vindicate-actions

CI building blocks for projects scaffolded by Vindicate. Everything here runs Playwright tests, generates a report, and writes a summary — nothing here ever sends data to a third-party server. All artifacts stay in GitHub's own artifact storage; the results summary uses GitHub's native job-summary feature, not a marketplace reporting action.

Assumes the calling repo already has @playwright/test installed and a working playwright.config.ts — these actions run your tests, they don't set up the project.

Usage

Three composite actions, used directly in your own workflow — no wrapper, no hidden matrix. Env vars and secrets go in your own env: block, the same way as any other GitHub Actions job.

name: vindicate playwright tests
on:
  push:
    branches: ["main"]
  pull_request:
    branches: ["main"]
  workflow_dispatch:

jobs:
  run-tests:
    strategy:
      matrix:
        shardIndex: [1, 2]
    env:
      BASE_URL: ${{ vars.BASE_URL }}
      AUTH_EMAIL: ${{ secrets.AUTH_EMAIL }}
    steps:
      - uses: OpenEvident/vindicate-actions/setup@v1
      - uses: OpenEvident/vindicate-actions/run-shard@v1
        with:
          shard-index: ${{ matrix.shardIndex }}
          total-shards: 2

  merge-reports:
    needs: [run-tests]
    if: always()
    steps:
      - uses: OpenEvident/vindicate-actions/setup@v1
      - uses: OpenEvident/vindicate-actions/merge-reports@v1

What's here

Path	What it does
setup/	Checkout, actions/setup-node, install dependencies.
run-shard/	Install the Playwright browser, run one shard, upload its blob report as a native GitHub Actions artifact.
merge-reports/	Merge blob reports into HTML/JSON/JUnit, write a Markdown job summary from the JSON report (native GITHUB_STEP_SUMMARY, no third-party reporting action), upload the HTML report and results as artifacts.
.github/workflows/release.yml	Maintainer-only: tags a release and force-moves the floating major tag.

Inputs

setup

Input	Default	What it does
node-version	"22"	Node.js version to install
cache-dependency-path	"package-lock.json"	Path passed to actions/setup-node's cache key
install-command	"npm ci"	Command used to install dependencies

run-shard

Input	Default	What it does
shard-index	(required)	Index of this shard, 1-based
total-shards	"2"	Total number of shards
browser	"chromium"	Playwright browser to install
test-args	""	Extra arguments appended to playwright test
blob-retention-days	"7"	Retention (days) for the uploaded blob-report artifact

merge-reports

Input	Default	What it does
html-retention-days	"14"	Retention (days) for the uploaded HTML report artifact

Versioning

Follows the standard GitHub Actions convention: immutable release tags (v1.2.3) plus a floating major tag (v1) that always points at the latest v1.x.x. Reference @v1 to get fixes and improvements automatically with no change to your own workflow file; reference @v1.2.3 if you want to pin to an exact, immutable version instead.

Security

Every actions/* dependency this repo uses internally is pinned to a full commit SHA (with the version as a comment), not a mutable tag — the OpenSSF Scorecard convention for supply-chain hardening. This repo itself uses zero third-party marketplace actions in its own tooling: release automation uses the gh CLI (already on GitHub-hosted runners), and CI lints every workflow/action file with actionlint, installed via its own SHA-pinned install script rather than a marketplace action. Dependabot (github-actions ecosystem) keeps the SHA pins themselves current.

No CodeQL here — this repo has no user input, network calls, or app logic for it to meaningfully analyze; actionlint catches the class of mistakes that actually apply to workflow/action files. CONTRIBUTING/CODE_OF_CONDUCT aren't duplicated here either — they're inherited from OpenEvident/.github, GitHub's default community health file mechanism, unless this repo ends up needing its own override.

License

Apache License, Version 2.0. See LICENSE.