Merge branch 'main' into fix-renovate

Author: fengmk2

.claude/skills/bump-vite-task/SKILL.md

@@ -59,7 +59,23 @@ To update snap tests:
 
 Snap test files are at `packages/cli/snap-tests/*/snap.txt` and `packages/cli/snap-tests-global/*/snap.txt`.
 
-### 7. Create the PR
+### 7. Review changelog and update docs
+
+- Fetch the vite-task `CHANGELOG.md` diff between old and new commits to see what changed:
+  ```
+  https://raw.githubusercontent.com/voidzero-dev/vite-task/<new-hash>/CHANGELOG.md
+  ```
+- Review each changelog entry and determine if it affects user-facing behavior: new CLI options, changed defaults, new config fields, removed features, etc.
+- The changelog contains links to the corresponding vite-task PRs. For complex changes, check the PR description and code diff (especially any docs changes in the PR) to understand the full scope of the change.
+- If user-facing changes are found, update the relevant docs in `docs/` (e.g., `docs/guide/`, `docs/config/`).
+- Common doc updates include:
+  - **New CLI flags/options**: Update the relevant config doc (e.g., `docs/config/run.md`, `docs/config/build.md`)
+  - **New features or commands**: Add or update the relevant guide page (e.g., `docs/guide/cache.md`)
+  - **Changed defaults or behavior**: Update any docs that describe the old behavior
+  - **Removed/deprecated options**: Remove or mark as deprecated in the relevant docs
+- If no user-facing changes are found, skip this step.
+
+### 8. Create the PR
 
 - Commit message: `chore: bump vite-task to <short-hash>`
 - PR title: `chore: bump vite-task to <short-hash>`
@@ -68,7 +84,7 @@ Snap test files are at `packages/cli/snap-tests/*/snap.txt` and `packages/cli/sn
   https://github.com/voidzero-dev/vite-task/compare/<old-hash>...<new-hash>#diff-06572a96a58dc510037d5efa622f9bec8519bc1beab13c9f251e97e657a9d4ed
   ```
 
-### 8. Verify CI
+### 9. Verify CI
 
 Wait for CI and ensure the `done` check passes. Key checks to monitor:
 

.github/actions/build-upstream/action.yml

@@ -27,6 +27,12 @@ runs:
       run: |
         echo "key=napi-binding-v3-${{ inputs.target }}-${{ env.RELEASE_BUILD }}-${{ env.DEBUG }}-${{ env.VERSION }}-${{ env.NPM_TAG }}-${{ hashFiles('packages/tools/.upstream-versions.json', 'Cargo.lock', 'crates/**/*.rs', 'crates/*/Cargo.toml', 'packages/cli/binding/**/*.rs', 'packages/cli/binding/Cargo.toml', 'Cargo.toml', '.cargo/config.toml', 'packages/cli/package.json', 'packages/cli/build.ts') }}" >> $GITHUB_OUTPUT
 
+    # Resolve the Rust target directory (CARGO_TARGET_DIR from setup-rust, or default "target")
+    - name: Resolve Rust target directory
+      id: rust-target
+      shell: bash
+      run: echo "dir=${CARGO_TARGET_DIR:-target}" >> $GITHUB_OUTPUT
+
     # Cache NAPI bindings and Rust CLI binary (the slow parts, especially on Windows)
     - name: Restore NAPI binding cache
       id: cache-restore
@@ -38,9 +44,9 @@ runs:
           packages/cli/binding/index.d.ts
           packages/cli/binding/index.cjs
           packages/cli/binding/index.d.cts
-          target/${{ inputs.target }}/release/vp
-          target/${{ inputs.target }}/release/vp.exe
-          target/${{ inputs.target }}/release/vp-shim.exe
+          ${{ steps.rust-target.outputs.dir }}/${{ inputs.target }}/release/vp
+          ${{ steps.rust-target.outputs.dir }}/${{ inputs.target }}/release/vp.exe
+          ${{ steps.rust-target.outputs.dir }}/${{ inputs.target }}/release/vp-shim.exe
         key: ${{ steps.cache-key.outputs.key }}
 
     # Apply Vite+ branding patches to vite source (CI checks out
@@ -147,9 +153,9 @@ runs:
           packages/cli/binding/index.d.ts
           packages/cli/binding/index.cjs
           packages/cli/binding/index.d.cts
-          target/${{ inputs.target }}/release/vp
-          target/${{ inputs.target }}/release/vp.exe
-          target/${{ inputs.target }}/release/vp-shim.exe
+          ${{ steps.rust-target.outputs.dir }}/${{ inputs.target }}/release/vp
+          ${{ steps.rust-target.outputs.dir }}/${{ inputs.target }}/release/vp.exe
+          ${{ steps.rust-target.outputs.dir }}/${{ inputs.target }}/release/vp-shim.exe
         key: ${{ steps.cache-key.outputs.key }}
 
     # Build vite-plus TypeScript after native bindings are ready

.github/actions/clone/action.yml

@@ -31,13 +31,13 @@ runs:
         node -e "console.log('ECOSYSTEM_CI_PROJECT_REPOSITORY=' + require('./ecosystem-ci/repo.json')['${{ inputs.ecosystem-ci-project }}'].repository.replace('https://github.com/', '').replace('.git', ''))" >> $GITHUB_OUTPUT
         echo "ECOSYSTEM_CI_PROJECT_PATH=${{ runner.temp }}/vite-plus-ecosystem-ci/${{ inputs.ecosystem-ci-project }}" >> $GITHUB_OUTPUT
 
-    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       with:
         repository: rolldown/rolldown
         path: rolldown
         ref: ${{ steps.upstream-versions.outputs.ROLLDOWN_HASH }}
 
-    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       with:
         repository: vitejs/vite
         path: vite

.github/workflows/ci.yml

@@ -44,7 +44,7 @@ jobs:
     outputs:
       code-changed: ${{ steps.filter.outputs.code }}
     steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # v3.0.2
         id: filter
         with:
@@ -60,7 +60,7 @@ jobs:
       contents: read
       packages: read
     steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - uses: ./.github/actions/download-rolldown-binaries
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}
@@ -80,7 +80,7 @@ jobs:
             target: aarch64-apple-darwin
     runs-on: ${{ matrix.os }}
     steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - uses: ./.github/actions/clone
 
       - name: Setup Dev Drive
@@ -93,7 +93,7 @@ jobs:
             CARGO_HOME,{{ DEV_DRIVE }}/.cargo
             RUSTUP_HOME,{{ DEV_DRIVE }}/.rustup
 
-      - uses: oxc-project/setup-rust@d286d43bc1f606abbd98096666ff8be68c8d5f57 # v1.0.0
+      - uses: oxc-project/setup-rust@23f38cfb0c04af97a055f76acee94d5be71c7c82 # v1.0.16
         with:
           save-cache: ${{ github.ref_name == 'main' }}
           cache-key: test
@@ -126,7 +126,7 @@ jobs:
         shell: sh {0}
         run: apk add --no-cache bash curl git musl-dev gcc g++ python3 cmake make
 
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - uses: ./.github/actions/clone
 
       - name: Install rustup
@@ -152,10 +152,10 @@ jobs:
     name: Lint
     runs-on: namespace-profile-linux-x64-default
     steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - uses: ./.github/actions/clone
 
-      - uses: oxc-project/setup-rust@d286d43bc1f606abbd98096666ff8be68c8d5f57 # v1.0.0
+      - uses: oxc-project/setup-rust@23f38cfb0c04af97a055f76acee94d5be71c7c82 # v1.0.16
         with:
           save-cache: ${{ github.ref_name == 'main' }}
           cache-key: lint
@@ -168,11 +168,11 @@ jobs:
           # cargo clippy --all-targets --all-features -- -D warnings
           # RUSTDOCFLAGS='-D warnings' cargo doc --no-deps --document-private-items
 
-      - uses: crate-ci/typos@631208b7aac2daa8b707f55e7331f9112b0e062d # v1.44.0
+      - uses: crate-ci/typos@02ea592e44b3a53c302f697cddca7641cd051c3d # v1.45.0
         with:
           files: .
