Adding playwright config for running console e2e.#1706
Conversation
openshift-ci
Bot
added
the
needs-rebase
|
Warning Review limit reached
More reviews will be available in 57 minutes and 57 seconds. Learn how PR review limits work. Your organization has run out of usage credits. Purchase more in the billing tab. ⌛ How to resolve this issue?After more reviews become available, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans include higher PR review limits than trial, open-source, and free plans. In all cases, reviews become available again over time. During sustained high-volume PR review activity, CodeRabbit may temporarily slow when the next review becomes available. Please see our Fair Usage Limits Policy for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Enterprise Run ID: 📒 Files selected for processing (3)
📝 WalkthroughWalkthroughThis PR migrates OpenShift Lightspeed console end-to-end tests from Cypress to Playwright. Two Tekton pipeline definitions (pf5 and pf6) and a test execution script are updated: pipeline descriptions, container images, environment variable names, and script invocations reference Playwright instead of Cypress, with the script adding Playwright browser installation and CI mode configuration. ChangesPlaywright E2E Migration
Estimated code review effort🎯 2 (Simple) | ⏱️ ~12 minutes Suggested reviewers
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
sriroopar
force-pushed
the
setting-up-playwright-script
branch
from
5ceb1bf to
9de69aa
Compare
openshift-ci
Bot
removed
the
needs-rebase
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🧹 Nitpick comments (1)
.tekton/integration-tests/scripts/run-console-playwright-tests.sh (1)
74-76: 💤 Low valueClarify function argument usage.
The
run_playwrightfunction accepts arguments via"$@"but is never invoked with any arguments (lines 79, 85). If Playwright configuration comes entirely from config files and no command-line arguments are needed, the function signature could be simplified. If arguments might be needed in the future, the current design is forward-compatible.Verify whether this is intentional (future-proofing) or if the signature should be simplified:
run_playwright() { - npx playwright test "$@" + npx playwright test }🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.tekton/integration-tests/scripts/run-console-playwright-tests.sh around lines 74 - 76, The run_playwright function currently declares npx playwright test "$@" but is never called with arguments; either simplify the function to always call npx playwright test (remove "$@" from run_playwright) if no CLI args are needed, or keep the forward-compatible signature and update all invocations of run_playwright (e.g., the calls on lines around where run_playwright is used) to explicitly pass any expected arguments; also add a short comment above the run_playwright function indicating which choice was made (no-arg vs forward-compatible) so future readers know the intention.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In
@.tekton/integration-tests/pipelines/lightspeed-console-e2e-test-pipeline-pf5.yaml:
- Line 191: The pipeline is using a vulnerable Playwright image
"mcr.microsoft.com/playwright:v1.60.0-noble" which Trivy flagged for multiple
HIGH CVEs; replace that image reference with a newer patched Playwright image
tag or digest (e.g., a more recent v1.x-noble tag or an explicit digest) to
eliminate CVE-2025-3887, CVE-2026-45447 and CVE-2026-33671, or if you intend to
accept the risk, add an explicit justification comment in the pipeline and a
documented risk acceptance ticket; update the image string in the pipeline task
spec where "mcr.microsoft.com/playwright:v1.60.0-noble" appears (or pin to an
immutable digest) and re-run vulnerability scans to verify remediation.
In @.tekton/integration-tests/scripts/run-console-playwright-tests.sh:
- Line 24: The export of LOGIN_PASSWORD currently uses command substitution
which can mask failures; change to first assign the result of cat
"${PASSWORD_PATH}" to a local variable (e.g., tmp or LOGIN_PASSWORD) and check
the exit status or test the file/readability of PASSWORD_PATH before exporting;
if cat fails or the file is unreadable, print an error and exit non‑zero,
otherwise run export LOGIN_PASSWORD to set the environment. Ensure you reference
the PASSWORD_PATH variable and the LOGIN_PASSWORD export in the script (the line
using export LOGIN_PASSWORD="$(cat "${PASSWORD_PATH}")") when making the change.
---
Nitpick comments:
In @.tekton/integration-tests/scripts/run-console-playwright-tests.sh:
- Around line 74-76: The run_playwright function currently declares npx
playwright test "$@" but is never called with arguments; either simplify the
function to always call npx playwright test (remove "$@" from run_playwright) if
no CLI args are needed, or keep the forward-compatible signature and update all
invocations of run_playwright (e.g., the calls on lines around where
run_playwright is used) to explicitly pass any expected arguments; also add a
short comment above the run_playwright function indicating which choice was made
(no-arg vs forward-compatible) so future readers know the intention.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: 66000d62-7c1a-43a0-ae9f-95fe6c290811
📒 Files selected for processing (3)
.tekton/integration-tests/pipelines/lightspeed-console-e2e-test-pipeline-pf5.yaml.tekton/integration-tests/pipelines/lightspeed-console-e2e-test-pipeline-pf6.yaml.tekton/integration-tests/scripts/run-console-playwright-tests.sh
| - name: BUNDLE_IMAGE | ||
| value: "$(params.bundle-image)" | ||
| image: cypress/browsers:26.0.0 | ||
| image: mcr.microsoft.com/playwright:v1.60.0-noble |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Description: Verify Playwright Docker image exists and check for vulnerabilities
# Check if the image exists and can be pulled
echo "Checking if image exists..."
docker manifest inspect mcr.microsoft.com/playwright:v1.60.0-noble >/dev/null 2>&1 && echo "✓ Image exists" || echo "✗ Image not found"
# Check available Playwright versions
echo -e "\nFetching recent Playwright releases..."
gh api repos/microsoft/playwright/releases --paginate | jq -r '.[].tag_name' | head -20Repository: openshift/lightspeed-operator
Length of output: 319
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "Checking likely existing Playwright image tags..."
for tag in "v1.60.0" "v1.60.0-noble" "v1.60.0-jammy" "v1.60.0-focal" "v1.60.0-bookworm" "v1.60.0-oraclelinux9"; do
printf " - %s: " "$tag"
if docker manifest inspect "mcr.microsoft.com/playwright:${tag}" >/dev/null 2>&1; then
echo "✓ exists"
else
echo "✗ not found"
fi
doneRepository: openshift/lightspeed-operator
Length of output: 307
🌐 Web query:
mcr.microsoft.com/playwright v1.60.0 noble tag exists
💡 Result:
Yes, the Docker tag mcr.microsoft.com/playwright:v1.60.0-noble exists in the Microsoft Artifact Registry [1]. Official Playwright documentation confirms that they publish images for v1.60.0 based on Ubuntu 24.04 LTS (Noble Numbat) using this tag [2][3].
Citations:
- 1: https://mcr.microsoft.com/en-us/artifact/mar/playwright/tag/v1.60.0-noble
- 2: https://playwright.dev/docs/docker
- 3: https://github.com/microsoft/playwright/blob/main/docs/src/docker.md
🏁 Script executed:
#!/bin/bash
set -euo pipefail
IMAGE="mcr.microsoft.com/playwright:v1.60.0-noble"
echo "Checking published tag page..."
curl -fsSL "https://mcr.microsoft.com/en-us/artifact/mar/playwright/tag/v1.60.0-noble" >/dev/null \
&& echo "✓ tag page reachable" || echo "✗ tag page not reachable"
echo "Scanning image (requires trivy)..."
if command -v trivy >/dev/null 2>&1; then
docker pull "$IMAGE"
trivy image --severity HIGH,CRITICAL --no-progress "$IMAGE"
else
echo "trivy not installed; run trivy/grype in CI against $IMAGE and fail on HIGH/CRITICAL"
fiRepository: openshift/lightspeed-operator
Length of output: 226
🏁 Script executed:
#!/bin/bash
set -euo pipefail
IMAGE="mcr.microsoft.com/playwright:v1.60.0-noble"
echo "Checking published tag..."
curl -fsSL "https://mcr.microsoft.com/en-us/artifact/mar/playwright/tag/v1.60.0-noble" >/dev/null \
&& echo "✓ Tag page reachable" || echo "✗ Tag page not reachable"
if command -v trivy >/dev/null 2>&1 && command -v docker >/dev/null 2>&1; then
docker pull "$IMAGE"
trivy image --severity HIGH,CRITICAL --no-progress "$IMAGE"
else
echo "Run this check in CI with docker + trivy installed to scan $IMAGE (fail on HIGH/CRITICAL)."
