[SDK-7461] fix(setup-env): deliver BUILD_RUN_IDENTIFIER, ask the API when the actor is unknown, stop failing silently

Three changes to the BrowserStack re-run delivery path.

1. BROWSERSTACK_BUILD_RUN_IDENTIFIER has been dropped since 2026-05-07.
The rebuild/details response carries three variables; the APS-19076 allowlist
(8ade0a3) listed only two plus BUILD_NAME, so the identifier is filtered out and
only a core.warning marks it. Verified against the live API. The SDKs send it as
build_run_identifier in the build-start payload, which files a re-run as an
attempt of its parent build rather than an unrelated build. PR #85's own body
predicted this: "If the rerun API legitimately sets additional names in
production, the list will need to grow."

2. An unreported GITHUB_TRIGGERING_ACTOR no longer aborts delivery.
That variable comes from the runner binary, so a self-hosted runner can simply
not set it. The actor check is only a cheap pre-filter — rebuild/details is the
authority and returns no variables when BrowserStack did not trigger the re-run.
Bailing on an absent actor turned a working re-run into a full-suite run on an
otherwise correctly configured workflow. We now warn and ask the API instead.

3. Every remaining delivery failure names itself.
With github-token at its 'none' default the job log was byte-identical to a
healthy run, and the CLI then runs the full spec set because
BROWSERSTACK_RERUN_TESTS is absent — so "all my tests ran again" was
undiagnosable. checkIfBStackReRun now names the missing input, a human-triggered
re-run says so, and an API failure is a warning rather than info. Attempt 1 stays
silent: an ordinary run is not a degraded re-run.

Verified end-to-end through the built dist into the real CLI across all eight
delivery states, and reproduced against a real reported failure: the build ran
11 sessions, the targeted spec folder holds 11 specs, and the real CLI dispatches
11 with the list absent and 3 with it present.

47 tests passing (4 new), eslint clean, dist rebuilt with ncc (reproducible).

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Author: anish353

setup-env/config/constants.js

@@ -24,9 +24,14 @@ module.exports = {
   // Object.keys(...).forEach(core.exportVariable, ...) call let any caller
   // who could influence the API response inject arbitrary env vars into
   // the workflow runner (CVSS 9.3 - env-var injection).
+  // Must list every name the rebuild/details response actually carries; a name missing
+  // here is dropped silently from the runner's perspective (only a ::warning:: in the log).
   ALLOWED_RERUN_ENV_VARS: [
     'BROWSERSTACK_RERUN',
     'BROWSERSTACK_RERUN_TESTS',
     'BROWSERSTACK_BUILD_NAME',
+    // SDK-7461: the SDKs read this as build_run_identifier in the build-start payload;
+    // without it a re-run is filed as an unrelated build run instead of an attempt of its parent.
+    'BROWSERSTACK_BUILD_RUN_IDENTIFIER',
   ],
 };

setup-env/dist/index.js

@@ -30,10 +30,15 @@ module.exports = {
   // Object.keys(...).forEach(core.exportVariable, ...) call let any caller
   // who could influence the API response inject arbitrary env vars into
   // the workflow runner (CVSS 9.3 - env-var injection).
+  // Must list every name the rebuild/details response actually carries; a name missing
+  // here is dropped silently from the runner's perspective (only a ::warning:: in the log).
   ALLOWED_RERUN_ENV_VARS: [
     'BROWSERSTACK_RERUN',
     'BROWSERSTACK_RERUN_TESTS',
     'BROWSERSTACK_BUILD_NAME',
+    // SDK-7461: the SDKs read this as build_run_identifier in the build-start payload;
+    // without it a re-run is filed as an unrelated build run instead of an attempt of its parent.
+    'BROWSERSTACK_BUILD_RUN_IDENTIFIER',
   ],
 };
 
@@ -34661,20 +34666,45 @@ class ActionInput {
   }
 
   async checkIfBStackReRun() {
-    // Ensure rerunAttempt is a number and greater than 1
+    // Attempt 1 is an ordinary run, not a re-run — stay silent, this is not a failure.
     if (!this.rerunAttempt || Number(this.rerunAttempt) <= 1) {
       return false;
     }
 
-    // Ensure runId, repository, username, and accessKey are valid
-    if (!this.runId || !this.repository || this.repository === 'none'
-      || !this.githubToken || this.githubToken === 'none' || !this.username || !this.accessKey) {
+    // Past this point GitHub re-ran the workflow, so the failed-test list was meant to be
+    // delivered. Every bail below silently degrades the re-run into a full-suite run, which
+    // is indistinguishable from correct behaviour unless we say so here (SDK-7461).
+    const missing = [];
+    if (!this.githubToken || this.githubToken === 'none') missing.push("the 'github-token' input");
+    if (!this.runId) missing.push('GITHUB_RUN_ID');
+    if (!this.repository || this.repository === 'none') missing.push('GITHUB_REPOSITORY');
+    if (!this.username) missing.push("the 'username' input");
+    if (!this.accessKey) missing.push("the 'access-key' input");
+
+    if (missing.length) {
+      core.warning(`This is re-run attempt ${this.rerunAttempt}, but BrowserStack cannot deliver the failed-test list because ${missing.join(', ')} ${missing.length > 1 ? 'are' : 'is'} not set. Every test will run again instead of only the failed ones. Pass github-token to this action to enable re-running only failed tests.`);
       return false;
     }
 
     const triggeringActor = process.env.GITHUB_TRIGGERING_ACTOR;
+
+    // The actor check is only a cheap pre-filter; the rebuild/details endpoint is the
+    // authority on whether BrowserStack triggered this re-run, and it returns no variables
+    // when it did not. GITHUB_TRIGGERING_ACTOR comes from the runner binary, so a
+    // self-hosted runner can simply not set it — bailing there would turn a working re-run
+    // into a full-suite run on an otherwise correct setup (SDK-7461). Ask the API instead.
+    if (!triggeringActor) {
+      core.warning(`This is re-run attempt ${this.rerunAttempt} and the runner did not report GITHUB_TRIGGERING_ACTOR, so BrowserStack cannot pre-confirm that it triggered this re-run — asking BrowserStack directly instead. This variable is set by the runner itself; on a self-hosted runner, updating the runner restores the faster check.`);
+      return true;
+    }
+
     core.info(`Triggering actor is - ${triggeringActor}`);
-    return triggeringActor === this.githubApp;
+    if (triggeringActor !== this.githubApp) {
+      core.info(`This re-run was started by '${triggeringActor}', not by the BrowserStack GitHub App ('${this.githubApp}'), so there is no failed-test list to apply and every test will run again. Re-runs started from the BrowserStack dashboard run only the failed tests; check that the BrowserStack GitHub App is installed on ${this.repository}.`);
+      return false;
+    }
+
+    return true;
   }
 
   async setBStackRerunEnvVars() {
@@ -34710,7 +34740,8 @@ class ActionInput {
         });
       }
     } catch (error) {
-      core.info(`Error setting BrowserStack rerun environment variables: ${error.message}`);
+      // Swallowing this as info hid a total delivery failure behind a normal-looking log.
+      core.warning(`Could not fetch the failed-test list from BrowserStack (${error.message}). Every test will run again instead of only the failed ones.`);
     }
   }
 }

setup-env/src/actionInput/index.js

@@ -94,20 +94,45 @@ class ActionInput {
   }
 
   async checkIfBStackReRun() {
-    // Ensure rerunAttempt is a number and greater than 1
+    // Attempt 1 is an ordinary run, not a re-run — stay silent, this is not a failure.
     if (!this.rerunAttempt || Number(this.rerunAttempt) <= 1) {
       return false;
     }
 
