ci.yml

name: CI

permissions:
  # Doing it explicitly because the default permission only includes metadata: read.
  contents: read

on:
  workflow_dispatch:
  pull_request:
    types: [opened, synchronize, labeled]
  push:
    branches:
      - main
    # `paths` with negations instead of paths-ignore: PTY snapshot baselines
    # are .md files (crates/vp_cli_snapshots/**/snapshots/*.md) and a
    # baseline-only push must still run CI. Later patterns win.
    paths:
      - '**'
      - '!**/*.md'
      - 'crates/vp_cli_snapshots/**'

concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }}
  cancel-in-progress: ${{ github.ref_name != 'main' }}

defaults:
  run:
    shell: bash

jobs:
  detect-changes:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      pull-requests: read
    outputs:
      # snapshots is OR-ed in because the PTY runner stores its assertions
      # as .md files (fixtures/**/snapshots/*.md), which the code filter's
      # markdown exclusion would otherwise classify as docs-only.
      code-changed: ${{ steps.filter.outputs.code == 'true' || steps.filter.outputs.snapshots == 'true' }}
    steps:
      - uses: taiki-e/checkout-action@7d1e50e93dc4fb3bba58f85018fadf77898aee8b # v1.4.2
      - uses: dorny/paths-filter@ceb8a2b8f2d89434be7ff52d3de7ec3738c5cc9d # v4.0.3
        id: filter
        with:
          predicate-quantifier: every
          filters: |
            code:
              - '!**/*.md'
              - '!docs/**'
              - '!.github/workflows/deploy-docs-preview.yml'
              - '!.github/workflows/deploy-docs.yml'
              - '!netlify.toml'
            snapshots:
              - 'crates/vp_cli_snapshots/**'

  docs-fmt:
    name: Docs format check
    needs: detect-changes
    # Docs-only changes skip the full CI matrix, so nothing else format-checks
    # them (code changes get `vp check` in cli-e2e-test). The required `done`
    # job waits for this check and propagates failures.
    if: needs.detect-changes.outputs.code-changed == 'false'
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: read
    steps:
      - uses: taiki-e/checkout-action@7d1e50e93dc4fb3bba58f85018fadf77898aee8b # v1.4.2
      - uses: ./.github/actions/clone

      - uses: ./.github/actions/setup-rust
        with:
          # Shares the Cargo cache with the Linux CLI test build job, which
          # builds the same target. Only that job saves it.
          save-cache: false
          cache-key: cli-snapshot-test-x86_64-unknown-linux-gnu-ci

      - uses: ./.github/actions/setup-ci-node

      # Format-check with the oxfmt of this commit instead of the released one.
      # A release carries the oxfmt it shipped with, which trails the catalog
      # pin the repo is formatted with, and then flags files the workspace
      # formatter accepts. build-upstream restores the NAPI binding cache the
      # code jobs fill, so a docs-only run reuses their binaries instead of
      # compiling Rust.
      - name: Build with upstream
        uses: ./.github/actions/build-upstream
        with:
          profile: ci
          target: x86_64-unknown-linux-gnu

      - name: Run vp fmt --check
        run: pnpm vp fmt --check

  download-previous-rolldown-binaries:
    needs: detect-changes
    if: needs.detect-changes.outputs.code-changed == 'true'
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: read
    steps:
      - uses: taiki-e/checkout-action@7d1e50e93dc4fb3bba58f85018fadf77898aee8b # v1.4.2
      - uses: ./.github/actions/download-rolldown-binaries
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}
  test:
    needs: detect-changes
    if: needs.detect-changes.outputs.code-changed == 'true'
    name: Test
    strategy:
      fail-fast: false
      matrix:
        include:
          - os: ubuntu-latest
            target: x86_64-unknown-linux-gnu
          - os: namespace-profile-mac-default
            target: aarch64-apple-darwin
    runs-on: ${{ matrix.os }}
    steps:
      - uses: taiki-e/checkout-action@7d1e50e93dc4fb3bba58f85018fadf77898aee8b # v1.4.2
      - uses: ./.github/actions/clone

      - uses: ./.github/actions/setup-rust
        with:
          save-cache: ${{ github.ref_name == 'main' }}
          cache-key: test
          tools: just

      - run: cargo check --all-targets --all-features
        env:
          RUSTFLAGS: '-D warnings --cfg tokio_unstable' # also update .cargo/config.toml

      - run: just test

  # Windows tests are cross-compiled on a fast Linux runner with cargo-xwin
  # (clang-cl + lld-link against the xwin-downloaded MSVC CRT/Windows SDK)
  # and packed into a portable nextest archive. The test-windows job then
  # only downloads the archive and runs it: no Rust toolchain, dev drive, or
  # compilation on the slow Windows runner. Same approach as
  # voidzero-dev/vite-task#443.
  build-windows-tests:
    needs: detect-changes
    if: needs.detect-changes.outputs.code-changed == 'true'
    name: Build Windows tests
    runs-on: ubuntu-latest
    env:
      XWIN_ACCEPT_LICENSE: '1'
      # The MSVC STL from xwin's VS17 manifest static-asserts a minimum Clang
      # version newer than what runner images ship. Microsoft's documented
      # escape hatch lets Detours (C++, via the fspy git dependency) compile
      # with the runner's clang-cl; cargo-xwin folds a pre-set CXXFLAGS into
      # the per-target CXXFLAGS it generates.
      CXXFLAGS: -D_ALLOW_COMPILER_AND_STL_VERSION_MISMATCH
    steps:
      - uses: taiki-e/checkout-action@7d1e50e93dc4fb3bba58f85018fadf77898aee8b # v1.4.2
      - uses: ./.github/actions/clone

      - uses: ./.github/actions/setup-xwin
        with:
          save-cache: ${{ github.ref_name == 'main' }}
          cache-key: windows-cross
          tools: cargo-nextest

      # `cargo xwin env` resolves the rustflags configured in
      # .cargo/config.toml (including the cfg-based Windows section), appends
      # its -Lnative Windows SDK paths, and re-exports the result as
      # CARGO_TARGET_X86_64_PC_WINDOWS_MSVC_RUSTFLAGS, so plain cargo
      # invocations cross-compile exactly like `cargo xwin` would. It renders
      # its intended *removal* of RUSTFLAGS as `export RUSTFLAGS="";`, which
      # must become a real unset: a set RUSTFLAGS takes precedence over the
      # target-specific rustflags and would shadow them.
      - name: Check Windows target
        run: |
          eval "$(cargo xwin env --target x86_64-pc-windows-msvc | grep '^export ')"
          unset RUSTFLAGS
          # Fail fast if cargo-xwin ever stops folding the repo's cfg-based
          # Windows rustflags (--cfg tokio_unstable, /STACK:8388608) into the
          # target env var; a dropped /STACK would be a silent runtime
          # difference in the shipped test binaries.
          case "$CARGO_TARGET_X86_64_PC_WINDOWS_MSVC_RUSTFLAGS" in
            *tokio_unstable*STACK:8388608*) ;;
            *)
              echo "::error::cargo-xwin dropped the .cargo/config.toml Windows rustflags: $CARGO_TARGET_X86_64_PC_WINDOWS_MSVC_RUSTFLAGS"
              exit 1
              ;;
          esac
          export CARGO_TARGET_X86_64_PC_WINDOWS_MSVC_RUSTFLAGS="$CARGO_TARGET_X86_64_PC_WINDOWS_MSVC_RUSTFLAGS -D warnings"
          cargo check --all-targets --all-features --target x86_64-pc-windows-msvc

      # Keep the package selection in sync with the `test` recipe in justfile.
      # vp_cli_snapshots is excluded there too: its snapshot suite needs a
      # built vp and node at runtime and joins the Windows archive later.
      # vp_trampoline is not a workspace member.
      # Run its portable parser and layout tests on Unix.
      # The Windows CLI snapshot suite tests Windows shim behavior.
      - name: Build test archive
        run: |
          eval "$(cargo xwin env --target x86_64-pc-windows-msvc | grep '^export ')"
          unset RUSTFLAGS
          cargo nextest archive $(for d in crates/*/; do n=$(basename $d); [ "$n" = "vp_cli_snapshots" ] || [ "$n" = "vp_trampoline" ] || echo -n "-p $n "; done) -p vite-plus-cli \
            --target x86_64-pc-windows-msvc --archive-file windows-tests.tar.zst

      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: windows-test-archive
          path: windows-tests.tar.zst
          retention-days: 7

