Fix test workflow artifact handoff and pin artifact actions to patched versions

[Copilot]

The test job expected .builds/testcafe-browser-provider-browserstack-1.15.2.tgz, but the tarball is produced in a separate build job and was not transferred across job boundaries. This PR adds explicit artifact handoff and pins artifact actions to patched versions.

• Workflow artifact handoff between jobs

  • Upload .builds/*.tgz in build
  • Download the same artifact into .builds in test before test-npm

• Action version pinning for security

  • Pin actions/download-artifact to v4.1.3 (patched for the arbitrary file write advisory)
  • Pin actions/upload-artifact to v4.6.2 for explicit, stable action resolution

• Resulting workflow behavior

  • test now receives the tarball at the expected path from build instead of assuming a shared filesystem

- uses: actions/upload-artifact@v4.6.2
  with:
    name: npm-package
    path: .builds/*.tgz

- uses: actions/download-artifact@v4.1.3
  with:
    name: npm-package
    path: .builds

Original prompt

Fix the failing GitHub Actions workflow in repository DevExpress/testcafe-browser-provider-browserstack.

Context:

• Workflow file: .github/workflows/test.yml
• Failing run: https://github.com/DevExpress/testcafe-browser-provider-browserstack/actions/runs/25741951689/job/75594666910
• The test job fails because it tries to access .builds/testcafe-browser-provider-browserstack-1.15.2.tgz, but that file does not exist in the test job workspace.
• Build and test are separate jobs, so filesystem outputs from build are not automatically available in test.
• The build job logs show that the tarball testcafe-browser-provider-browserstack-1.15.2.tgz is created successfully before a later unrelated npm error No workspaces found! message.

Requested fix:

• Update the workflow so that the package tarball produced in the build job is persisted and made available to the test job.
• Preferred approach: upload .builds/*.tgz as an artifact in the build job and download it into .builds in the test job before DevExpress/testcafe-build-system/actions/test-npm@main runs.
• Keep the change focused on fixing the failing workflow.

Acceptance criteria:

• The test job can access the expected tarball path .builds/testcafe-browser-provider-browserstack-1.15.2.tgz.
• The workflow remains valid GitHub Actions YAML.
• The PR should contain only the minimal workflow changes needed to fix this issue.

The following is the prior conversation context from the user's chat exploration (may be truncated):

User: Please find a solution for this failing job. Use the logs, job definition, and any referenced files where the failure occurred. Keep your response focused on the solution and include code suggestions when appropriate.

Assistant: The failure is caused by the test job trying to unpack a package tarball that was never made available in that job:

• Failing log: .builds/testcafe-browser-provider-browserstack-1.15.2.tgz: Cannot open: No such file or directory
• The expected filename comes from package.json version 1.15.2 in package.json.
• The workflow separates build and test into different jobs in .github/workflows/test.yml, but the test job only runs prepare and test-npm; it does not receive the .builds output from build.

Solution: make the package artifact available to the test job, or build it again there.

Recommended fix: upload .builds in build, then download it in test.

name: Tests

on:
  push:
    branches:
      - master
  pull_request_target:
  workflow_dispatch:

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - uses: DevExpress/testcafe-build-system/actions/prepare@main
      - uses: DevExpress/testcafe-build-system/actions/build@main

      - name: Upload package artifact
        uses: actions/upload-artifact@v4
        with:
          name: npm-package
          path: .builds/*.tgz

  test:
    runs-on: ubuntu-latest
    needs: [build]
    steps:
      - uses: DevExpress/testcafe-build-system/actions/prepare@main

      - name: Download package artifact
        uses: actions/download-artifact@v4
        with:
          name: npm-package
          path: .builds

      - uses: DevExpress/testcafe-build-system/actions/test-npm@main
        env:
          BROWSERSTACK_USERNAME: ${{ secrets.BROWSERSTACK_USERNAME }}
          BROWSERSTACK_ACCESS_KEY: ${{ secrets.BROWSERSTACK_ACCESS_KEY }}
        with:
          task: test

Alternative fix: if test-npm only needs the tarball and not a separately produced artifact, rebuild in the test job before running tests:

  test:
    runs-on: ubuntu-latest
    needs: [build]
    steps:
      - uses: DevExpress/testcafe-build-system/actions/prepare@main
      - uses: DevExpress/testcafe-build-system/actions/build@main
      - uses: DevExpress/testcafe-build-system/actions/test-npm@main
        env:
          BROWSERSTACK_USERNAME: ${{ secrets.BROWSERSTACK_USERNAME }}
          BROWSERSTACK_ACCESS_KEY: ${{ secrets.BROWSERSTACK_ACCESS_KEY }}
        with:
          task: test

The artifact approach is better because it preserves the exact package built in the build job and avoids duplicating work.

User: trace logs of the build job

Assistant: I can trace it, but I need the build job ID first. The log tool only returned the failing test job when queried by run.

From the workflow, the build job is the separate build job in:

jobs:
  build:
    runs-on: ubuntu-latest
    steps: 
      - uses: DevExpress...

</details>



<!-- START COPILOT CODING AGENT SUFFIX -->

*This pull request was created from Copilot chat.*
>