-    // Ensure runId, repository, username, and accessKey are valid
-    if (!this.runId || !this.repository || this.repository === 'none'
-      || !this.githubToken || this.githubToken === 'none' || !this.username || !this.accessKey) {
+    // Past this point GitHub re-ran the workflow, so the failed-test list was meant to be
+    // delivered. Every bail below silently degrades the re-run into a full-suite run, which
+    // is indistinguishable from correct behaviour unless we say so here (SDK-7461).
+    const missing = [];
+    if (!this.githubToken || this.githubToken === 'none') missing.push("the 'github-token' input");
+    if (!this.runId) missing.push('GITHUB_RUN_ID');
+    if (!this.repository || this.repository === 'none') missing.push('GITHUB_REPOSITORY');
+    if (!this.username) missing.push("the 'username' input");
+    if (!this.accessKey) missing.push("the 'access-key' input");
+
+    if (missing.length) {
+      core.warning(`This is re-run attempt ${this.rerunAttempt}, but BrowserStack cannot deliver the failed-test list because ${missing.join(', ')} ${missing.length > 1 ? 'are' : 'is'} not set. Every test will run again instead of only the failed ones. Pass github-token to this action to enable re-running only failed tests.`);
       return false;
     }
 
     const triggeringActor = process.env.GITHUB_TRIGGERING_ACTOR;
+
+    // The actor check is only a cheap pre-filter; the rebuild/details endpoint is the
+    // authority on whether BrowserStack triggered this re-run, and it returns no variables
+    // when it did not. GITHUB_TRIGGERING_ACTOR comes from the runner binary, so a
+    // self-hosted runner can simply not set it — bailing there would turn a working re-run
+    // into a full-suite run on an otherwise correct setup (SDK-7461). Ask the API instead.
+    if (!triggeringActor) {
+      core.warning(`This is re-run attempt ${this.rerunAttempt} and the runner did not report GITHUB_TRIGGERING_ACTOR, so BrowserStack cannot pre-confirm that it triggered this re-run — asking BrowserStack directly instead. This variable is set by the runner itself; on a self-hosted runner, updating the runner restores the faster check.`);
+      return true;
+    }
+
     core.info(`Triggering actor is - ${triggeringActor}`);
-    return triggeringActor === this.githubApp;
+    if (triggeringActor !== this.githubApp) {
+      core.info(`This re-run was started by '${triggeringActor}', not by the BrowserStack GitHub App ('${this.githubApp}'), so there is no failed-test list to apply and every test will run again. Re-runs started from the BrowserStack dashboard run only the failed tests; check that the BrowserStack GitHub App is installed on ${this.repository}.`);
+      return false;
+    }
+
+    return true;
   }
 
   async setBStackRerunEnvVars() {
@@ -143,7 +168,8 @@ class ActionInput {
         });
       }
     } catch (error) {
-      core.info(`Error setting BrowserStack rerun environment variables: ${error.message}`);
+      // Swallowing this as info hid a total delivery failure behind a normal-looking log.
+      core.warning(`Could not fetch the failed-test list from BrowserStack (${error.message}). Every test will run again instead of only the failed ones.`);
     }
   }
 }