      # Separate archive for the PTY snapshot suite (excluded from the
      # unit-test archive above): its suite needs vp, node, and a built
      # packages/cli/dist at runtime, which only cli-snapshot-test-windows
      # provides. The archive carries the cli_snapshots test binary plus the
      # vpt helper; nextest rewrites CARGO_MANIFEST_DIR/CARGO_BIN_EXE_vpt at
      # run time so the relocated binaries find fixtures and helpers.
      - name: Build snapshot test archive
        run: |
          eval "$(cargo xwin env --target x86_64-pc-windows-msvc | grep '^export ')"
          unset RUSTFLAGS
          cargo nextest archive -p vp_cli_snapshots \
            --target x86_64-pc-windows-msvc --archive-file windows-snapshot-tests.tar.zst

      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: windows-snapshot-test-archive
          path: windows-snapshot-tests.tar.zst
          retention-days: 7

  test-windows:
    needs: build-windows-tests
    name: Test (Windows)
    runs-on: namespace-profile-windows-4c-8g
    steps:
      - uses: taiki-e/checkout-action@7d1e50e93dc4fb3bba58f85018fadf77898aee8b # v1.4.2
      - uses: ./.github/actions/clone

      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
        with:
          name: windows-test-archive

      - uses: taiki-e/install-action@ab6895351a88b908e96a4697860d4ffea5e57dbe # v2.87.27
        with:
          tool: cargo-nextest

      # `cargo-nextest` is invoked directly so the job never depends on the
      # runner's Rust toolchain.
      # Cross-compiled archives may also contain host-built proc-macro tests;
      # filter them out before Windows tries to list their ELF binaries.
      # --test-threads=1: nextest runs each test in its own process, so
      # serial_test's in-process locks no longer serialize tests that contend
      # on cross-process shared state (fixed temp paths, e.g.
      # `vp-test-custom-home` in vp_shared::home tests). The whole suite is
      # only ~1 minute of test time, so full serialization is cheap
      # insurance; revisit if it becomes the bottleneck.
      - name: Run tests
        run: cargo-nextest nextest run -E 'platform(target)' --archive-file windows-tests.tar.zst --workspace-remap . --test-threads 1
        env:
          RUST_MIN_STACK: '8388608'
          # Keep Windows env parity with the `test` recipe in justfile.
          __COMPAT_LAYER: RunAsInvoker
          # Snapshot assertions resolve paths from the Linux build machine's
          # workspace root baked in at compile time; point insta at this
          # checkout instead (without it, insta shells out to a `cargo` that
          # is not installed here).
          INSTA_WORKSPACE_ROOT: ${{ github.workspace }}

  test-musl:
    needs: detect-changes
    if: needs.detect-changes.outputs.code-changed == 'true'
    name: Test (Linux x64 musl)
    runs-on: ubuntu-latest
    container:
      image: node:25-alpine3.21
    env:
      # GitHub Actions sets HOME=/github/home in containers, but the euid home is /root.
      # Pin Rust tooling paths to avoid $HOME mismatch issues.
      CARGO_HOME: /root/.cargo
      RUSTUP_HOME: /root/.rustup
      # `-crt-static`: vite-task's `fspy_preload_unix` cdylib (unconditional
      # build-dep since voidzero-dev/vite-task#344) can't link against a
      # static musl libc. vite+ ships as a NAPI module that links musl libc
      # dynamically anyway, so matching here is correct.
      # Must mirror `.cargo/config.toml` rustflags — RUSTFLAGS env overrides
      # both [build] and [target.*] levels.
      RUSTFLAGS: --cfg tokio_unstable -C link-args=-Wl,--warn-unresolved-symbols -C target-feature=-crt-static
    steps:
      - name: Install Alpine dependencies
        shell: sh {0}
        run: apk add --no-cache bash curl git just musl-dev gcc g++ python3 cmake make

      - uses: taiki-e/checkout-action@7d1e50e93dc4fb3bba58f85018fadf77898aee8b # v1.4.2

      - name: Record Alpine Node.js runtime
        run: node -p "'ALPINE_NODE=' + process.execPath" >> "$GITHUB_ENV"

      - uses: ./.github/actions/clone
        with:
          # setup-node's Linux binaries require glibc; keep the container's musl build.
          setup-node: 'false'

      - name: Verify clone preserves the Alpine Node.js runtime
        run: |
          node -e "require('node:assert/strict').equal(process.execPath, process.env.ALPINE_NODE)"
          node --version

      - name: Install rustup
        run: |
          # GitHub Actions sets HOME=/github/home in containers, but rustup expects euid home (/root)
          export HOME=/root
          curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --default-toolchain none
          echo "/root/.cargo/bin" >> "$GITHUB_PATH"

      - name: Install Rust toolchain
        run: rustup show

      # Skip separate cargo check — cargo test already compiles everything.
      - run: just test

  lint:
    needs: detect-changes
    if: needs.detect-changes.outputs.code-changed == 'true'
    name: Lint
    runs-on: ubuntu-latest
    steps:
      - uses: taiki-e/checkout-action@7d1e50e93dc4fb3bba58f85018fadf77898aee8b # v1.4.2
      - uses: ./.github/actions/clone

      - uses: ./.github/actions/setup-ci-node

      - uses: ./.github/actions/setup-rust
        with:
          save-cache: ${{ github.ref_name == 'main' }}
          cache-key: lint
          tools: just,cargo-shear
          components: clippy rust-docs rustfmt

      - name: Rust lint
        id: rust-lint
        background: true
        run: |
          cargo shear
          cargo fmt --check
          cargo fmt --manifest-path crates/vp_trampoline/Cargo.toml --check
          just lint
          # RUSTDOCFLAGS='-D warnings' cargo doc --no-deps --document-private-items

      - uses: crate-ci/typos@7f9d0819ca1c008ade73f4b41fa9d258d48f605b # v1.51.1
        with:
          files: .

      - name: Install docs dependencies
        run: pnpm -C docs install --frozen-lockfile

      # Retry once because `pnpm dedupe --check` re-resolves all dependencies and
      # can non-deterministically flag optional transitive peers (e.g. oxc-resolver
      # via dts-resolver) as dedup-able depending on async resolution order.
      - name: Deduplicate dependencies
        run: pnpm dedupe --check || pnpm dedupe --check

      - wait: rust-lint

  # Cross-compiles the Windows release NAPI binding (vite-plus .node) and CLI
  # binaries (vp.exe, vp-shim.exe, vp-setup.exe) on a fast Linux runner with
  # cargo-xwin, then publishes them as the windows-cli-binaries artifact. The
  # Windows entries of cli-e2e-test and install-e2e-test-sfw
  # download that artifact instead of each spending ~24 minutes rebuilding the
  # same binaries on slow windows-latest runners whenever build-upstream's
  # NAPI binding cache misses. Release builds are unaffected: they keep
  # building natively on Windows via reusable-release-build.yml (their cache
  # keys differ through RELEASE_BUILD/VERSION).
  build-windows-cli:
    needs: detect-changes
    if: needs.detect-changes.outputs.code-changed == 'true'
    name: Build Windows CLI binaries
    runs-on: ubuntu-latest
    steps:
      - uses: taiki-e/checkout-action@7d1e50e93dc4fb3bba58f85018fadf77898aee8b # v1.4.2
      - uses: ./.github/actions/clone
      - uses: ./.github/actions/build-windows-cli
        with:
          profile: ci
          save-cache: ${{ github.ref_name == 'main' }}

  cli-e2e-test:
    name: CLI E2E test
    needs:
      - download-previous-rolldown-binaries
      - build-windows-cli
      - build-cli-test-binaries
    strategy:
      fail-fast: false
      matrix:
        include:
          - os: ubuntu-latest
            target: x86_64-unknown-linux-gnu
            test-node: 22.18.0
          - os: namespace-profile-mac-default
            target: aarch64-apple-darwin
            test-node: 24.11.0
          - os: namespace-profile-windows-4c-8g
            target: x86_64-pc-windows-msvc
            test-node: 26.0.0
    runs-on: ${{ matrix.os }}
    steps:
      - uses: taiki-e/checkout-action@7d1e50e93dc4fb3bba58f85018fadf77898aee8b # v1.4.2
      - uses: ./.github/actions/clone

      - uses: ./.github/actions/setup-ci-node

      - name: Install docs dependencies
        run: pnpm -C docs install --frozen-lockfile

      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
        with:
          name: rolldown-binaries
          path: ./rolldown/packages/rolldown/src
          merge-multiple: true

