Cached setup-wright GitHub composite Action: installs the Wright CLI and caches the verified executable. Read the organization routing in wrightkit/.github first. This file adds only what is specific to this repository.
- Wright owns the release archives, checksums, and the
latest/versionpointer. This repository only consumes them. Do not change that contract here. - Keep the Action to setup. No command wrappers, no provider/project/build caching, no write token or secrets.
- Keep the cache key exact. Never add a restore prefix. Verify SHA-256 before cache save and before use, and never execute an unverified cached binary.
action.ymlis the public contract (inputs, outputs,uses: wrightkit/setup-wright@v1). Change it only withREADME.mdand the helper tests in the same PR.- Run
scripts/test-setup-wright.sh,actionlint, andshellcheck -S warning scripts/*.shbefore a PR. ThesmokeCI job is the real consuming-workflow check and pins an exact Wright version. - Never create tags or releases by hand.
.github/workflows/release.ymlownsvX.Y.Zand the movingv1. - Pin third-party actions to a full commit SHA.