fix(ci): align vendored Vitest dependencies before install

Author: fengmk2

.github/actions/clone/action.yml

@@ -47,6 +47,12 @@ runs:
         ref: ${{ steps.upstream-versions.outputs.ROLLDOWN_VITE_HASH }}
         persist-credentials: false
 
+    # Match the manifests used by sync-remote when it generated the root lockfile.
+    # setup-node installs with --frozen-lockfile, so this must run before it.
+    - name: Align vendored Vitest dependencies
+      shell: bash
+      run: node packages/tools/src/vendored-vitest.mjs
+
     # Disable autocrlf to preserve LF line endings on Windows
     # This prevents prettier/eslint from failing with "Delete ␍" errors
     - name: Configure git for LF line endings

.typos.toml

@@ -1,3 +1,7 @@
+[default]
+# Vitest v4 used this misspelled directory; the migrator must recognize it.
+extend-ignore-re = ['\.vitest-attachements\b']
+
 [default.extend-words]
 ratatui = "ratatui"
 PUNICODE = "PUNICODE"

packages/tools/src/__tests__/sync-remote-deps.spec.ts

@@ -1,18 +1,114 @@
-import { mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
+import { spawnSync } from 'node:child_process';
+import { copyFileSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 
 import * as semver from 'semver';
 import { describe, expect, test } from 'vitest';
+import * as yaml from 'yaml';
 
+import { VITEST_VERSION } from '../../../cli/src/utils/constants.ts';
 import {
-  alignVendoredVitestDependencies,
   mergePnpmWorkspaces,
   syncCargoOxcVersions,
   syncViteDevtoolsDependencies,
 } from '../sync-remote-deps.ts';
+import { alignVendoredVitestDependencies } from '../vendored-vitest.mjs';
 
 describe('vendored Vitest v5 bridge', () => {
+  test('can be imported from stdin without running the bootstrap', () => {
+    const root = mkdtempSync(join(tmpdir(), 'vp-vendored-vitest-import-'));
+    try {
+      const url = new URL('../vendored-vitest.mjs', import.meta.url).href;
+      const result = spawnSync(process.execPath, ['--input-type=module', '-'], {
+        cwd: root,
+        encoding: 'utf8',
+        input: `import ${JSON.stringify(url)};`,
+      });
+      expect(result.stderr).toBe('');
+      expect(result.status).toBe(0);
+    } finally {
+      rmSync(root, { recursive: true, force: true });
+    }
+  });
+
+  test('keeps the bootstrap runtime pin in sync with the root catalog', () => {
+    const workspace = yaml.parse(
+      readFileSync(new URL('../../../../pnpm-workspace.yaml', import.meta.url), 'utf8'),
+    );
+    expect(workspace.catalog.vitest).toBe(VITEST_VERSION);
+  });
+
+  test.each(['4.1.10', '^5.0.0', '5.1.0-beta.1'])(
+    'rejects an unsupported bootstrap runtime pin %s before changing manifests',
+    (version) => {
+      const root = mkdtempSync(join(tmpdir(), 'vp-vendored-vitest-bootstrap-'));
+      try {
+        const constantsDir = join(root, 'packages/cli/src/utils');
+        mkdirSync(constantsDir, { recursive: true });
+        writeFileSync(
+          join(constantsDir, 'constants.ts'),
+          `export const VITEST_VERSION = '${version}';\n`,
+        );
+        const script = join(root, 'vendored-vitest.mjs');
+        copyFileSync(new URL('../vendored-vitest.mjs', import.meta.url), script);
+        const result = spawnSync(process.execPath, [script], { cwd: root, encoding: 'utf8' });
+        expect(result.status).not.toBe(0);
+        expect(result.stderr).toContain('VITEST_VERSION must declare an exact stable v5 version');
+      } finally {
+        rmSync(root, { recursive: true, force: true });
+      }
+    },
+  );
+
+  test.each(['5.0.0', '5.1.2'])(
+    'runs before dependency installation with the selected %s runtime pin',
+    (version) => {
+      const root = mkdtempSync(join(tmpdir(), 'vp-vendored-vitest-bootstrap-'));
+      try {
+        const constantsDir = join(root, 'packages/cli/src/utils');
+        mkdirSync(constantsDir, { recursive: true });
+        writeFileSync(
+          join(constantsDir, 'constants.ts'),
+          `export const VITEST_VERSION = '${version}';\n`,
+        );
+        // Copy the entry point outside the repo so it cannot resolve node_modules.
+        const script = join(root, 'vendored-vitest.mjs');
+        copyFileSync(new URL('../vendored-vitest.mjs', import.meta.url), script);
+        for (const vendor of ['vite', 'rolldown']) {
+          mkdirSync(join(root, vendor, 'packages', vendor), { recursive: true });
+          writeFileSync(
+            join(root, vendor, 'packages', vendor, 'package.json'),
+            JSON.stringify({
+              dependencies: { '@vitest/utils': '4.1.10' },
+              devDependencies: { vitest: 'catalog:' },
+              optionalDependencies: { '@vitest/spy': '^4.1.10' },
+            }),
+          );
+        }
+        const run = () => spawnSync(process.execPath, [script], { cwd: root, encoding: 'utf8' });
+        const first = run();
+        expect(first.stderr).toBe('');
+        expect(first.status).toBe(0);
+        const manifests = ['vite', 'rolldown'].map((vendor) =>
+          join(root, vendor, 'packages', vendor, 'package.json'),
+        );
+        const sources = manifests.map((file) => readFileSync(file, 'utf8'));
+        for (const source of sources) {
+          expect(JSON.parse(source)).toEqual({
+            dependencies: { '@vitest/utils': version },
+            devDependencies: { vitest: 'catalog:' },
+            optionalDependencies: { '@vitest/spy': version },
+          });
+        }
+        expect(run().status).toBe(0);
+        expect(manifests.map((file) => readFileSync(file, 'utf8'))).toEqual(sources);
+      } finally {
+        rmSync(root, { recursive: true, force: true });
+      }
+    },
+  );
+
   test('resolves the reviewed Vitest major catalog conflict', () => {
     const merged = mergePnpmWorkspaces(
       { catalog: { vitest: '5.0.0' } },