      # Prebuilt by build-windows-cli (Linux + cargo-xwin); the artifact
      # paths are workspace-relative, so this places the binding into
      # packages/cli/binding/ and the CLI binaries into
      # target/x86_64-pc-windows-msvc/release/ where
      # `tool install-global-cli` finds them.
      - name: Download prebuilt Windows binaries
        if: runner.os == 'Windows'
        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
        with:
          name: windows-cli-binaries

      - uses: ./.github/actions/download-cli-test-binaries
        if: runner.os != 'Windows'
        with:
          target: ${{ matrix.target }}

      - name: Build with upstream
        uses: ./.github/actions/build-upstream
        with:
          target: ${{ matrix.target }}
          skip-native: true

      - name: Ensure no unexpected file changes after build
        if: ${{ matrix.target == 'x86_64-unknown-linux-gnu' }}
        run: |
          if [[ -n "$(git status --porcelain)" ]]; then
            echo "::error::Unexpected file changes detected after build"
            git status
            git diff
            exit 1
          fi

      - name: Check TypeScript types
        if: ${{ matrix.target == 'x86_64-unknown-linux-gnu' }}
        run: pnpm tsgo

      - name: Install Global CLI vp
        run: |
          pnpm bootstrap-cli:ci
          if [[ "$RUNNER_OS" != "Windows" ]]; then
            . "$HOME/.vite-plus/env"
            # GITHUB_PATH prepends entries, but fallback shims must remain last.
            echo "PATH=$PATH" >> "$GITHUB_ENV"
          fi

      - name: Load Windows CLI environment
        if: runner.os == 'Windows'
        shell: pwsh
        run: |
          . (Join-Path $HOME '.vite-plus/env.ps1')
          "PATH=$env:Path" >> $env:GITHUB_ENV

      - name: Verify vp installation
        run: |
          which vp
          vp --version
          vp -h

      - name: Run vp check
        run: vp check

      - name: Run unit tests
        run: vp env exec --node ${{ matrix.test-node }} node packages/cli/dist/bin.js test run
        env:
          RUST_BACKTRACE: '1'
          RUST_MIN_STACK: 8388608

      - name: Test global package install (powershell)
        if: ${{ runner.os != 'Linux' }}
        shell: pwsh
        run: |
          $vpHome = Join-Path $HOME ".vite-plus"
          $vpBin = Join-Path $vpHome "bin"
          . (Join-Path $vpHome 'env.ps1')

          Write-Host "PATH: $env:Path"
          Get-Command node
          Get-Command npm
          Get-Command npx
          Get-Command vp
          vp env doctor

          # Test 1: Install a JS-based CLI (typescript)
          vp install -g typescript
          tsc --version
          Get-Command tsc

          # Test 2: Verify the package was installed correctly
          Get-ChildItem $vpBin

          # Test 3: Uninstall
          vp uninstall -g typescript

          # Test 4: Verify uninstall removed shim
          Write-Host "Checking bin dir after uninstall:"
          Get-ChildItem $vpBin
          $shimPath = if ($IsWindows) { Join-Path $vpBin "tsc.cmd" } else { Join-Path $vpBin "tsc" }
          if (Test-Path $shimPath) {
            Write-Error "tsc shim file still exists at $shimPath"
            exit 1
          }
          Write-Host "tsc shim removed successfully"

          # Test 5: use session
          vp env use 18
          node --version
          vp env doctor
          vp env use --unset
          node --version

      - name: Test global package install (cmd)
        if: ${{ runner.os == 'Windows' }}
        shell: cmd
        run: |
          echo "PATH: %PATH%"
          where.exe node
          where.exe npm
          where.exe npx
          where.exe vp

          vp env use 18
          node --version
          vp env use --unset
          node --version

          vp env doctor

          REM Test 1: Install a JS-based CLI (typescript)
          vp install -g typescript
          tsc --version
          where.exe tsc

          REM Test 2: Verify the package was installed correctly
          dir "%USERPROFILE%\.vite-plus\packages\typescript\"
          dir "%USERPROFILE%\.vite-plus\bin\"

          REM Test 3: Uninstall
          vp uninstall -g typescript

          REM Test 4: Verify uninstall removed shim (.cmd wrapper)
          echo Checking bin dir after uninstall:
          dir "%USERPROFILE%\.vite-plus\bin\"
          if exist "%USERPROFILE%\.vite-plus\bin\tsc.cmd" (
            echo Error: tsc.cmd shim file still exists
            exit /b 1
          )
          echo tsc.cmd shim removed successfully

          REM Test 5: Verify shell script was also removed (for Git Bash)
          if exist "%USERPROFILE%\.vite-plus\bin\tsc" (
            echo Error: tsc shell script still exists
            exit /b 1
          )
          echo tsc shell script removed successfully

          REM Test 6: use session
          vp env use 18
          node --version
          vp env doctor
          vp env use --unset
          node --version

      - name: Test global package install (bash)
        run: |
          echo "PATH: $PATH"
          ls -la ~/.vite-plus/
          ls -la ~/.vite-plus/bin/
          which node
          which npm
          which npx
          which vp
          vp env doctor

          # Test 1: Install a JS-based CLI (typescript)
          vp install -g typescript
          tsc --version
          which tsc

          # Test 2: Verify the package was installed correctly
          ls -la ~/.vite-plus/bin/

          # Test 3: Uninstall
          vp uninstall -g typescript

          # Test 4: Verify uninstall removed shim
          echo "Checking bin dir after uninstall:"
          ls -la ~/.vite-plus/bin/
          if [ -f ~/.vite-plus/bin/tsc ]; then
            echo "Error: tsc shim file still exists at ~/.vite-plus/bin/tsc"
            exit 1
          fi
          echo "tsc shim removed successfully"

          # Test 5: use session
          vp env use 18
          node --version
          vp env doctor
          vp env use --unset
          node --version

      # Upgrade tests (merged from separate job to avoid duplicate build)
      - name: Test upgrade (bash)
        shell: bash
        run: |
          # Resolve `current` (symlink on Unix, junction on Windows) and return
          # the install dir basename — "local-dev-<timestamp>" for the dev
          # build, "<version>" for a downloaded release. Node's realpathSync
          # handles symlinks and junctions uniformly.
          get_current_dirname() {
            node -p "require('path').basename(require('fs').realpathSync(require('path').resolve(process.env.USERPROFILE || process.env.HOME, '.vite-plus', 'current')))"
          }

          # Assert on the `current` target dir, not the version: right after a
          # release commit on main, the dev build's version equals npm latest,
          # so `vp upgrade --force` succeeds but the version is unchanged.
          # The dir flip (dev → release → dev) is the real signal that the
          # download/extract/swap and rollback flows ran end-to-end.
          INITIAL_DIR=$(get_current_dirname)
          echo "Initial install dir: $INITIAL_DIR"

          # --check queries npm registry and prints update status
          vp upgrade --check

          # full upgrade: download, extract, swap
          vp upgrade --force
          vp --version
          vp env doctor

          ls -la ~/.vite-plus/

          UPDATED_DIR=$(get_current_dirname)
          echo "Updated install dir: $UPDATED_DIR"
          if [ "$UPDATED_DIR" == "$INITIAL_DIR" ]; then
            echo "Error: current install dir should have changed after upgrade (still $INITIAL_DIR)"
            exit 1
          fi

          # rollback to the previous install
          vp upgrade --rollback
          vp --version
          vp env doctor

          ROLLBACK_DIR=$(get_current_dirname)
          echo "Rollback install dir: $ROLLBACK_DIR"
          if [ "$ROLLBACK_DIR" != "$INITIAL_DIR" ]; then
            echo "Error: current install dir should have been restored after rollback (expected $INITIAL_DIR, got $ROLLBACK_DIR)"
            exit 1
          fi

      - name: Test upgrade (powershell)
        if: ${{ runner.os != 'Linux' }}
        shell: pwsh
        run: |
          $vpHome = Join-Path $HOME ".vite-plus"
          . (Join-Path $vpHome 'env.ps1')
          Get-ChildItem $vpHome

          # See bash block above for why we assert on the install dir basename.
          function Get-CurrentDirname {
            node -p "require('path').basename(require('fs').realpathSync(require('path').resolve(process.env.USERPROFILE || process.env.HOME, '.vite-plus', 'current')))"
          }

          $initialDir = Get-CurrentDirname
          Write-Host "Initial install dir: $initialDir"