setup-env/test/actionInput/index.test.js

@@ -241,6 +241,51 @@ describe('Action Input operations for fetching all inputs, triggering validation
       expect(result).to.be.false;
       delete process.env.GITHUB_TRIGGERING_ACTOR;
     });
+
+    it('Falls through to the API when the runner reports no triggering actor (SDK-7461)', async () => {
+      // Self-hosted runners set GITHUB_TRIGGERING_ACTOR only from a certain runner version.
+      // The actor check is a pre-filter, not the authority — bailing here turned a working
+      // re-run into a full-suite run on an otherwise correct setup.
+      const coreWarningStub = sinon.stub(core, 'warning');
+      const actionInput = new ActionInput();
+      delete process.env.GITHUB_TRIGGERING_ACTOR;
+
+      const result = await actionInput.checkIfBStackReRun();
+
+      // eslint-disable-next-line no-unused-expressions
+      expect(result).to.be.true;
+      sinon.assert.calledWith(coreWarningStub, sinon.match(/did not report GITHUB_TRIGGERING_ACTOR/));
+      sinon.assert.calledWith(coreWarningStub, sinon.match(/asking BrowserStack directly/));
+      sinon.assert.neverCalledWith(coreWarningStub, sinon.match(/GitHub App is installed/));
+    });
+
+    it('Warns which input is missing when a re-run cannot be delivered (SDK-7461)', async () => {
+      // Without this the job log for a degraded re-run is byte-identical to a healthy
+      // run, so "all tests ran again" is undiagnosable from the customer's side.
+      const coreWarningStub = sinon.stub(core, 'warning');
+      const actionInput = new ActionInput();
+      actionInput.githubToken = 'none';
+
+      const result = await actionInput.checkIfBStackReRun();
+
+      // eslint-disable-next-line no-unused-expressions
+      expect(result).to.be.false;
+      sinon.assert.calledWith(coreWarningStub, sinon.match(/github-token/));
+      sinon.assert.calledWith(coreWarningStub, sinon.match(/Every test will run again/));
+    });
+
+    it('Explains a human-triggered re-run rather than failing silently (SDK-7461)', async () => {
+      const coreInfoStub = sinon.stub(core, 'info');
+      const actionInput = new ActionInput();
+      process.env.GITHUB_TRIGGERING_ACTOR = 'someHuman';
+
+      const result = await actionInput.checkIfBStackReRun();
+
+      // eslint-disable-next-line no-unused-expressions
+      expect(result).to.be.false;
+      sinon.assert.calledWith(coreInfoStub, sinon.match(/not by the BrowserStack GitHub App/));
+      delete process.env.GITHUB_TRIGGERING_ACTOR;
+    });
   });
 
   context('Set BrowserStack Rerun Environment Variables', () => {
@@ -320,13 +365,39 @@ describe('Action Input operations for fetching all inputs, triggering validation
     });
 
     it('Handles errors when BrowserStack API fails', async () => {
+      // SDK-7461: a delivery failure is a warning, not info — as info it was
+      // indistinguishable from a healthy run in the job log.
+      const coreWarningStub = sinon.stub(core, 'warning');
       const actionInput = new ActionInput();
       axiosGetStub.rejects(new Error('API failed'));
 
       await actionInput.setBStackRerunEnvVars();
 
-      sinon.assert.calledTwice(core.info);
+      sinon.assert.calledWith(coreWarningStub, sinon.match(/API failed/));
+      sinon.assert.calledWith(coreWarningStub, sinon.match(/Every test will run again/));
       sinon.assert.neverCalledWith(core.exportVariable, sinon.match.any, sinon.match.any);
     });
+
+    it('Exports BROWSERSTACK_BUILD_RUN_IDENTIFIER from the API response (SDK-7461)', async () => {
+      // Regression: the rebuild/details response carries this alongside RERUN/RERUN_TESTS,
+      // and the SDKs send it as build_run_identifier to link a re-run to its parent build
+      // run. It was absent from ALLOWED_RERUN_ENV_VARS, so the allowlist dropped it.
+      const actionInput = new ActionInput();
+      axiosGetStub.resolves({
+        data: {
+          data: {
+            variables: {
+              BROWSERSTACK_RERUN: 'true',
+              BROWSERSTACK_RERUN_TESTS: 'cypress/tests/A/spec1.ts,cypress/tests/B/spec2.ts',
+              BROWSERSTACK_BUILD_RUN_IDENTIFIER: '1784546348645-29728341550',
+            },
+          },
+        },
+      });
+
+      await actionInput.setBStackRerunEnvVars();
+
+      sinon.assert.calledWith(core.exportVariable, 'BROWSERSTACK_BUILD_RUN_IDENTIFIER', '1784546348645-29728341550');
+    });
   });
 });