latest]
        layout: [home, split]
        version: ["0.3.0", "0.3.3"]
        include:
          - os: ubuntu-latest
            layout: xdg
            version: "0.3.0"
          - os: ubuntu-latest
            layout: xdg
            version: "0.3.3"
    runs-on: ${{ matrix.os }}
    timeout-minutes: 10
    env:
      VP_PR_VERSION: ""
      REUSE_LAYOUT: ${{ matrix.layout }}
      REUSE_VERSION: ${{ matrix.version }}
    steps:
      - uses: taiki-e/checkout-action@7d1e50e93dc4fb3bba58f85018fadf77898aee8b # v1.4.2

      - name: Prepare project and record CLI downloads
        shell: bash
        run: |
          mkdir -p "$RUNNER_TEMP/reuse-project"
          printf '{"name":"reuse-project","private":true,"devDependencies":{"vite-plus":"%s"}}\n' "$REUSE_VERSION" > "$RUNNER_TEMP/reuse-project/package.json"
          reuse_root="$RUNNER_TEMP/setup-vp-reuse"
          # The Windows installer passes this path to cmd.exe for mklink.
          if [ "$RUNNER_OS" = "Windows" ]; then reuse_root="$(cygpath -w "$reuse_root")"; fi
          {
            case "$REUSE_LAYOUT" in
              home)
                echo "VP_HOME=$reuse_root"
                echo "SETUP_VP_REUSE_DATA=$reuse_root"
                ;;
              split)
                echo "VP_HOME="
                echo "VP_DATA_DIR=$reuse_root"
                echo "VP_BIN_DIR=$reuse_root-bin"
                echo "VP_CACHE_DIR=$reuse_root-cache"
                echo "SETUP_VP_REUSE_DATA=$reuse_root"
                ;;
              xdg)
                echo "VP_HOME="
                echo "XDG_DATA_HOME=$reuse_root-xdg"
                echo "SETUP_VP_REUSE_DATA=$reuse_root-xdg/vite-plus"
                ;;
            esac
          } >> "$GITHUB_ENV"
          bash test/record-cli-downloads.sh

      - name: Setup Vite+ for the first time
        id: first-setup
        uses: $/.
        with:
          working-directory: ${{ runner.temp }}/reuse-project
          node-version: "22.23.1"
          run-install: false
          cache: false

      - name: Check the first installation and start recording reuse
        shell: bash
        working-directory: ${{ runner.temp }}/reuse-project
        env:
          INSTALLED_VERSION: ${{ steps.first-setup.outputs.version }}
        run: |
          test "$INSTALLED_VERSION" = "$REUSE_VERSION"
          binary=vp
          if [ "$RUNNER_OS" = "Windows" ]; then binary=vp.exe; fi
          test -x "$SETUP_VP_REUSE_DATA/current/bin/$binary"
          test -f "$SETUP_VP_REUSE_DATA/$REUSE_VERSION/node_modules/vite-plus/package.json"
          test "$(node --version)" = "v22.23.1"
          # Check that the recorder sees real downloads before relying on it.
          # Windows downloads through PowerShell; file snapshots cover that path.
          if [ "$RUNNER_OS" != "Windows" ]; then test -s "$SETUP_VP_REUSE_DOWNLOADS"; fi
          echo "CLI downloads during the first setup:"
          cat "$SETUP_VP_REUSE_DOWNLOADS"
          node "$GITHUB_WORKSPACE/test/reuse-installation-snapshot.mjs" "$SETUP_VP_REUSE_DATA/current" > "$RUNNER_TEMP/reuse-before.json"
          : > "$SETUP_VP_REUSE_DOWNLOADS"

      - name: Setup the same Vite+ version again
        id: second-setup
        uses: $/.
        with:
          working-directory: ${{ runner.temp }}/reuse-project
          node-version: "22.23.1"
          run-install: false
          cache: false

      - name: Verify the second setup reuses the installation
        shell: bash
        working-directory: ${{ runner.temp }}/reuse-project
        env:
          INSTALLED_VERSION: ${{ steps.second-setup.outputs.version }}
        run: |
          test "$INSTALLED_VERSION" = "$REUSE_VERSION"
          test "$(node --version)" = "v22.23.1"
          failed=0
          if [ -s "$SETUP_VP_REUSE_DOWNLOADS" ]; then
            echo "::error::The second setup downloaded the installed Vite+ version again (issue #145)."
            cat "$SETUP_VP_REUSE_DOWNLOADS"
            failed=1
          fi
          node "$GITHUB_WORKSPACE/test/reuse-installation-snapshot.mjs" "$SETUP_VP_REUSE_DATA/current" > "$RUNNER_TEMP/reuse-after.json"
          if ! cmp -s "$RUNNER_TEMP/reuse-before.json" "$RUNNER_TEMP/reuse-after.json"; then
            echo "::error::The second setup changed the installed version tree (issue #145)."
            diff -u "$RUNNER_TEMP/reuse-before.json" "$RUNNER_TEMP/reuse-after.json" || true
            failed=1
          fi
          exit "$failed"

  test-reuse-installation-integrity:
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest, macos-latest, windows-latest]
    runs-on: ${{ matrix.os }}
    timeout-minutes: 10
    env:
      VP_PR_VERSION: ""
    steps:
      - uses: taiki-e/checkout-action@7d1e50e93dc4fb3bba58f85018fadf77898aee8b # v1.4.2

      - name: Prepare an isolated global installation and project
        run: node test/reuse-installation-integrity.mjs prepare

      - name: Install Vite+
        uses: $/.
        with:
          version: "0.3.3"
          run-install: false
          cache: false

      - name: Remove the active native binding and reproduce the CLI failure
        run: node test/reuse-installation-integrity.mjs remove-binding

      - name: Repair the incomplete installation
        uses: $/.
        with:
          version: "0.3.3"
          run-install: false
          cache: false

      - name: Check that JavaScript CLI commands work again
        run: node test/reuse-installation-integrity.mjs verify-repair

