Skip to content

Run e2e job inside the Playwright container image#282

Closed
mariusvniekerk wants to merge 10 commits intogotestsumfrom
e2e-pw-image
Closed

Run e2e job inside the Playwright container image#282
mariusvniekerk wants to merge 10 commits intogotestsumfrom
e2e-pw-image

Conversation

@mariusvniekerk
Copy link
Copy Markdown
Collaborator

Summary

Why

Recent webkit run #74867926876, step 8 spent ~13 of ~14 minutes in apt-get pulling 114 MB of gstreamer/gtk debs from azure.archive.ubuntu.com at ~143 kB/s. Caching ~/.cache/ms-playwright would not have helped — the apt traffic is the bottleneck. Using the prebuilt image eliminates that round-trip.

🤖 Generated with Claude Code

Switch the e2e matrix job to `runs-on: ubuntu-latest` with `container:
mcr.microsoft.com/playwright:v1.55.1-noble`. Browsers and their OS deps
ship preinstalled in that image, so we drop the `bunx playwright install
--with-deps` step entirely.

The motivation is the apt-get phase of `--with-deps`. Recent webkit runs
spent ~13 of the ~14-minute install step pulling 114 MB of gstreamer/gtk
debs from azure.archive.ubuntu.com at ~143 kB/s. The browser tarball
download itself is the cheap part, so caching `~/.cache/ms-playwright`
would not have helped; eliminating the apt round-trip does.

Tag pin (`v1.55.1-noble`) must track `@playwright/test` in bun.lock.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
@roborev-ci
Copy link
Copy Markdown

roborev-ci Bot commented May 7, 2026

roborev: Combined Review (5369c64)

E2E CI change has one High-severity version mismatch and one Medium-severity supply-chain risk.

High

  • .github/workflows/ci.yml:197
    The Playwright container image tag mcr.microsoft.com/playwright:v1.55.1-noble does not match the project’s @playwright/test version in frontend/package.json / frontend/bun.lock (1.54.2). The workflow comment says the image tag must track the lockfile version, and this mismatch can cause unexpected E2E failures.

    Fix: use mcr.microsoft.com/playwright:v1.54.2-noble.

Medium

  • .github/workflows/ci.yml:195
    The E2E job uses a mutable third-party container tag. If the tag is republished or the upstream image supply chain is compromised, the CI job runs subsequent steps inside attacker-controlled tooling with access to the checked-out repo and job token context.

    Fix: pin the image by digest, for example mcr.microsoft.com/playwright@sha256:<digest>, and update it intentionally when bumping Playwright.


Synthesized from 3 reviews (agents: codex, gemini | types: default, security)

The Playwright image (mcr.microsoft.com/playwright:v1.55.1-noble) is
minimal beyond Node.js and the browsers; it ships without unzip, which
oven-sh/setup-bun shells out to in order to extract the bun tarball.
The action fails on every matrix entry with:

  Error: Unable to locate executable file: unzip.

Add a tiny apt-get step before setup-bun. The metadata fetch and single
package install are cheap (~a few seconds), unrelated to the heavy
gstreamer install that motivated moving to the container image.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
@roborev-ci
Copy link
Copy Markdown

roborev-ci Bot commented May 7, 2026

roborev: Combined Review (debfbec)

No medium-or-higher issues found.

All reviewers agree the change is clean.


Synthesized from 3 reviews (agents: codex, gemini | types: default, security)

actions/checkout writes its safe.directory entry against a temporary
HOME during its own steps, so when later steps run inside the
container with HOME=/github/home, the entry is gone. go build then
fails the VCS-stamp shell-out with "error obtaining VCS status: exit
status 128", since git refuses to read a working tree owned by another
uid (the host runner).

Re-register safe.directory after checkout against the persistent HOME
so subsequent git invocations from go build succeed.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
@roborev-ci
Copy link
Copy Markdown

roborev-ci Bot commented May 7, 2026

roborev: Combined Review (9462af4)

High severity issue found: the e2e CI image and Playwright dependency versions are mismatched.

High

  • .github/workflows/ci.yml:197
    The workflow uses mcr.microsoft.com/playwright:v1.55.1-noble, but frontend/package.json and frontend/bun.lock still pin Playwright to 1.54.2. Since the browser install step was removed, Playwright 1.54.2 will look for browser revisions that do not match the ones preinstalled in the 1.55.1 container image, causing the e2e job to fail.

    Fix: Use mcr.microsoft.com/playwright:v1.54.2-noble, or upgrade the frontend Playwright dependency and lockfile to 1.55.1.


Synthesized from 3 reviews (agents: codex, gemini | types: default, security)

The host-runner Go jobs (lint, test, race, build) all share an ~178 MB
setup-go cache keyed
  setup-go-Linux-x64-ubuntu24-go-1.26.0-<go.sum-hash>

The "ubuntu24" segment comes from setup-go reading the ImageOS env
var, which GitHub sets on hosted runners but does not propagate into
container jobs. The e2e job therefore got a cache miss every run and
re-downloaded the entire module set inside the container.

The Playwright image is also Ubuntu 24 (noble) on amd64 with the same
Go toolchain, and the build/module caches are content-addressed
(filenames are hashes of inputs, no absolute paths baked in), so the
host's cache is reusable from inside the container. Set ImageOS at
the job level so the keys line up.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
@roborev-ci
Copy link
Copy Markdown

roborev-ci Bot commented May 7, 2026

roborev: Combined Review (0b00721)

E2E CI has a High-severity version mismatch that will likely break Playwright browser resolution.

High

  • .github/workflows/ci.yml:196
    The e2e job now uses mcr.microsoft.com/playwright:v1.55.1-noble, but frontend/bun.lock pins @playwright/test and playwright to 1.54.2. Since the install step was removed, Playwright 1.54.2 will look for its own browser revision, which is not the one preinstalled in the 1.55.1 image, causing CI e2e runs to fail with a missing browser executable error.

    Fix by either changing the container image to mcr.microsoft.com/playwright:v1.54.2-noble, or upgrading @playwright/test, playwright, and frontend/bun.lock to 1.55.1.


Synthesized from 3 reviews (agents: codex, gemini | types: default, security)

The Playwright image doesn't ship tmux, but the e2e workspace runtime
spawns tmux sessions to host workspace shells. Without it the e2e tests
fail with "tmux: executable file not found" before they can drive the UI.
Bundle the install with unzip so we still hit apt-get only once.
@roborev-ci
Copy link
Copy Markdown

roborev-ci Bot commented May 7, 2026

roborev: Combined Review (d90abac)

CI will fail unless the Playwright container version is aligned with the locked Playwright dependency.

High

  • .github/workflows/ci.yml:197
    The e2e job uses mcr.microsoft.com/playwright:v1.55.1-noble and removes playwright install, but the repo is still locked to @playwright/test / playwright 1.54.2. Playwright Docker images include browsers for the matching Playwright version, so the tests will look for 1.54.2 browser binaries that are not installed.

    Fix: Pin the container image to mcr.microsoft.com/playwright:v1.54.2-noble, or update @playwright/test and the lockfile to 1.55.1 in the same change.


Synthesized from 3 reviews (agents: codex, gemini | types: default, security)

Firefox and WebKit refuse to launch when \$HOME is owned by another user.
Actions runs the Playwright container as root but sets HOME=/github/home,
which the image initializes as pwuser, so Playwright dies with "Firefox
is unable to launch if the \$HOME folder isn't owned by the current
user". Setting HOME=/root just on the test step is the workaround
Playwright's own error message recommends, and leaves the surrounding
steps (setup-go cache, bun install) on /github/home where they expect
to be.
@roborev-ci
Copy link
Copy Markdown

roborev-ci Bot commented May 7, 2026

roborev: Combined Review (4dee7b9)

Medium issue found: e2e may still fail from Git safe-directory config being written under a different HOME.

Medium

  • .github/workflows/ci.yml:257: The e2e step overrides HOME=/root, but the earlier safe.directory registration was written under the default /github/home. Since Playwright starts the server with go run, Go may still invoke git for VCS stamping and hit the same dubious-ownership failure the workflow is trying to avoid.

    Fix: Register the workspace as safe under /root before Playwright runs, e.g. HOME=/root git config --global --add safe.directory "$GITHUB_WORKSPACE", or avoid changing HOME for the process that launches go run.


Synthesized from 3 reviews (agents: codex, gemini | types: default, security)

When a workflow run is cancelled mid-test (e.g. concurrency cancel from
a follow-up push), gotestsum's --jsonfile is left without a final
elapsed-bearing event. The publish steps still ran under
'if: always() && ...' and dorny/test-reporter then errored with
"missing elapsed on final test event", clobbering the run with a
red annotation that has nothing to do with the actual test results.
Switch the conditions to !cancelled() so we only publish when there's
a real, complete result file to parse; success and failure paths still
publish as before.
@roborev-ci
Copy link
Copy Markdown

roborev-ci Bot commented May 7, 2026

roborev: Combined Review (95d5736)

High-risk CI issue found: e2e tests are likely to fail because the Playwright container version does not match the pinned test runner.

High

  • .github/workflows/ci.yml:195
    The e2e job skips playwright install and uses mcr.microsoft.com/playwright:v1.55.1-noble, while the repo pins @playwright/test to 1.54.2. Playwright browser revisions must match the runner version, so CI may fail when launching browsers.

    Fix: Use mcr.microsoft.com/playwright:v1.54.2-noble, or update @playwright/test and bun.lock to 1.55.1.


Synthesized from 3 reviews (agents: codex, gemini | types: default, security)

Two related bugs in gitclone.Manager.Diff that only show up on git
< 2.50 (e.g. the Playwright noble image used by the e2e job runs git
2.43, while hosted ubuntu-latest is on 2.53):

  - whitespaceOnlyFiles compared "git diff --raw" to "git diff --raw -w"
    and treated the difference as the whitespace-only set. Older git
    ignores -w in --raw output (it just compares blob SHAs), so the two
    outputs were identical and we concluded no file was whitespace-only.
    Pivot through --numstat -w instead, which honors -w consistently.

  - The hideWhitespace=true branch never dropped files from the result;
    it relied on --raw -w doing the filtering for us. Older git leaves
    those files in, so the API returned modified-but-whitespace-only
    files even when the caller asked to hide them. Drop them server-side
    after parsing, gated on Status == "modified" so renames/adds/deletes
    still pass through.

Caught by tests/e2e-full/diff-view.spec.ts "hide whitespace toggle
filters whitespace-only files", which expected 3 files but saw 4 in
the noble container.
@roborev-ci
Copy link
Copy Markdown

roborev-ci Bot commented May 7, 2026

roborev: Combined Review (956a8bd)

Medium-confidence issues remain in whitespace diff filtering and missing e2e coverage.

Medium

  • internal/gitclone/diff.go:228 - whitespaceOnlyFiles treats every raw diff path missing from --numstat -w as whitespace-only, but --numstat can also omit metadata-only changes such as file mode changes. With hideWhitespace=true, a chmod-only change may disappear from the PR diff even though it is not whitespace-only. Preserve raw metadata and exclude mode-only or metadata-bearing changes from the whitespace-only map; only classify content changes as whitespace-only when the blob changed and --numstat -w omits them.

  • internal/gitclone/diff.go:152 - This user-visible PR diff behavior change lacks full-stack/e2e coverage. Add an API or full-stack e2e test with a real git fixture verifying hideWhitespace=true filters whitespace-only modified files while keeping non-whitespace and metadata-only changes visible.


Synthesized from 3 reviews (agents: codex, gemini | types: default, security)

setup-go's cache tarball stores absolute paths from where it was saved.
Host jobs save with GOCACHE=/home/runner/.cache/go-build, but the e2e
container resolves go env to /github/home/.cache/go-build, so even when
the cache key matches (after the earlier ImageOS=ubuntu24 fix), the
restore extracts to /home/runner/... and Go looks at /github/home/...
and finds nothing. Result: every e2e browser builds the e2e-server
binary cold, ~30 s.

Pin GOCACHE and GOMODCACHE to the host paths in the container, mkdir
them before setup-go runs so the restore has a target, and the
e2e-server build now hits the warm cache populated by the test/race
host jobs.
@roborev-ci
Copy link
Copy Markdown

roborev-ci Bot commented May 7, 2026

roborev: Combined Review (958f168)

Medium-risk change with one missing coverage finding.

Medium

  • internal/gitclone/diff.go:151 - The new hide-whitespace diff behavior depends on a server-side --numstat -w fallback for older Git versions, but there is no e2e/API coverage for this user-visible PR diff path. Add an e2e/API test that exercises the real HTTP API and SQLite path with a PR diff containing a whitespace-only file, verifying hide-whitespace omits it while default mode still marks it as whitespace-only.

Synthesized from 3 reviews (agents: codex, gemini | types: default, security)

@actions/cache hashes the compression method into the cache version
alongside the paths and key. Host runners ship zstd and save with
cache.tzst; the Playwright noble image lacks zstd and falls back to
gzip, so the container looks up cache.tgz under the same setup-go-*
key and misses every time. Path alignment alone (the prior fix) wasn't
enough — same key, different version.

Add zstd to the apt-get install so @actions/cache picks it up and
the container-side lookup matches the host's saved version. The Build
E2E server step should now hit the warm cache on subsequent runs
instead of compiling cold.
@roborev-ci
Copy link
Copy Markdown

roborev-ci Bot commented May 7, 2026

roborev: Combined Review (b0264e4)

Summary verdict: One Medium test coverage gap remains; no High or Critical findings were reported.

Medium

  • internal/gitclone/diff.go:148 - The whitespace-hiding diff behavior fixes a user-visible PR diff bug, but there is no e2e coverage for the older-Git path it protects. Add a full-stack e2e test using a fixture repo with a whitespace-only modified file, asserting the default diff includes it and hideWhitespace removes it through the real HTTP/API flow.

Synthesized from 3 reviews (agents: codex, gemini | types: default, security)

@mariusvniekerk mariusvniekerk deleted the branch gotestsum May 7, 2026 20:04
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant