Repository navigation
checks #88
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: native-browser-install-proof | |
| on: | |
| workflow_dispatch: | |
| permissions: | |
| contents: read | |
| jobs: | |
| native-browser-install: | |
| runs-on: ubuntu-24.04 | |
| timeout-minutes: 20 | |
| steps: | |
| - name: Checkout exact proof source | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 | |
| with: | |
| persist-credentials: false | |
| - name: Setup workspace | |
| uses: ./.github/actions/setup | |
| with: | |
| provider: github | |
| - name: Provision real dependencies and process tracing | |
| working-directory: apps/sim | |
| run: | | |
| mkdir -p "$RUNNER_TEMP/browser-install-proof" | |
| bunx --no-install playwright install-deps chromium | |
| sudo apt-get install -y --no-install-recommends strace | |
| - name: Compare baseline and candidate process boundaries | |
| working-directory: apps/sim | |
| run: | | |
| report="$RUNNER_TEMP/browser-install-proof" | |
| started=$SECONDS | |
| sudo env "PATH=$PATH" "HOME=$HOME" strace -f -e trace=execve -o "$report/baseline.trace" \ | |
| bunx --no-install playwright install --with-deps --no-shell chromium > "$report/baseline.log" 2>&1 | |
| baseline_seconds=$((SECONDS - started)) | |
| grep -E 'execve\([^,]*apt-get", \["apt-get", "update"' "$report/baseline.trace" | |
| started=$SECONDS | |
| sudo env "PATH=$PATH" "HOME=$HOME" strace -f -e trace=execve -o "$report/candidate.trace" \ | |
| bash "$GITHUB_WORKSPACE/.github/scripts/install-playwright.sh" --no-shell chromium > "$report/candidate.log" 2>&1 | |
| candidate_seconds=$((SECONDS - started)) | |
| if grep -E 'execve\([^,]*apt-get", \["apt-get", "update"' "$report/candidate.trace"; then | |
| echo '::error::An already-provisioned runner updated apt.' | |
| exit 1 | |
| fi | |
| grep -F 'All system dependencies are installed.' "$report/candidate.log" | |
| jq -n --arg source "$(git rev-parse HEAD)" --argjson baseline "$baseline_seconds" --argjson candidate "$candidate_seconds" \ | |
| '{source:$source,baselineSeconds:$baseline,candidateSeconds:$candidate,baselineUpdatedApt:true,candidateUpdatedApt:false}' > "$report/comparison.json" | |
| cat "$report/comparison.json" | |
| - name: Restore a genuinely missing browser dependency | |
| working-directory: apps/sim | |
| run: | | |
| report="$RUNNER_TEMP/browser-install-proof" | |
| sudo dpkg --remove fonts-wqy-zenhei | |
| if dpkg-query -W -f='${Status}' fonts-wqy-zenhei 2>/dev/null | grep -q 'install ok installed'; then exit 1; fi | |
| bash "$GITHUB_WORKSPACE/.github/scripts/install-playwright.sh" --no-shell chromium > "$report/missing-dependency.log" 2>&1 | |
| dpkg-query -W -f='${Status}' fonts-wqy-zenhei | grep -F 'install ok installed' | |
| jq -n '{removedPackage:"fonts-wqy-zenhei",restored:true}' > "$report/dependency.json" | |
| - name: Launch full Chromium and headless shell | |
| working-directory: apps/sim | |
| env: | |
| BROWSER_INSTALL_REPORT_PATH: ${{ runner.temp }}/browser-install-proof/launches.json | |
| run: | | |
| bash "$GITHUB_WORKSPACE/.github/scripts/install-playwright.sh" --only-shell chromium | |
| bun --no-env-file - <<'JS' | |
| import { chromium } from 'playwright' | |
| const results = [] | |
| for (const channel of ['chromium', undefined]) { | |
| const started = performance.now() | |
| const browser = await chromium.launch({ ...(channel ? { channel } : {}), headless: true }) | |
| const page = await browser.newPage() | |
| await page.setContent('<title>Native browser fixture</title>') | |
| if (await page.title() !== 'Native browser fixture') throw new Error('Native browser did not execute the fixture') | |
| results.push({ channel: channel ?? 'headless-shell', version: browser.version(), status: 'passed', durationMs: performance.now() - started }) | |
| await browser.close() | |
| } | |
| await Bun.write(process.env.BROWSER_INSTALL_REPORT_PATH, JSON.stringify({ results }, null, 2)) | |
| JS | |
| - name: Preserve provisioning evidence | |
| if: always() | |
| uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 | |
| with: | |
| name: native-browser-install-proof | |
| path: ${{ runner.temp }}/browser-install-proof/ | |
| retention-days: 7 |