      - name: Check combined and per-manager installer overrides on an existing installation
        if: runner.os == 'Linux'
        run: node test/reuse-installation-integrity.mjs manager-overrides

  test-reuse-restored-prepare:
    runs-on: ubuntu-latest
    timeout-minutes: 10
    env:
      VP_PR_VERSION: ""
    steps:
      - uses: taiki-e/checkout-action@7d1e50e93dc4fb3bba58f85018fadf77898aee8b # v1.4.2
      - name: Select the installation directory and record downloads
        run: |
          echo "VP_HOME=$RUNNER_TEMP/setup-vp-restored" >> "$GITHUB_ENV"
          bash test/record-cli-downloads.sh
      - name: Install from the user's version-file inputs
        uses: $/.
        with:
          working-directory: test/reuse-project
          version-file: package.json
          node-version-file: package.json
          cache: false
          run-install: false
      - name: Save the complete installation
        run: |
          test -s "$SETUP_VP_REUSE_DOWNLOADS"
          test ! -e "$VP_HOME/bin/corepack"
          node test/reuse-installation-snapshot.mjs "$VP_HOME/current" > "$RUNNER_TEMP/reuse-before.json"
          # Preserve symlinks, permissions, and nanosecond timestamps across jobs.
          tar --format=posix -czf "$RUNNER_TEMP/reuse-installation.tar.gz" -C "$VP_HOME" .
      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: reuse-installation
          path: |
            ${{ runner.temp }}/reuse-installation.tar.gz
            ${{ runner.temp }}/reuse-before.json
          compression-level: 0
          retention-days: 1

  test-reuse-restored-version:
    needs: test-reuse-restored-prepare
    runs-on: ubuntu-latest
    timeout-minutes: 10
    env:
      VP_PR_VERSION: ""
    steps:
      - uses: taiki-e/checkout-action@7d1e50e93dc4fb3bba58f85018fadf77898aee8b # v1.4.2
      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
        with:
          name: reuse-installation
          path: ${{ runner.temp }}
      - name: Restore the installation on a fresh runner
        run: |
          export VP_HOME="$RUNNER_TEMP/setup-vp-restored"
          echo "VP_HOME=$VP_HOME" >> "$GITHUB_ENV"
          test ! -e "$VP_HOME"
          mkdir -p "$VP_HOME"
          tar -xzf "$RUNNER_TEMP/reuse-installation.tar.gz" -C "$VP_HOME"
          node test/reuse-installation-snapshot.mjs "$VP_HOME/current" > "$RUNNER_TEMP/reuse-restored.json"
          cmp "$RUNNER_TEMP/reuse-before.json" "$RUNNER_TEMP/reuse-restored.json"
          bash test/record-cli-downloads.sh
      - name: Reuse the restored installation
        id: setup
        uses: $/.
        with:
          working-directory: test/reuse-project
          version-file: package.json
          node-version-file: package.json
          cache: false
          run-install: false
      - name: Verify versions and zero installation work
        env:
          INSTALLED_VERSION: ${{ steps.setup.outputs.version }}
        run: |
          # Renovate bumps the fixture's catalog entry, so read the version from it.
          expected="$(awk '$1 == "vite-plus:" { gsub(/"/, "", $2); print $2 }' test/reuse-project/pnpm-workspace.yaml)"
          test -n "$expected"
          test "$INSTALLED_VERSION" = "$expected"
          test "$(node --version)" = "v22.23.1"
          cat "$SETUP_VP_REUSE_DOWNLOADS"
          test ! -s "$SETUP_VP_REUSE_DOWNLOADS"
          node test/reuse-installation-snapshot.mjs "$VP_HOME/current" > "$RUNNER_TEMP/reuse-after.json"
          diff -u "$RUNNER_TEMP/reuse-before.json" "$RUNNER_TEMP/reuse-after.json"

  test-preview-build:
    # End-to-end coverage for the commit-pinned install path: resolve the
    # newest pkg.pr.new preview build (0.0.0-commit.<sha>) from the registry
    # bridge and install it through the version input, so the install script
    # is fetched from that build's commit instead of main.
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest, macos-latest, windows-latest]
    runs-on: ${{ matrix.os }}
    # The version assertion below must see the bridge-resolved build. Pin
    # VP_PR_VERSION to "" so a manual pr_version dispatch can't override it.
    env:
      VP_PR_VERSION: ""
    steps:
      - uses: taiki-e/checkout-action@7d1e50e93dc4fb3bba58f85018fadf77898aee8b # v1.4.2

      - name: Resolve the newest preview build from the registry bridge
        id: preview
        shell: bash
        run: |
          metadata="$RUNNER_TEMP/setup-vp-preview-metadata.json"
          # Download to a file so curl can discard partial responses before retrying.
          curl -fsSL --connect-timeout 5 --max-time 15 \
            --retry 3 --retry-delay 2 --retry-max-time 60 \
            -o "$metadata" https://registry-bridge.viteplus.dev/vite-plus
          version="$(jq -r '.time | to_entries | map(select(.key | test("^0\\.0\\.0-commit\\.[0-9a-f]{40}$"))) | max_by(.value).key' "$metadata")"
          if [[ ! "$version" =~ ^0\.0\.0-commit\.[0-9a-f]{40}$ ]]; then
            echo "Unexpected preview build version from the registry bridge: ${version}" >&2
            exit 1
          fi
          echo "Resolved preview build: ${version}"
          echo "version=${version}" >> "$GITHUB_OUTPUT"

      # The self-repository reference gives the action its repository identity.
      # The preview installer uses that identity for legacy path compatibility.
      - name: Setup Vite+
        uses: $/.
        with:
          version: ${{ steps.preview.outputs.version }}
          run-install: false
          cache: false

      - name: Verify shim PATH order in a subsequent step
        run: node test/verify-vp-path.mjs

      - name: Verify installation
        shell: bash
        env:
          PREVIEW_VERSION: ${{ steps.preview.outputs.version }}
        run: |
          vp env current
          vp i -g cowsay@1.6.0
          vp env doctor
          vp --version | grep -F -- "$PREVIEW_VERSION"

  test-node-version:
    strategy:
      fail-fast: false
      matrix:
        node-version: ["lts", "20", "22", "24"]
    runs-on: ubuntu-latest
    steps:
      - uses: taiki-e/checkout-action@7d1e50e93dc4fb3bba58f85018fadf77898aee8b # v1.4.2

