Repository navigation
Pin the browser integration test job to ubuntu-24.04 - #1454
Merged
Merged
Conversation
GitHub moved ubuntu-latest to 26.04, and `playwright install --with-deps chromium` now fails with "Playwright does not support chromium on ubuntu26.04-x64". No browser is installed, so every Playwright test fails in a few milliseconds. Runs on 2026-10-26 passed; the first runs on 2026-10-27 failed on every branch. Pin only this job. The other integration jobs do not drive a browser, and the Axum job gets Chrome through browser-actions/setup-chrome, which works on the newer image. Unpin once the pinned Playwright version supports it.
aram356
requested review from
ChristianPavilonis,
dhruv8sh and
prk-Jr
and removed request for
ChristianPavilonis
October 27, 2026 05:17
prk-Jr
approved these changes
Oct 27, 2026
5 tasks done
prk-Jr
added a commit
that referenced
this pull request
Oct 27, 2026
Resolve the conflicts with #1222, #1290, #1413 and #1454 semantically: - Apply #1413's request-host validation to every selected source except the authenticated forwarder, including ingress and adapter runtime origin, and keep RequestInfo::from_request fallible. - Carry trace_bootstrap through #1290's async EOF driver so trace-active documents keep their bootstrap on that path. - Move the trace auth log test onto #1222's shared WarningCapture so the two test loggers no longer race for the process-global slot. - Adapt main's tests that relied on unauthenticated forwarded headers, and rewrite main's host-selection CHANGELOG entry to the merged order.
prk-Jr
added a commit
that referenced
this pull request
Oct 27, 2026
The ubuntu-latest image moved to 26.04, where Playwright cannot install chromium. Apply the same pin #1454 gave the browser integration tests job.
jwrosewell
pushed a commit
to jwrosewell/trusted-server
that referenced
this pull request
Oct 28, 2026
GitHub moved ubuntu-latest to 26.04, and `playwright install --with-deps chromium` now fails with "Playwright does not support chromium on ubuntu26.04-x64". No browser is installed, so every Playwright test fails in a few milliseconds. Runs on 2026-10-26 passed; the first runs on 2026-10-27 failed on every branch. Pin only this job. The other integration jobs do not drive a browser, and the Axum job gets Chrome through browser-actions/setup-chrome, which works on the newer image. Unpin once the pinned Playwright version supports it. (cherry picked from commit fd2bf10)
This was referenced Oct 28, 2026
prk-Jr
added a commit
that referenced
this pull request
Oct 30, 2026
* docs: design mobile ad-render trace endpoint * docs: harden mobile ad trace design * Add server auction evidence to mobile trace design * Reconcile mobile trace design contracts * Clarify mobile trace design contracts * Clarify trace body validation and browser cleanup * Clarify trace failure and export cleanup contracts * Clarify mobile trace capture and truncation rules * Add default-off mobile ad-rendering trace workflow * Link trace release checklist to the repository plan * Preserve advertising behavior and trace controls * Run skipped-page trace regression in CI * Record CodeQL test-fixture triage * Bound trace capture cost and complete review corrections * Treat only commas that border reserved cookies as ambiguous When Cookie field multiplicity is not preserved, any comma anywhere in the header made all four trace cookie results unavailable. Google Identity's JSON-valued g_state cookie contains commas and is set on every page load of publishers that use One Tap, so tracing could never activate for those visitors. A comma is now ambiguous only when it could change a reserved result: inside a reserved cookie's own segment, where it could truncate the value, or directly before a reserved name, where it could hide an occurrence inside another cookie's value. Commas inside unrelated values cannot do either. The replacement-character rule is unchanged. Update the four fixtures that relied on the old rule to use a comma that still borders the session cookie, and align the spec and operator guide. * Lead the trace viewer with what happened and per-slot cards The trace page listed every retained field in one long column, so a reader on a phone had to scroll through many screens of label/value pairs, raw float timings and Unavailable rows to learn whether an ad slot filled. Open the report with a What happened summary: a headline, a short reading computed only from retained fields, count tiles and fill chips. A Needs attention list links to empty, fill-unknown, incomplete or creative-failure slots. Each GPT slot gets a card with its