From a2749ad8109c7f8cf262098a4deb74360deeae32 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Tue, 12 May 2026 13:49:08 +0000
Subject: [PATCH 1/3] Initial plan


From 80d31c5f43570fd79ef163e3e1726e1a924dcc72 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Tue, 12 May 2026 13:50:24 +0000
Subject: [PATCH 2/3] Fix CI: upload/download npm tarball artifact between
 build and test jobs

Agent-Logs-Url: https://github.com/DevExpress/testcafe-browser-provider-browserstack/sessions/401193be-b017-479a-b361-92fab77525ca

Co-authored-by: aleks-pro <14822473+aleks-pro@users.noreply.github.com>
---
 .github/workflows/test.yml | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index d306cdf..f79f588 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -14,13 +14,22 @@ jobs:
       - uses: DevExpress/testcafe-build-system/actions/prepare@main
       
       - uses: DevExpress/testcafe-build-system/actions/build@main
-      
+
+      - uses: actions/upload-artifact@v4
+        with:
+          name: npm-package
+          path: .builds/*.tgz
      
   test:
     runs-on: ubuntu-latest
     needs: [build]
     steps:
       - uses: DevExpress/testcafe-build-system/actions/prepare@main
+
+      - uses: actions/download-artifact@v4
+        with:
+          name: npm-package
+          path: .builds
       
       - uses: DevExpress/testcafe-build-system/actions/test-npm@main
         env:

From d3ca0f9d0d661a8dae673c3750a8360f56643c85 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Tue, 12 May 2026 13:52:37 +0000
Subject: [PATCH 3/3] Fix CVE: pin actions/download-artifact to v4.3.0 to avoid
 Arbitrary File Write vulnerability

Agent-Logs-Url: https://github.com/DevExpress/testcafe-browser-provider-browserstack/sessions/401193be-b017-479a-b361-92fab77525ca

Co-authored-by: aleks-pro <14822473+aleks-pro@users.noreply.github.com>
---
 .github/workflows/test.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index f79f588..1513ec1 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -26,7 +26,7 @@ jobs:
     steps:
       - uses: DevExpress/testcafe-build-system/actions/prepare@main
 
-      - uses: actions/download-artifact@v4
+      - uses: actions/download-artifact@v4.3.0
         with:
           name: npm-package
           path: .builds