      # Create the throwaway fixture under $RUNNER_TEMP, outside the repo. The
      # repo commits a pnpm-workspace.yaml (for the release-age exclude), so a
      # fixture inside the repo would be treated as part of this repo's
      # workspace and `vp install`/`vp run` would resolve to the repo root.
      # ${RUNNER_TEMP//\\//} normalizes Windows backslashes for bash.
      - name: Create test project
        shell: bash
        run: |
          DIR="${RUNNER_TEMP//\\//}/test-project"
          mkdir -p "$DIR"
          # Pin pnpm to v10. Vite+'s bundled pnpm 11 requires node:sqlite
          # (Node >= 22.5) and crashes on Node 20; pnpm 10 still runs on Node 20.
          echo '{"name":"test-project","private":true,"packageManager":"pnpm@10.34.3"}' > "$DIR/package.json"

      # Runs `vp env use <version>` then `vp install` in the test project.
      - name: Setup Vite+ with Node.js ${{ matrix.node-version }}
        id: setup
        uses: $/.
        with:
          node-version: ${{ matrix.node-version }}
          run-install: |
            - cwd: ${{ runner.temp }}/test-project
          cache: false

      - name: Verify installation
        run: vp --version

      - name: Verify Node.js version
        shell: bash
        run: |
          ACTUAL=$(node --version)
          echo "Node.js version: $ACTUAL"
          if [ "${{ matrix.node-version }}" != "lts" ]; then
            echo "$ACTUAL" | grep -q "^v${{ matrix.node-version }}\." || (echo "Expected Node.js v${{ matrix.node-version }}.x but got $ACTUAL" && exit 1)
          fi

      # The outputs describe the action's project directory (this repository),
      # not the run-install cwd.
      - name: Verify Node.js and package-manager outputs
        shell: bash
        env:
          OUTPUT_NODE_VERSION: ${{ steps.setup.outputs.node-version }}
          OUTPUT_PACKAGE_MANAGER: ${{ steps.setup.outputs.package-manager }}
          OUTPUT_PACKAGE_MANAGER_VERSION: ${{ steps.setup.outputs.package-manager-version }}
        run: |
          test "v$OUTPUT_NODE_VERSION" = "$(node --version)"
          expected="$(node -p "require('./package.json').packageManager.split('+')[0]")"
          test "$OUTPUT_PACKAGE_MANAGER@$OUTPUT_PACKAGE_MANAGER_VERSION" = "$expected"

  # Reproduces https://github.com/voidzero-dev/setup-vp/issues/128: with no
  # explicit Node.js input, the managed `node` shim should use Vite+'s normal
  # project resolution and honor package.json#devEngines.runtime.
  test-auto-node-version:
    runs-on: ubuntu-latest
    steps:
      - uses: taiki-e/checkout-action@7d1e50e93dc4fb3bba58f85018fadf77898aee8b # v1.4.2

      - name: Create project with devEngines.runtime
        shell: bash
        run: |
          DIR="${RUNNER_TEMP//\\//}/test-project"
          mkdir -p "$DIR"
          echo '{"name":"test-project","private":true,"devEngines":{"runtime":{"name":"node","version":"22.18.0"}}}' > "$DIR/package.json"

      - name: Setup Vite+ without a Node.js input
        id: setup
        uses: $/.
        with:
          working-directory: ${{ runner.temp }}/test-project
          run-install: false
          cache: false

      - name: Verify project Node.js version
        working-directory: ${{ runner.temp }}/test-project
        shell: bash
        env:
          OUTPUT_NODE_VERSION: ${{ steps.setup.outputs.node-version }}
        run: |
          ACTUAL=$(node --version)
          echo "Node.js version: $ACTUAL"
          if [ "$ACTUAL" != "v22.18.0" ]; then
            echo "::error::expected Node.js v22.18.0 from devEngines.runtime, got $ACTUAL"
            exit 1
          fi
          test "$OUTPUT_NODE_VERSION" = "22.18.0"

  # End-to-end check of node-manager: false. Node.js management is disabled
  # while package-manager management keeps the installer defaults. Shims may
  # remain on PATH, so compare process.execPath to verify that both `node`
  # and `vp exec node` execute the runner's original Node.js after installation.
  test-node-manager-off:
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest, macos-latest, windows-latest]
    runs-on: ${{ matrix.os }}
    steps:
      - uses: taiki-e/checkout-action@7d1e50e93dc4fb3bba58f85018fadf77898aee8b # v1.4.2

      - name: Record preinstalled Node.js
        id: before
        shell: bash
        run: |
          echo "path=$(node -p 'process.execPath' | tr -d '\r')" >> "$GITHUB_OUTPUT"
          echo "version=$(node --version | tr -d '\r')" >> "$GITHUB_OUTPUT"

      - name: Create test project
        shell: bash
        run: |
          DIR="${RUNNER_TEMP//\\//}/test-project"
          mkdir -p "$DIR"
          echo '{"name":"test-project","private":true}' > "$DIR/package.json"

      - name: Setup Vite+ without Node.js manager
        id: setup
        uses: $/.
        with:
          node-manager: false
          run-install: |
            - cwd: ${{ runner.temp }}/test-project
          cache: false

      - name: Verify installation
        run: vp --version

      - name: Verify system Node.js is untouched
        shell: bash
        env:
          OUTPUT_NODE_VERSION: ${{ steps.setup.outputs.node-version }}
          BEFORE_NODE_PATH: ${{ steps.before.outputs.path }}
          BEFORE_NODE_VERSION: ${{ steps.before.outputs.version }}
        run: |
          ACTUAL_PATH=$(node -p 'process.execPath' | tr -d '\r')
          ACTUAL_VERSION=$(node --version | tr -d '\r')
          echo "node before: $BEFORE_NODE_PATH ($BEFORE_NODE_VERSION)"
          echo "node after:  $ACTUAL_PATH ($ACTUAL_VERSION)"
          if [ "$ACTUAL_PATH" != "$BEFORE_NODE_PATH" ]; then
            echo "::error::node resolves to $ACTUAL_PATH; expected $BEFORE_NODE_PATH"
            exit 1
          fi
          if [ "$ACTUAL_VERSION" != "$BEFORE_NODE_VERSION" ]; then
            echo "::error::node is $ACTUAL_VERSION; expected $BEFORE_NODE_VERSION"
            exit 1
          fi
          test "v$OUTPUT_NODE_VERSION" = "$BEFORE_NODE_VERSION"

