From 9643916f16bef9cbc74d75e4864faf17f1ede49e Mon Sep 17 00:00:00 2001
From: Jens <jens@localhost.localdomain>
Date: Tue, 1 Sep 2026 17:30:15 +0200
Subject: [PATCH] ci: run browser gate in pinned Playwright image

---
 .gitea/workflows/managed-validation.yml | 12 +++++++-----
 1 file changed, 7 insertions(+), 5 deletions(-)

diff --git a/.gitea/workflows/managed-validation.yml b/.gitea/workflows/managed-validation.yml
index ad2d911..97e29d5 100644
--- a/.gitea/workflows/managed-validation.yml
+++ b/.gitea/workflows/managed-validation.yml
@@ -23,6 +23,11 @@ jobs:
     name: full
     runs-on: ubuntu-latest
     timeout-minutes: 30
+    container:
+      image: mcr.microsoft.com/playwright/python:v1.54.0-noble
+      options: --ipc=host
+    env:
+      PLAYWRIGHT_BROWSERS_PATH: /ms-playwright
     steps:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
       - name: Validate repository with a bounded profile
@@ -58,11 +63,8 @@ jobs:
               export PATH="${UV_PROJECT_ENVIRONMENT}/bin:${PATH}"
               if [[ "${profile}" == test || "${profile}" == full ]]; then
                 if "${managed_uv}" run python -c 'import pytest' 2>/dev/null; then
-                  # Avoid an unbounded apt transaction here: it previously
-                  # kept the job alive for more than an hour before any test
-                  # had started. Missing runtime libraries still fail closed
-                  # when the mandatory browser tests launch Chromium.
-                  timeout --foreground 10m "${managed_uv}" run playwright install chromium
+                  # The version-matched Playwright CI image supplies Chromium
+                  # and its runtime libraries without an apt transaction.
                   timeout --foreground 20m "${managed_uv}" run python -m pytest
                 fi
               fi