From 9816ca7c1adabfa408ad99acd8e0c322328b823d Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Sun, 26 Jul 2026 03:23:27 +0000 Subject: [PATCH 1/5] fix: disable Chromium sandbox for playwright-cli mode in CI containers Set PLAYWRIGHT_MCP_SANDBOX=false via $GITHUB_ENV so that all subsequent steps (including the agent step) have the sandbox disabled. This mirrors the --no-sandbox flag already used in Docker/MCP mode and fixes the 'Playwright can't run in this sandbox environment' error reported in #48082. The @playwright/cli package reads PLAYWRIGHT_MCP_SANDBOX to control whether to enable the Chromium process sandbox. GitHub Actions runners are containerised environments where namespace-based sandboxing is unavailable, causing playwright-cli to abort. Writing this variable to $GITHUB_ENV ensures it is available for all job steps that follow, including the AWF-sandboxed agent step (--env-all propagates it). Fixes #48082 Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com> --- .github/workflows/blog-auditor.lock.yml | 2 ++ .github/workflows/cloclo.lock.yml | 2 ++ .github/workflows/daily-model-inventory.lock.yml | 2 ++ .../daily-multi-device-docs-tester.lock.yml | 2 ++ .github/workflows/docs-noob-tester.lock.yml | 2 ++ .github/workflows/slide-deck-maintainer.lock.yml | 2 ++ .github/workflows/smoke-claude.lock.yml | 2 ++ .github/workflows/smoke-codex.lock.yml | 2 ++ .../workflows/smoke-copilot-aoai-apikey.lock.yml | 2 ++ .github/workflows/smoke-copilot-aoai-entra.lock.yml | 2 ++ .github/workflows/smoke-copilot-arm.lock.yml | 2 ++ .github/workflows/smoke-copilot.lock.yml | 2 ++ .../workflows/visual-regression-checker.lock.yml | 2 ++ .../workflows/weekly-editors-health-check.lock.yml | 2 ++ pkg/workflow/playwright_cli.go | 13 +++++++++++++ pkg/workflow/playwright_cli_test.go | 7 ++++++- 16 files changed, 47 insertions(+), 1 deletion(-) diff --git a/.github/workflows/blog-auditor.lock.yml b/.github/workflows/blog-auditor.lock.yml index ca7767f66b9..126added711 100644 --- a/.github/workflows/blog-auditor.lock.yml +++ b/.github/workflows/blog-auditor.lock.yml @@ -577,6 +577,8 @@ jobs: env: PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD: '1' timeout-minutes: 10 + - name: Configure Playwright CLI sandbox + run: echo 'PLAYWRIGHT_MCP_SANDBOX=false' >> "$GITHUB_ENV" - name: Determine automatic lockdown mode for GitHub MCP Server id: determine-automatic-lockdown uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 (source v9) diff --git a/.github/workflows/cloclo.lock.yml b/.github/workflows/cloclo.lock.yml index be70c0b1f30..5b11fbbeb16 100644 --- a/.github/workflows/cloclo.lock.yml +++ b/.github/workflows/cloclo.lock.yml @@ -703,6 +703,8 @@ jobs: env: PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD: '1' timeout-minutes: 10 + - name: Configure Playwright CLI sandbox + run: echo 'PLAYWRIGHT_MCP_SANDBOX=false' >> "$GITHUB_ENV" - name: Determine automatic lockdown mode for GitHub MCP Server id: determine-automatic-lockdown uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 (source v9) diff --git a/.github/workflows/daily-model-inventory.lock.yml b/.github/workflows/daily-model-inventory.lock.yml index 23fc8b5ab61..530419449f7 100644 --- a/.github/workflows/daily-model-inventory.lock.yml +++ b/.github/workflows/daily-model-inventory.lock.yml @@ -550,6 +550,8 @@ jobs: env: PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD: '1' timeout-minutes: 10 + - name: Configure Playwright CLI sandbox + run: echo 'PLAYWRIGHT_MCP_SANDBOX=false' >> "$GITHUB_ENV" - name: Determine automatic lockdown mode for GitHub MCP Server id: determine-automatic-lockdown uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 (source v9) diff --git a/.github/workflows/daily-multi-device-docs-tester.lock.yml b/.github/workflows/daily-multi-device-docs-tester.lock.yml index 586c72a618b..c1e289130c8 100644 --- a/.github/workflows/daily-multi-device-docs-tester.lock.yml +++ b/.github/workflows/daily-multi-device-docs-tester.lock.yml @@ -537,6 +537,8 @@ jobs: env: PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD: '1' timeout-minutes: 10 + - name: Configure Playwright CLI sandbox + run: echo 'PLAYWRIGHT_MCP_SANDBOX=false' >> "$GITHUB_ENV" - name: Determine automatic lockdown mode for GitHub MCP Server id: determine-automatic-lockdown uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 (source v9) diff --git a/.github/workflows/docs-noob-tester.lock.yml b/.github/workflows/docs-noob-tester.lock.yml index f837fb18c32..b9adb54489a 100644 --- a/.github/workflows/docs-noob-tester.lock.yml +++ b/.github/workflows/docs-noob-tester.lock.yml @@ -532,6 +532,8 @@ jobs: env: PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD: '1' timeout-minutes: 10 + - name: Configure Playwright CLI sandbox + run: echo 'PLAYWRIGHT_MCP_SANDBOX=false' >> "$GITHUB_ENV" - name: Determine automatic lockdown mode for GitHub MCP Server id: determine-automatic-lockdown uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 (source v9) diff --git a/.github/workflows/slide-deck-maintainer.lock.yml b/.github/workflows/slide-deck-maintainer.lock.yml index 3dc8eb9c594..dd743daabcb 100644 --- a/.github/workflows/slide-deck-maintainer.lock.yml +++ b/.github/workflows/slide-deck-maintainer.lock.yml @@ -584,6 +584,8 @@ jobs: env: PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD: '1' timeout-minutes: 10 + - name: Configure Playwright CLI sandbox + run: echo 'PLAYWRIGHT_MCP_SANDBOX=false' >> "$GITHUB_ENV" - name: Determine automatic lockdown mode for GitHub MCP Server id: determine-automatic-lockdown uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 (source v9) diff --git a/.github/workflows/smoke-claude.lock.yml b/.github/workflows/smoke-claude.lock.yml index b8e0879386b..5d0bb8a756b 100644 --- a/.github/workflows/smoke-claude.lock.yml +++ b/.github/workflows/smoke-claude.lock.yml @@ -828,6 +828,8 @@ jobs: env: PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD: '1' timeout-minutes: 10 + - name: Configure Playwright CLI sandbox + run: echo 'PLAYWRIGHT_MCP_SANDBOX=false' >> "$GITHUB_ENV" - name: Determine automatic lockdown mode for GitHub MCP Server id: determine-automatic-lockdown uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 (source v9) diff --git a/.github/workflows/smoke-codex.lock.yml b/.github/workflows/smoke-codex.lock.yml index be632757588..6b9453f8b95 100644 --- a/.github/workflows/smoke-codex.lock.yml +++ b/.github/workflows/smoke-codex.lock.yml @@ -680,6 +680,8 @@ jobs: env: PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD: '1' timeout-minutes: 10 + - name: Configure Playwright CLI sandbox + run: echo 'PLAYWRIGHT_MCP_SANDBOX=false' >> "$GITHUB_ENV" - name: Determine automatic lockdown mode for GitHub MCP Server id: determine-automatic-lockdown uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 (source v9) diff --git a/.github/workflows/smoke-copilot-aoai-apikey.lock.yml b/.github/workflows/smoke-copilot-aoai-apikey.lock.yml index 449bb792d7b..943413877a1 100644 --- a/.github/workflows/smoke-copilot-aoai-apikey.lock.yml +++ b/.github/workflows/smoke-copilot-aoai-apikey.lock.yml @@ -741,6 +741,8 @@ jobs: env: PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD: '1' timeout-minutes: 10 + - name: Configure Playwright CLI sandbox + run: echo 'PLAYWRIGHT_MCP_SANDBOX=false' >> "$GITHUB_ENV" - name: Determine automatic lockdown mode for GitHub MCP Server id: determine-automatic-lockdown uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 (source v9) diff --git a/.github/workflows/smoke-copilot-aoai-entra.lock.yml b/.github/workflows/smoke-copilot-aoai-entra.lock.yml index 3fe6a2173e2..bce9e230dc5 100644 --- a/.github/workflows/smoke-copilot-aoai-entra.lock.yml +++ b/.github/workflows/smoke-copilot-aoai-entra.lock.yml @@ -742,6 +742,8 @@ jobs: env: PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD: '1' timeout-minutes: 10 + - name: Configure Playwright CLI sandbox + run: echo 'PLAYWRIGHT_MCP_SANDBOX=false' >> "$GITHUB_ENV" - name: Determine automatic lockdown mode for GitHub MCP Server id: determine-automatic-lockdown uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 (source v9) diff --git a/.github/workflows/smoke-copilot-arm.lock.yml b/.github/workflows/smoke-copilot-arm.lock.yml index 00ab08b3fec..ced0f4314e2 100644 --- a/.github/workflows/smoke-copilot-arm.lock.yml +++ b/.github/workflows/smoke-copilot-arm.lock.yml @@ -669,6 +669,8 @@ jobs: env: PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD: '1' timeout-minutes: 10 + - name: Configure Playwright CLI sandbox + run: echo 'PLAYWRIGHT_MCP_SANDBOX=false' >> "$GITHUB_ENV" - name: Determine automatic lockdown mode for GitHub MCP Server id: determine-automatic-lockdown uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 (source v9) diff --git a/.github/workflows/smoke-copilot.lock.yml b/.github/workflows/smoke-copilot.lock.yml index 0277e3af28c..6ad70a59599 100644 --- a/.github/workflows/smoke-copilot.lock.yml +++ b/.github/workflows/smoke-copilot.lock.yml @@ -757,6 +757,8 @@ jobs: env: PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD: '1' timeout-minutes: 10 + - name: Configure Playwright CLI sandbox + run: echo 'PLAYWRIGHT_MCP_SANDBOX=false' >> "$GITHUB_ENV" - name: Determine automatic lockdown mode for GitHub MCP Server id: determine-automatic-lockdown uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 (source v9) diff --git a/.github/workflows/visual-regression-checker.lock.yml b/.github/workflows/visual-regression-checker.lock.yml index 51752d6c442..fa135511921 100644 --- a/.github/workflows/visual-regression-checker.lock.yml +++ b/.github/workflows/visual-regression-checker.lock.yml @@ -585,6 +585,8 @@ jobs: env: PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD: '1' timeout-minutes: 10 + - name: Configure Playwright CLI sandbox + run: echo 'PLAYWRIGHT_MCP_SANDBOX=false' >> "$GITHUB_ENV" - name: Determine automatic lockdown mode for GitHub MCP Server id: determine-automatic-lockdown uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 (source v9) diff --git a/.github/workflows/weekly-editors-health-check.lock.yml b/.github/workflows/weekly-editors-health-check.lock.yml index ce87bd7740f..d18b3de7e55 100644 --- a/.github/workflows/weekly-editors-health-check.lock.yml +++ b/.github/workflows/weekly-editors-health-check.lock.yml @@ -524,6 +524,8 @@ jobs: env: PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD: '1' timeout-minutes: 10 + - name: Configure Playwright CLI sandbox + run: echo 'PLAYWRIGHT_MCP_SANDBOX=false' >> "$GITHUB_ENV" - name: Determine automatic lockdown mode for GitHub MCP Server id: determine-automatic-lockdown uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 (source v9) diff --git a/pkg/workflow/playwright_cli.go b/pkg/workflow/playwright_cli.go index 662546ebd26..348ca50432b 100644 --- a/pkg/workflow/playwright_cli.go +++ b/pkg/workflow/playwright_cli.go @@ -104,6 +104,19 @@ func generatePlaywrightCLIInstallSteps(workflowData *WorkflowData) []GitHubActio } steps = append(steps, installSkillsStep) + // Disable the Chromium process sandbox for all subsequent steps by writing + // PLAYWRIGHT_MCP_SANDBOX=false to $GITHUB_ENV. GitHub Actions runners are + // containerised environments where kernel namespace sandboxing is unavailable, + // which causes playwright-cli to abort with "Playwright can't run in this + // sandbox environment". Setting this variable makes playwright-cli skip the + // sandbox (equivalent to --no-sandbox in Docker/MCP mode) without disabling + // any other security boundary of the runner itself. + sandboxStep := GitHubActionStep{ + " - name: Configure Playwright CLI sandbox", + ` run: echo 'PLAYWRIGHT_MCP_SANDBOX=false' >> "$GITHUB_ENV"`, + } + steps = append(steps, sandboxStep) + playwrightCLILog.Printf("Generated %d Playwright CLI install steps", len(steps)) return steps } diff --git a/pkg/workflow/playwright_cli_test.go b/pkg/workflow/playwright_cli_test.go index b9ce11ea2fc..48bbfad690d 100644 --- a/pkg/workflow/playwright_cli_test.go +++ b/pkg/workflow/playwright_cli_test.go @@ -20,7 +20,7 @@ func TestGeneratePlaywrightCLIInstallSteps_DefaultVersionUsesCooldown(t *testing }, }) - require.Len(t, steps, 2, "expected npm install step plus skills install step") + require.Len(t, steps, 3, "expected npm install step, skills install step, and sandbox configuration step") installStep := strings.Join(steps[0], "\n") assert.Contains(t, installStep, "npm install -g @playwright/cli@"+string(constants.DefaultPlaywrightCLIVersion)) @@ -30,4 +30,9 @@ func TestGeneratePlaywrightCLIInstallSteps_DefaultVersionUsesCooldown(t *testing skillsStep := strings.Join(steps[1], "\n") assert.Contains(t, skillsStep, "playwright-cli install --skills") assert.Contains(t, skillsStep, "PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD: '1'") + + sandboxStep := strings.Join(steps[2], "\n") + assert.Contains(t, sandboxStep, "Configure Playwright CLI sandbox") + assert.Contains(t, sandboxStep, "PLAYWRIGHT_MCP_SANDBOX=false") + assert.Contains(t, sandboxStep, "$GITHUB_ENV") } From c8e8fe317ce77f60b15dd38b98fb67ecc66380ad Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Sun, 26 Jul 2026 03:36:36 +0000 Subject: [PATCH 2/5] plan: move PLAYWRIGHT_MCP_SANDBOX to job-level env Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com> --- .github/skills/agentic-workflows/SKILL.md | 1 + 1 file changed, 1 insertion(+) diff --git a/.github/skills/agentic-workflows/SKILL.md b/.github/skills/agentic-workflows/SKILL.md index 615a51e551e..3fc711d4035 100644 --- a/.github/skills/agentic-workflows/SKILL.md +++ b/.github/skills/agentic-workflows/SKILL.md @@ -49,6 +49,7 @@ Load these files from `github/gh-aw` (they are not available locally). - `.github/aw/optimize-agentic-workflow.md` - `.github/aw/patterns.md` - `.github/aw/pr-reviewer.md` +- `.github/aw/release-workflow.md` - `.github/aw/report.md` - `.github/aw/reuse.md` - `.github/aw/safe-outputs-automation.md` From 061d836499cf0910a3b9999693f6d0e3a2c80201 Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Sun, 26 Jul 2026 03:47:01 +0000 Subject: [PATCH 3/5] fix: set PLAYWRIGHT_MCP_SANDBOX=false at job-level env instead of a step Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com> --- .github/skills/agentic-workflows/SKILL.md | 1 - .github/workflows/blog-auditor.lock.yml | 2 -- .github/workflows/cloclo.lock.yml | 2 -- .github/workflows/daily-model-inventory.lock.yml | 2 -- .../daily-multi-device-docs-tester.lock.yml | 2 -- .github/workflows/docs-noob-tester.lock.yml | 2 -- .github/workflows/slide-deck-maintainer.lock.yml | 2 -- .github/workflows/smoke-claude.lock.yml | 2 -- .github/workflows/smoke-codex.lock.yml | 2 -- .../workflows/smoke-copilot-aoai-apikey.lock.yml | 2 -- .../workflows/smoke-copilot-aoai-entra.lock.yml | 2 -- .github/workflows/smoke-copilot-arm.lock.yml | 2 -- .github/workflows/smoke-copilot.lock.yml | 2 -- .../workflows/visual-regression-checker.lock.yml | 2 -- .../weekly-editors-health-check.lock.yml | 2 -- pkg/workflow/compiler_main_job_helpers.go | 9 +++++++++ pkg/workflow/compiler_main_job_helpers_test.go | 16 ++++++++++++++++ pkg/workflow/playwright_cli.go | 13 ------------- pkg/workflow/playwright_cli_test.go | 7 +------ .../playwright-cli-mode.golden | 1 + .../WasmBinary/playwright-cli-mode.golden | 1 + 21 files changed, 28 insertions(+), 48 deletions(-) diff --git a/.github/skills/agentic-workflows/SKILL.md b/.github/skills/agentic-workflows/SKILL.md index 3fc711d4035..615a51e551e 100644 --- a/.github/skills/agentic-workflows/SKILL.md +++ b/.github/skills/agentic-workflows/SKILL.md @@ -49,7 +49,6 @@ Load these files from `github/gh-aw` (they are not available locally). - `.github/aw/optimize-agentic-workflow.md` - `.github/aw/patterns.md` - `.github/aw/pr-reviewer.md` -- `.github/aw/release-workflow.md` - `.github/aw/report.md` - `.github/aw/reuse.md` - `.github/aw/safe-outputs-automation.md` diff --git a/.github/workflows/blog-auditor.lock.yml b/.github/workflows/blog-auditor.lock.yml index 126added711..ca7767f66b9 100644 --- a/.github/workflows/blog-auditor.lock.yml +++ b/.github/workflows/blog-auditor.lock.yml @@ -577,8 +577,6 @@ jobs: env: PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD: '1' timeout-minutes: 10 - - name: Configure Playwright CLI sandbox - run: echo 'PLAYWRIGHT_MCP_SANDBOX=false' >> "$GITHUB_ENV" - name: Determine automatic lockdown mode for GitHub MCP Server id: determine-automatic-lockdown uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 (source v9) diff --git a/.github/workflows/cloclo.lock.yml b/.github/workflows/cloclo.lock.yml index 5b11fbbeb16..be70c0b1f30 100644 --- a/.github/workflows/cloclo.lock.yml +++ b/.github/workflows/cloclo.lock.yml @@ -703,8 +703,6 @@ jobs: env: PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD: '1' timeout-minutes: 10 - - name: Configure Playwright CLI sandbox - run: echo 'PLAYWRIGHT_MCP_SANDBOX=false' >> "$GITHUB_ENV" - name: Determine automatic lockdown mode for GitHub MCP Server id: determine-automatic-lockdown uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 (source v9) diff --git a/.github/workflows/daily-model-inventory.lock.yml b/.github/workflows/daily-model-inventory.lock.yml index 530419449f7..23fc8b5ab61 100644 --- a/.github/workflows/daily-model-inventory.lock.yml +++ b/.github/workflows/daily-model-inventory.lock.yml @@ -550,8 +550,6 @@ jobs: env: PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD: '1' timeout-minutes: 10 - - name: Configure Playwright CLI sandbox - run: echo 'PLAYWRIGHT_MCP_SANDBOX=false' >> "$GITHUB_ENV" - name: Determine automatic lockdown mode for GitHub MCP Server id: determine-automatic-lockdown uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 (source v9) diff --git a/.github/workflows/daily-multi-device-docs-tester.lock.yml b/.github/workflows/daily-multi-device-docs-tester.lock.yml index c1e289130c8..586c72a618b 100644 --- a/.github/workflows/daily-multi-device-docs-tester.lock.yml +++ b/.github/workflows/daily-multi-device-docs-tester.lock.yml @@ -537,8 +537,6 @@ jobs: env: PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD: '1' timeout-minutes: 10 - - name: Configure Playwright CLI sandbox - run: echo 'PLAYWRIGHT_MCP_SANDBOX=false' >> "$GITHUB_ENV" - name: Determine automatic lockdown mode for GitHub MCP Server id: determine-automatic-lockdown uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 (source v9) diff --git a/.github/workflows/docs-noob-tester.lock.yml b/.github/workflows/docs-noob-tester.lock.yml index b9adb54489a..f837fb18c32 100644 --- a/.github/workflows/docs-noob-tester.lock.yml +++ b/.github/workflows/docs-noob-tester.lock.yml @@ -532,8 +532,6 @@ jobs: env: PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD: '1' timeout-minutes: 10 - - name: Configure Playwright CLI sandbox - run: echo 'PLAYWRIGHT_MCP_SANDBOX=false' >> "$GITHUB_ENV" - name: Determine automatic lockdown mode for GitHub MCP Server id: determine-automatic-lockdown uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 (source v9) diff --git a/.github/workflows/slide-deck-maintainer.lock.yml b/.github/workflows/slide-deck-maintainer.lock.yml index dd743daabcb..3dc8eb9c594 100644 --- a/.github/workflows/slide-deck-maintainer.lock.yml +++ b/.github/workflows/slide-deck-maintainer.lock.yml @@ -584,8 +584,6 @@ jobs: env: PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD: '1' timeout-minutes: 10 - - name: Configure Playwright CLI sandbox - run: echo 'PLAYWRIGHT_MCP_SANDBOX=false' >> "$GITHUB_ENV" - name: Determine automatic lockdown mode for GitHub MCP Server id: determine-automatic-lockdown uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 (source v9) diff --git a/.github/workflows/smoke-claude.lock.yml b/.github/workflows/smoke-claude.lock.yml index 5d0bb8a756b..b8e0879386b 100644 --- a/.github/workflows/smoke-claude.lock.yml +++ b/.github/workflows/smoke-claude.lock.yml @@ -828,8 +828,6 @@ jobs: env: PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD: '1' timeout-minutes: 10 - - name: Configure Playwright CLI sandbox - run: echo 'PLAYWRIGHT_MCP_SANDBOX=false' >> "$GITHUB_ENV" - name: Determine automatic lockdown mode for GitHub MCP Server id: determine-automatic-lockdown uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 (source v9) diff --git a/.github/workflows/smoke-codex.lock.yml b/.github/workflows/smoke-codex.lock.yml index 6b9453f8b95..be632757588 100644 --- a/.github/workflows/smoke-codex.lock.yml +++ b/.github/workflows/smoke-codex.lock.yml @@ -680,8 +680,6 @@ jobs: env: PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD: '1' timeout-minutes: 10 - - name: Configure Playwright CLI sandbox - run: echo 'PLAYWRIGHT_MCP_SANDBOX=false' >> "$GITHUB_ENV" - name: Determine automatic lockdown mode for GitHub MCP Server id: determine-automatic-lockdown uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 (source v9) diff --git a/.github/workflows/smoke-copilot-aoai-apikey.lock.yml b/.github/workflows/smoke-copilot-aoai-apikey.lock.yml index 943413877a1..449bb792d7b 100644 --- a/.github/workflows/smoke-copilot-aoai-apikey.lock.yml +++ b/.github/workflows/smoke-copilot-aoai-apikey.lock.yml @@ -741,8 +741,6 @@ jobs: env: PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD: '1' timeout-minutes: 10 - - name: Configure Playwright CLI sandbox - run: echo 'PLAYWRIGHT_MCP_SANDBOX=false' >> "$GITHUB_ENV" - name: Determine automatic lockdown mode for GitHub MCP Server id: determine-automatic-lockdown uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 (source v9) diff --git a/.github/workflows/smoke-copilot-aoai-entra.lock.yml b/.github/workflows/smoke-copilot-aoai-entra.lock.yml index bce9e230dc5..3fe6a2173e2 100644 --- a/.github/workflows/smoke-copilot-aoai-entra.lock.yml +++ b/.github/workflows/smoke-copilot-aoai-entra.lock.yml @@ -742,8 +742,6 @@ jobs: env: PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD: '1' timeout-minutes: 10 - - name: Configure Playwright CLI sandbox - run: echo 'PLAYWRIGHT_MCP_SANDBOX=false' >> "$GITHUB_ENV" - name: Determine automatic lockdown mode for GitHub MCP Server id: determine-automatic-lockdown uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 (source v9) diff --git a/.github/workflows/smoke-copilot-arm.lock.yml b/.github/workflows/smoke-copilot-arm.lock.yml index ced0f4314e2..00ab08b3fec 100644 --- a/.github/workflows/smoke-copilot-arm.lock.yml +++ b/.github/workflows/smoke-copilot-arm.lock.yml @@ -669,8 +669,6 @@ jobs: env: PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD: '1' timeout-minutes: 10 - - name: Configure Playwright CLI sandbox - run: echo 'PLAYWRIGHT_MCP_SANDBOX=false' >> "$GITHUB_ENV" - name: Determine automatic lockdown mode for GitHub MCP Server id: determine-automatic-lockdown uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 (source v9) diff --git a/.github/workflows/smoke-copilot.lock.yml b/.github/workflows/smoke-copilot.lock.yml index 6ad70a59599..0277e3af28c 100644 --- a/.github/workflows/smoke-copilot.lock.yml +++ b/.github/workflows/smoke-copilot.lock.yml @@ -757,8 +757,6 @@ jobs: env: PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD: '1' timeout-minutes: 10 - - name: Configure Playwright CLI sandbox - run: echo 'PLAYWRIGHT_MCP_SANDBOX=false' >> "$GITHUB_ENV" - name: Determine automatic lockdown mode for GitHub MCP Server id: determine-automatic-lockdown uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 (source v9) diff --git a/.github/workflows/visual-regression-checker.lock.yml b/.github/workflows/visual-regression-checker.lock.yml index fa135511921..51752d6c442 100644 --- a/.github/workflows/visual-regression-checker.lock.yml +++ b/.github/workflows/visual-regression-checker.lock.yml @@ -585,8 +585,6 @@ jobs: env: PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD: '1' timeout-minutes: 10 - - name: Configure Playwright CLI sandbox - run: echo 'PLAYWRIGHT_MCP_SANDBOX=false' >> "$GITHUB_ENV" - name: Determine automatic lockdown mode for GitHub MCP Server id: determine-automatic-lockdown uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 (source v9) diff --git a/.github/workflows/weekly-editors-health-check.lock.yml b/.github/workflows/weekly-editors-health-check.lock.yml index d18b3de7e55..ce87bd7740f 100644 --- a/.github/workflows/weekly-editors-health-check.lock.yml +++ b/.github/workflows/weekly-editors-health-check.lock.yml @@ -524,8 +524,6 @@ jobs: env: PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD: '1' timeout-minutes: 10 - - name: Configure Playwright CLI sandbox - run: echo 'PLAYWRIGHT_MCP_SANDBOX=false' >> "$GITHUB_ENV" - name: Determine automatic lockdown mode for GitHub MCP Server id: determine-automatic-lockdown uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 (source v9) diff --git a/pkg/workflow/compiler_main_job_helpers.go b/pkg/workflow/compiler_main_job_helpers.go index 21295082410..d2487f38d6a 100644 --- a/pkg/workflow/compiler_main_job_helpers.go +++ b/pkg/workflow/compiler_main_job_helpers.go @@ -251,6 +251,15 @@ func (c *Compiler) buildMainJobOutputs(data *WorkflowData) map[string]string { func (c *Compiler) buildMainJobEnv(data *WorkflowData) map[string]string { var env map[string]string + // Disable the Chromium process sandbox for playwright CLI mode. + // GitHub Actions runners are containerised environments where kernel namespace + // sandboxing is unavailable, which causes playwright-cli to abort with + // "Playwright can't run in this sandbox environment". + if isPlaywrightCLIMode(data.Tools) { + env = make(map[string]string) + env["PLAYWRIGHT_MCP_SANDBOX"] = "false" + } + if data.SafeOutputs != nil { compilerMainJobLog.Printf("Configuring safe-outputs job env for main job (uploadAssets=%v)", data.SafeOutputs.UploadAssets != nil) env = make(map[string]string) diff --git a/pkg/workflow/compiler_main_job_helpers_test.go b/pkg/workflow/compiler_main_job_helpers_test.go index fc275938286..94fe651f96b 100644 --- a/pkg/workflow/compiler_main_job_helpers_test.go +++ b/pkg/workflow/compiler_main_job_helpers_test.go @@ -260,6 +260,22 @@ func TestBuildMainJobEnv(t *testing.T) { require.NotNil(t, env) assert.Contains(t, env["GH_AW_PROJECT_UTC"], "+05:30") }) + + t.Run("playwright CLI mode sets PLAYWRIGHT_MCP_SANDBOX=false", func(t *testing.T) { + c := NewCompiler() + c.repoConfigLoaded = true + c.repoConfig = &RepoConfig{} + data := &WorkflowData{ + Tools: map[string]any{ + "playwright": map[string]any{ + "mode": "cli", + }, + }, + } + env := c.buildMainJobEnv(data) + require.NotNil(t, env) + assert.Equal(t, "false", env["PLAYWRIGHT_MCP_SANDBOX"]) + }) } // TestBuildMainJobPermissions tests that permissions are built correctly. diff --git a/pkg/workflow/playwright_cli.go b/pkg/workflow/playwright_cli.go index 348ca50432b..662546ebd26 100644 --- a/pkg/workflow/playwright_cli.go +++ b/pkg/workflow/playwright_cli.go @@ -104,19 +104,6 @@ func generatePlaywrightCLIInstallSteps(workflowData *WorkflowData) []GitHubActio } steps = append(steps, installSkillsStep) - // Disable the Chromium process sandbox for all subsequent steps by writing - // PLAYWRIGHT_MCP_SANDBOX=false to $GITHUB_ENV. GitHub Actions runners are - // containerised environments where kernel namespace sandboxing is unavailable, - // which causes playwright-cli to abort with "Playwright can't run in this - // sandbox environment". Setting this variable makes playwright-cli skip the - // sandbox (equivalent to --no-sandbox in Docker/MCP mode) without disabling - // any other security boundary of the runner itself. - sandboxStep := GitHubActionStep{ - " - name: Configure Playwright CLI sandbox", - ` run: echo 'PLAYWRIGHT_MCP_SANDBOX=false' >> "$GITHUB_ENV"`, - } - steps = append(steps, sandboxStep) - playwrightCLILog.Printf("Generated %d Playwright CLI install steps", len(steps)) return steps } diff --git a/pkg/workflow/playwright_cli_test.go b/pkg/workflow/playwright_cli_test.go index 48bbfad690d..686c8a0ef4e 100644 --- a/pkg/workflow/playwright_cli_test.go +++ b/pkg/workflow/playwright_cli_test.go @@ -20,7 +20,7 @@ func TestGeneratePlaywrightCLIInstallSteps_DefaultVersionUsesCooldown(t *testing }, }) - require.Len(t, steps, 3, "expected npm install step, skills install step, and sandbox configuration step") + require.Len(t, steps, 2, "expected npm install step and skills install step") installStep := strings.Join(steps[0], "\n") assert.Contains(t, installStep, "npm install -g @playwright/cli@"+string(constants.DefaultPlaywrightCLIVersion)) @@ -30,9 +30,4 @@ func TestGeneratePlaywrightCLIInstallSteps_DefaultVersionUsesCooldown(t *testing skillsStep := strings.Join(steps[1], "\n") assert.Contains(t, skillsStep, "playwright-cli install --skills") assert.Contains(t, skillsStep, "PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD: '1'") - - sandboxStep := strings.Join(steps[2], "\n") - assert.Contains(t, sandboxStep, "Configure Playwright CLI sandbox") - assert.Contains(t, sandboxStep, "PLAYWRIGHT_MCP_SANDBOX=false") - assert.Contains(t, sandboxStep, "$GITHUB_ENV") } diff --git a/pkg/workflow/testdata/TestWasmGolden_CompileFixtures/playwright-cli-mode.golden b/pkg/workflow/testdata/TestWasmGolden_CompileFixtures/playwright-cli-mode.golden index 2c42568f4e9..7607d3823a3 100644 --- a/pkg/workflow/testdata/TestWasmGolden_CompileFixtures/playwright-cli-mode.golden +++ b/pkg/workflow/testdata/TestWasmGolden_CompileFixtures/playwright-cli-mode.golden @@ -337,6 +337,7 @@ jobs: env: GH_AW_RUNTIME_FEATURES: ${{ vars.GH_AW_RUNTIME_FEATURES }} GH_AW_WORKFLOW_ID_SANITIZED: playwrightclimode + PLAYWRIGHT_MCP_SANDBOX: false outputs: agentic_engine_timeout: ${{ steps.detect-agent-errors.outputs.agentic_engine_timeout || 'false' }} ai_credits_rate_limit_error: ${{ steps.parse-mcp-gateway.outputs.ai_credits_rate_limit_error || 'false' }} diff --git a/pkg/workflow/testdata/wasm_golden/WasmBinary/playwright-cli-mode.golden