feat: align GitLab and Azure setup features

[fengmk2]

GitLab and Azure now support version files, Node.js selection, project .npmrc authentication, and full YAML install inputs. The runtimes also retry the known sfw command-lookup failure.

GitLab adds a Windows template, native cache controls, and outputs in .setup-vp-outputs.env. Azure adds named outputs and a cache for sfw.

On Azure, nodeVersion now selects the project runtime through vp env use. bootstrapNodeVersion controls UseNode@1.

Azure E2E tests remain out of scope. Cache@2 still has no supported restore-only control.

[github-actions]

✅ GitLab E2E passed

Commit: 34a961f93e8e0fe9fc28ee8bac319a2e9ca2acfa
Suite: full · Vite+ version: latest

GitLab pipeline · GitHub Actions run

[Copilot]

🟡 Changes recommended

Critical Windows command execution and additional cache, ordering, and diagnostic fixes remain.

Get a fresh assessment by requesting another Copilot review.

Pull request overview

This PR aligns GitLab and Azure setup features with GitHub through shared CI runtime support.

Changes:

• Adds shared version, Node.js, authentication, install, SFW, and cache handling.
• Adds GitLab Windows support, caching, outputs, and expanded inputs.
• Adds Azure runtime selection, caching, outputs, and install inputs.
• Adds tests, documentation, RFC updates, and workflow coverage.

Review findings:

• Critical (1 vote): Windows command helpers must support the vp.cmd fallback through cmd.exe.
• Moderate (1 vote): Include runner platform in GitLab cache keys.
• Moderate (1 vote): Relocate absolute Bun symlink targets when creating snapshots.
• Moderate (1 vote): Recompute the lockfile hash during cache save.
• Moderate (1 vote): Select the project Node.js before GitLab package-manager commands.
• Nit (1 vote): Make the retry warning platform-specific.

File summaries

File	Reviewed changes
test/cache-snapshot.test.mjs	GitLab cache snapshot regression coverage.
src/version-file.ts	GitHub version-file resolver wrapper.
src/types.ts	Shared lockfile type exports.
src/portable-bundles.test.ts	Portable bundle regression tests.
src/node-version-file.ts	GitHub Node.js version-file resolver wrapper.
src/lockfile-version.ts	Lockfile version integration.
src/install-viteplus.test.ts	Vite+ installation tests.
src/gitlab/template.test.ts	GitLab template tests.
src/gitlab/shell.ts	GitLab shell environment and output handling.
src/gitlab/shell.test.ts	GitLab shell tests.
src/gitlab/run-install.test.ts	GitLab install-input tests.
src/gitlab/index.ts	GitLab setup orchestration and cache lifecycle.
src/gitlab/index.test.ts	GitLab orchestration tests.
src/gitlab/bootstrap.test.ts	GitLab bootstrap tests.
src/gitlab/auth.ts	GitLab authentication integration.
src/ci/vp-dirs.ts	Vite+ directory and executable resolution.
src/ci/vp-dirs.test.ts	Vite+ directory resolution tests.
src/ci/version-file.ts	Shared version resolution.
src/ci/types.ts	Shared CI types.
src/ci/run-install.ts	YAML install parsing and retry behavior.
src/ci/run-install.test.ts	Shared install tests.
src/ci/resolution.ts	Shared runtime and package resolution.
src/ci/project.ts	Project metadata and runtime handling.
src/ci/process.ts	Portable command execution helpers.
src/ci/npmrc.ts	Project .npmrc analysis.
src/ci/node-version-file.ts	Shared Node.js version resolution.
src/ci/lockfile-version.ts	Shared lockfile version detection.
src/ci/install-viteplus.ts	Portable Vite+ installation.
src/ci/install-viteplus.test.ts	Vite+ installation tests.
src/ci/install-sfw.ts	Cached SFW installation.
src/ci/install-sfw.test.ts	SFW installation tests.
src/ci/cache-snapshot.ts	Cache snapshot creation and restoration.
src/ci/cache-snapshot.test.ts	Cache snapshot tests.
src/ci/auth.ts	Shared registry authentication.
src/ci/auth.test.ts	Authentication tests.
src/azure/template.test.ts	Azure template tests.
src/azure/parity.test.ts	Azure feature-parity tests.
src/azure/install-viteplus.ts	Azure Vite+ installation integration.
src/azure/inputs.ts	Azure input parsing.
src/azure/index.ts	Azure lifecycle orchestration.
src/azure/commands.ts	Azure command handling.
src/auth.ts	GitHub authentication integration.
rfcs/gitlab-integration.md	GitLab integration design documentation.
rfcs/azure-pipelines-integration.md	Azure Pipelines integration design documentation.
README.md	Integration and usage documentation.
gitlab/setup-vp.yml	Unix GitLab template, caching, and outputs.
gitlab/setup-vp-windows.yml	Windows GitLab template.
gitlab/bootstrap.sh	GitLab Unix bootstrap script.
gitlab/bootstrap.ps1	GitLab Windows bootstrap script.
azure/setup-vp.yml	Azure inputs, caching, and outputs.
azure/bootstrap.ps1	Azure Windows bootstrap script.
.github/workflows/test.yml	CI coverage for the new runtime behavior.

Review details

Suppressed comments (5)

gitlab/setup-vp.yml:175

• These keys do not include the runner OS or architecture. Two jobs with the same job slug/ref on different platforms can upload the same GitLab cache key concurrently; the last archive then drops the other platform's snapshot, despite the contents being partitioned by platform below. Include a runner-platform dimension in the key (or otherwise make each platform's key distinct) to avoid this last-writer-wins loss.

    key: "setup-vp-v1-$CI_JOB_NAME_SLUG-$CI_COMMIT_REF_SLUG"
    fallback_keys:
      - "setup-vp-v1-$CI_JOB_NAME_SLUG-$CI_DEFAULT_BRANCH"

src/ci/cache-snapshot.ts:20

• The snapshot copies Bun's directory symlinks without relocating their targets. The test and comments identify Bun links as absolute, so a cached link under .setup-vp-cache still points at the original cachePath; restoring that snapshot on a runner whose store has a different absolute path leaves the link dangling and makes restored Bun packages unusable. Rewrite in-store absolute targets to relative links (and preserve relative targets), and test restore into a different temporary root.

function copyCacheDirectory(source: string, destination: string, overwrite: boolean): void {
  cpSync(source, destination, {
    recursive: true,
    force: overwrite,
    errorOnExist: false,
    filter: (src, dest) => {

src/ci/cache-snapshot.ts:88

• hash is captured before runInstall runs. If the install updates the lockfile, this setup-phase cache.save() copies the new store but records the old lock hash, so a later restore can report a miss or associate the snapshot with the wrong dependency graph. Recompute the hash from metadata.lockFile inside save() before writing manifest (the separate save-cache process happens to recompute it only because it creates a new resolver).

        writeFileSync(manifest, hash, "utf8");

src/ci/run-install.ts:94

• This warning is emitted on every platform, but the PowerShell warm-up below runs only on win32; Unix users therefore see a message claiming an action that was not performed. Make the message platform-specific so the retry diagnostics accurately describe what happened.
  src/gitlab/index.ts:90
• When package-manager is configured, applyEnvironmentModes() runs its vp pm ... commands before this new vp env use call. That means the package-manager mode is configured under the runner's Node.js instead of the project Node.js selected by node-version; the GitHub and Azure runtimes select the project Node before applying package-manager commands. Move the vp env use call before applyEnvironmentModes().

• Files reviewed: 52/55 changed files
• Comments generated: 1
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[naokihaba]

@codex review

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-14T15:13:16.586872Z	e194b11	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

Codex Review: Something went wrong. Try again later by commenting “@codex review”.

Provided git ref c78b0d474cbbaba2c7167e45d49a1b4754e8c94d does not exist

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[naokihaba]

@codex review

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: c78b0d474c

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[Copilot]

🟡 Changes recommended

Six unresolved findings remain, including critical Windows-template and Bun lockfile parsing issues.

Get a fresh assessment by requesting another Copilot review.

Review details

Suppressed comments (3)

src/azure/index.ts:170

• Azure leaves undefined macros in authEnv as literal values such as $(CUSTOM_TOKEN), just as it does for NODE_AUTH_TOKEN. The callback currently propagates that literal as a secret and leaves it in the task environment, so a project .npmrc reference can send the unresolved macro instead of treating the credential as missing. Apply the same unresolved-macro filtering to custom auth variables before propagation.

