deps: resolve one Patchright version across the workspace

package.json

@@ -135,6 +135,9 @@
     "@huggingface/transformers": {
       "sharp": "^0.35.4"
     },
+    "@pdpp/polyfill-connectors": {
+      "patchright": "$patchright"
+    },
     "qs": "^6.15.2"
   }
 }

reference-implementation/runtime/browser-executable.ts

@@ -39,7 +39,7 @@ export const IMAGE_BROWSERS_PATH = "/opt/patchright-browsers";
  */
 export const BROWSERS_PATH_ENV_KEYS = ["PLAYWRIGHT_BROWSERS_PATH", "PATCHRIGHT_BROWSERS_PATH"] as const;
 
-/** The only variable patchright-core 1.63.0 reads for the browsers directory. */
+/** The only variable patchright-core reads for the browsers directory. */
 const PATCHRIGHT_READS_KEY = "PLAYWRIGHT_BROWSERS_PATH";
 
 const LINUX_EXECUTABLE_DIRS: Readonly<Record<string, string>> = {

scripts/patchright-single-version.test.ts

@@ -0,0 +1,61 @@
+// Copyright The PDP-Connect Contributors
+// SPDX-License-Identifier: Apache-2.0
+
+// One Patchright for the whole workspace. The Dockerfile installs the browser
+// revision of reference-implementation's exact `patchright` pin, and
+// runtime/browser-executable.ts checks for that revision. Whether the built
+// image really launches that browser is covered by the docker-images workflow,
+// not here. A second copy of
+// Patchright in the lockfile (for example one pinned by the vendored
+// @pdpp/polyfill-connectors tarball) launches a different Chromium revision
+// than the one the image installs. The root `overrides` entry for
+// @pdpp/polyfill-connectors keeps the tree on one version.
+
+import assert from "node:assert/strict";
+import { readFileSync } from "node:fs";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import { test } from "vitest";
+
+const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
+
+function readJson(relativePath: string) {
+  return JSON.parse(readFileSync(path.join(root, relativePath), "utf8"));
+}
+
+function lockedPatchrightEntries(): Array<{ key: string; version: string }> {
+  const lock = readJson("package-lock.json");
+  return Object.entries<{ version?: string }>(lock.packages)
+    .filter(([key]) => /(^|\/)node_modules\/patchright(-core)?$/.test(key))
+    .map(([key, entry]) => ({ key, version: String(entry.version) }));
+}
+
+test("package-lock.json resolves every patchright and patchright-core copy to the image's pin", () => {
+  const pin = readJson("reference-implementation/package.json").dependencies.patchright;
+  assert.match(pin, /^\d+\.\d+\.\d+$/, "reference-implementation must pin patchright exactly");
+
+  const entries = lockedPatchrightEntries();
+  assert.ok(
+    entries.some((entry) => entry.key === "node_modules/patchright"),
+    "lockfile has no top-level patchright entry"
+  );
+  assert.ok(
+    entries.some((entry) => entry.key === "node_modules/patchright-core"),
+    "lockfile has no top-level patchright-core entry"
+  );
+  const stray = entries.filter((entry) => entry.version !== pin);
+  assert.deepEqual(stray, [], `lockfile entries not on patchright ${pin}`);
+});
+
+test("the root patchright dependency matches the reference-implementation pin", () => {
+  assert.equal(
+    readJson("package.json").dependencies.patchright,
+    readJson("reference-implementation/package.json").dependencies.patchright
+  );
+});
+
+test("the root overrides keep the vendored connectors package on the root patchright", () => {
+  // Without this entry the lockfile test above still passes until the next
+  // regeneration, when npm would nest the tarball's own pin again.
+  assert.equal(readJson("package.json").overrides?.["@pdpp/polyfill-connectors"]?.patchright, "$patchright");
+});

vite.config.ts

@@ -63,6 +63,7 @@ export default defineConfig(({ mode }) => ({
       "scripts/mutation-falsification/*.test.ts",
       "scripts/check-dockerfile-copy-paths.test.ts",
       "scripts/chrome-distrust-policy.test.ts",
+      "scripts/patchright-single-version.test.ts",
       "scripts/check-flyio-deploy-env.test.ts",
       "scripts/check-railway-deploy-env.test.ts",
       "scripts/check-railway-ghcr-public.test.ts",