fill state, a proportional response/render/viewable timing bar, its exact server-slot link and a collapsed All details disclosure. Server auctions stay expanded; request, cookie and coverage sections collapse. Unavailable fields fold behind N fields unavailable, timings round to one decimal and capture times read as UTC. The summary never names an auction winner, counts only bidder-role bids so mediator echoes are not double counted, names the outcome of auctions that did not complete and applies no latency thresholds. Timing bars use stylesheet flex-weight classes, not inline styles, so the strict style-src 'self' CSP holds, and the exact milliseconds stay in text and in the bar's accessible label. Light and dark themes follow the system setting. Split the 680-line viewer into a pure, unit-tested summary model (view-model.ts), DOM primitives (report-dom.ts), detail sections (report-details.ts) and the page layout (report-view.ts). Rebuild the v1 trace assets and manifest, drop the setup shell's duplicated instruction, and describe the page in spec section 6.3. * Pin trace path classification across Fastly request conversion Fastly main skips client-IP sanitization when the native request path is a trace path, and the router hook later classifies the converted URI. Add a regression test that runs encoded, dot-segment, doubled-slash, case and lookalike paths through both and asserts they agree, so a future conversion change cannot route unsanitized forwarded headers into ordinary dispatch. Drop the repeated activation value from the bounded-lifetime test; only 1 and true activate diagnostics. * Authenticate forwarded public origins before request dispatch * Document random forwarder tokens and temporary digest comparison * Address trace workflow review findings Document authenticated forwarding and the current dev proxy limitation, pin the Spin runtime checksum, and keep composition tests compatible with ES2020. Refresh the stale trace input digest after verifying rebuilt JS and CSS exactly match the frozen assets. * Address trace build provenance and dispatch review findings * Update EdgeZero to reviewed request ingress revision * Forward Cloudflare fixture readiness through shared spawn helper * Resolve trace asset and authenticated client IP review findings * Align trace Spin installer with the pinned runtime * Align trace metadata and asset validation with review findings * Link trace versioning follow-up outside the published docs * Pin the trace browser acceptance job to ubuntu-24.04 The ubuntu-latest image moved to 26.04, where Playwright cannot install chromium. Apply the same pin #1454 gave the browser integration tests job. * Use released EdgeZero v0.0.11 for trace routing Migrate ingress metadata to the released module and convert Fastly requests through the public adapter API while retaining the snapshot captured before native mutation. Add a regression for original-origin preservation and update the implementation-plan API references. * Use EdgeZero's Fastly ingress capture Convert through the public adapter API without replacing its ingress metadata. Native sanitation leaves the URL and Host unchanged, so the earlier snapshot and application-owned override are redundant. Remove the helper-only test and align the implementation plan with adapter-owned capture. * Keep trace security fixtures compatible with domain lint * Explain split malformed origin fixtures
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
ubuntu-latestmoved to 26.04, andplaywright install --with-deps chromiumnow fails:No browser gets installed, so every Playwright test then fails in a few milliseconds. This is repo-wide and not specific to any branch: the
browser integration testscheck passed on runs from 2026-10-26 and fails on the first runs from 2026-10-27, withImage: ubuntu-26.04in the job log.Found while CI was red on #1300; the failure is unrelated to that PR's changes, so the fix is here rather than mixed into it.
What changed
Pin only the
browser-testsjob toubuntu-24.04.The other jobs are deliberately left floating:
integration tests,integration tests (Fastly EC lifecycle), andprepare integration artifactsdo not drive a browser.cargo test (axum native)does use Chrome, but obtains it throughbrowser-actions/setup-chrome, which works on 26.04. Verified: on the same 26.04 run where the browser job failed, that job passed.Testing
actionlint .github/workflows/integration-tests.ymlpasses.runs-onchanges; the other three stayubuntu-latest.browser integration testsrun, which exercises the pinned image.Unpin once the pinned Playwright version supports the newer image.