packages/tools/src/sync-remote-deps.ts

@@ -1,9 +1,14 @@
 import { execSync, spawnSync } from 'node:child_process';
-import { existsSync, readFileSync, readdirSync, rmSync, writeFileSync } from 'node:fs';
+import { existsSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
 import { join } from 'node:path';
 import { parseArgs } from 'node:util';
 
 import upstreamVersions from '../.upstream-versions.json' with { type: 'json' };
+import {
+  alignVendoredVitestDependencies,
+  REMOVED_VITEST_PACKAGES,
+  VITEST_EXACT_VERSION_PACKAGES,
+} from './vendored-vitest.mjs';
 
 interface PnpmWorkspace {
   packages?: string[];
@@ -370,65 +375,6 @@ const OXC_PACKAGES = new Set([
   'oxlint',
   'oxlint-tsgolint',
 ]);
-// These official packages share the runner version selected by upgrade-deps.ts.
-// Community packages, such as browser-webdriverio, have independent versions.
-const VITEST_EXACT_VERSION_PACKAGES = new Set([
-  'vitest',
-  '@vitest/browser',
-  '@vitest/browser-playwright',
-  '@vitest/browser-preview',
-  '@vitest/coverage-v8',
-  '@vitest/coverage-istanbul',
-  '@vitest/mocker',
-  '@vitest/pretty-format',
-  '@vitest/snapshot',
-  '@vitest/spy',
-  '@vitest/ui',
-  '@vitest/utils',
-  '@vitest/web-worker',
-]);
-const REMOVED_VITEST_PACKAGES = new Set(['@vitest/runner', '@vitest/expect']);
-
-export function alignVendoredVitestDependencies(rootDir: string, version: string): void {
-  for (const vendor of [VITE_DIR, ROLLDOWN_DIR]) {
-    const packagesDir = join(rootDir, vendor, 'packages');
-    const dirs = [
-      join(rootDir, vendor),
-      ...readdirSync(packagesDir, { withFileTypes: true })
-        .filter((entry) => entry.isDirectory())
-        .map((entry) => join(packagesDir, entry.name)),
-    ];
-    for (const dir of dirs) {
-      const file = join(dir, 'package.json');
-      if (!existsSync(file)) {
-        continue;
-      }
-      const source = readFileSync(file, 'utf8');
-      const pkg = JSON.parse(source) as Record<string, Record<string, string>>;
-      let changed = false;
-      for (const field of ['dependencies', 'devDependencies', 'optionalDependencies']) {
-        for (const name of Object.keys(pkg[field] ?? {})) {
-          if (REMOVED_VITEST_PACKAGES.has(name)) {
-            throw new Error(`Migrate removed ${name} use in ${file} before synchronizing Vitest`);
-          }
-          if (!VITEST_EXACT_VERSION_PACKAGES.has(name)) {
-            continue;
-          }
-          // Only the default catalog is aligned during sync; named catalogs can still use v4.
-          if (pkg[field][name] !== version && pkg[field][name] !== 'catalog:') {
-            pkg[field][name] = version;
-            changed = true;
-          }
-        }
-      }
-      if (changed) {
-        writeFileSync(file, `${JSON.stringify(pkg, null, 2)}\n`);
-        log(`Aligned Vitest dependencies in ${file} to ${version}`);
-      }
-    }
-  }
-}
-
 // These packages should always use the highest version
 function syncedPackages(packageName: string): boolean {
   if (OXC_PACKAGES.has(packageName) || packageName === 'tinybench') {

