[DaveHanns]

Summary

An Actor whose .actor/actor.json sets dockerContextDir above its own folder (a monorepo Actor, as in apify/actor-monorepo-example) cannot be built from what apify push uploads, and --force replaces a working Git source with that upload. apify push now refuses such an Actor before any Actor read or write, pointing at the tracking Epic and the Git source workaround.

Closes #1524, part of the monorepo Epic apify/apify-core#28685.

Changes

• New src/lib/docker-context.ts with resolveDockerContext, getContextFilePaths, readGitState, and monorepoUnsupportedMessage, lifted from the actor-runtime branch; the one cosmetic difference is the extracted toPosix helper.
• resolveDockerContext reports one of four kinds: none (the field is absent, with no path work), within (the context is the Actor folder or a directory inside it), outside (a monorepo Actor, with the source root and the Actor path in it), and invalid (with the message to show).
• apify push runs the resolver before the Actor lookup, the Git source prompt, and any write. It works from the Actor folder's real path, so a symlinked --dir resolves as the platform does. An invalid dockerContextDir (such as a missing directory or one outside the Git repository) exits 5, a monorepo Actor exits 255, and an absent field or a context at or below the Actor folder pushes as usual. Messages go to stderr, so --json keeps stdout clean; the refusal names the folder when actor.json has no name.

Tests

• test/local/lib/docker-context.test.ts: the resolver inside and outside Git.
• test/local/lib/docker-context-files.test.ts: the file collector and its no-Git fallback.
• test/local/lib/docker-context-state.test.ts: readGitState.
• test/local/commands/push-monorepo.test.ts: apify push on a monorepo-shaped repository with a mocked client.

Notes for reviewers

• The actor-runtime branch (feat: Add local Actor runtime (apify runtime) #1496) should merge master afterward and drop its source-context.ts for this module.
• The kinds were split at the repository owner's request so a context inside the Actor folder is named within rather than none, and such a context is now checked to exist.
• Versus the branch: a context at or below the Actor folder is an ordinary push, because the platform accepts it; a missing context is reported as missing before its position is checked, so "does not contain the Actor's folder" appears only for existing directories outside Git; getContextFilePaths returns forward-slash paths on every platform.
• Versus the issue checklist: inside Git, a sibling directory in the repository is a monorepo Actor with the repository root as the source (exit 255, not 5), since the platform clone holds the whole repository. The refusal ends with the Apify Console Git source hint, not the branch's runtime clause.
• readGitState and getContextFilePaths have no caller yet; they land now so the upload with actorPath (apify push: upload monorepo Actors with the repository root and actorPath #1525) and the branch share one module.

🤖 Generated with Claude Code

[l2ysho]

One suggestion, otherwise LGTM 🚀

[l2ysho]

Suggested change

	const contextPathInActor = relative(realActorDir, contextRoot);
	const contextPathInActor = relative(realActorDir, realContextRoot);

[DaveHanns]

Thanks! I'd keep this one as is, on purpose. This line decides whether push can simply upload the Actor folder, so it has to judge the folder the way the upload will look. Push follows a symlink and stores its files under the link's own name, so the platform only ever sees the path as written, not where the link points.

Example: the Actor folder has a symlink sym pointing to a folder outside it, and actor.json sets "dockerContextDir": "../sym". Push uploads those files as a normal folder sym inside the Actor, and the platform builds it fine. contextRoot points to sym inside the Actor, so the check says "inside", which matches. realContextRoot points to the folder outside, so the check would say "outside" and refuse a push that works today.

I added a comment on the line (50fb1b8) and a test that pins this case (1af9abf); the test fails with the suggested change.