[DaveHanns]

Summary

apify push checks none of the file-path fields in .actor/actor.json. The platform resolves them after the upload: a missing schema fails the build, a missing dockerfile silently falls back to a Dockerfile the user did not choose, and a missing readme or changelog falls back to the default README or CHANGELOG. This PR applies the worker's rules in the CLI before the login check and before the Actor is looked up or written. Problems that would fail the build or build the wrong image stop the push; a readme or changelog the platform recovers from only prints a warning.

Closes #1500. Part of apify/apify-core#28685. Builds on #1502 (merged): the check runs after the dockerContextDir resolver.

Changes

• New src/lib/actor-paths.ts: checkActorPaths returns one problem (field, value, resolved path, reason, severity) per failing field. formatActorPathProblems builds the message for one severity, with a header that says what happens. push.ts prints warnings to stderr and continues, and prints errors and exits with code 5 (InvalidActorJson) when any exist. The login check now runs after these local checks, so a broken Actor fails the same way with or without a login.
• Fields: dockerfile, readme, changelog, input, output, webServerSchema, the storages schemas, plus inputSchema and outputSchema. The worker copies a set alias over input or output, so the alias wins and the base key is skipped. Inline objects and empty strings (unset on the worker) are skipped.
• Rules: relative to .actor/ and inside the upload root, no backslash (the platform resolves paths with forward slashes), an existing file, and among the files push uploads. The first rule reads the value as the Linux worker does, where a backslash is part of a name, so an absolute or escaping path stays an error even with a backslash in it. dockerfile, readme, and changelog match case-insensitively, as the worker finds them by a directory listing; schemas match exactly.
• Severity: for readme and changelog, a missing file (a dangling symlink included), a file push does not upload, a case mismatch with the uploaded file, and a backslash are warnings. An absolute path, a path outside the upload root, and a directory stay errors, as the worker fails the build on them. dockerfile and schema references are errors in every case.
• Symlinks count by their own path: push reads through a link and uploads the content there, so a link to a file outside the upload root passes when push sends it.
• When dockerContextDir points inside the Actor folder, dockerfile must lie inside that context: the worker runs BuildKit with --local dockerfile=<context dir> and filename=<Dockerfile relative to the context>, so a Dockerfile outside it cannot be read by the build.
• Without dockerfile and with a Docker context, the CLI applies the worker's default lookup: .actor/Dockerfile, then Dockerfile in the Actor folder, by any case, among the files push uploads. A default that .gitignore or .actorignore drops is skipped, as the platform never sees it. A found default must pass the same rules as a set dockerfile, so a default outside the context stops the push. With no default and a context other than the Actor folder, push stops too: the platform would build that context with its built-in Node.js Dockerfile. A context that is the Actor folder itself, or no context, keeps the built-in Dockerfile as before.

Tests

• test/local/lib/actor-paths.test.ts: every rule, the aliases, empty strings, backslashes, symlinks (a dangling one and a symlinked Actor folder included), the case mismatch reason, the severity of each readme and changelog reason, a backslash in an absolute or escaping readme, the default Dockerfile lookup in every context (an ignored default included), and the message for each severity.
• test/local/commands/push-actor-paths.test.ts: errors stop push with exit code 5 before the login check and any Actor read or write; a default Dockerfile outside ../docker and the built-in Dockerfile in ../docker stop it; no Dockerfile with dockerContextDir .. or without a context pushes; a default .actor/Dockerfile in the context pushes; the js-cypress shape and a missing changelog print a warning and push, with stdout clean under --json; an absolute readme, a readme outside the upload root, a missing dockerfile, and a missing schema stop it.
• test/local/commands/push-monorepo.test.ts: the context within the Actor folder now has a Dockerfile of its own.
• Lint, format, build, update-docs (no change), and test:local pass, except the two [python] fixture tests that need a newer Python.

Notes for reviewers

• Default Dockerfile: before this change, push let through the two cases from the review. With "dockerContextDir": "../docker" and a Dockerfile in the Actor folder, the build failed on open ../Dockerfile; without it, the platform built docker/ with its built-in Dockerfile and ignored docker/Dockerfile. Both now stop push and name the Dockerfile the platform would use.
• Warning severity: the worker logs a warning for a readme or changelog it cannot find and falls back to its default lookup (.actor/ACTOR.md, .actor/README.md, then README.md or README in the Actor folder, and likewise for the changelog), so the build succeeds. Failing the push there would block Actors that build fine today. A missing dockerfile falls back as well, but to a Dockerfile the user did not choose, so it stays an error.
• The js-cypress template sets "readme": "./README.md" with README.md in the Actor folder and none in .actor/. It now pushes with a warning instead of failing; fixing the template is a separate follow-up in apify/actor-templates.
• Reproduced through the built CLI with no login: both review scenarios exit with code 5 before the login check, and the js-cypress shape prints the warning and then stops only at the login check with exit code 1.
• The helper returns a list instead of throwing, so stage 2 of monorepo push can pass the repository root as uploadRoot.
• Roots are real paths, as the resolver returns them, so a symlinked --dir is not mistaken for an escape.

🤖 Generated with Claude Code

[apify-factory]

Looks good, nothing blocking.

🏭 Factory review — ℹ️ not auto-approved

This change was reviewed but cannot be auto-approved: a gate failed, so the review cannot end in an approval.

check	result
Static gates	❌ 14/16 — base-branch, max-lines
Review findings	✅ none
Reviewer escalation	❌ The new check makes apify push fail on paths that used to push fine, based on platform worker rules this repo can't confirm (for example, a missing readme or dockerfile used to fall back to the default).
Juror 1 — claude-sonnet-5-5, adversarial	⏭️ skipped — a gate failed

Why it was not auto-approved

Failed gates:

• base-branch: base is feat/push-monorepo-preflight, required master
• max-lines: 646 changed lines (+644/-2), limit 200

The comments above are the review itself; this section only explains the approval decision. Push a change and request @apify-factory again to re-run it, or ask a human to review.

_{Reviewed e3edc7960 · workflow run}

[apify-factory]

Looks good, nothing blocking.

[l2ysho]

In followup we should check apify/actor-templates -> at least js-cypress template will break due to its invalid README path actor.json

[l2ysho]

one preexisting problem I found -> run and push does not use the same input schema

with inputSchema: "./custom_input.json":

• push and the platform use custom_input.json.
• apify run, validate-schema, edit-input-schema and generate-schema-types fall through to .actor/INPUT_SCHEMA.json

we should resolve also this in followup issue.

[DaveHanns]

Thanks for checking the templates.

• js-cypress is the only one of the 47 templates with a broken path. fix(js-cypress): drop the broken readme path actor-templates#1125 drops its readme line, so the platform finds README.md on its own.
• This PR doesn't break js-cypress even before that merges: a readme the platform can't find is now only a warning.
• While checking the templates, I found that apify run and the schema commands ignore inputSchema and outputSchema in actor.json, and every template uses them. That's a separate bug: apify run and the schema commands ignore inputSchema and outputSchema in actor.json #1534.
• Push now checks actor.json before it asks for a login, so these errors show up even when you aren't logged in.

Ready for another look.

[l2ysho]

nice 🚀