From db57076c16927328d920c5f0312dacceae644d32 Mon Sep 17 00:00:00 2001 From: Chris Shuttlesworth Date: Fri, 2 Oct 2026 14:29:59 -0400 Subject: [PATCH] Mirror the Playwright tag on the PR that moves the pin mirror-playwright was dispatch-only, so Renovate's v1.63.0 bump (#67) was merged and released in v1.10.0 with nothing mirrored, and every consumer bump went red on a 404. A path-filtered pull_request trigger mirrors the new tag while the bump PR is open, so the PR can't merge or ship until the mirror holds the tag. The Actions-access grant that made the trigger unsafe in nmon has existed here since 2026-08-19. Closes #70 Co-Authored-By: Claude Opus 5.5 --- .github/workflows/mirror-playwright.yml | 19 +++++++++++++++---- 1 file changed, 15 insertions(+), 4 deletions(-) diff --git a/.github/workflows/mirror-playwright.yml b/.github/workflows/mirror-playwright.yml index f92de8a..c75def6 100644 --- a/.github/workflows/mirror-playwright.yml +++ b/.github/workflows/mirror-playwright.yml @@ -8,7 +8,15 @@ # cdn.playwright.dev — same slow path — blew playwright's 30s download timeout # under CI contention and failed builds outright. See nmon#76. # -# MANUAL ONLY — there is deliberately no schedule. In nmon, the job's +# RUNS ON THE PR THAT MOVES THE PIN, plus by hand. No schedule: the only event +# that needs a new mirror tag is a change to playwright-test.yml, so the +# pull_request trigger below mirrors it while that PR is open. A Renovate bump +# then cannot merge (or automerge) with its tag unmirrored, and no release can +# ship a pin the mirror lacks. Until 2026-10-02 this was manual-only, and +# v1.10.0 shipped v1.63.0-noble with nothing mirrored (#70). The mirror job +# skips the copy when the tag is already current, so a re-run costs seconds. +# +# The Actions-access grant is what makes that possible. In nmon, the job's # GITHUB_TOKEN could not push to the ghcr package: being the package's # Repository source (via the org.opencontainers.image.source label) confers # READ only, and the Actions-access panel will not offer the source repo. @@ -21,11 +29,14 @@ # hand: # crane pull --platform linux/amd64 mcr.microsoft.com/playwright: /tmp/pw.tar # crane push /tmp/pw.tar ghcr.io/cshuttle/playwright: -# Nothing silently rots either way: playwright-test.yml's lockstep job fails -# any PR whose tag is not mirrored, so the reminder arrives before the merge -# rather than in a scheduled run nobody watches. +# Consumers' lockstep job is the backstop: it fails any consumer PR whose tag +# is not mirrored. name: mirror-playwright on: + pull_request: + paths: + - .github/workflows/playwright-test.yml + - .github/workflows/mirror-playwright.yml workflow_dispatch: inputs: tag: