Add Playwright loopback smoke workflows - #7934
Merged
Merged
Conversation
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 6ba940bd-5aa8-4dd2-9c34-fc4c991fe355
Contributor
✅ Coverage Check PassedOverall Coverage
📁 Per-file Coverage Changes (1 files)
Coverage comparison generated by |
Contributor
There was a problem hiding this comment.
Copilot review overview
🟡 Changes recommended
npm installation bypasses AWF network enforcement, and the Cloud Hypervisor workflow does not expose the required runner tool cache.
Once you've addressed the issues Copilot identified, you can request another Copilot review.
Review tier: Balanced
Findings: 4
New issues introduced by this change (4)
| Severity | Finding |
|---|---|
 |
.github/workflows/smoke-playwright-runc.md — This install runs as a host setup step before the generated awf invocation… |
|
.github/workflows/smoke-playwright-gvisor.md — This install runs as a host setup step before the generated awf invocation… |
|
.github/workflows/smoke-playwright-docker-sbx.md — This install runs as a host setup step before the generated awf invocation… |
|
.github/workflows/smoke-playwright-cloud-hypervisor.md — This install runs as a host setup step before the generated awf invocation… |
What changed in this PR
Adds Playwright loopback smoke coverage across four AWF runtimes, including browser validation, blocked egress checks, and generated workflow support.
Changes:
- Adds shared Playwright smoke and result-validation scripts.
- Adds runc, gVisor, Docker sbx, and Cloud Hypervisor workflows.
- Extends post-processing for new gVisor and sbx locks.
| File | Description |
|---|---|
scripts/ci/validate-playwright-loopback-smoke.js |
Validates runtime results. |
scripts/ci/run-playwright-loopback-smoke.sh |
Runs browser smoke checks. |
scripts/ci/postprocess-smoke-workflows.ts |
Patches new runtime locks. |
.github/workflows/smoke-playwright-runc.md |
Defines runc smoke workflow. |
.github/workflows/smoke-playwright-runc.lock.yml |
Compiled runc workflow. |
.github/workflows/smoke-playwright-gvisor.md |
Defines gVisor smoke workflow. |
.github/workflows/smoke-playwright-gvisor.lock.yml |
Compiled gVisor workflow. |
.github/workflows/smoke-playwright-docker-sbx.md |
Defines sbx smoke workflow. |
.github/workflows/smoke-playwright-docker-sbx.lock.yml |
Compiled and patched sbx workflow. |
.github/workflows/smoke-playwright-cloud-hypervisor.md |
Defines Cloud Hypervisor smoke workflow. |
.github/workflows/smoke-playwright-cloud-hypervisor.lock.yml |
Compiled Cloud Hypervisor workflow. |
Suppressed comments (1)
.github/workflows/smoke-playwright-cloud-hypervisor.md:49
- The generated Cloud Hypervisor command omits
--cloud-hypervisor-mount-policy workspace-and-tool-cache, although Playwright CLI is installed under the runner's global Node tool cache and the generated guest command scansRUNNER_TOOL_CACHE. AWF defaults toworkspace-onlyand removes that variable unless the cache export exists (docs/awf-config-spec.md:148-164;src/cloud-hypervisor/guest-environment-builder.ts:43-51), so this workflow fails before it can findplaywright-cli. Add the explicit tool-cache mount policy to this workflow's generated AWF invocation, then regenerate and post-process the lock.
runtime: cloud-hypervisor
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Comment on lines
+31
to
+34
| - name: Install Playwright CLI from Microsoft registry | ||
| run: | | ||
| test "$(npm view @playwright/cli@0.1.18 version --registry="$NPM_CONFIG_REGISTRY")" = "0.1.18" | ||
| npm install -g @playwright/cli@0.1.18 --registry="$NPM_CONFIG_REGISTRY" |
Comment on lines
+31
to
+34
| - name: Install Playwright CLI from Microsoft registry | ||
| run: | | ||
| test "$(npm view @playwright/cli@0.1.18 version --registry="$NPM_CONFIG_REGISTRY")" = "0.1.18" | ||
| npm install -g @playwright/cli@0.1.18 --registry="$NPM_CONFIG_REGISTRY" |
Comment on lines
+31
to
+34
| - name: Install Playwright CLI from Microsoft registry | ||
| run: | | ||
| test "$(npm view @playwright/cli@0.1.18 version --registry="$NPM_CONFIG_REGISTRY")" = "0.1.18" | ||
| npm install -g @playwright/cli@0.1.18 --registry="$NPM_CONFIG_REGISTRY" |
Comment on lines
+31
to
+34
| - name: Install Playwright CLI from Microsoft registry | ||
| run: | | ||
| test "$(npm view @playwright/cli@0.1.18 version --registry="$NPM_CONFIG_REGISTRY")" = "0.1.18" | ||
| npm install -g @playwright/cli@0.1.18 --registry="$NPM_CONFIG_REGISTRY" |
Contributor
|
⏳ Copilot review left inline comments. @lpcox To proceed:
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
127.0.0.1https://example.comnavigation failsPackage provenance
@playwright/cli@0.1.18https://packagefeedproxy.microsoft.io/npm/Both
@playwright/cli@0.1.18and the post-processing dependencyts-node@10.9.2are available from the Microsoft registry.Validation
The runtime workflows intentionally determine whether each sandbox image/rootfs already contains Chromium's required Linux shared libraries; failures will identify which runtime artifact needs those dependencies baked in without granting package-manager privileges inside the sandbox.