    (name, value) => {
      if (name === "NODE_AUTH_TOKEN" || value === undefined) return;
      ports.setVariable(name, value, {
        isSecret: name !== "NPM_CONFIG_USERCONFIG" && name !== "PNPM_CONFIG_USERCONFIG",
      });

src/azure/index.ts:189

• getCommandOutput returns undefined when vp exits non-zero, but this fallback converts the failure to ""; parseInstalledVpVersion then returns unknown and the finalize phase publishes successful-looking outputs. A failed post-install version check should fail the task instead of reporting an unknown installed version.

  const versionOutput = ports.getCommandOutput("vp", ["--version"], { cwd: projectDir }) || "";

src/gitlab/index.ts:115

• getCommandOutput returns undefined when vp exits non-zero, but this fallback turns that failure into a successful empty result. The job then writes SETUP_VP_INSTALLED_VERSION=unknown and continues, so a broken post-install vp is reported as success instead of failing setup. Preserve the undefined result and fail before publishing outputs.

• Files reviewed: 54/57 changed files
• Comments generated: 3
• Review effort level: Lite

[Copilot]

🟡 Changes recommended

Unresolved critical and moderate issues remain in cache snapshots and Windows support.

Get a fresh assessment by requesting another Copilot review.

Review details

Files not reviewed (1)

• pnpm-lock.yaml: Generated file

Suppressed comments (2)

gitlab/setup-vp-windows.yml:76

• PowerShell here-strings preserve the line break before the closing marker. This makes even scalar defaults such as version, working-directory, and setup-ref contain trailing newlines; the resolver treats a whitespace-suffixed version as explicit, and the resulting paths/URL are invalid on Windows. Trim scalar assignments (while retaining the raw here-string only where multiline YAML is required) before exporting them.

      $env:SETUP_VP_VERSION = @'
      $[[ inputs.version ]]
      '@

src/ci/cache-snapshot.ts:50

• statSync(src).isDirectory() is true for a Bun junction on Windows, so directory links are always recreated with the dir type here instead of a junction. Creating that kind of symbolic link can require SeCreateSymbolicLinkPrivilege on ordinary Windows runners; the save error is swallowed later, so cache saves can silently lose these entries. Preserve/use a Windows-safe junction type for directory links.

        symlinkSync(
          relocated,
          dest,
          statSync(src, { throwIfNoEntry: false })?.isDirectory() ? "dir" : "file",
        );

• Files reviewed: 56/60 changed files
• Comments generated: 3
• Review effort level: Lite

[fengmk2]

@codex review

[Copilot]

🟡 Changes recommended

Four unresolved findings remain, including one critical cache-symlink issue and three moderate template/runtime issues.

Get a fresh assessment by requesting another Copilot review.

Review details

Suppressed comments (3)

azure/setup-vp.yml:137

• stepName is interpolated directly into Azure task name values, but the template accepts any string and the README only says it is a unique prefix. Azure task names must be valid identifiers (letters/numbers/underscores), so values such as build-linux or my setup make the expanded pipeline invalid. Restrict/validate this parameter (and document the allowed characters), or use a fixed valid task name while preserving a separate output-prefix mechanism.

    name: ${{ parameters.stepName }}Windows

gitlab/setup-vp-windows.yml:78

• These PowerShell here-strings include a trailing newline in every exported value. The runtime treats these values by truthiness without trimming, so even defaults become values such as version="\n", workingDirectory=".\n", and setup-ref="v1.20.0\n"; the latter produces an invalid bootstrap URL and the former can resolve to a nonexistent directory. Trim each interpolated input (or assign it without a here-string newline) before exporting it.

      $env:SETUP_VP_VERSION = @'
      $[[ inputs.version ]]
      '@
      $env:SETUP_VP_VERSION_FILE = @'
      $[[ inputs.version-file ]]

src/ci/install-sfw.ts:102

• With no client override, downloadFile now requires curl or wget and no longer has the Node HTTP fallback. That makes sfw: true fail on supported Windows GitLab/Azure runners that have Node and PowerShell but neither downloader, even though the templates otherwise support Windows and the previous implementation worked in that environment. Retain a Node/PowerShell fallback or explicitly enforce this dependency for the Windows paths.

  if (!clientOverride) {
    downloadFileWithShell(url, outputPath, timeoutMs);
    return Promise.resolve();

• Files reviewed: 55/58 changed files
• Comments generated: 1
• Review effort level: Lite

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: e194b11c04

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".