From a950bfd1ab54f0f02865b11f63e12758d704407f Mon Sep 17 00:00:00 2001 From: Wondertan Date: Thu, 3 Sep 2026 20:34:15 +0100 Subject: [PATCH 1/2] ci: run every package's Playwright suite Adds a "Browser tests" job that runs `test:e2e:install` and then `test:e2e` in every package that defines them, each against its own local server; packages without a suite are skipped, so the job is a no-op until one lands. Nothing is added to the workspace root. Assisted-by: Claude Fable 5.1 Claude-Session: https://claude.ai/code/session_012SVAaP3Z7Haz18WJBjCZAw Signed-off-by: Wondertan --- .github/workflows/ci.yml | 32 ++++++++++++++++++++++++++++++++ 1 file changed, 32 insertions(+) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index a1817efa..40b8ff53 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -216,3 +216,35 @@ jobs: missing=1 done exit "$missing" + + # --------------------------------------------------------------------------- + # Browser tests: every package's Playwright suite (`test:e2e`), each against + # its own local server, with browsers installed by the package's own + # `test:e2e:install`. No external service is involved. + # --------------------------------------------------------------------------- + browser: + name: Browser tests + runs-on: ubuntu-latest + timeout-minutes: 30 + steps: + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + + - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10 + with: + version: 10 + - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 + with: + node-version: 24 + cache: pnpm + cache-dependency-path: ts/pnpm-lock.yaml + + - name: Install dependencies + run: pnpm -C ts install --frozen-lockfile + + # Each package that has a Playwright suite installs the browsers it + # needs and runs its own suite; packages without one are skipped. + - name: Install browsers + run: pnpm -C ts -r --if-present run test:e2e:install + + - name: Browser tests + run: pnpm -C ts -r --if-present run test:e2e From 1a97f28becf285e3f3b4202d90949a149b73c01a Mon Sep 17 00:00:00 2001 From: Wondertan Date: Mon, 14 Sep 2026 11:13:27 +0200 Subject: [PATCH 2/2] ci: retain ceremony runtime coverage in shared browser job Build workspace dependencies and check browser test types before running all suites. Grant read access to the matched notary image and run suites serially with sufficient time for real proving and notarization. Continue through failed suites while preserving a failing job outcome. Assisted-by: GPT-6 Signed-off-by: Wondertan --- .github/workflows/ci.yml | 30 ++++++++++++++++++++---------- 1 file changed, 20 insertions(+), 10 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 40b8ff53..6d7ffb44 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -1,10 +1,6 @@ name: CI -# Three jobs: the TypeScript workspace (library + demo), DCO, and the -# compose-stack smoke test — our first automated -# infra-level integration test (it boots the real released images against a -# fresh anvil, re-runs the deterministic deploy, and asserts the services -# answer). +# TypeScript checks, workspace browser tests, infrastructure smoke and DCO. # # Every third-party action is pinned by commit SHA, with the tag in a # comment, so a moved tag cannot change what executes. @@ -218,14 +214,17 @@ jobs: exit "$missing" # --------------------------------------------------------------------------- - # Browser tests: every package's Playwright suite (`test:e2e`), each against - # its own local server, with browsers installed by the package's own - # `test:e2e:install`. No external service is involved. + # Browser tests: each workspace owns its suite, browser installation and + # test servers. Ceremony also exercises real proving and matched-notary + # containers, with release downloads and external network requests. # --------------------------------------------------------------------------- browser: name: Browser tests runs-on: ubuntu-latest - timeout-minutes: 30 + timeout-minutes: 60 + permissions: + contents: read + packages: read steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 @@ -241,10 +240,21 @@ jobs: - name: Install dependencies run: pnpm -C ts install --frozen-lockfile + - name: Build workspace + run: pnpm -C ts build + # Each package that has a Playwright suite installs the browsers it # needs and runs its own suite; packages without one are skipped. - name: Install browsers run: pnpm -C ts -r --if-present run test:e2e:install + - name: Check browser test types + run: pnpm -C ts -r --if-present run typecheck:e2e + + - name: Log in to ghcr for the matched notary image + run: echo "${{ secrets.GITHUB_TOKEN }}" | docker login ghcr.io -u "${{ github.actor }}" --password-stdin + + # Run suites serially so proof generation has the runner to itself. + # Keep running independent suites after a failure; the job still fails. - name: Browser tests - run: pnpm -C ts -r --if-present run test:e2e + run: pnpm -C ts -r --workspace-concurrency=1 --no-bail --if-present run test:e2e