ci: boot the runner image and run playwright against it - #79
Merged
Conversation
matthew-demidoff
force-pushed
the
phase2/authz-matrix
branch
from
September 5, 2026 19:47
d05cf5a to
aff8208
Compare
matthew-demidoff
force-pushed
the
phase2/runner-e2e
branch
from
September 5, 2026 19:47
6d159ad to
52475f6
Compare
CI built the production runner image on every push and then threw it away, running the Playwright scenarios against the dev server instead. Nonce CSP, HSTS, the standalone server and migrate-on-boot exist only in the image, so the artifact that ships was the one thing the end-to-end suite never touched. Tag the runner build, boot it on the host network against the Postgres and Redis services with the five secrets validateConfig() requires (Cloudflare's always-pass Turnstile keypair, so form submissions can be exercised later), wait on /api/health/ready, and point Playwright at it via PLAYWRIGHT_BASE_URL. Container logs are dumped on failure and the container is always removed. Locally nothing changes: without PLAYWRIGHT_BASE_URL the config still starts the dev server on 3100.
matthew-demidoff
force-pushed
the
phase2/runner-e2e
branch
from
September 5, 2026 19:56
52475f6 to
ce68224
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Third of the CI stack; based on #78 (phase2/authz-matrix). Needs the Redis
service from #77 because /api/health/ready requires both stores. Rebase onto
master after #78 merges.
CI built the production runner image on every push and then threw it away,
running the Playwright scenarios against the dev server instead. Nonce CSP,
HSTS, the standalone server and migrate-on-boot exist only in the image, so
the artifact that ships was the one thing the end-to-end suite never touched.
the Postgres and Redis services and the five secrets validateConfig()
requires (Cloudflare's documented always-pass Turnstile keypair, so
login/register submissions can be exercised in a later spec), wait on
/api/health/ready with a bounded loop that dumps container logs on
timeout, run Playwright with PLAYWRIGHT_BASE_URL, dump logs on failure,
always remove the container. Playwright's browser install overlaps the
image boot. The dev-server e2e run is dropped from CI: one pass, against
the artifact that ships.
when it is unset. Local flow unchanged.
Rehearsed locally against scratch Postgres/Redis: the image was ready in
about 4s, served the production CSP and HSTS headers, and all 14 e2e
scenarios passed against it; the dev-server path still passes with the
variable unset.