fiRepository: openshift/lightspeed-operator
Length of output: 247
🏁 Script executed:
#!/bin/bash
set -euo pipefail
IMAGE="mcr.microsoft.com/playwright:v1.60.0-noble"
command -v docker >/dev/null 2>&1 || { echo "docker not found"; exit 1; }
command -v trivy >/dev/null 2>&1 || { echo "trivy not found"; exit 1; }
docker pull "$IMAGE"
trivy image --severity HIGH,CRITICAL --no-progress "$IMAGE"
# Optional (recommended): pin by digest for reproducibility
# DIGEST="$(docker inspect --format='{{index .RepoDigests 0}}' "$IMAGE" | cut -d@ -f2)"
# echo "Pinned digest: $DIGEST"Repository: openshift/lightspeed-operator
Length of output: 90
🏁 Script executed:
#!/bin/bash
set -euo pipefail
IMAGE="mcr.microsoft.com/playwright:v1.60.0-noble"
# In CI where docker + trivy are available
command -v docker >/dev/null 2>&1 || { echo "docker not found"; exit 1; }
command -v trivy >/dev/null 2>&1 || { echo "trivy not found"; exit 1; }
docker pull "$IMAGE"
trivy image --severity HIGH,CRITICAL --no-progress "$IMAGE"
# Optional: pin to immutable digest (recommended)
# DIGEST="$(docker inspect --format='{{index .RepoDigests 0}}' "$IMAGE" | awk -F@ '{print $2}')"
# echo "$IMAGE@$DIGEST"Repository: openshift/lightspeed-operator
Length of output: 90
🏁 Script executed:
#!/bin/bash
set -euo pipefail
IMAGE="mcr.microsoft.com/playwright:v1.60.0-noble"
command -v docker >/dev/null 2>&1 || { echo "docker not found (run in CI)"; exit 1; }
command -v trivy >/dev/null 2>&1 || { echo "trivy not found (install in CI)"; exit 1; }
docker pull "$IMAGE"
trivy image --severity HIGH,CRITICAL --no-progress "$IMAGE"
# Optional (recommended): pin to digest
# DIGEST="$(docker inspect --format='{{index .RepoDigests 0}}' "$IMAGE" | awk -F@ '{print $2}')"
# echo "$IMAGE@$DIGEST"Repository: openshift/lightspeed-operator
Length of output: 102
🏁 Script executed:
#!/bin/bash
set -euo pipefail
IMAGE="mcr.microsoft.com/playwright:v1.60.0-noble"
command -v docker >/dev/null 2>&1 || { echo "docker not found (run in CI)"; exit 1; }
command -v trivy >/dev/null 2>&1 || { echo "trivy not found (install in CI)"; exit 1; }
docker pull "$IMAGE"
trivy image --severity HIGH,CRITICAL --no-progress "$IMAGE"
# Optional (recommended): pin to immutable digest
# DIGEST="$(docker inspect --format='{{index .RepoDigests 0}}' "$IMAGE" | awk -F@ '{print $2}')"
# echo "Pinned digest: $IMAGE@$DIGEST"Repository: openshift/lightspeed-operator
Length of output: 102
🏁 Script executed:
#!/bin/bash
set -euo pipefail
IMAGE="mcr.microsoft.com/playwright:v1.60.0-noble"
command -v docker >/dev/null 2>&1 || { echo "docker not found"; exit 1; }
command -v trivy >/dev/null 2>&1 || { echo "trivy not found"; exit 1; }
docker pull "$IMAGE"
trivy image --severity HIGH,CRITICAL --no-progress "$IMAGE"
# Optional: pin by digest for reproducibility
# DIGEST="$(docker inspect --format='{{index .RepoDigests 0}}' "$IMAGE" | awk -F@ '{print $2}')"
# echo "$IMAGE@$DIGEST"Repository: openshift/lightspeed-operator
Length of output: 90
🏁 Script executed:
#!/bin/bash
set -euo pipefail
IMAGE="mcr.microsoft.com/playwright:v1.60.0-noble"
command -v trivy >/dev/null 2>&1 || { echo "trivy not found (install in CI)"; exit 1; }
# Scans the remote image directly (no docker daemon required)
trivy image --severity HIGH,CRITICAL --no-progress "$IMAGE"
# Optional: pin to immutable digest (do in CI using your preferred tooling, e.g., crane/skopeo)
# DIGEST="$(crane digest "$IMAGE")"
# echo "Pinned image: $IMAGE@$DIGEST"Repository: openshift/lightspeed-operator
Length of output: 45074
Address HIGH vulnerabilities in Playwright image used by the pipeline
In .tekton/integration-tests/pipelines/lightspeed-console-e2e-test-pipeline-pf5.yaml (line 191), mcr.microsoft.com/playwright:v1.60.0-noble is an official Microsoft Playwright Ubuntu 24.04 “Noble” image, but Trivy reports 4 HIGH vulnerabilities (0 CRITICAL): CVE-2025-3887 (gstreamer1.0-plugins-bad), CVE-2026-45447 (libssl3t64), and CVE-2026-33671 (picomatch). Update to a newer patched Playwright image tag/digest (or justify risk acceptance if this is intentionally tolerated for e2e-only usage).
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In
@.tekton/integration-tests/pipelines/lightspeed-console-e2e-test-pipeline-pf5.yaml
at line 191, The pipeline is using a vulnerable Playwright image
"mcr.microsoft.com/playwright:v1.60.0-noble" which Trivy flagged for multiple
HIGH CVEs; replace that image reference with a newer patched Playwright image
tag or digest (e.g., a more recent v1.x-noble tag or an explicit digest) to
eliminate CVE-2025-3887, CVE-2026-45447 and CVE-2026-33671, or if you intend to
accept the risk, add an explicit justification comment in the pipeline and a
documented risk acceptance ticket; update the image string in the pipeline task
spec where "mcr.microsoft.com/playwright:v1.60.0-noble" appears (or pin to an
immutable digest) and re-run vulnerability scans to verify remediation.
9de69aa to
a5a0846
Compare
sriroopar
force-pushed
the
setting-up-playwright-script
branch
from
a5a0846 to
7c5e53b
Compare
|
@sriroopar: all tests passed! Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
1 participant
Description
Type of change
Related Tickets & Documents
Checklist before requesting a review
Testing
Summary by CodeRabbit