Repository navigation
Conversation
This was referenced Nov 5, 2026
tnunamak
force-pushed
the
ci/pin-runner-and-install-browser
branch
from
November 6, 2026 03:54
42c0f13 to
dce5b77
Compare
tnunamak
changed the title
This was referenced Nov 6, 2026
tnunamak
force-pushed
the
ci/pin-runner-and-install-browser
branch
from
November 6, 2026 15:45
ea3ebf8 to
27e278c
Compare
tnunamak
changed the title
The root and the reference implementation pinned patchright 1.64.1. The vendored @pdpp/polyfill-connectors tarball pins 1.63.0 exactly, so npm nested a second copy, and the browser tests launched that copy. The desktop runtime (pdpp-runtime) resolves 1.63.0, and the desktop release bundles Chromium from playwright-runner's Playwright 1.63.0. So CI ran one Patchright, the Docker image installed another, and `npx patchright install` fetched browsers for neither the tests nor the desktop. Pin 1.63.0 everywhere, the version the desktop and the vendored connectors already use. Each version fixes one Chromium revision, so CI, the Docker image and the desktop now launch the same browser. Assisted-by: AI Signed-off-by: Tim Nunamaker <tnunamak@gmail.com>
ubuntu-latest now resolves to 26.04, for which Patchright publishes no Chromium build, so the browser tests failed with no executable. Pin the typecheck, shard and postgres jobs to ubuntu-24.04 and install Patchright's Chromium explicitly. Return to ubuntu-latest once Patchright publishes a 26.04 build. scripts/check-patchright-version.mjs fails CI when the root, pdpp-runtime or playwright-runner lock resolves a different version, so a partial bump cannot split the tested browser from the shipped one. Dependabot's root entry cannot bump the other two locks, so it now skips patchright. Assisted-by: AI Signed-off-by: Tim Nunamaker <tnunamak@gmail.com>
tnunamak
force-pushed
the
ci/pin-runner-and-install-browser
branch
from
November 6, 2026 16:06
27e278c to
557680e
Compare
tnunamak
changed the title
…lders The npm entry ignored patchright, so no security or version update reached the browser that logs in to users' sites. It now covers /, /pdpp-runtime and /playwright-runner, and a browser group combines each of patchright, patchright-core, playwright and playwright-core across the three directories. Dependabot opens one pull request per dependency name, so patchright and playwright arrive separately; scripts/check-patchright-version.mjs fails each until both are merged together. Assisted-by: AI Signed-off-by: Tim Nunamaker <tnunamak@gmail.com>
Dependabot documents one pull request across directories only for group-by dependency-name, which splits patchright from playwright. A weekly workflow moves the three folders together and runs the version check before it opens the pull request. Assisted-by: AI Signed-off-by: Tim Nunamaker <tnunamak@gmail.com>
A still-open pull request from the previous run made the push fail every week. The open-and-push step moves to a script so the guard has a test. Assisted-by: AI Signed-off-by: Tim Nunamaker <tnunamak@gmail.com>
Assisted-by: AI Signed-off-by: Tim Nunamaker <tnunamak@gmail.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The version check fails CI when patchright, patchright-core and playwright-core differ between the root,
pdpp-runtimeandplaywright-runnerlocks. The oldignore:blocked every Dependabot bump of them..github/dependabot.yml: removesignore:, covers all three folders, and keeps the browser packages in one group out of the genericnpmgroup. Dependabot documents one pull request across directories only undergroup-by: dependency-name, which opens one per package name..github/workflows/browser-stack-bump.yml(weekly): bumps the three folders withscripts/bump-browser-stack.mjs, regenerates the locks, runsscripts/check-patchright-version.mjs, thenscripts/open-browser-stack-pr.shopens one pull request, or skips if last week's branch is still on origin. AGITHUB_TOKENpull request needs a close and reopen to start checks.@pdpp/polyfill-connectorstarball pins patchright 1.63.0 exactly, so a bump fails the check until an override is added. The upgrade is a separate pull request.Assisted-by: AI