packages/tools/src/vendored-vitest.d.mts

@@ -0,0 +1,3 @@
+export const VITEST_EXACT_VERSION_PACKAGES: Set<string>;
+export const REMOVED_VITEST_PACKAGES: Set<string>;
+export function alignVendoredVitestDependencies(rootDir: string, version: string): void;

packages/tools/src/vendored-vitest.mjs

@@ -0,0 +1,83 @@
+import { existsSync, readFileSync, readdirSync, realpathSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+// This module runs before dependency installation and Node.js setup in CI.
+// Keep it as plain JavaScript with only built-in imports.
+// These official packages share the runner version selected by upgrade-deps.ts.
+// Community packages, such as browser-webdriverio, have independent versions.
+export const VITEST_EXACT_VERSION_PACKAGES = new Set([
+  'vitest',
+  '@vitest/browser',
+  '@vitest/browser-playwright',
+  '@vitest/browser-preview',
+  '@vitest/coverage-v8',
+  '@vitest/coverage-istanbul',
+  '@vitest/mocker',
+  '@vitest/pretty-format',
+  '@vitest/snapshot',
+  '@vitest/spy',
+  '@vitest/ui',
+  '@vitest/utils',
+  '@vitest/web-worker',
+]);
+export const REMOVED_VITEST_PACKAGES = new Set(['@vitest/runner', '@vitest/expect']);
+
+/**
+ * @param {string} rootDir
+ * @param {string} version
+ */
+export function alignVendoredVitestDependencies(rootDir, version) {
+  for (const vendor of ['vite', 'rolldown']) {
+    const packagesDir = join(rootDir, vendor, 'packages');
+    const dirs = [
+      join(rootDir, vendor),
+      ...readdirSync(packagesDir, { withFileTypes: true })
+        .filter((entry) => entry.isDirectory())
+        .map((entry) => join(packagesDir, entry.name)),
+    ];
+    for (const dir of dirs) {
+      const file = join(dir, 'package.json');
+      if (!existsSync(file)) {
+        continue;
+      }
+      const source = readFileSync(file, 'utf8');
+      const pkg = JSON.parse(source);
+      let changed = false;
+      for (const field of ['dependencies', 'devDependencies', 'optionalDependencies']) {
+        for (const name of Object.keys(pkg[field] ?? {})) {
+          if (REMOVED_VITEST_PACKAGES.has(name)) {
+            throw new Error(`Migrate removed ${name} use in ${file} before synchronizing Vitest`);
+          }
+          if (!VITEST_EXACT_VERSION_PACKAGES.has(name)) {
+            continue;
+          }
+          // Only the default catalog is aligned during sync; named catalogs can still use v4.
+          if (pkg[field][name] !== version && pkg[field][name] !== 'catalog:') {
+            pkg[field][name] = version;
+            changed = true;
+          }
+        }
+      }
+      if (changed) {
+        writeFileSync(file, `${JSON.stringify(pkg, null, 2)}\n`);
+      }
+    }
+  }
+}
+
+if (
+  process.argv[1] &&
+  existsSync(process.argv[1]) &&
+  fileURLToPath(import.meta.url) === realpathSync(process.argv[1])
+) {
+  const rootDir = process.cwd();
+  // upgrade-deps.ts keeps this exact runtime pin in sync with the root catalog.
+  // Read the declaration without loading TypeScript or an installed YAML parser.
+  const constants = readFileSync(join(rootDir, 'packages/cli/src/utils/constants.ts'), 'utf8');
+  const version = constants.match(/^export const VITEST_VERSION = '(5\.\d+\.\d+)';\r?$/m)?.[1];
+  if (!version) {
+    throw new Error('VITEST_VERSION must declare an exact stable v5 version');
+  }
+  alignVendoredVitestDependencies(rootDir, version);
+}