fix: install pkg.pr.new preview builds via VP_PR_VERSION

src/install-viteplus.test.ts

@@ -1,4 +1,4 @@
-import { describe, it, expect, afterEach, vi } from "vite-plus/test";
+import { describe, it, expect, beforeEach, afterEach, vi } from "vite-plus/test";
 import { exec } from "@actions/exec";
 import { warning } from "@actions/core";
 import { installVitePlus } from "./install-viteplus.js";
@@ -32,7 +32,15 @@ const baseInputs: Inputs = {
 };
 
 describe("installVitePlus", () => {
+  // installVitePlus spreads process.env into the child env, so a VP_PR_VERSION
+  // inherited from the runner (setup-vp's own CI sets it) would make these tests
+  // non-hermetic. Clear it before each test; unstubAllEnvs restores the original.
+  beforeEach(() => {
+    vi.stubEnv("VP_PR_VERSION", undefined);
+  });
+
   afterEach(() => {
+    vi.unstubAllEnvs();
     vi.resetAllMocks();
   });
 
@@ -113,4 +121,31 @@ describe("installVitePlus", () => {
     expect(script).toContain("--max-time");
     expect(script).toMatch(/\| bash$/);
   });
+
+  const commitSha = "7d848b3da1987fa60b4cf18487fcc36a2a697e94";
+  it.each([
+    {
+      desc: "should route pkg.pr.new commit builds through VP_PR_VERSION",
+      version: `0.0.0-commit.${commitSha}`,
+      expected: commitSha,
+    },
+    {
+      desc: "should not set VP_PR_VERSION for regular published versions",
+      version: "0.2.1",
+      expected: undefined,
+    },
+    {
+      desc: "should require a full 40-char SHA and ignore near-miss lengths",
+      // 39 hex chars: matched the old 7-40 bound but not the tightened 40.
+      version: `0.0.0-commit.${commitSha.slice(0, 39)}`,
+      expected: undefined,
+    },
+  ])("$desc", async ({ version, expected }) => {
+    vi.mocked(exec).mockResolvedValueOnce(0);
+
+    await installVitePlus({ ...baseInputs, version });
+
+    const options = vi.mocked(exec).mock.calls[0][2] as { env: { [key: string]: string } };
+    expect(options.env.VP_PR_VERSION).toBe(expected);
+  });
 });

src/install-viteplus.ts

@@ -25,6 +25,21 @@ const INSTALL_RETRY_DELAY_MS = 2000;
 const CURL_TIMEOUT_FLAGS = "--connect-timeout 5 --max-time 15";
 const PWSH_TIMEOUT_SEC = 15;
 
+// pkg.pr.new preview builds are published as `0.0.0-commit.<sha>` (for example
+// via the vite-plus registry bridge that `vp migrate` writes into `.npmrc`).
+// Those builds live only on pkg.pr.new, never on the npm registry, and the
+// install script does not read `.npmrc`: it resolves `VP_VERSION` straight
+// from the npm registry, so a commit build 404s there. Extract the commit SHA
+// so we can route it through the script's pkg.pr.new path via VP_PR_VERSION.
+// The bridge only ever publishes `0.0.0-commit.<full 40-char sha>`, and the
+// install script maps a 40-char SHA straight to that build, so require exactly
+// 40 hex chars and nothing shorter is mistaken for a commit build.
+const PKG_PR_NEW_COMMIT_RE = /^0\.0\.0-commit\.([0-9a-f]{40})$/i;
+
+function pkgPrNewCommitSha(version: string): string | undefined {
+  return version.match(PKG_PR_NEW_COMMIT_RE)?.[1];
+}
+
 export async function installVitePlus(inputs: Inputs): Promise<void> {
   const { version } = inputs;
 
@@ -38,6 +53,13 @@ export async function installVitePlus(inputs: Inputs): Promise<void> {
     VITE_PLUS_VERSION: version,
   } as { [key: string]: string };
 
+  // For pkg.pr.new preview builds, tell the install script to fetch from
+  // pkg.pr.new (bypassing the npm registry) instead of resolving VP_VERSION.
+  const prVersion = pkgPrNewCommitSha(version);
+  if (prVersion) {
+    env.VP_PR_VERSION = prVersion;
+  }
+
   const urls = process.platform === "win32" ? INSTALL_URLS_PS1 : INSTALL_URLS_SH;
   const maxAttempts = INSTALL_MAX_ROUNDS * urls.length;
   let failureReason = "";