 
-      - uses: oxc-project/setup-node@fdbf0dfd334c4e6d56ceeb77d91c76339c2a0885 # v1.0.4
+      - uses: oxc-project/setup-node@4c26e7cb3605b6bdef5450dacd02c434b10fd8ba # v1.2.0
 
       - name: Install docs dependencies
         run: pnpm -C docs install --frozen-lockfile
@@ -196,7 +196,7 @@ jobs:
             target: x86_64-pc-windows-msvc
     runs-on: ${{ matrix.os }}
     steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - uses: ./.github/actions/clone
 
       - name: Setup Dev Drive
@@ -209,13 +209,13 @@ jobs:
             CARGO_HOME,{{ DEV_DRIVE }}/.cargo
             RUSTUP_HOME,{{ DEV_DRIVE }}/.rustup
 
-      - uses: oxc-project/setup-rust@d286d43bc1f606abbd98096666ff8be68c8d5f57 # v1.0.0
+      - uses: oxc-project/setup-rust@23f38cfb0c04af97a055f76acee94d5be71c7c82 # v1.0.16
         with:
           save-cache: ${{ github.ref_name == 'main' }}
           cache-key: cli-e2e-test-${{ matrix.target }}
           target-dir: ${{ runner.os == 'Windows' && format('{0}/target', env.DEV_DRIVE) || '' }}
 
-      - uses: oxc-project/setup-node@fdbf0dfd334c4e6d56ceeb77d91c76339c2a0885 # v1.0.4
+      - uses: oxc-project/setup-node@4c26e7cb3605b6bdef5450dacd02c434b10fd8ba # v1.2.0
 
       - name: Install docs dependencies
         run: pnpm -C docs install --frozen-lockfile
@@ -521,7 +521,16 @@ jobs:
       - name: Test implode (bash)
         shell: bash
         run: |
-          vp implode --yes
+          # Retry on Windows — file locks can cause transient "Access is denied" errors
+          if [[ "$RUNNER_OS" == "Windows" ]]; then
+            for i in 1 2 3; do
+              vp implode --yes && break
+              echo "Retry $i: vp implode failed, waiting 5s..."
+              sleep 5
+            done
+          else
+            vp implode --yes
+          fi
           ls -la ~/
           VP_HOME="${USERPROFILE:-$HOME}/.vite-plus"
           if [ -d "$VP_HOME" ]; then
@@ -536,7 +545,13 @@ jobs:
         if: ${{ matrix.os == 'windows-latest' }}
         shell: pwsh
         run: |
-          vp implode --yes
+          # Retry — Windows file locks can cause transient "Access is denied" errors
+          foreach ($i in 1..3) {
+            vp implode --yes
+            if ($LASTEXITCODE -eq 0) { break }
+            Write-Host "Retry $i`: vp implode failed, waiting 5s..."
+            Start-Sleep -Seconds 5
+          }
           Start-Sleep -Seconds 5
           dir "$env:USERPROFILE\"
           if (Test-Path "$env:USERPROFILE\.vite-plus") {
@@ -550,9 +565,16 @@ jobs:
         if: ${{ matrix.os == 'windows-latest' }}
         shell: cmd
         run: |
+          REM Retry — Windows file locks can cause transient "Access is denied" errors
           REM vp.exe renames its own parent directory; cmd.exe may report
           REM "The system cannot find the path specified" on exit — ignore it.
-          vp implode --yes || ver >NUL
+          for /L %%i in (1,1,3) do (
+            vp implode --yes || ver >NUL
+            if not exist "%USERPROFILE%\.vite-plus" goto implode_done
+            echo Retry %%i: vp implode failed, waiting 5s...
+            timeout /T 5 /NOBREAK >NUL
+          )
+          :implode_done
           timeout /T 5 /NOBREAK >NUL
           dir "%USERPROFILE%\"
           if exist "%USERPROFILE%\.vite-plus" (
@@ -608,7 +630,7 @@ jobs:
             shardTotal: 3
     runs-on: ${{ matrix.os }}
     steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - uses: ./.github/actions/clone
 
       - name: Setup Dev Drive
@@ -621,13 +643,13 @@ jobs:
             CARGO_HOME,{{ DEV_DRIVE }}/.cargo
             RUSTUP_HOME,{{ DEV_DRIVE }}/.rustup
 
-      - uses: oxc-project/setup-rust@d286d43bc1f606abbd98096666ff8be68c8d5f57 # v1.0.0
+      - uses: oxc-project/setup-rust@23f38cfb0c04af97a055f76acee94d5be71c7c82 # v1.0.16
         with:
           save-cache: ${{ github.ref_name == 'main' }}
           cache-key: cli-snap-test-${{ matrix.target }}
           target-dir: ${{ runner.os == 'Windows' && format('{0}/target', env.DEV_DRIVE) || '' }}
 
-      - uses: oxc-project/setup-node@fdbf0dfd334c4e6d56ceeb77d91c76339c2a0885 # v1.0.4
+      - uses: oxc-project/setup-node@4c26e7cb3605b6bdef5450dacd02c434b10fd8ba # v1.2.0
 
       - name: Install docs dependencies
         run: pnpm -C docs install --frozen-lockfile
@@ -666,15 +688,15 @@ jobs:
       - download-previous-rolldown-binaries
     runs-on: namespace-profile-linux-x64-default
     steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - uses: ./.github/actions/clone
 
-      - uses: oxc-project/setup-rust@d286d43bc1f606abbd98096666ff8be68c8d5f57 # v1.0.0
+      - uses: oxc-project/setup-rust@23f38cfb0c04af97a055f76acee94d5be71c7c82 # v1.0.16
         with:
           save-cache: ${{ github.ref_name == 'main' }}
           cache-key: cli-e2e-test-musl
 
-      - uses: oxc-project/setup-node@fdbf0dfd334c4e6d56ceeb77d91c76339c2a0885 # v1.0.4
+      - uses: oxc-project/setup-node@4c26e7cb3605b6bdef5450dacd02c434b10fd8ba # v1.2.0
 
       - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
         with:
@@ -745,15 +767,15 @@ jobs:
       github.event_name != 'pull_request' ||
       contains(github.event.pull_request.labels.*.name, 'test: install-e2e')
     steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - uses: ./.github/actions/clone
 
-      - uses: oxc-project/setup-rust@d286d43bc1f606abbd98096666ff8be68c8d5f57 # v1.0.0
+      - uses: oxc-project/setup-rust@23f38cfb0c04af97a055f76acee94d5be71c7c82 # v1.0.16
         with:
           save-cache: ${{ github.ref_name == 'main' }}
           cache-key: install-e2e-test
 
-      - uses: oxc-project/setup-node@fdbf0dfd334c4e6d56ceeb77d91c76339c2a0885 # v1.0.4
+      - uses: oxc-project/setup-node@4c26e7cb3605b6bdef5450dacd02c434b10fd8ba # v1.2.0
 
       - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
         with:

.github/workflows/deny.yml

@@ -27,21 +27,21 @@ jobs:
     name: Cargo Deny
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           persist-credentials: false
 
       - name: Output rolldown hash
         id: upstream-versions
         run: node -e "console.log('ROLLDOWN_HASH=' + require('./packages/tools/.upstream-versions.json').rolldown.hash)" >> $GITHUB_OUTPUT
 
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           repository: rolldown/rolldown
           path: rolldown
           ref: ${{ steps.upstream-versions.outputs.ROLLDOWN_HASH }}
 
-      - uses: oxc-project/setup-rust@d286d43bc1f606abbd98096666ff8be68c8d5f57 # v1.0.0
+      - uses: oxc-project/setup-rust@23f38cfb0c04af97a055f76acee94d5be71c7c82 # v1.0.16
         with:
           restore-cache: false
           # Pinned to 0.18.6+ for CVSS 4.0 support (EmbarkStudios/cargo-deny#805)