          # --check queries npm registry and prints update status
          vp upgrade --check

          # full upgrade: download, extract, swap
          vp upgrade --force
          vp --version
          vp env doctor

          Get-ChildItem $vpHome

          $updatedDir = Get-CurrentDirname
          Write-Host "Updated install dir: $updatedDir"
          if ($updatedDir -eq $initialDir) {
            Write-Error "Error: current install dir should have changed after upgrade (still $initialDir)"
            exit 1
          }

          # rollback to the previous install
          vp upgrade --rollback
          vp --version
          vp env doctor

          $rollbackDir = Get-CurrentDirname
          Write-Host "Rollback install dir: $rollbackDir"
          if ($rollbackDir -ne $initialDir) {
            Write-Error "Error: current install dir should have been restored after rollback (expected $initialDir, got $rollbackDir)"
            exit 1
          }

      - name: Test upgrade (cmd)
        if: ${{ runner.os == 'Windows' }}
        shell: cmd
        run: |
          REM See bash block above for why we assert on the install dir basename.
          for /f "usebackq delims=" %%v in (`node -p "require('path').basename(require('fs').realpathSync(require('path').resolve(process.env.USERPROFILE, '.vite-plus', 'current')))"`) do set INITIAL_DIR=%%v
          echo Initial install dir: %INITIAL_DIR%

          REM --check queries npm registry and prints update status
          vp upgrade --check

          REM full upgrade: download, extract, swap
          vp upgrade --force
          vp --version
          vp env doctor

          dir "%USERPROFILE%\.vite-plus\"

          for /f "usebackq delims=" %%v in (`node -p "require('path').basename(require('fs').realpathSync(require('path').resolve(process.env.USERPROFILE, '.vite-plus', 'current')))"`) do set UPDATED_DIR=%%v
          echo Updated install dir: %UPDATED_DIR%
          if "%UPDATED_DIR%"=="%INITIAL_DIR%" (
            echo Error: current install dir should have changed after upgrade, still %INITIAL_DIR%
            exit /b 1
          )

          REM rollback to the previous install
          vp upgrade --rollback
          vp --version
          vp env doctor

          for /f "usebackq delims=" %%v in (`node -p "require('path').basename(require('fs').realpathSync(require('path').resolve(process.env.USERPROFILE, '.vite-plus', 'current')))"`) do set ROLLBACK_DIR=%%v
          echo Rollback install dir: %ROLLBACK_DIR%
          if not "%ROLLBACK_DIR%"=="%INITIAL_DIR%" (
            echo Error: current install dir should have been restored after rollback, expected %INITIAL_DIR%, got %ROLLBACK_DIR%
            exit /b 1
          )

      - name: Test same-version forced upgrade (Windows)
        if: ${{ runner.os == 'Windows' }}
        shell: pwsh
        run: |
          # Force-reinstall the published `latest` version rather than the local
          # build's version: mid-release-cycle the build can be ahead of the
          # registry, and `vp upgrade <version>` must download <version> from npm.
          $version = "$(npm view vite-plus version)".Trim()
          if (-not $version) {
            Write-Error "Failed to resolve latest published vite-plus version"
            exit 1
          }

          $realVpHome = Join-Path $HOME ".vite-plus"
          $currentVp = Join-Path $realVpHome "current/bin/vp.exe"

          $tempVpHome = Join-Path $env:RUNNER_TEMP "vp-same-version-force"
          if (Test-Path $tempVpHome) {
            Remove-Item $tempVpHome -Recurse -Force
          }

          $initialVersionDir = Join-Path $tempVpHome $version
          $initialBinDir = Join-Path $initialVersionDir "bin"
          New-Item -ItemType Directory -Path $initialBinDir | Out-Null
          Copy-Item $currentVp (Join-Path $initialBinDir "vp.exe")
          # Preserve installed state so the first invocation executes upgrade.
          Copy-Item (Join-Path (Split-Path $currentVp) ".vp-setup-complete") $initialBinDir
          New-Item -ItemType Junction -Path (Join-Path $tempVpHome "current") -Target $initialVersionDir | Out-Null

          $env:VP_HOME = $tempVpHome
          & (Join-Path $tempVpHome "current/bin/vp.exe") upgrade $version --force

          $currentTarget = (Get-Item (Join-Path $tempVpHome "current")).Target
          if ($currentTarget -is [array]) {
            $currentTarget = $currentTarget[0]
          }
          $updatedDir = Split-Path -Leaf $currentTarget
          Write-Host "Updated install dir: $updatedDir"
          if (-not $updatedDir.StartsWith("$version+force.")) {
            Write-Error "Expected current to point at a forced reinstall dir for $version, got $updatedDir"
            exit 1
          }

          if (-not (Test-Path (Join-Path $tempVpHome "$version/bin/vp.exe"))) {
            Write-Error "Original same-version install directory was unexpectedly removed"
            exit 1
          }

          $previousVersion = Get-Content (Join-Path $tempVpHome ".previous-version") -Raw
          if ($previousVersion.Trim() -ne $version) {
            Write-Error "Expected .previous-version to be $version, got $previousVersion"
            exit 1
          }

      - name: Test same-version forced upgrade (Unix)
        if: ${{ runner.os != 'Windows' }}
        shell: bash
        run: |
          # Unix mirror of the Windows same-version forced-upgrade test above.
          # Overwriting the running binary in place does not fail on macOS or
          # modern Linux the way it does on Windows, but the fix still changes
          # the on-disk layout on every platform (current must repoint at a
          # `<version>+force.*` dir, the original version tree must survive, and
          # `.previous-version` must be recorded), so we assert that here too.
          #
          # Force-reinstall the published `latest` version rather than the local
          # build's version: mid-release-cycle the build can be ahead of the
          # registry, and `vp upgrade <version>` must download <version> from npm.
          version=$(npm view vite-plus version)
          if [ -z "$version" ]; then
            echo "Failed to resolve latest published vite-plus version"
            exit 1
          fi

          real_vp_home="$HOME/.vite-plus"
          current_vp="$real_vp_home/current/bin/vp"
          temp_vp_home="${RUNNER_TEMP:?RUNNER_TEMP must be set}/vp-same-version-force"
          rm -rf "$temp_vp_home"

          initial_bin_dir="$temp_vp_home/$version/bin"
          mkdir -p "$initial_bin_dir"
          cp "$current_vp" "$initial_bin_dir/vp"
          # Preserve installed state so the first invocation executes upgrade.
          cp "$(dirname "$current_vp")/.vp-setup-complete" "$initial_bin_dir/"
          chmod +x "$initial_bin_dir/vp"
          # Relative symlink, matching swap_current_link's `current -> <version>`.
          ln -s "$version" "$temp_vp_home/current"

          VP_HOME="$temp_vp_home" "$temp_vp_home/current/bin/vp" upgrade "$version" --force

          updated_dir=$(basename "$(readlink "$temp_vp_home/current")")
          echo "Updated install dir: $updated_dir"
          case "$updated_dir" in
            "$version+force."*) ;;
            *)
              echo "Expected current to point at a forced reinstall dir for $version, got $updated_dir"
              exit 1
              ;;
          esac

          if [ ! -f "$temp_vp_home/$version/bin/vp" ]; then
            echo "Original same-version install directory was unexpectedly removed"
            exit 1
          fi

          previous_version=$(tr -d '[:space:]' < "$temp_vp_home/.previous-version")
          if [ "$previous_version" != "$version" ]; then
            echo "Expected .previous-version to be $version, got $previous_version"
            exit 1
          fi

      - name: Test implode (bash)
        shell: bash
        run: |
          # Retry on Windows — file locks can cause transient "Access is denied" errors
          if [[ "$RUNNER_OS" == "Windows" ]]; then
            for i in 1 2 3; do
              vp implode --yes && break
              echo "Retry $i: vp implode failed, waiting 5s..."
              sleep 5
            done
          else
            vp implode --yes
          fi
          ls -la ~/
          VP_HOME="${USERPROFILE:-$HOME}/.vite-plus"
          if [ -d "$VP_HOME" ]; then
            echo "Error: $VP_HOME still exists after implode"
            exit 1
          fi
          # Reinstall
          pnpm bootstrap-cli:ci
          vp --version

      - name: Test implode (powershell)
        if: ${{ runner.os != 'Linux' }}
        shell: pwsh
        run: |
          $vpHome = Join-Path $HOME ".vite-plus"
          . (Join-Path $vpHome 'env.ps1')

          if ($IsWindows) {
            # Retry — Windows file locks can cause transient "Access is denied" errors
            foreach ($i in 1..3) {
              vp implode --yes
              if ($LASTEXITCODE -eq 0) { break }
              Write-Host "Retry $i`: vp implode failed, waiting 5s..."
              Start-Sleep -Seconds 5
            }
            Start-Sleep -Seconds 5
          } else {
            vp implode --yes
          }

          Get-ChildItem $HOME
          if (Test-Path $vpHome) {
            Write-Error "$vpHome still exists after implode"
            exit 1
          }
          pnpm bootstrap-cli:ci
          vp --version

      - name: Test implode (cmd)
        if: ${{ runner.os == 'Windows' }}
        shell: cmd
        run: |
          REM Retry — Windows file locks can cause transient "Access is denied" errors
          REM vp.exe renames its own parent directory; cmd.exe may report
          REM "The system cannot find the path specified" on exit — ignore it.
          for /L %%i in (1,1,3) do (
            vp implode --yes || ver >NUL
            if not exist "%USERPROFILE%\.vite-plus" goto implode_done
            echo Retry %%i: vp implode failed, waiting 5s...
            timeout /T 5 /NOBREAK >NUL
          )
          :implode_done
          timeout /T 5 /NOBREAK >NUL
          dir "%USERPROFILE%\"
          if exist "%USERPROFILE%\.vite-plus" (
            echo Error: .vite-plus still exists after implode
            exit /b 1
          )
          pnpm bootstrap-cli:ci
          vp --version

  # Build the native CLI and snapshot runner once per platform, then share
  # them across the E2E job and snapshot shards. Tar preserves permissions.
  build-cli-test-binaries:
    name: Build CLI test binaries (${{ matrix.target }})
    needs:
      - download-previous-rolldown-binaries
    strategy:
      fail-fast: false
      matrix:
        include:
          - os: ubuntu-latest
            target: x86_64-unknown-linux-gnu
          - os: namespace-profile-mac-default
            target: aarch64-apple-darwin
    runs-on: ${{ matrix.os }}
    steps:
      - uses: taiki-e/checkout-action@7d1e50e93dc4fb3bba58f85018fadf77898aee8b # v1.4.2
      - uses: ./.github/actions/clone

      - uses: ./.github/actions/setup-rust
        with:
          save-cache: ${{ github.ref_name == 'main' }}
          cache-key: cli-snapshot-test-${{ matrix.target }}-ci

      - uses: ./.github/actions/setup-ci-node

      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
        with:
          name: rolldown-binaries
          path: ./rolldown/packages/rolldown/src
          merge-multiple: true

      - name: Build with upstream
        uses: ./.github/actions/build-upstream
        with:
          profile: ci
          target: ${{ matrix.target }}

      - name: Ensure no unexpected file changes after build
        if: ${{ matrix.target == 'x86_64-unknown-linux-gnu' }}
        run: |
          if [[ -n "$(git status --porcelain)" ]]; then
            echo "::error::Unexpected file changes detected after build"
            git status
            git diff
            exit 1
          fi

      - name: Build snapshot test binaries
        run: cargo test -p vp_cli_snapshots --no-run --message-format=json > "$RUNNER_TEMP/snapshot-test-build.json"

      - name: Test snapshot runner utilities
        run: cargo test -p vp_cli_snapshots --test redact_unit --test shard_unit --test registry_pack_unit --test report_unit --test schedule_unit

      - name: Package CLI test binaries
        run: |
          artifact_dir="$(mktemp -d)"
          trap 'rm -rf "$artifact_dir"' EXIT
          binding_dir="$artifact_dir/packages/cli/binding"
          cli_dir="$artifact_dir/target/$BUILD_TARGET/release"
          snapshot_dir="$artifact_dir/target/snapshot-tests"
          mkdir -p "$binding_dir" "$cli_dir" "$snapshot_dir"

          cp packages/cli/binding/*.node packages/cli/binding/vite-plus.build-time "$binding_dir/"
          cargo metadata --locked --format-version 1 \
            | jq '{packages: [.packages[] | {name, version, source}]}' \
            > "$binding_dir/vite-plus.cargo-metadata.json"
          cp "${CARGO_TARGET_DIR:-target}/$BUILD_TARGET/release/vp" "$cli_dir/"
          for binary in cli_snapshots vpt; do
            binary_path="$(jq -er --arg name "$binary" \
              'select(.reason == "compiler-artifact" and .target.name == $name and .executable != null) | .executable' \
              "$RUNNER_TEMP/snapshot-test-build.json")"
            cp "$binary_path" "$snapshot_dir/$binary"
          done
          tar -czf "$RUNNER_TEMP/cli-test-binaries.tar.gz" -C "$artifact_dir" .
        env:
          BUILD_TARGET: ${{ matrix.target }}

      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: cli-test-binaries-${{ matrix.target }}
          path: ${{ runner.temp }}/cli-test-binaries.tar.gz
          if-no-files-found: error
          retention-days: 7

  # Each shard reuses the native CLI and test binaries from the platform's
  # build job. Only the TypeScript packages are built here for local-flavor
  # cases. Windows uses its cross-compiled artifacts in the separate job.
  cli-snapshot-test:
    name: CLI snapshot test (${{ matrix.target }}, shard ${{ matrix.shard }}/3)
    needs:
      - build-cli-test-binaries
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest, namespace-profile-mac-default]
        shard: [1, 2, 3]
        include:
          - os: ubuntu-latest
            target: x86_64-unknown-linux-gnu
          - os: namespace-profile-mac-default
            target: aarch64-apple-darwin
    runs-on: ${{ matrix.os }}
    steps:
      - uses: taiki-e/checkout-action@7d1e50e93dc4fb3bba58f85018fadf77898aee8b # v1.4.2
      - uses: ./.github/actions/clone

      # Fish and Zsh can both use apt or Homebrew; keep their installs sequential.
      - name: Install snapshot shells
        id: snapshot-shells
        background: true
        run: |
          for snapshot_shell in fish zsh; do
            if ! command -v "$snapshot_shell" >/dev/null 2>&1; then
              if [ "$RUNNER_OS" = 'Linux' ]; then
                sudo apt-get update
                sudo apt-get install --yes "$snapshot_shell"
              else
                brew install "$snapshot_shell"
              fi
            fi
            "$snapshot_shell" --version
          done

      # https://github.com/marketplace/actions/setup-nu
      - name: Install Nushell
        uses: hustcer/setup-nu@ccd5bb5426b05a32009c2ba967946231f3919c97 # v3.25
        with:
          version: '*'

      - uses: ./.github/actions/setup-ci-node

      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
        with:
          name: rolldown-binaries
          path: ./rolldown/packages/rolldown/src
          merge-multiple: true

      - uses: ./.github/actions/download-cli-test-binaries
        with:
          target: ${{ matrix.target }}

      - name: Install Playwright Chromium
        id: playwright
        background: true
        run: pnpm exec playwright install chromium
        env:
          PLAYWRIGHT_BROWSERS_PATH: '0'

      - name: Build with upstream
        uses: ./.github/actions/build-upstream
        with:
          target: ${{ matrix.target }}
          skip-native: true

      - name: Install Global CLI vp
        run: pnpm bootstrap-cli:ci

      # Seed both the repository pin and the default LTS before command timers
      # start. Fixtures without a version pin use LTS, not the repository pin.
      - name: Prewarm managed runtimes
        run: |
          "$HOME/.vite-plus/bin/vp" node --version
          VP_NODE_VERSION=lts "$HOME/.vite-plus/bin/vp" node --version

      - wait: [snapshot-shells, playwright]

      - name: Run PTY snapshot tests
        run: |
          export VP_SNAP_SH_BIN="$(command -v sh)"
          export VP_SNAP_BASH_BIN="$(command -v bash)"
          export VP_SNAP_ZSH_BIN="$(command -v zsh)"
          VP_SNAP_GLOBAL_VP="$HOME/.vite-plus/bin/vp" \
          VP_SNAP_JS_RUNTIME_DIR="$HOME/.vite-plus/js_runtime" \
          VP_SNAP_FISH_BIN="$(command -v fish)" \
          VP_SNAP_NU_BIN="$(command -v nu)" \
          ./target/snapshot-tests/cli_snapshots --test-threads 8
        env:
          RUST_BACKTRACE: '1'
          # Relocate fixture and helper paths while keeping the same test
          # process and VP_SNAP_SHARD partitioning as cargo test.
          CARGO_MANIFEST_DIR: ${{ github.workspace }}/crates/vp_cli_snapshots
          CARGO_BIN_EXE_vpt: ${{ github.workspace }}/target/snapshot-tests/vpt
          VP_SNAP_SHARD: ${{ matrix.shard }}/3
          VP_SNAP_ARTIFACTS_DIR: ${{ runner.temp }}/snapshot-artifacts

      - name: Upload snapshot diagnostics and timings
        if: ${{ !cancelled() }}
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: snapshot-diagnostics-${{ matrix.target }}-${{ matrix.shard }}
          path: ${{ runner.temp }}/snapshot-artifacts
          if-no-files-found: ignore
          retention-days: 7

  # Runs the PTY snapshot suite (crates/vp_cli_snapshots) on Windows with
  # BOTH vp flavors, without a Rust toolchain on the runner: the test binary
  # and vpt arrive cross-compiled in the nextest archive from
  # build-windows-tests, the global vp comes prebuilt from build-windows-cli,
  # and the JS CLI is built here (skip-native) for the local flavor.
  cli-snapshot-test-windows:
    name: CLI snapshot test (Windows, shard ${{ matrix.shard }}/3)
    needs:
      - download-previous-rolldown-binaries
      - build-windows-cli
      - build-windows-tests
    strategy:
      fail-fast: false
      matrix:
        shard: [1, 2, 3]
    # Runs on the Namespace Windows runner. This is a PTY snapshot suite that
    # opens a pseudo-console (ConPTY) and spawns vp into it. It previously stayed
    # on GitHub-hosted windows-latest because Namespace's Windows runners ran
    # under a Session-0 service account with no interactive console, where the
    # ConPTY spawn blocked and every case timed out at 60s. #2126 (vite-task
    # bump) resolved that; revert to windows-latest if it recurs.
    runs-on: namespace-profile-windows-4c-8g
    steps:
      - uses: taiki-e/checkout-action@7d1e50e93dc4fb3bba58f85018fadf77898aee8b # v1.4.2
      - uses: ./.github/actions/clone

      # Route TEMP/TMP onto a Dev Drive (ReFS): staged fixture workspaces
      # live under os.tmpdir() and must resolve pnpm junction reparse points
      # cleanly. NTFS-on-C: preserves the junction-target backslashes during
      # resolution, which produces mixed `\` / `/` paths that break Node's
      # ESM subpath-import walk-up (`#module-sync-enabled` inside
      # `@voidzero-dev/vite-plus-core` -> `ERR_PACKAGE_IMPORT_NOT_DEFINED`).
      - name: Setup Dev Drive
        uses: samypr100/setup-dev-drive@562171fe8df7401fdf582d766cd3b6ab80d5b1a0 # v4.1.0
        with:
          drive-size: 12GB
          drive-format: ReFS
          env-mapping: |
            TEMP,{{ DEV_DRIVE }}/Temp
            TMP,{{ DEV_DRIVE }}/Temp

      - name: Create TEMP/TMP on Dev Drive
        shell: bash
        run: mkdir -p "$TEMP" "$TMP"

      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
        with:
          name: windows-snapshot-test-archive

      - uses: taiki-e/install-action@ab6895351a88b908e96a4697860d4ffea5e57dbe # v2.87.27
        with:
          tool: cargo-nextest

      - uses: ./.github/actions/setup-ci-node

      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
        with:
          name: rolldown-binaries
          path: ./rolldown/packages/rolldown/src
          merge-multiple: true

      # See the cli-e2e-test job for details on the prebuilt binaries.
      - name: Download prebuilt Windows binaries
        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
        with:
          name: windows-cli-binaries

      - name: Install Playwright Chromium
        id: playwright
        background: true
        run: pnpm exec playwright install chromium
        env:
          PLAYWRIGHT_BROWSERS_PATH: '0'

      - name: Build with upstream
        uses: ./.github/actions/build-upstream
        with:
          target: x86_64-pc-windows-msvc
          skip-native: true

      - name: Install Global CLI vp
        shell: bash
        run: pnpm bootstrap-cli:ci

      # Seed both the repository pin and the default LTS before command timers
      # start. Fixtures without a version pin use LTS, not the repository pin.
      - name: Prewarm managed runtimes
        shell: bash
        run: |
          "$USERPROFILE/.vite-plus/bin/vp.exe" node --version
          VP_NODE_VERSION=lts "$USERPROFILE/.vite-plus/bin/vp.exe" node --version

      # Keep fixtures outside runner.temp: setup-node writes an .npmrc there,
      # which Yarn Classic discovers when walking parent directories.
      - name: Create NTFS temp directory for case-sensitive shim snapshots
        if: matrix.shard == 1
        id: snapshot-temp
        shell: pwsh
        run: |
          $volume = [System.IO.Path]::GetPathRoot($env:RUNNER_TEMP)
          $snapshotTemp = Join-Path $volume ('vp-snapshots-' + [guid]::NewGuid().ToString('N'))
          New-Item -ItemType Directory -Path $snapshotTemp | Out-Null
          "directory=$snapshotTemp" >> $env:GITHUB_OUTPUT

      - wait: playwright

      # `cargo-nextest` is invoked directly so the job never depends on the
      # runner's Rust toolchain. --workspace-remap makes nextest rewrite
      # CARGO_MANIFEST_DIR and CARGO_BIN_EXE_vpt to this checkout, which is
      # how the relocated test binary finds fixtures and helpers.
      - name: Run PTY snapshot tests
        shell: bash
        run: |
          # current/bin, not bin: on Windows bin\vp.exe is the trampoline,
          # which re-execs %VP_HOME%\current\bin\vp.exe; the runner gives
          # each case an isolated VP_HOME with no install inside, so the
          # trampoline would fail. current\bin\vp.exe is the real CLI.
          export VP_SNAP_GLOBAL_VP="$USERPROFILE/.vite-plus/current/bin/vp.exe"
          export VP_SNAP_JS_RUNTIME_DIR="$USERPROFILE/.vite-plus/js_runtime"
          export VP_SNAP_CMD_BIN="$(cygpath -w "$(command -v cmd.exe)")"
          # Keep pwsh at its canonical installation path; copying pwsh.exe
          # alone can break its adjacent runtime dependencies.
          export VP_SNAP_PWSH_BIN="$(cygpath -w "$(command -v pwsh.exe)")"
          # Reserve all nextest workers for cases that need the execution gate.
          # Generate the overrides from the fixtures, including automatic Ctrl-C
          # isolation, so this configuration cannot drift from the runner.
          VP_SNAP_NEXTEST_CONFIG="$RUNNER_TEMP/snapshot-nextest.toml" \
            cargo-nextest nextest list --archive-file windows-snapshot-tests.tar.zst --workspace-remap . \
            > "$RUNNER_TEMP/snapshot-test-list.txt"
          nextest_run_args=(
            --test-threads 8 --config-file "$RUNNER_TEMP/snapshot-nextest.toml"
            --archive-file windows-snapshot-tests.tar.zst --workspace-remap . --no-fail-fast
          )
          snapshot_registry=(
            node packages/tools/src/local-npm-registry.ts --snapshot-runner
            --snapshot-fixtures "$GITHUB_WORKSPACE/crates/vp_cli_snapshots/tests/cli_snapshots/registry"
            --snapshot-cache "$VP_SNAP_REGISTRY_CACHE_DIR"
          )
          run_snapshots() {
            # Keep both registries alive across nextest's one-process-per-case
            # workers. Only local-registry cases receive checkout packages.
            "${snapshot_registry[@]}" --request-log "$VP_SNAP_ARTIFACTS_DIR/shared-registry/registry.jsonl" -- \
              "${snapshot_registry[@]}" --packages-dir "$VP_SNAP_PACKAGES_DIR/packages" \
                --request-log "$VP_SNAP_ARTIFACTS_DIR/packed-registry/registry.jsonl" -- \
                cargo-nextest nextest run "${nextest_run_args[@]}" "$@"
          }
          # --no-fail-fast: on a snapshot suite every diff is diagnostic
          # signal; cancelling on the first failure hides the rest.
          test_exit=0
          # This fixture requires case-sensitive directory support, which the
          # default temp directory on these runners does not provide.
          run_snapshots --partition hash:${{ matrix.shard }}/3 \
            -E 'not test(windows_case_sensitive_shims)' || test_exit=$?

          if [[ '${{ matrix.shard }}' == '1' ]]; then
            # Run both flavors on NTFS once. Rust's GetTempPath2 ignores
            # TEMP/TMP under the SYSTEM account, so override SystemTemp.
            SystemTemp='${{ steps.snapshot-temp.outputs.directory }}' \
              run_snapshots \
                -E 'test(windows_case_sensitive_shims)' || test_exit=$?

