Repository navigation
fix(mise): revert @playwright/cli pin to latest - #466
Conversation
Issue #373's pin to 0.1.18 was a temporary workaround for a trust regression in @playwright/cli's 0.1.19 release (published without GitHub Actions OIDC provenance, unlike every prior release). Upstream restored GitHub Actions + OIDC publishing (microsoft/playwright-cli#459), confirmed by 0.1.20/0.1.21 npm attestations matching the same trusted publish workflow, and a local `mise install` of `latest` now succeeds. Revert the entry to "latest", matching sibling npm-backend entries in the same file, and drop the now-obsolete pin comment. The neighboring inshellisense comment cross-referenced that pin to contrast its own, unrelated low-download-count gate; rework it so it no longer points at a pin that no longer exists. Closes #465
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
This comment has been minimized.
This comment has been minimized.
There was a problem hiding this comment.
Copilot review overview
🟢 Approval recommended
The config and test changes are consistent with the stated goal and are internally coherent with no issues found in the modified hunks.
Review effort: Lite
Findings: None
What changed in this PR
This PR reverts the @playwright/cli mise tool entry back to tracking "latest" now that upstream npm publish provenance (GitHub Actions OIDC / SLSA attestations) has been restored, and updates nearby commentary and tests to match.
Changes:
- Update
home/dot_config/mise/config.tomlto set"npm:@playwright/cli" = "latest"and remove the obsolete pin rationale. - Rework the adjacent
@microsoft/inshellisensecomment block to avoid dangling references while still distinguishing aube’s low-download gate vs. trust/provenance-regression behavior. - Update the bats test to assert
"latest"for@playwright/cliand rename the test accordingly.
| File | Description |
|---|---|
| home/dot_config/mise/config.toml | Reverts @playwright/cli from a pinned version back to "latest" and adjusts surrounding explanatory comments. |
| tests/bash/60-mise.bats | Renames the playwright-related test and updates the assertion to expect "latest". |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
This comment has been minimized.
This comment has been minimized.
|
Rejected — chatgpt-codex-connector[bot] did not review HEAD 042fd98 (Codex usage limits for code reviews reached); this is not a completed review (source: #issuecomment-5755892001) |
This comment has been minimized.
This comment has been minimized.
|
|
F4 Cleanup Evidence (server-side fallback via
|
Summary
home/dot_config/mise/config.toml'snpm:@playwright/clientry from
0.1.18back to"latest": upstream restored GitHubActions + OIDC publishing (devops: restore npm publishing from GitHub Actions microsoft/playwright-cli#459), confirmed
by npm attestations on
0.1.20/0.1.21matching the same trustedpublish workflow that
0.1.0-0.1.18used, and delete thenow-obsolete pin comment.
npm:@microsoft/inshellisensecomment blockso it no longer cross-references the removed playwright pin, while
still correctly distinguishing aube's two reputation/trust gates
(low-download-count vs. trust/provenance-regression).
tests/bash/60-mise.bats: rename the playwright pin test andflip its assertion to check for
"latest"instead of"0.1.18".Validation
tests/bash/helpers/bats-core/bin/bats tests/bash/: 482 passed.npx markdownlint-cli2andnpx cspell lint "**": 0 issues.pwsh -c "Invoke-Pester tests/powershell/ -Output Detailed -CI": 445passed, 119 skipped, 1 failed -- the same pre-existing
mkcert -installbounded-timeout fixture already documented asunrelated, concurrency-sensitive flakiness in perf(shell): reduce repeated Windows path scans during WSL startup #462 (Windows-only
scopes are skipped on this WSL host; the authoritative full run
remains Windows local execution and Windows CI). It passes in
isolation (
57-setup-mkcert-ca.Tests.ps1alone: 11/11) and onlytimes out under concurrent local load; this PR touches no
PowerShell files.
combinedmode): 0 findings on thisdiff. Independent per-agent critique pass: 0 blocking findings (one
Low, out-of-scope note about pre-existing blank-line spacing near
the edited entry, not introduced by this change).
drafting fix(mise): revert @playwright/cli pin to latest now that upstream OIDC trust is restored #465:
mise install -y "npm:@playwright/cli@latest"(mise2026.9.11) resolves to
0.1.21with notrustPolicy=no-downgraderejection.
Commit signing
Configured GPG signing was attempted once and failed at pinentry
(
PINENTRY_LAUNCHED ... curses,signing failed: End of file/署名に失敗しました: ファイル終端). Per the pinentry/TTY category, thegpg-agent restart step was skipped. The repository's
git commit-sshfallback then succeeded; commit
042fd98carries an SSH signature.Local verification reports no signature validity because
gpg.ssh.allowedSignersFileis not configured (same as #462).Closes #465
🤖 Generated with Claude Code
Summary by CodeRabbit