      - name: Verify vp commands use the system Node.js
        shell: bash
        env:
          BEFORE_NODE_PATH: ${{ steps.before.outputs.path }}
          BEFORE_NODE_VERSION: ${{ steps.before.outputs.version }}
        run: |
          EXEC_PATH=$(vp exec node -p 'process.execPath' | tr -d '\r')
          EXEC_VERSION=$(vp exec node --version | tr -d '\r')
          echo "vp exec node -p process.execPath: $EXEC_PATH"
          echo "vp exec node --version: $EXEC_VERSION"
          if [ "$EXEC_PATH" != "$BEFORE_NODE_PATH" ]; then
            echo "::error::vp resolved Node.js at $EXEC_PATH; expected system $BEFORE_NODE_PATH"
            exit 1
          fi
          if [ "$EXEC_VERSION" != "$BEFORE_NODE_VERSION" ]; then
            echo "::error::vp resolved Node.js $EXEC_VERSION; expected system $BEFORE_NODE_VERSION"
            exit 1
          fi

  test-package-manager:
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest, macos-latest, windows-latest]
        config:
          - input: "true"
            modes: '["managed", "managed", "managed", "managed"]'
          - input: "false"
            modes: '["system_first", "system_first", "system_first", "system_first"]'
          - input: "{npm: false, pnpm: true, yarn: false}"
            modes: '["system_first", "managed", "system_first", "managed"]'
    runs-on: ${{ matrix.os }}
    steps:
      - uses: taiki-e/checkout-action@7d1e50e93dc4fb3bba58f85018fadf77898aee8b # v1.4.2

      - name: Setup Vite+ with package-manager configuration
        uses: $/.
        with:
          package-manager: ${{ matrix.config.input }}
          run-install: false
          cache: false

      # Query the real CLI so this covers input parsing, installation, and mode
      # changes, including true and omitted entries in a partial mapping.
      - name: Verify package-manager modes and independent Node.js management
        shell: bash
        env:
          EXPECTED_MODES: ${{ matrix.config.modes }}
        run: |
          node --input-type=module <<'NODE'
          import assert from 'node:assert/strict';
          import { execFileSync } from 'node:child_process';

          const managers = ['npm', 'pnpm', 'yarn', 'bun'];
          const modes = JSON.parse(process.env.EXPECTED_MODES);
          for (const [index, manager] of managers.entries()) {
            const { package_manager: current } = JSON.parse(
              execFileSync('vp', ['env', 'current', manager, '--json'], { encoding: 'utf8' }),
            );
            console.log(`${manager}: ${current.mode}`);
            assert.equal(current.mode, modes[index], `${manager} mode`);
          }
          const { node } = JSON.parse(
            execFileSync('vp', ['env', 'current', 'node', '--json'], { encoding: 'utf8' }),
          );
          assert.equal(node.mode, 'managed', 'Node.js management must remain enabled');
          NODE

  test-default-version:
    # End-to-end check of the default version-resolution logic: with no `version`
    # or `version-file` input, the action auto-detects the vite-plus version from
    # the project's package.json (direct pin or catalog), and falls back to
    # `latest` when it can't be resolved to an exact version (e.g. a semver
    # range). Pin VP_PR_VERSION to "" so a manual pr_version dispatch can't
    # override the version we assert on (a pkg.pr.new build would ignore
    # VP_VERSION entirely). Fixtures live under $RUNNER_TEMP, outside the repo,
    # so the committed pnpm-workspace.yaml doesn't influence resolution.
    env:
      VP_PR_VERSION: ""
    strategy:
      fail-fast: false
      matrix:
        include:
          # Pins an older exact version (not the current `latest`) so a match
          # proves the pin was honored rather than a coincidental latest.
          - scenario: exact
            expected: "0.2.0"
          - scenario: catalog
            expected: "0.2.0"
          # A package.json range resolves to the exact version pinned by the
          # lockfile rather than falling back to latest.
          - scenario: lockfile-pnpm
            expected: "0.2.0"
          - scenario: lockfile-npm
            expected: "0.2.0"
          # A range with no lockfile can't be resolved, so auto-detect falls back
          # to `latest` instead of failing the run.
          - scenario: fallback-range
            expected: latest
    runs-on: ubuntu-latest
    steps:
      - uses: taiki-e/checkout-action@7d1e50e93dc4fb3bba58f85018fadf77898aee8b # v1.4.2

      - name: Create ${{ matrix.scenario }} fixture
        shell: bash
        run: |
          DIR="${RUNNER_TEMP//\\//}/default-version-${{ matrix.scenario }}"
          mkdir -p "$DIR"
          case "${{ matrix.scenario }}" in
            exact)
              echo '{"name":"fixture","private":true,"devDependencies":{"vite-plus":"0.2.0"}}' > "$DIR/package.json"
              ;;
            catalog)
              echo '{"name":"fixture","private":true,"devDependencies":{"vite-plus":"catalog:"}}' > "$DIR/package.json"
              printf 'catalog:\n  vite-plus: 0.2.0\n' > "$DIR/pnpm-workspace.yaml"
              ;;
            lockfile-pnpm)
              echo '{"name":"fixture","private":true,"devDependencies":{"vite-plus":"^0.2.0"}}' > "$DIR/package.json"
              printf 'importers:\n  .:\n    devDependencies:\n      vite-plus:\n        specifier: ^0.2.0\n        version: 0.2.0\n' > "$DIR/pnpm-lock.yaml"
              ;;
            lockfile-npm)
              echo '{"name":"fixture","private":true,"devDependencies":{"vite-plus":"^0.2.0"}}' > "$DIR/package.json"
              echo '{"name":"fixture","lockfileVersion":3,"packages":{"":{"devDependencies":{"vite-plus":"^0.2.0"}},"node_modules/vite-plus":{"version":"0.2.0"}}}' > "$DIR/package-lock.json"
              ;;
            fallback-range)
              echo '{"name":"fixture","private":true,"devDependencies":{"vite-plus":"^0.2.0"}}' > "$DIR/package.json"
              ;;
          esac

      - name: Setup Vite+ (auto-detect, no version input)
        uses: $/.
        id: setup
        with:
          working-directory: ${{ runner.temp }}/default-version-${{ matrix.scenario }}
          run-install: false
          cache: false

