fix(migrate): scan composite actions under .github

Author: fengmk2

docs/guide/ci.md

@@ -11,9 +11,9 @@ You can use `voidzero-dev/setup-vp` to use Vite+ in CI environments.
 Set `<setup-vp-version>` in each example to an exact version from the [`setup-vp` releases page](https://github.com/voidzero-dev/setup-vp/releases). You can use a commit SHA instead. Do not use the `v1` tag. The `v1` tag no longer receives updates.
 
 Run `vp migrate` to replace exact `voidzero-dev/setup-vp@v1` references in
-GitHub Actions workflows and composite actions with the latest exact release
-known to your Vite+ version. Existing exact versions and commit SHAs remain
-unchanged.
+GitHub Actions workflows and composite actions under `.github` with the latest
+exact release known to your Vite+ version. Existing exact versions and commit
+SHAs remain unchanged.
 
 ### Automatic Version Updates
 

docs/guide/migrate-rules.md

@@ -255,9 +255,10 @@ Unrelated `bunx` commands and other package-executor forms remain unchanged.
 ## Continuous Integration Rules
 
 Migration replaces exact `voidzero-dev/setup-vp@v1` references in GitHub
-Actions workflows and composite actions with the latest exact `setup-vp`
-release known to that Vite+ version. The frozen `v1` tag does not receive new
-releases. Existing exact versions and commit SHAs are left unchanged.
+Actions workflows and composite actions under `.github` with the latest exact
+`setup-vp` release known to that Vite+ version. The frozen `v1` tag does not
+receive new releases. Existing exact versions and commit SHAs are left
+unchanged.
 
 ## Node.js Version Rules
 
@@ -270,8 +271,9 @@ migrations run it unconditionally.
   existing `.node-version` is kept.
 - When `.nvmrc` is removed, any `actions/setup-node` `node-version-file:
 .nvmrc` reference in `.github/workflows/*.{yml,yaml}` and composite actions
-  (`.github/actions/**/action.{yml,yaml}`) is repointed to `.node-version` so
-  CI does not fail with "node version file ... does not exist".
+  under `.github` (`.github/**/action.{yml,yaml}`) is repointed to
+  `.node-version` so CI does not fail with "node version file ... does not
+  exist".
 
 ## Package-Manager Rules
 

packages/cli/src/migration/__tests__/migrator.spec.ts

@@ -1484,7 +1484,10 @@ describe('migrateSetupVpVersion', () => {
       ].join('\r\n'),
     );
     const actionPath = path.join(actionDir, 'action.yaml');
-    fs.writeFileSync(actionPath, 'runs:\n  steps:\n    - uses : voidzero-dev/setup-vp@v1\n');
+    fs.writeFileSync(
+      actionPath,
+      'runs:\n  using: composite\n  steps:\n    - uses : voidzero-dev/setup-vp@v1\n',
+    );
     const nestedWorkflowPath = path.join(workflowsDir, 'nested', 'ignored.yml');
     fs.writeFileSync(nestedWorkflowPath, '- uses: voidzero-dev/setup-vp@v1\n');
     const report = createMigrationReport();
@@ -1519,6 +1522,52 @@ describe('migrateSetupVpVersion', () => {
     expect(migrateSetupVpVersion(tmpDir, report)).toEqual([]);
     expect(report.setupVpVersionUpdatedFileCount).toBe(2);
   });
+
+  it('updates composite actions elsewhere under .github and stays within that directory', () => {
+    const actionPath = path.join(tmpDir, '.github', 'ci', 'actions', 'setup', 'action.yml');
+    const nonCompositePath = path.join(
+      tmpDir,
+      '.github',
+      'ci',
+      'actions',
+      'javascript',
+      'action.yml',
+    );
+    const outsideScopePath = path.join(tmpDir, 'ci', 'actions', 'outside-scope', 'action.yml');
+    const compositeAction =
+      'runs:\n  using: composite\n  steps:\n    - uses: voidzero-dev/setup-vp@v1\n';
+    const nonCompositeAction = [
+      'inputs:',
+      '  example:',
+      '    description: Example workflow text',
+      '    default: |',
+      '      - uses: voidzero-dev/setup-vp@v1',
+      'runs:',
+      '  using: node20',
+      '  main: index.js',
+      '',
+    ].join('\n');
+
+    fs.mkdirSync(path.dirname(actionPath), { recursive: true });
+    fs.mkdirSync(path.dirname(nonCompositePath), { recursive: true });
+    fs.mkdirSync(path.dirname(outsideScopePath), { recursive: true });
+    fs.writeFileSync(actionPath, compositeAction);
+    fs.writeFileSync(nonCompositePath, nonCompositeAction);
+    fs.writeFileSync(outsideScopePath, compositeAction);
+    const report = createMigrationReport();
+
+    const updatedFiles = migrateSetupVpVersion(tmpDir, report).map((filePath) =>
+      filePath.split(path.sep).join('/'),
+    );
+
+    expect(updatedFiles).toEqual(['.github/ci/actions/setup/action.yml']);
+    expect(fs.readFileSync(actionPath, 'utf8')).toContain(
+      `uses: voidzero-dev/setup-vp@${SETUP_VP_VERSION}`,
+    );
+    expect(fs.readFileSync(nonCompositePath, 'utf8')).toBe(nonCompositeAction);
+    expect(fs.readFileSync(outsideScopePath, 'utf8')).toBe(compositeAction);
+    expect(report.setupVpVersionUpdatedFileCount).toBe(1);
+  });
 });
 