            # Exercise the same environment wrapper under Windows PowerShell 5.1.
            VP_SNAP_PWSH_BIN="$(cygpath -w "$(command -v powershell.exe)")" \
              run_snapshots \
                -E 'test(command_env_powershell)' || test_exit=$?
          fi
          exit "$test_exit"
        env:
          RUST_BACKTRACE: '1'
          # Share immutable tarballs across nextest processes in this job.
          VP_SNAP_PACKAGES_DIR: ${{ runner.temp }}/snapshot-packages
          VP_SNAP_REGISTRY_CACHE_DIR: ${{ runner.temp }}/snapshot-registry-cache
          VP_SNAP_ARTIFACTS_DIR: ${{ runner.temp }}/snapshot-artifacts
          # Keep Windows env parity with the `test` recipe in justfile.
          __COMPAT_LAYER: RunAsInvoker

      - name: Upload snapshot diagnostics and timings
        if: ${{ !cancelled() }}
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: snapshot-diagnostics-windows-${{ matrix.shard }}
          path: ${{ runner.temp }}/snapshot-artifacts
          if-no-files-found: ignore
          retention-days: 7

  cli-e2e-test-musl:
    name: CLI E2E test (Linux x64 musl)
    needs:
      - download-previous-rolldown-binaries
    runs-on: ubuntu-latest
    steps:
      - uses: taiki-e/checkout-action@7d1e50e93dc4fb3bba58f85018fadf77898aee8b # v1.4.2
      - uses: ./.github/actions/clone

      - uses: ./.github/actions/setup-rust
        with:
          save-cache: ${{ github.ref_name == 'main' }}
          cache-key: cli-e2e-test-musl-ci

      - uses: ./.github/actions/setup-ci-node

      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
        with:
          name: rolldown-binaries
          path: ./rolldown/packages/rolldown/src
          merge-multiple: true

      # Cross-compile for musl on the glibc host
      - name: Build with upstream (musl)
        uses: ./.github/actions/build-upstream
        with:
          profile: ci
          target: x86_64-unknown-linux-musl

      # Run bootstrap-cli:ci and E2E tests inside an Alpine container where musl is native.
      # Can't run on the glibc host because NAPI .node files are musl-linked.
      - name: Run E2E in Alpine container
        run: |
          docker run --rm \
            -e CI=true \
            -e GITHUB_ACTIONS=true \
            -v "${{ github.workspace }}:/workspace" \
            -w /workspace \
            node:22-alpine3.21 sh -ec "
              apk add --no-cache bash curl ca-certificates git zip unzip

              # Install pnpm and re-resolve optional dependencies for musl.
              # The host node_modules has glibc bindings; pnpm store holds both
              # but we need to re-link the musl variants.
              # The image's Corepack expects pnpm's removed JavaScript entry point.
              npm install --global \"\$(node -p \"require('./package.json').packageManager\")\"
              pnpm install --frozen-lockfile --force

              # Download musl rolldown binding (host downloaded glibc variant)
              ROLLDOWN_VERSION=\$(node -p \"require('./rolldown/packages/rolldown/package.json').version\")
              npm pack \"@rolldown/binding-linux-x64-musl@\${ROLLDOWN_VERSION}\"
              tar -xzf \"rolldown-binding-linux-x64-musl-\${ROLLDOWN_VERSION}.tgz\"
              cp ./package/rolldown-binding.linux-x64-musl.node ./packages/core/dist/rolldown/shared/
              cp ./package/rolldown-binding.linux-x64-musl.node ./rolldown/packages/rolldown/dist/shared/
              rm -rf package *.tgz

              pnpm bootstrap-cli:ci
              . \"\$HOME/.vite-plus/env\"

              vp --version
              vp -h
              vp env doctor

              # Verify shims work
              which node
              which npm
              node --version

              # Test global package install
              vp install -g typescript
              tsc --version
              vp uninstall -g typescript

              git config --global --add safe.directory /workspace
              RUST_BACKTRACE=1 pnpm test:unit
            "

  # Regression test for #2278: Debian slim images ship no ca-certificates
  # package, and every vp command that touched the network aborted there
  # (0.1.23 to 0.2.6) or failed with a handled error (#2273). The global vp
  # is built inside a bookworm container so the binary's glibc floor matches
  # the runtime image, then runs in node:24-bookworm-slim (the image from the
  # report) where HTTPS must work through the bundled Mozilla roots fallback.
  certless-image-test:
    needs: detect-changes
    if: needs.detect-changes.outputs.code-changed == 'true'
    name: Cert-less image E2E test
    runs-on: ubuntu-latest
    timeout-minutes: 30
    steps:
      - uses: taiki-e/checkout-action@7d1e50e93dc4fb3bba58f85018fadf77898aee8b # v1.4.2
      - uses: ./.github/actions/clone

      - uses: ./.github/actions/setup-rust
        with:
          save-cache: ${{ github.ref_name == 'main' }}
          cache-key: certless-image-test

      # Mounting the host rustup and cargo homes reuses the pinned nightly
      # that setup-rust installed and the restored registry cache, so the
      # container downloads nothing on a warm run (rustup dist binaries
      # target glibc 2.17 and run on bookworm's 2.36). `rustup show` still
      # installs the toolchain if the mount misses it.
      - name: Build the global vp in a bookworm container
        run: |
          docker run --rm \
            -v "${{ github.workspace }}:/work" \
            -v "$HOME/.rustup:/usr/local/rustup" \
            -v "$HOME/.cargo/registry:/usr/local/cargo/registry" \
            -v "$HOME/.cargo/git:/usr/local/cargo/git" \
            -w /work rust:1-bookworm bash -c '
              set -e
              apt-get update -qq && apt-get install -y -qq --no-install-recommends cmake python3
              rustup show
              cargo build -p vp_global_cli
            '

      # Docker creates files as root. The host cache action must read and clean them.
      - name: Restore Cargo cache ownership
        run: sudo chown -R "$(id -u):$(id -g)" "$HOME/.cargo/registry" "$HOME/.cargo/git" target

      - name: Run vp in node:24-bookworm-slim without a CA store
        run: |
          docker run --rm \
            -v "${{ github.workspace }}/target/debug/vp:/usr/local/bin/vp:ro" \
            node:24-bookworm-slim bash -c '
              set -ex
              # The image must actually lack the CA bundle, or this job stops
              # guarding anything.
              test ! -e /etc/ssl/certs/ca-certificates.crt
              # Exercise commands on the mounted build without installing a published package.
              touch /usr/local/bin/.vp-setup-complete
              vp --version
              # HTTPS to nodejs.org through the shared client; exits nonzero
              # without the bundled-roots fallback.
              vp env list-remote --lts --json > /tmp/vp-versions.json
              node -e "const versions = require(\"/tmp/vp-versions.json\"); if (!versions.node?.length) process.exit(1)"
            '

  install-e2e-test:
    name: Local CLI `vp install` E2E test
    needs:
      - build-cli-test-binaries
    runs-on: ubuntu-latest
    # Run if: not a PR, OR PR has 'test: install-e2e' label
    if: >-
      github.event_name != 'pull_request' ||
      contains(github.event.pull_request.labels.*.name, 'test: install-e2e')
    steps:
      - uses: taiki-e/checkout-action@7d1e50e93dc4fb3bba58f85018fadf77898aee8b # v1.4.2
      - uses: ./.github/actions/clone

      - uses: ./.github/actions/setup-ci-node

      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
        with:
          name: rolldown-binaries
          path: ./rolldown/packages/rolldown/src
          merge-multiple: true

      - uses: ./.github/actions/download-cli-test-binaries
        with:
          target: x86_64-unknown-linux-gnu

      - name: Build with upstream
        uses: ./.github/actions/build-upstream
        with:
          target: x86_64-unknown-linux-gnu
          skip-native: true

      - name: Build CLI
        run: |
          pnpm bootstrap-cli:ci
          echo "$HOME/.vite-plus/bin" >> $GITHUB_PATH

