test:python fails on fork PRs: it loads test/api suites that throw without TEST_USER_TOKEN

[l2ysho]

Note

TL;DR — test:python is the only test script missing --exclude ./test/api. Vitest loads those files anyway, they throw at import without a token, and fork PRs get no secrets. Result: all 8 Python Support legs red, zero Python tests involved. One-word fix in package.json.

pnpm run test:python loads the test/api suites, which throw at import time when TEST_USER_TOKEN is unset. Python tests need no Apify token, so the whole Python Support matrix goes red on every fork PR for a reason unrelated to Python.

Cause

test:python is the only test script without --exclude ./test/api (package.json):

test:local   → --exclude ./test/api --exclude ./test/e2e
test:e2e     → --exclude ./test/api
test:api     → --exclude ./test/e2e
test:python  → (nothing)

Vitest loads every test file before filtering by --testNamePattern, so test/api/**/*.test.ts get imported. They import test/__setup__/config.ts, which throws at module scope:

if (!ENV_TEST_USER_TOKEN) {
	throw Error('You must configure "TEST_USER_TOKEN" environment variable to run tests!');
}

GitHub does not pass repo secrets to pull_request runs from forks, so secrets.APIFY_TEST_USER_API_TOKEN resolves to an empty string there. Six suites fail to collect and the job fails, with zero Python tests involved.

Evidence

PR #1332 (fork PR), run https://github.com/apify/apify-cli/actions/runs/31963514484:

• Local Tests — green on all 6 legs (test:local excludes ./test/api)
• Python Support — red on all 8 legs
• API Tests — red, and legitimately so: those tests do need the token

Fix

Minimal:

"test:python": "vitest run --testNamePattern \"\\[python\\]\" --exclude ./test/api",

This drops test/api/__fixtures__/commands/python/python-scrapy-template-works.test.ts from the Python job. It is tagged [python] [api] and its name also matches the test:api pattern, so the API job still covers it — no loss of coverage in internal CI.

More thorough: move the token check in test/__setup__/config.ts out of module scope into the setup hook, so filtered-out tests never trip it. Costs a small refactor across the 6 importers, but makes any future script immune to the same trap.

Out of scope

The API Tests job cannot be made green on fork PRs — it genuinely needs the secret. Separate decision: either skip it on forks via
github.event.pull_request.head.repo.full_name == github.repository, or re-run the branch from an internal branch. Note that skipping the Python matrix the same way would break the test_python_support_result aggregate gate, which asserts result == 'success' and would see 'skipped'.

pull_request_target is not an option — it would run fork code with the Apify test-user token.

🤖 Generated with Claude Code