      - name: Assert resolved version
        shell: bash
        env:
          EXPECTED: ${{ matrix.expected }}
          ACTUAL: ${{ steps.setup.outputs.version }}
        run: |
          echo "scenario=${{ matrix.scenario }} expected=$EXPECTED actual=$ACTUAL"
          if [ -z "$ACTUAL" ] || [ "$ACTUAL" = "unknown" ]; then
            echo "::error::action did not report an installed version (got '$ACTUAL')"
            exit 1
          fi
          if [ "$EXPECTED" = "latest" ]; then
            # `latest` moves, so require a concrete semver (the output is the
            # resolved global version, never the tag) rather than a literal.
            echo "$ACTUAL" | grep -Eq '^[0-9]+\.[0-9]+\.[0-9]+' || {
              echo "::error::fallback did not resolve to a semver version: '$ACTUAL'"
              exit 1
            }
          elif [ "$ACTUAL" != "$EXPECTED" ]; then
            echo "::error::expected vite-plus $EXPECTED but the action installed $ACTUAL"
            exit 1
          fi
          echo "OK: ${{ matrix.scenario }} resolved to $ACTUAL"

  test-cache-pnpm:
    strategy:
      fail-fast: false
      matrix:
        cache-save: [true, false]
    runs-on: ubuntu-latest
    steps:
      - uses: taiki-e/checkout-action@7d1e50e93dc4fb3bba58f85018fadf77898aee8b # v1.4.2

      - name: Create test project with pnpm-lock.yaml
        run: |
          mkdir -p test-project
          cd test-project
          echo '{"name":"test-project","private":true}' > package.json
          touch pnpm-lock.yaml

      - name: Setup Vite+ with pnpm cache (cache-save=${{ matrix.cache-save }})
        uses: $/.
        id: setup
        with:
          run-install: false
          cache: true
          cache-save: ${{ matrix.cache-save }}
          cache-dependency-path: test-project/pnpm-lock.yaml

      - name: Verify installation
        shell: bash
        env:
          INSTALLED_VERSION: ${{ steps.setup.outputs.version }}
          CACHE_HIT: ${{ steps.setup.outputs.cache-hit }}
        run: |
          vp --version
          echo "Installed version: $INSTALLED_VERSION"
          echo "Cache hit: $CACHE_HIT"

  test-cache-npm:
    runs-on: ubuntu-latest
    steps:
      - uses: taiki-e/checkout-action@7d1e50e93dc4fb3bba58f85018fadf77898aee8b # v1.4.2

      - name: Create test project with package-lock.json
        run: |
          mkdir -p test-project
          cd test-project
          echo '{"name":"test-project","private":true}' > package.json
          echo '{"name":"test-project","lockfileVersion":3}' > package-lock.json

      - name: Setup Vite+ with npm cache
        uses: $/.
        id: setup
        with:
          run-install: false
          cache: true
          cache-dependency-path: test-project/package-lock.json

      - name: Verify installation
        shell: bash
        env:
          INSTALLED_VERSION: ${{ steps.setup.outputs.version }}
          CACHE_HIT: ${{ steps.setup.outputs.cache-hit }}
        run: |
          vp --version
          echo "Installed version: $INSTALLED_VERSION"
          echo "Cache hit: $CACHE_HIT"

  test-cache-yarn:
    runs-on: ubuntu-latest
    steps:
      - uses: taiki-e/checkout-action@7d1e50e93dc4fb3bba58f85018fadf77898aee8b # v1.4.2

      - name: Create test project with yarn.lock
        run: |
          mkdir -p test-project
          cd test-project
          echo '{"name":"test-project","private":true}' > package.json
          touch yarn.lock

      - name: Setup Vite+ with yarn cache
        uses: $/.
        id: setup
        with:
          run-install: false
          cache: true
          cache-dependency-path: test-project/yarn.lock

      - name: Verify installation
        shell: bash
        env:
          INSTALLED_VERSION: ${{ steps.setup.outputs.version }}
          CACHE_HIT: ${{ steps.setup.outputs.cache-hit }}
        run: |
          vp --version
          echo "Installed version: $INSTALLED_VERSION"
          echo "Cache hit: $CACHE_HIT"

  test-cache-bun:
    strategy:
      fail-fast: false
      matrix:
        lockfile: [bun.lock, bun.lockb]
    runs-on: ubuntu-latest
    steps:
      - uses: taiki-e/checkout-action@7d1e50e93dc4fb3bba58f85018fadf77898aee8b # v1.4.2

      - name: Create test project with ${{ matrix.lockfile }}
        run: |
          mkdir -p test-project
          cd test-project
          echo '{"name":"test-project","private":true}' > package.json
          touch ${{ matrix.lockfile }}

      - name: Setup Vite+ with bun cache (${{ matrix.lockfile }})
        uses: $/.
        id: setup
        with:
          run-install: false
          cache: true
          cache-dependency-path: test-project/${{ matrix.lockfile }}

      - name: Verify installation
        shell: bash
        env:
          INSTALLED_VERSION: ${{ steps.setup.outputs.version }}
          CACHE_HIT: ${{ steps.setup.outputs.cache-hit }}
        run: |
          vp --version
          echo "Installed version: $INSTALLED_VERSION"
          echo "Cache hit: $CACHE_HIT"

  test-vp-exec:
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest, macos-latest, windows-latest]
    runs-on: ${{ matrix.os }}
    steps:
      - uses: taiki-e/checkout-action@7d1e50e93dc4fb3bba58f85018fadf77898aee8b # v1.4.2

      - name: Setup Vite+
        uses: $/.
        with:
          run-install: false
          cache: false

      - name: Verify vp exec works
        run: vp exec node -e "console.log('vp exec works')"

  test-vp-install-and-exec:
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest, macos-latest, windows-latest]
    runs-on: ${{ matrix.os }}
    steps:
      - uses: taiki-e/checkout-action@7d1e50e93dc4fb3bba58f85018fadf77898aee8b # v1.4.2

      # Fixture lives under $RUNNER_TEMP (outside the repo) so the committed
      # pnpm-workspace.yaml doesn't make vp resolve it to the repo root.
      - name: Create test project
        shell: bash
        run: |
          DIR="${RUNNER_TEMP//\\//}/test-project"
          mkdir -p "$DIR"
          echo '{"name":"test-project","private":true,"scripts":{"hello":"node -e \"console.log(1+1)\""}}' > "$DIR/package.json"

      - name: Setup Vite+ with install
        uses: $/.
        with:
          run-install: |
            - cwd: ${{ runner.temp }}/test-project
          cache: false

      - name: Verify vp exec in project
        working-directory: ${{ runner.temp }}/test-project
        run: vp exec node -e "console.log('vp exec in project works')"

      - name: Verify vp run in project
        working-directory: ${{ runner.temp }}/test-project
        run: vp run hello

  test-registry-url:
    runs-on: ubuntu-latest
    steps:
      - uses: taiki-e/checkout-action@7d1e50e93dc4fb3bba58f85018fadf77898aee8b # v1.4.2

      - name: Setup Vite+ with registry-url
        uses: $/.
        with:
          run-install: false
          cache: false
          registry-url: "https://npm.pkg.github.com"
          scope: "@voidzero-dev"

      - name: Verify .npmrc was created
        run: |
          echo "NPM_CONFIG_USERCONFIG=$NPM_CONFIG_USERCONFIG"
          cat "$NPM_CONFIG_USERCONFIG"
          grep -q "@voidzero-dev:registry=https://npm.pkg.github.com/" "$NPM_CONFIG_USERCONFIG"
          grep -q "_authToken=\${NODE_AUTH_TOKEN}" "$NPM_CONFIG_USERCONFIG"

      - name: Verify NODE_AUTH_TOKEN is exported
        run: |
          echo "NODE_AUTH_TOKEN is set: ${NODE_AUTH_TOKEN:+yes}"

  test-alpine-container:
    runs-on: ubuntu-latest
    container:
      image: alpine:3.24
    steps:
      - name: Install Alpine dependencies
        run: apk add --no-cache bash curl gcompat libstdc++

      - uses: taiki-e/checkout-action@7d1e50e93dc4fb3bba58f85018fadf77898aee8b # v1.4.2

      - name: Setup Vite+
        uses: $/.
        with:
          run-install: false
          cache: false

      - name: Verify installation
        run: vp --version

      - name: Verify vp exec works
        run: vp exec node -e "console.log('vp exec works in Alpine')"

  test-sfw:
    # sfw wraps vp install end-to-end on all OSes (macOS / Windows supported
    # since vite-plus v0.1.23). On Linux we verify across every package
    # manager vp auto-detects via lockfile (pnpm/npm/yarn/bun); macOS / Windows
    # run pnpm only because the PM choice doesn't change the sfw wrap path —
    # those cells exist to prove the cross-platform sfw download + wrap works.
    # vp version follows the workflow default (`latest`, or the pr_version
    # pkg.pr.new build on manual dispatch via VP_PR_VERSION) — sfw is decoupled
    # from vp's release channel, so it just rides whatever vp the rest of the
    # matrix is testing.
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest, macos-latest, windows-latest]
        package-manager: [pnpm, npm, yarn, bun]
        exclude:
          # Non-Linux runs pnpm only — PM diversity adds no sfw-wrap coverage.
          - { os: macos-latest, package-manager: npm }
          - { os: macos-latest, package-manager: yarn }
          - { os: macos-latest, package-manager: bun }
          - { os: windows-latest, package-manager: npm }
          - { os: windows-latest, package-manager: yarn }
          - { os: windows-latest, package-manager: bun }
    runs-on: ${{ matrix.os }}
    steps:
      - uses: taiki-e/checkout-action@7d1e50e93dc4fb3bba58f85018fadf77898aee8b # v1.4.2

      # Fixture lives under $RUNNER_TEMP (outside the repo) so the committed
      # pnpm-workspace.yaml doesn't make vp resolve it to the repo root.
      - name: Create test project for ${{ matrix.package-manager }}
        shell: bash
        run: |
          case "${{ matrix.package-manager }}" in
            pnpm) LOCKFILE=pnpm-lock.yaml; CONTENTS='' ;;
            npm)  LOCKFILE=package-lock.json; CONTENTS='{"name":"test-project","lockfileVersion":3}' ;;
            yarn) LOCKFILE=yarn.lock; CONTENTS='' ;;
            bun)  LOCKFILE=bun.lock; CONTENTS='' ;;
            *)    echo "Unsupported package-manager: ${{ matrix.package-manager }}" >&2; exit 1 ;;
          esac
          DIR="${RUNNER_TEMP//\\//}/test-project"
          mkdir -p "$DIR"
          echo '{"name":"test-project","private":true,"dependencies":{"is-odd":"^3.0.1"}}' > "$DIR/package.json"
          printf '%s' "$CONTENTS" > "$DIR/$LOCKFILE"

      - name: Configure Yarn .yarnrc.yml (Linux + yarn only)
        if: matrix.package-manager == 'yarn' && runner.os == 'Linux'
        # nodeLinker=node-modules: Yarn Berry defaults to Plug'n'Play, which
        #   makes plain `require()` from a non-yarn-wrapped node process fail.
        # enableImmutableInstalls=false: Yarn Berry auto-enables immutable
        #   installs under CI, which makes the bootstrap from an empty
        #   yarn.lock fail with YN0028. Setting it here (instead of via the
        #   YARN_ENABLE_IMMUTABLE_INSTALLS env var) survives any future
        #   env-sanitization vp might apply to spawned subprocesses.
        shell: bash
        run: |
          {
            echo "nodeLinker: node-modules"
            echo "enableImmutableInstalls: false"
          } > "${RUNNER_TEMP//\\//}/test-project/.yarnrc.yml"

      - name: Setup Vite+ with sfw + ${{ matrix.package-manager }}
        uses: $/.
        with:
          sfw: true
          run-install: |
            - cwd: ${{ runner.temp }}/test-project
          cache: false

      - name: Verify sfw is on PATH
        run: sfw --version

      - name: Verify dependency installed via ${{ matrix.package-manager }}
        working-directory: ${{ runner.temp }}/test-project
        run: vp exec node -e "console.log(require('is-odd')(3))"

  test-sfw-alpine:
    # vp version follows the workflow default (`latest`, or a pr_version
    # pkg.pr.new build on manual dispatch) — sfw's musl asset selection is
    # decoupled from vp's release channel.
    # NOTE: if this job is later re-matrixed (multiple vp builds, multiple
    # alpine versions, etc.), restore `strategy: { fail-fast: false }` so a
    # flake in one shard doesn't cancel the others.
    runs-on: ubuntu-latest
    container:
      image: alpine:3.24
    steps:
      - name: Install Alpine dependencies
        run: apk add --no-cache bash curl gcompat libstdc++

