From 7969fc1b1ad313990e7231467aad6647e9960f42 Mon Sep 17 00:00:00 2001 From: Ompragash Date: Wed, 9 Sep 2026 23:55:07 +0530 Subject: [PATCH] fix(ci): isolate Playwright dependencies to Ubuntu sources --- .github/workflows/pages.yml | 4 ++- .../RELEASE_CONTAINER_REMEDIATION_20260906.md | 11 +++++++ scripts/check-workflow.mjs | 3 ++ scripts/install-browser-deps.sh | 30 +++++++++++++++++++ 4 files changed, 47 insertions(+), 1 deletion(-) create mode 100644 scripts/install-browser-deps.sh diff --git a/.github/workflows/pages.yml b/.github/workflows/pages.yml index aca79de..4bb1b4b 100644 --- a/.github/workflows/pages.yml +++ b/.github/workflows/pages.yml @@ -58,8 +58,10 @@ jobs: - name: Install site dependencies and browser run: | + set -euo pipefail pnpm install --frozen-lockfile - pnpm exec playwright install --with-deps chromium + bash scripts/install-browser-deps.sh + pnpm exec playwright install chromium - name: Verify canonical docs and final site artifact env: diff --git a/docs/execution/RELEASE_CONTAINER_REMEDIATION_20260906.md b/docs/execution/RELEASE_CONTAINER_REMEDIATION_20260906.md index 9192aa9..a5ade04 100644 --- a/docs/execution/RELEASE_CONTAINER_REMEDIATION_20260906.md +++ b/docs/execution/RELEASE_CONTAINER_REMEDIATION_20260906.md @@ -294,3 +294,14 @@ The live durable receipt records three `gpt-6-astra` requests with high reasonin The trusted outer pipeline built and tested the original and changed application; each isolated application test run passed two tests. Rescanning against the same recorded vulnerability database removed the three targeted advisories, introduced no new findings and disclosed 270 unrelated residual findings. Those residual findings remain unresolved. Independent verification recomputed eligibility and matched the exact two-file remote PR tree. Report `remediate-34195429813/publication-verification.json` has SHA-256 `6ffd78a9f761f419a3640f41f63a46aa37d4f9bb3d4b7fead4bc13472b420d8c`. [Publication reconciliation run 34196095845](https://github.com/Ompragash/agentctl-remediation-demo/actions/runs/34196095845) passed with the paid jobs skipped before any steps. It revalidated the recorded publication artifact and reused the same branch, fingerprint, validated tree and draft PR with zero fresh provider requests. The verification report `reconcile-34196095845/verification.json` has SHA-256 `a35fd2e745557f72d3ee30f4a6703cd0c0145386cac64b85523e25859ac7cffd`. This verifies outer CI publication reconciliation. Runtime replay and selective recovery have separate execution evidence; no exactly-once GitHub delivery guarantee follows. Production publication and smoke testing of the published image remain separate operator steps. + + +## Isolated browser dependencies after deployment failure + +The approved documentation PR9 merged as `6cbdf51d9bf7f229099643695909f3d36ff5b72d`, but [Pages run 34384620405](https://github.com/opensourceops/opensourceops.github.io/actions/runs/34384620405) failed twice during browser dependency installation. Both attempts rejected a checksum mismatch in the unrelated Google Chrome APT repository before site verification or deployment. The original logs remain in `deployed-7dee64e/attempt-1-failure.log` and `attempt-2-failure.log`; neither attempt is passing evidence. + +The workflow now installs the pinned Playwright system dependencies with a temporary APT configuration that selects only the Ubuntu 24.04 runner's existing `ubuntu.sources`. An empty additional-source directory and temporary package indexes isolate that invocation from unrelated repositories and cached indexes. The original mirrors, signed keyring, authentication, TLS and hash verification remain unchanged. The helper removes its temporary files and does not rewrite system repository configuration. Browser download still uses the pinned local Playwright CLI, and the full paired verification command is unchanged. + +This uses the documented [APT configuration paths](https://manpages.ubuntu.com/manpages/noble/man5/apt.conf.5.html) and [Playwright dependency command](https://playwright.dev/docs/browsers#install-system-dependencies). The pinned CLI runs explicitly through `sudo env` so APT receives its process-local configuration; Playwright's own elevation would drop that environment variable. The framework pin and all generated source and package bytes remain at `7dee64e`. + +A disposable Ubuntu 24.04 ARM64 regression passed with the actual pinned Playwright CLI. Ordinary APT rejected an unsigned fixture repository; the scoped dependency installation succeeded. Ubuntu and fixture repository files remained byte-identical, the unsigned repository still failed afterward, and temporary configuration was removed. The test used image `c5d7ef7bcac94a1079cf99039a14f1f322e2e860400197cb367bdb97aac8c8f3`; `apt-isolation-verification.json` and the complete install log remain alongside the prior failures. Local shell syntax, workflow, writing, Markdown and diff checks passed. The exact hosted AMD64 paired gate and public deployment are the next required evidence. diff --git a/scripts/check-workflow.mjs b/scripts/check-workflow.mjs index 58b2eb1..b0e0fc5 100644 --- a/scripts/check-workflow.mjs +++ b/scripts/check-workflow.mjs @@ -40,6 +40,9 @@ for (const required of [ 'pages: write', 'id-token: write', 'path: site/_site', + 'bash scripts/install-browser-deps.sh', + 'pnpm exec playwright install chromium', + 'run: pnpm verify:agentctl', ]) { if (!workflow.includes(required)) errors.push(`missing workflow contract: ${required}`); } diff --git a/scripts/install-browser-deps.sh b/scripts/install-browser-deps.sh new file mode 100644 index 0000000..98b4072 --- /dev/null +++ b/scripts/install-browser-deps.sh @@ -0,0 +1,30 @@ +#!/usr/bin/env bash +set -euo pipefail + +# This CI helper targets the workflow's pinned Ubuntu 24.04 runner. +source /etc/os-release +if [[ "$ID" != ubuntu || "$VERSION_ID" != 24.04 ]]; then + echo 'Browser dependency isolation requires Ubuntu 24.04.' >&2 + exit 1 +fi +test -s /etc/apt/sources.list.d/ubuntu.sources + +node_bin="$(command -v node)" +playwright_cli="$(node -p 'require.resolve("@playwright/test/cli")')" +apt_work="$(mktemp -d /tmp/agentctl-playwright-apt.XXXXXX)" +trap 'sudo rm -rf -- "$apt_work"' EXIT +chmod 755 "$apt_work" +mkdir "$apt_work/empty" "$apt_work/lists" + +# Preserve Ubuntu's configured mirrors and Signed-By keyring. Scope both source +# discovery and cached indexes to this invocation; never rewrite host sources. +cat > "$apt_work/apt.conf" <