Implement pest --record command for browser test generation

.github/SECURITY.md

@@ -0,0 +1,3 @@
+# Security Policy
+
+Please refer to the [Pest Security Policy](https://github.com/pestphp/pest/security/policy) for information on how to report security vulnerabilities.

.github/dependabot.yml

@@ -0,0 +1,19 @@
+version: 2
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    groups:
+      github-actions:
+        patterns:
+          - "*"
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    target-branch: "5.x"
+    groups:
+      github-actions:
+        patterns:
+          - "*"

.github/workflows/tests.yml

@@ -2,6 +2,9 @@ name: Tests
 
 on: ['push', 'pull_request']
 
+permissions:
+  contents: read
+
 jobs:
   ci:
     runs-on: ${{ matrix.os }}
@@ -16,15 +19,15 @@ jobs:
 
     steps:
     - name: Checkout
-      uses: actions/checkout@v6
+      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
 
     - name: Setup Node ${{ matrix.node }}
-      uses: actions/setup-node@v6
+      uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
       with:
         node-version: ${{ matrix.node }}
 
     - name: Setup PHP
-      uses: shivammathur/setup-php@v2
+      uses: shivammathur/setup-php@accd6127cb78bee3e8082180cb391013d204ef9f # v2
       with:
         php-version: ${{ matrix.php }}
         tools: composer:v2

README.md

@@ -2,6 +2,16 @@ This repository contains the Pest Plugin for Browser.
 
 > If you want to start testing your application with Pest, visit the main **[Pest Repository](https://github.com/pestphp/pest)**.
 
+### Recording Tests
+
+Generate browser-tests by recording your interactions in the browser:
+
+```bash
+vendor/bin/pest --record
+```
+
+See **[RECORDING.md](RECORDING.md)** for more information.
+
 - Explore our docs at **[pestphp.com »](https://pestphp.com)**
 - Follow the creator Nuno Maduro:
     - YouTube: **[youtube.com/@nunomaduro](https://www.youtube.com/@nunomaduro)** — Videos every weekday

RECORDING.md

@@ -0,0 +1,79 @@
+# Recording Guide
+
+## How it works
+
+`vendor/bin/pest --record` automatically starts an HTTP server with `APP_ENV=testing` before the browser opens, then
+shuts it down when recording ends — matching the same behavior as running browser tests normally with `vendor/bin/pest`.
+
+The browser opens at full screen resolution by default (auto-detected per OS). Close the browser when done. Pest prompts
+for a test description and output file, then writes the generated test to `tests/Browser/`.
+
+## Options
+
+| Option                 | Default           | Description                                                   |
+|------------------------|-------------------|---------------------------------------------------------------|
+| `--url=`               | auto              | Skip auto-server; connect to this URL instead                 |
+| `--visit=`             | `/`               | Path to open on start                                         |
+| `--test-id-attribute=` | `id`              | HTML attribute used for element selectors                     |
+| `--device=`            | —                 | Emulate a device (e.g. `"iPhone 15"`)                         |
+| `--viewport=`          | screen resolution | Viewport size in pixels (e.g. `1280,800`)                     |
+| `--auth` / `--user`    | —                 | Start browser pre-authenticated as a factory user (see below) |
+| `--auth-script=`       | —                 | Path to a custom auth bootstrap script (non-Laravel apps)     |
+| `--env=`               | `testing`         | Environment for the auto-started server                       |
+| `--migrate-fresh`      | —                 | Run `migrate:fresh` before opening the browser                |
+| `--seed`               | —                 | Seed the database after `--migrate-fresh`                     |
+| `--browser=`           | `chrome`          | Browser to record with: `chrome`, `firefox`, `safari`         |
+| `--channel=`           | —                 | Browser channel (e.g. `msedge`, `chrome-canary`)              |
+| `--lang=`              | —                 | Override browser locale (e.g. `fr`, `nl`)                     |
+| `--timezone=`          | —                 | Override browser timezone (e.g. `Europe/Paris`)               |
+| `--color-scheme=`      | —                 | Preferred color scheme: `dark`, `light`, `no-preference`      |
+
+## Recording in a specific browser
+
+```bash
+vendor/bin/pest --record --browser=firefox
+vendor/bin/pest --record --browser=chrome --channel=msedge
+```
+
+## Recording with locale or timezone
+
+```bash
+vendor/bin/pest --record --lang=fr --timezone=Europe/Paris
+vendor/bin/pest --record --color-scheme=dark
+```
+
+## Recording authenticated flows (`--auth`)
+
+Tests run with `APP_ENV=testing` (fresh, isolated DB). Recording against credentials that only exist in your local DB
+means those credentials won't exist when the test runs.
+
+`--auth` solves this without manual login: before the browser opens, Pest bootstraps the Laravel app, creates a factory
+user, starts a session authenticated as that user, and injects a valid session cookie into the browser. The browser
+starts pre-authenticated.
+
+```bash
+vendor/bin/pest --record --auth --visit=/dashboard
+```
+
+`--user` is an alias for `--auth`.
+
+The generated test uses `$this->actingAs(\App\Models\User::factory()->create())` — no real credentials, works in any
+environment.
+
+## Fresh database before recording
+
+```bash
+vendor/bin/pest --record --migrate-fresh --seed --visit=/dashboard
+```
+
+Useful when you want to record against a predictable dataset.
+
+## Recording against an existing server
+
+Pass `--url=` to skip the auto-server entirely:
+
+```bash
+vendor/bin/pest --record --url=http://localhost:8000 --visit=/dashboard
+```
+
+Useful when you have Herd, Valet, or a running `php artisan serve` instance.

composer.json

@@ -95,7 +95,8 @@
     "extra": {
         "pest": {
             "plugins": [
-                "Pest\\Browser\\Plugin"
+                "Pest\\Browser\\Plugin",
+                "Pest\\Browser\\Record"
             ]
         }
     }