      - uses: taiki-e/checkout-action@7d1e50e93dc4fb3bba58f85018fadf77898aee8b # v1.4.2

      # Fixture lives outside the repo so the committed pnpm-workspace.yaml
      # doesn't make vp resolve it to the repo root. This is a container job:
      # ${{ runner.temp }} would expand to the HOST path, but the shell and the
      # action both run inside the container (where RUNNER_TEMP maps to /__w/_temp),
      # so a host path passed via YAML wouldn't exist in the container. Use a
      # literal in-container path (/tmp, outside the /__w workspace mount) that
      # needs no host<->container translation.
      - name: Create test project with a real dependency
        run: |
          mkdir -p /tmp/test-project
          echo '{"name":"test-project","private":true,"dependencies":{"is-odd":"^3.0.1"}}' > /tmp/test-project/package.json

      - name: Setup Vite+ with sfw (musl)
        uses: $/.
        with:
          sfw: true
          run-install: |
            - cwd: /tmp/test-project
          cache: false

      - name: Verify sfw is on PATH (musl)
        run: sfw --version

      - name: Verify dependency installed under sfw (musl)
        working-directory: /tmp/test-project
        run: vp exec node -e "console.log(require('is-odd')(3))"

  test-sfw-blocks-malicious:
    # Temporarily skip while Socket alert lookups fail. Restore in #161:
    # https://github.com/voidzero-dev/setup-vp/issues/161
    if: false
    # Verifies sfw actually intercepts a known-malicious package, not just
    # that it wraps the install. Uses `lodahs` (lodash typosquat), the same
    # canary SocketDev's own workflows use:
    # https://github.com/SocketDev/bun-security-scanner/blob/main/.github/workflows/test.yml
    # If this job ever stops blocking, either sfw is misconfigured or the
    # canary itself has been delisted — swap it for another Socket-flagged
    # package from https://socket.dev/blog/category/threat-research.
    # vp version follows the workflow default (`latest`, or a pr_version
    # pkg.pr.new build on manual dispatch) — sfw block behavior is decoupled
    # from vp's release channel.
    # Runs on all three OSes: a fail-open regression in vp/sfw's proxy or CA
    # handling can be platform-specific (the #73 rustls cert-trust class of
    # bug was), so each OS needs its own block assertion — benign-install
    # success (the test-sfw job) is not enough proof.
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest, macos-latest, windows-latest]
    runs-on: ${{ matrix.os }}
    steps:
      - uses: taiki-e/checkout-action@7d1e50e93dc4fb3bba58f85018fadf77898aee8b # v1.4.2

      # Fixture lives under $RUNNER_TEMP (outside the repo) so the committed
      # pnpm-workspace.yaml doesn't make vp resolve it to the repo root.
      - name: Create test project with a benign dependency
        shell: bash
        run: |
          DIR="${RUNNER_TEMP//\\//}/test-project"
          mkdir -p "$DIR"
          echo '{"name":"test-project","private":true,"dependencies":{"is-odd":"^3.0.1"}}' > "$DIR/package.json"

      - name: Setup Vite+ with sfw and install benign dep
        uses: $/.
        with:
          sfw: true
          run-install: |
            - cwd: ${{ runner.temp }}/test-project
          cache: false

      - name: Assert sfw blocks malicious package (lodahs typosquat of lodash)
        shell: bash
        working-directory: ${{ runner.temp }}/test-project
        # Exit code alone isn't sufficient: a non-zero exit from npm 404,
        # network blip, or vp crash would also produce a false positive. We
        # also require the literal sfw block-line for lodahs in the combined
        # output so an unrelated failure doesn't get reported as "sfw blocked
        # it". The block-line format observed in CI is:
        #   " - blocked npm package: name: lodahs; version: ...; reason: ..."
        # The banner "Protected by Socket Firewall" and the "=== Socket
        # Firewall ===" header are emitted on EVERY sfw invocation, so neither
        # of those is a usable marker — use the unique "blocked npm package:
        # name: lodahs" line instead.
        run: |
          set +e
          OUTPUT=$(sfw vp install lodahs 2>&1)
          CODE=$?
          set -e
          printf '%s\n' "$OUTPUT"
          if [ "$CODE" -eq 0 ]; then
            echo "::error::sfw failed to block lodahs on ${{ matrix.os }} — install exited 0"
            exit 1
          fi
          if ! printf '%s' "$OUTPUT" | grep -qF -- "blocked npm package: name: lodahs"; then
            echo "::error::sfw vp install exited $CODE on ${{ matrix.os }} but the lodahs block-line was not in the output — likely failed for a non-sfw reason (canary delisted, network blip, vp crash, or sfw output format changed). Swap the canary if Socket has delisted lodahs, or update the marker grep if sfw's block-line format changed."
            exit 1
          fi
          echo "OK: sfw blocked lodahs on ${{ matrix.os }} (exit $CODE, block-line found)"

  test-sfw-with-socketdev-action:
    # Exercises the composition path: install sfw via the upstream
    # `socketdev/action@<sha>` step first, then call setup-vp with `sfw:
    # true`. setup-vp should DETECT the pre-installed sfw on PATH (via
    # findSfwOnPath()) and SKIP its bundled download. We assert that by
    # checking $RUNNER_TEMP/sfw-bin/sfw[.exe] — the exact path
    # installSfw() would have created — was NOT created. We also assert the
    # composed sfw actually BLOCKS a malicious package (lodahs), so this path
    # is proven to enforce, not just to be wired up.
    # See README "Advanced: stricter supply chain via socketdev/action".
    runs-on: ubuntu-latest
    steps:
      - uses: taiki-e/checkout-action@7d1e50e93dc4fb3bba58f85018fadf77898aee8b # v1.4.2