 describe('detectNodeVersionManagerFile', () => {

packages/cli/src/migration/migrator/setup.ts

@@ -4,6 +4,7 @@ import path from 'node:path';
 import * as prompts from '@voidzero-dev/vite-plus-prompts';
 import { globSync } from 'glob';
 import semver from 'semver';
+import { parse as parseYaml } from 'yaml';
 
 import { type DownloadPackageManagerResult } from '../../../binding/index.js';
 import { SETUP_VP_VERSION } from '../../utils/constants.ts';
@@ -130,20 +131,47 @@ export function parseNvmrcVersion(alias: string): string | null {
  */
 const NODE_VERSION_FILE_NVMRC_RE = /(node-version-file:[ \t]*)(['"]?)(\.\/)?\.nvmrc\2(?=\s|$)/gm;
 
+function isCompositeActionFile(filePath: string): boolean {
+  try {
+    const action = parseYaml(fs.readFileSync(filePath, 'utf8')) as unknown;
+    if (typeof action !== 'object' || action === null || Array.isArray(action)) {
+      return false;
+    }
+    const runs = (action as Record<string, unknown>).runs;
+    return (
+      typeof runs === 'object' &&
+      runs !== null &&
+      !Array.isArray(runs) &&
+      (runs as Record<string, unknown>).using === 'composite'
+    );
+  } catch {
+    return false;
+  }
+}
+
 /**
  * Collect GitHub Actions YAML files that migration may inspect: top-level
  * workflows (`.github/workflows/*.{yml,yaml}`, which GitHub runs only when flat
- * in that directory) and composite action definitions
- * (`.github/actions/**\/action.{yml,yaml}`, which may nest at any depth). Returns
- * absolute paths; a missing `.github` tree just yields an empty list. `nocase`
- * keeps the match case-insensitive on case-sensitive filesystems.
+ * in that directory) and composite action definitions anywhere beneath
+ * `.github`. Action metadata is included only when `runs.using` is `composite`.
+ * Returns absolute paths. `nocase` keeps filename matching case-insensitive on
+ * case-sensitive filesystems. Recursive discovery intentionally remains scoped
+ * to the `.github` directory.
  */
 function collectGithubActionFiles(projectPath: string): string[] {
-  return globSync(['workflows/*.{yml,yaml}', 'actions/**/action.{yml,yaml}'], {
+  const options = {
     cwd: path.join(projectPath, '.github'),
     absolute: true,
     nocase: true,
-  });
+    nodir: true,
+  } as const;
+  const workflows = globSync('workflows/*.{yml,yaml}', options);
+  const compositeActions = globSync('**/action.{yml,yaml}', {
+    ...options,
+    dot: true,
+  }).filter(isCompositeActionFile);
+
+  return [...new Set([...workflows, ...compositeActions])];
 }
 
 /**