      - name: Run local CLI `vp install`
        run: |
          export PATH=$PWD/node_modules/.bin:$PATH
          vp -h
          # Test vp install on various repositories with different package managers
          # Entry format: "owner/repo:dir" or "owner/repo:dir:ref" (tag or branch to clone)
          repos=(
            # pnpm workspace
            # Keep a fixed pnpm 11 workspace for compatibility coverage.
            "pnpm/pnpm:pnpm:v11.11.0"
            "vitejs/vite:vite"
            # yarn workspace
            "napi-rs/napi-rs:napi-rs"
            "toeverything/AFFiNE:AFFiNE"
            # npm workspace
            "npm/cli:npm"
            "redhat-developer/vscode-extension-tester:vscode-extension-tester"
          )

          for repo_info in "${repos[@]}"; do
            IFS=':' read -r repo dir_name ref <<< "$repo_info"
            echo "Testing vp install on $repo${ref:+ ($ref)}…"
            # remove the directory if it exists
            if [ -d "$RUNNER_TEMP/$dir_name" ]; then
              rm -rf "$RUNNER_TEMP/$dir_name"
            fi
            clone_args=(--depth 1)
            if [ -n "$ref" ]; then
              clone_args+=(--branch "$ref")
            fi
            git clone "${clone_args[@]}" "https://github.com/$repo.git" "$RUNNER_TEMP/$dir_name"
            cd "$RUNNER_TEMP/$dir_name"
            vp install --no-frozen-lockfile
            # run again to show install cache increase by time
            time vp install
            echo "✓ Successfully installed dependencies for $repo"
            echo ""
          done

  install-e2e-test-sfw:
    name: Local CLI `vp install` E2E test (Socket Firewall Free)
    env:
      # Includes nodejs/node#61999 (first backported in Node 24.20.0).
      # Override vp's project pins; sfw's embedded Node runtime is separate.
      VP_NODE_VERSION: '24.21.0'
    needs:
      - build-cli-test-binaries
    # Run if: not a PR (push-to-main / workflow_dispatch), OR PR has 'test: sfw' label.
    # Heavy job (real registry traffic) — gated to avoid running on every PR.
    if: >-
      github.event_name != 'pull_request' ||
      contains(github.event.pull_request.labels.*.name, 'test: sfw')
    strategy:
      fail-fast: false
      matrix:
        include:
          - os: ubuntu-latest
            target: x86_64-unknown-linux-gnu
            sfw_asset: sfw-free-linux-x86_64
            vp_bin: vp
            # Only Linux needs the TLS-bypass: the ubuntu-latest runner
            # doesn't preinstall Node 22.18 into vp's cache, so vp's HttpClient
            # (rustls) fetches `nodejs.org/.../SHASUMS256.txt` through sfw and
            # hits the upstream EKU bug. macOS/Windows runners ship Node in
            # vp's cache already, so vp never calls its HttpClient through sfw
            # in this test — leave the verification on there.
            vp_insecure_tls: '1'
          - os: namespace-profile-mac-default
            target: aarch64-apple-darwin
            sfw_asset: sfw-free-macos-arm64
            vp_bin: vp
            vp_insecure_tls: ''
          # TODO: Restore Windows in a separate job that needs build-windows-cli
          # when SFW's embedded Node includes
          # https://github.com/nodejs/node/pull/61999 (Node 24.20.0 / 26.7.0).
          # SFW 1.15.2 embeds Node 24.9.0 and hits UV_HANDLE_CLOSING at shutdown.
          # VP_NODE_VERSION only changes the child runtime, not SFW's runtime.
          # - os: namespace-profile-windows-4c-8g
          #   target: x86_64-pc-windows-msvc
          #   sfw_asset: sfw-free-windows-x86_64.exe
          #   # SFW spawns directly without PATHEXT, so use vp.exe on Windows.
          #   vp_bin: vp.exe
          #   vp_insecure_tls: ''
    runs-on: ${{ matrix.os }}
    steps:
      - uses: taiki-e/checkout-action@7d1e50e93dc4fb3bba58f85018fadf77898aee8b # v1.4.2
      - uses: ./.github/actions/clone

      - uses: ./.github/actions/setup-ci-node

      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
        with:
          name: rolldown-binaries
          path: ./rolldown/packages/rolldown/src
          merge-multiple: true

      - uses: ./.github/actions/download-cli-test-binaries
        with:
          target: ${{ matrix.target }}

      - name: Build with upstream
        uses: ./.github/actions/build-upstream
        with:
          target: ${{ matrix.target }}
          skip-native: true

      - name: Build CLI
        run: |
          pnpm bootstrap-cli:ci
          # Mirror the per-OS path form used by the `test` job (ci.yml ~L266):
          # GITHUB_PATH on Windows needs a Windows-style path, otherwise child
          # processes spawned by tools like sfw (which use CreateProcess and
          # not bash's PATH munging) can't resolve `vp.exe`.
          if [[ "$RUNNER_OS" == "Windows" ]]; then
            echo "$USERPROFILE\.vite-plus\bin" >> $GITHUB_PATH
          else
            echo "$HOME/.vite-plus/bin" >> $GITHUB_PATH
          fi

      - name: Prepare Node.js for SFW tests
        # Download the selected runtime before entering sfw's proxy.
        run: vp env exec node --version

      - name: Download sfw
        run: |
          set -euo pipefail
          mkdir -p "$RUNNER_TEMP/sfw-bin"
          # `--remove-on-error` (curl 7.83+) prevents leaving a zero-byte file
          # on failure so the next step's `sfw --version` fails clearly rather
          # than with "exec format error" on an empty binary.
          curl --fail --location --remove-on-error --retry 3 --retry-delay 2 \
            --output "$RUNNER_TEMP/sfw-bin/sfw${{ runner.os == 'Windows' && '.exe' || '' }}" \
            "https://github.com/SocketDev/sfw-free/releases/latest/download/${{ matrix.sfw_asset }}"
          if [[ "${{ runner.os }}" != "Windows" ]]; then
            chmod +x "$RUNNER_TEMP/sfw-bin/sfw"
          fi
          echo "$RUNNER_TEMP/sfw-bin" >> "$GITHUB_PATH"

      - name: Verify sfw and embedded Node versions
        run: |
          printf '%s\n' 'console.error("SFW embedded Node:", process.version, process.execPath);' \
            > "$RUNNER_TEMP/sfw-node-version.cjs"
          NODE_OPTIONS="--require=\"$RUNNER_TEMP/sfw-node-version.cjs\"" sfw --version

      - name: Run `sfw vp install` against a real repo
        # TODO(SocketDev/sfw-free#30, SocketDev/sfw-free#43): drop `vp_insecure_tls`
        # from the Linux matrix entry once sfw ships the EKU fix. Verified
        # against sfw v1.11.0 (releases/latest as of 2026-05-28): on Linux,
        # vp's HTTPS request to nodejs.org through sfw still fails with
        # "invalid peer certificate: UnknownIssuer" because sfw's CA carries a
        # present-but-empty Extended Key Usage extension that rustls rejects.
        # macOS/Windows runners cache Node 22.18 in vp's directory, so vp
        # doesn't call its HttpClient through sfw — leaving TLS verification
        # enabled there gives us coverage that the bypass *isn't* used on
        # those platforms.
        env:
          VP_INSECURE_TLS: ${{ matrix.vp_insecure_tls }}
        run: |
          set -euo pipefail
          sfw "${{ matrix.vp_bin }}" env exec node --version
          # Force the registry-fetch path: install a pinned pnpm globally so
          # vp downloads it (and therefore traverses sfw) rather than reusing
          # whatever's preinstalled on the runner.
          sfw "${{ matrix.vp_bin }}" i -g pnpm@9.15.0
          # Then exercise `vp install` inside a real repo, also through sfw.
          git clone --depth 1 https://github.com/vitejs/vite.git "$RUNNER_TEMP/vite"
          cd "$RUNNER_TEMP/vite"
          sfw "${{ matrix.vp_bin }}" install --no-frozen-lockfile

  done:
    runs-on: ubuntu-latest
    if: always()
    needs:
      - docs-fmt
      - test
      - build-windows-tests
      - test-windows
      - build-windows-cli
      - test-musl
      - lint
      - cli-e2e-test
      - cli-e2e-test-musl
      - certless-image-test
      - build-cli-test-binaries
      - cli-snapshot-test
      - cli-snapshot-test-windows
      # Skipped on unlabeled PRs; counted on push-to-main and labeled PRs.
      # `contains(needs.*.result, 'failure')` ignores "skipped" results.
      - install-e2e-test
      - install-e2e-test-sfw
    steps:
      - run: exit 1
        # Thank you, next https://github.com/vercel/next.js/blob/canary/.github/workflows/build_and_test.yml#L379
        if: ${{ contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled') }}