      # Fixture lives under $RUNNER_TEMP (outside the repo) so the committed
      # pnpm-workspace.yaml doesn't make vp resolve it to the repo root.
      - name: Create test project with a real dependency
        shell: bash
        run: |
          DIR="${RUNNER_TEMP//\\//}/test-project"
          mkdir -p "$DIR"
          echo '{"name":"test-project","private":true,"dependencies":{"is-odd":"^3.0.1"}}' > "$DIR/package.json"

      - name: Install sfw via socketdev/action
        uses: socketdev/action@ba6de6cc0565af1f42295590380973573297e31f
        with:
          mode: firewall-free

      - name: Setup Vite+ with sfw (composition path)
        uses: $/.
        id: setup-vp
        with:
          sfw: true
          run-install: |
            - cwd: ${{ runner.temp }}/test-project
          cache: false

      - name: Verify setup-vp used the composed sfw (no bundled download)
        shell: bash
        # Negative assertion: if setup-vp had downloaded its own sfw, it
        # would land at $RUNNER_TEMP/sfw-bin/sfw[.exe] (per
        # getSfwBinDir() in install-sfw.ts). On the composition path the
        # PATH-detection branch should fire FIRST and skip the download
        # entirely, so neither file should exist.
        run: |
          if [ -e "$RUNNER_TEMP/sfw-bin/sfw" ] || [ -e "$RUNNER_TEMP/sfw-bin/sfw.exe" ]; then
            echo "::error::setup-vp downloaded its own sfw binary even though one was pre-installed via socketdev/action. The PATH-detection branch in setupSfw() regressed."
            exit 1
          fi
          echo "OK: setup-vp used the pre-installed sfw (no bundled download at \$RUNNER_TEMP/sfw-bin/)"

      - name: Verify dependency installed under composed sfw
        working-directory: ${{ runner.temp }}/test-project
        run: vp exec node -e "console.log(require('is-odd')(3))"

      - name: Assert composed sfw blocks malicious package (lodahs)
        # Temporarily skip while Socket alert lookups fail. Restore in #161:
        # https://github.com/voidzero-dev/setup-vp/issues/161
        if: false
        shell: bash
        working-directory: ${{ runner.temp }}/test-project
        # Proves the composition path actually enforces, not just that sfw is
        # present. socketdev/action exports SFW_JSON_REPORT_PATH into the env,
        # which makes sfw write its block report to JSON instead of stdout —
        # we unset it here so the block-line goes to stdout, matching the
        # marker check used by test-sfw-blocks-malicious.
        run: |
          unset SFW_JSON_REPORT_PATH
          set +e
          OUTPUT=$(sfw vp install lodahs 2>&1)
          CODE=$?
          set -e
          printf '%s\n' "$OUTPUT"
          if [ "$CODE" -eq 0 ]; then
            echo "::error::composed sfw failed to block lodahs — install exited 0"
            exit 1
          fi
          if ! printf '%s' "$OUTPUT" | grep -qF -- "blocked npm package: name: lodahs"; then
            echo "::error::composed sfw vp install exited $CODE but the lodahs block-line was not in the output (canary delisted, network blip, or sfw output format changed)."
            exit 1
          fi
          echo "OK: composed sfw blocked lodahs (exit $CODE, block-line found)"

  test-gitlab-cache-snapshot:
    name: GitLab cache snapshot regression (${{ matrix.os }})
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest, macos-latest]
    runs-on: ${{ matrix.os }}
    timeout-minutes: 5
    permissions:
      contents: read
    steps:
      - uses: taiki-e/checkout-action@7d1e50e93dc4fb3bba58f85018fadf77898aee8b # v1.4.2
      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
        with:
          node-version: 24.15.0
      - name: Verify repeated saves with Bun-style directory symlinks
        run: node --test test/cache-snapshot.test.mjs

  test-azure-runtime:
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest, macos-latest, windows-latest]
    runs-on: ${{ matrix.os }}
    steps:
      - uses: taiki-e/checkout-action@7d1e50e93dc4fb3bba58f85018fadf77898aee8b # v1.4.2

      - name: Setup Vite+
        uses: $/.
        with:
          run-install: true
          cache: false

      - name: Build portable bundles
        run: vp run build

      - name: Verify Azure runtime invalid phase smoke test
        shell: bash
        run: |
          if node dist/azure/index.mjs invalid-phase; then
            echo "::error::Azure runtime accepted an invalid phase"
            exit 1
          fi

      - name: Verify bootstrap syntax (Unix)
        if: runner.os != 'Windows'
        run: bash -n azure/bootstrap.sh gitlab/bootstrap.sh

      - name: Verify bootstrap syntax (Windows)
        if: runner.os == 'Windows'
        shell: pwsh
        run: |
          [scriptblock]::Create((Get-Content -Raw azure/bootstrap.ps1)) > $null
          [scriptblock]::Create((Get-Content -Raw gitlab/bootstrap.ps1)) > $null

  test-unit:
    name: Unit tests (${{ matrix.os }})
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest, macos-latest, windows-latest]
    runs-on: ${{ matrix.os }}
    # Use the published CLI for repository checks, including manual runs.
    env:
      VP_PR_VERSION: ""
    steps:
      - uses: taiki-e/checkout-action@7d1e50e93dc4fb3bba58f85018fadf77898aee8b # v1.4.2
      - name: Setup Vite+ and test dependencies
        uses: $/.
        with:
          node-version-file: .node-version
      # Some tests inspect or execute dist/, so build on each runner first.
      - name: Build
        run: vp run build
      - name: Unit tests
        run: vp run test

  build:
    runs-on: ubuntu-latest
    # This job verifies the action's own artifacts (dist/ committed and up to
    # date, types, lint). Pin it to the latest published Vite+ even on a
    # pr_version dispatch: a pre-release bundler could shift dist/ output and
    # fail the "dist is up to date" diff for reasons unrelated to the change.
    env:
      VP_PR_VERSION: ""
    steps:
      - uses: taiki-e/checkout-action@7d1e50e93dc4fb3bba58f85018fadf77898aee8b # v1.4.2

      - name: Setup Vite+ with cache
        uses: $/.
        id: setup
        with:
          cache: true
          node-version-file: .node-version

      - name: Type check
        run: vp run typecheck

      - name: Check
        run: vp run check

      - name: Build
        run: vp run build

      - name: Verify dist is up to date
        run: |
          git diff --exit-code dist/ || (echo "dist/ is out of date. Run 'vp run build' and commit." && exit 1)