b/pkg/workflow/testdata/wasm_golden/WasmBinary/playwright-cli-mode.golden index 9bca52b25d1..a3b9187574a 100644 --- a/pkg/workflow/testdata/wasm_golden/WasmBinary/playwright-cli-mode.golden +++ b/pkg/workflow/testdata/wasm_golden/WasmBinary/playwright-cli-mode.golden @@ -337,6 +337,7 @@ jobs: env: GH_AW_RUNTIME_FEATURES: ${{ vars.GH_AW_RUNTIME_FEATURES }} GH_AW_WORKFLOW_ID_SANITIZED: playwrightclimode + PLAYWRIGHT_MCP_SANDBOX: false outputs: agentic_engine_timeout: ${{ steps.detect-agent-errors.outputs.agentic_engine_timeout || 'false' }} ai_credits_rate_limit_error: ${{ steps.parse-mcp-gateway.outputs.ai_credits_rate_limit_error || 'false' }} From 00747671e06f5ee53d914094e1f233046001793a Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Sun, 26 Jul 2026 07:54:58 +0000 Subject: [PATCH 4/5] fix: preserve PLAYWRIGHT_MCP_SANDBOX when safe-outputs is enabled Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com> --- pkg/workflow/compiler_main_job_helpers.go | 8 ++++++-- pkg/workflow/compiler_main_job_helpers_test.go | 18 ++++++++++++++++++ 2 files changed, 24 insertions(+), 2 deletions(-) diff --git a/pkg/workflow/compiler_main_job_helpers.go b/pkg/workflow/compiler_main_job_helpers.go index d2487f38d6a..f0d013b1880 100644 --- a/pkg/workflow/compiler_main_job_helpers.go +++ b/pkg/workflow/compiler_main_job_helpers.go @@ -256,13 +256,17 @@ func (c *Compiler) buildMainJobEnv(data *WorkflowData) map[string]string { // sandboxing is unavailable, which causes playwright-cli to abort with // "Playwright can't run in this sandbox environment". if isPlaywrightCLIMode(data.Tools) { - env = make(map[string]string) + if env == nil { + env = make(map[string]string) + } env["PLAYWRIGHT_MCP_SANDBOX"] = "false" } if data.SafeOutputs != nil { compilerMainJobLog.Printf("Configuring safe-outputs job env for main job (uploadAssets=%v)", data.SafeOutputs.UploadAssets != nil) - env = make(map[string]string) + if env == nil { + env = make(map[string]string) + } // Set GH_AW_MCP_LOG_DIR for safe outputs MCP server logging // Store in mcp-logs directory so it's included in mcp-logs artifact diff --git a/pkg/workflow/compiler_main_job_helpers_test.go b/pkg/workflow/compiler_main_job_helpers_test.go index 94fe651f96b..b56598ddf6d 100644 --- a/pkg/workflow/compiler_main_job_helpers_test.go +++ b/pkg/workflow/compiler_main_job_helpers_test.go @@ -276,6 +276,24 @@ func TestBuildMainJobEnv(t *testing.T) { require.NotNil(t, env) assert.Equal(t, "false", env["PLAYWRIGHT_MCP_SANDBOX"]) }) + + t.Run("safe-outputs with playwright CLI preserves PLAYWRIGHT_MCP_SANDBOX", func(t *testing.T) { + c := NewCompiler() + c.repoConfigLoaded = true + c.repoConfig = &RepoConfig{} + data := &WorkflowData{ + Tools: map[string]any{ + "playwright": map[string]any{ + "mode": "cli", + }, + }, + SafeOutputs: &SafeOutputsConfig{}, + } + env := c.buildMainJobEnv(data) + require.NotNil(t, env) + assert.Equal(t, "false", env["PLAYWRIGHT_MCP_SANDBOX"]) + assert.Equal(t, "${{ github.event.repository.default_branch }}", env["DEFAULT_BRANCH"]) + }) } // TestBuildMainJobPermissions tests that permissions are built correctly. From cd34081405b29b5a6c219ae75f6110eacf979d74 Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Sun, 26 Jul 2026 08:39:28 +0000 Subject: [PATCH 5/5] chore: verify review-thread resolution readiness Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com> --- .github/workflows/blog-auditor.lock.yml | 1 + .github/workflows/cloclo.lock.yml | 1 + .github/workflows/daily-model-inventory.lock.yml | 1 + .github/workflows/daily-multi-device-docs-tester.lock.yml | 1 + .github/workflows/docs-noob-tester.lock.yml | 1 + .github/workflows/slide-deck-maintainer.lock.yml | 1 + .github/workflows/smoke-claude.lock.yml | 1 + .github/workflows/smoke-codex.lock.yml | 1 + .github/workflows/smoke-copilot-aoai-apikey.lock.yml | 1 + .github/workflows/smoke-copilot-aoai-entra.lock.yml | 1 + .github/workflows/smoke-copilot-arm.lock.yml | 1 + .github/workflows/smoke-copilot.lock.yml | 1 + .github/workflows/visual-regression-checker.lock.yml | 1 + .github/workflows/weekly-editors-health-check.lock.yml | 1 + 14 files changed, 14 insertions(+) diff --git a/.github/workflows/blog-auditor.lock.yml b/.github/workflows/blog-auditor.lock.yml index ca7767f66b9..d726d8cf4ee 100644 --- a/.github/workflows/blog-auditor.lock.yml +++ b/.github/workflows/blog-auditor.lock.yml @@ -470,6 +470,7 @@ jobs: GH_AW_PROJECT_UTC: "-08:00" GH_AW_RUNTIME_FEATURES: ${{ vars.GH_AW_RUNTIME_FEATURES }} GH_AW_WORKFLOW_ID_SANITIZED: blogauditor + PLAYWRIGHT_MCP_SANDBOX: false outputs: agentic_engine_timeout: ${{ steps.detect-agent-errors.outputs.agentic_engine_timeout || 'false' }} ai_credits_rate_limit_error: ${{ steps.parse-mcp-gateway.outputs.ai_credits_rate_limit_error || 'false' }} diff --git a/.github/workflows/cloclo.lock.yml b/.github/workflows/cloclo.lock.yml index be70c0b1f30..32b242686ca 100644 --- a/.github/workflows/cloclo.lock.yml +++ b/.github/workflows/cloclo.lock.yml @@ -548,6 +548,7 @@ jobs: GH_AW_PROJECT_UTC: "-08:00" GH_AW_RUNTIME_FEATURES: ${{ vars.GH_AW_RUNTIME_FEATURES }} GH_AW_WORKFLOW_ID_SANITIZED: cloclo + PLAYWRIGHT_MCP_SANDBOX: false outputs: agentic_engine_timeout: ${{ steps.detect-agent-errors.outputs.agentic_engine_timeout || 'false' }} ai_credits_rate_limit_error: ${{ steps.parse-mcp-gateway.outputs.ai_credits_rate_limit_error || 'false' }} diff --git a/.github/workflows/daily-model-inventory.lock.yml b/.github/workflows/daily-model-inventory.lock.yml index 23fc8b5ab61..dcf5b40412d 100644 --- a/.github/workflows/daily-model-inventory.lock.yml +++ b/.github/workflows/daily-model-inventory.lock.yml @@ -424,6 +424,7 @@ jobs: GH_AW_PROJECT_UTC: "-08:00" GH_AW_RUNTIME_FEATURES: ${{ vars.GH_AW_RUNTIME_FEATURES }} GH_AW_WORKFLOW_ID_SANITIZED: dailymodelinventory + PLAYWRIGHT_MCP_SANDBOX: false outputs: agentic_engine_timeout: ${{ steps.detect-agent-errors.outputs.agentic_engine_timeout || 'false' }} ai_credits_rate_limit_error: ${{ steps.parse-mcp-gateway.outputs.ai_credits_rate_limit_error || 'false' }} diff --git a/.github/workflows/daily-multi-device-docs-tester.lock.yml b/.github/workflows/daily-multi-device-docs-tester.lock.yml index 586c72a618b..b5925a6ef9f 100644 --- a/.github/workflows/daily-multi-device-docs-tester.lock.yml +++ b/.github/workflows/daily-multi-device-docs-tester.lock.yml @@ -431,6 +431,7 @@ jobs: GH_AW_PROJECT_UTC: "-08:00" GH_AW_RUNTIME_FEATURES: ${{ vars.GH_AW_RUNTIME_FEATURES }} GH_AW_WORKFLOW_ID_SANITIZED: dailymultidevicedocstester + PLAYWRIGHT_MCP_SANDBOX: false outputs: ai_credits_rate_limit_error: ${{ steps.parse-mcp-gateway.outputs.ai_credits_rate_limit_error || 'false' }} aic: ${{ steps.parse-mcp-gateway.outputs.aic }} diff --git a/.github/workflows/docs-noob-tester.lock.yml b/.github/workflows/docs-noob-tester.lock.yml index f837fb18c32..251684ad3f2 100644 --- a/.github/workflows/docs-noob-tester.lock.yml +++ b/.github/workflows/docs-noob-tester.lock.yml @@ -421,6 +421,7 @@ jobs: GH_AW_PROJECT_UTC: "-08:00" GH_AW_RUNTIME_FEATURES: ${{ vars.GH_AW_RUNTIME_FEATURES }} GH_AW_WORKFLOW_ID_SANITIZED: docsnoobtester + PLAYWRIGHT_MCP_SANDBOX: false outputs: agentic_engine_timeout: ${{ steps.detect-agent-errors.outputs.agentic_engine_timeout || 'false' }} ai_credits_rate_limit_error: ${{ steps.parse-mcp-gateway.outputs.ai_credits_rate_limit_error || 'false' }} diff --git a/.github/workflows/slide-deck-maintainer.lock.yml b/.github/workflows/slide-deck-maintainer.lock.yml index 3dc8eb9c594..7c85b8ab208 100644 --- a/.github/workflows/slide-deck-maintainer.lock.yml +++ b/.github/workflows/slide-deck-maintainer.lock.yml @@ -451,6 +451,7 @@ jobs: GH_AW_PROJECT_UTC: "-08:00" GH_AW_RUNTIME_FEATURES: ${{ vars.GH_AW_RUNTIME_FEATURES }} GH_AW_WORKFLOW_ID_SANITIZED: slidedeckmaintainer + PLAYWRIGHT_MCP_SANDBOX: false outputs: agentic_engine_timeout: ${{ steps.detect-agent-errors.outputs.agentic_engine_timeout || 'false' }} ai_credits_rate_limit_error: ${{ steps.parse-mcp-gateway.outputs.ai_credits_rate_limit_error || 'false' }} diff --git a/.github/workflows/smoke-claude.lock.yml b/.github/workflows/smoke-claude.lock.yml index b8e0879386b..27ec3de6872 100644 --- a/.github/workflows/smoke-claude.lock.yml +++ b/.github/workflows/smoke-claude.lock.yml @@ -656,6 +656,7 @@ jobs: GH_AW_PROJECT_UTC: "-08:00" GH_AW_RUNTIME_FEATURES: ${{ vars.GH_AW_RUNTIME_FEATURES }} GH_AW_WORKFLOW_ID_SANITIZED: smokeclaude + PLAYWRIGHT_MCP_SANDBOX: false outputs: agentic_engine_timeout: ${{ steps.detect-agent-errors.outputs.agentic_engine_timeout || 'false' }} ai_credits_rate_limit_error: ${{ steps.parse-mcp-gateway.outputs.ai_credits_rate_limit_error || 'false' }} diff --git a/.github/workflows/smoke-codex.lock.yml b/.github/workflows/smoke-codex.lock.yml index be632757588..e88cd4c72f9 100644 --- a/.github/workflows/smoke-codex.lock.yml +++ b/.github/workflows/smoke-codex.lock.yml @@ -532,6 +532,7 @@ jobs: GH_AW_PROJECT_UTC: "-08:00" GH_AW_RUNTIME_FEATURES: ${{ vars.GH_AW_RUNTIME_FEATURES }} GH_AW_WORKFLOW_ID_SANITIZED: smokecodex + PLAYWRIGHT_MCP_SANDBOX: false outputs: agentic_engine_timeout: ${{ steps.detect-agent-errors.outputs.agentic_engine_timeout || 'false' }} ai_credits_rate_limit_error: ${{ steps.parse-mcp-gateway.outputs.ai_credits_rate_limit_error || 'false' }} diff --git a/.github/workflows/smoke-copilot-aoai-apikey.lock.yml b/.github/workflows/smoke-copilot-aoai-apikey.lock.yml index 449bb792d7b..3ce1731f1c9 100644 --- a/.github/workflows/smoke-copilot-aoai-apikey.lock.yml +++ b/.github/workflows/smoke-copilot-aoai-apikey.lock.yml @@ -567,6 +567,7 @@ jobs: GH_AW_PROJECT_UTC: "-08:00" GH_AW_RUNTIME_FEATURES: ${{ vars.GH_AW_RUNTIME_FEATURES }} GH_AW_WORKFLOW_ID_SANITIZED: smokecopilotaoaiapikey + PLAYWRIGHT_MCP_SANDBOX: false outputs: agentic_engine_timeout: ${{ steps.detect-agent-errors.outputs.agentic_engine_timeout || 'false' }} ai_credits_rate_limit_error: ${{ steps.parse-mcp-gateway.outputs.ai_credits_rate_limit_error || 'false' }} diff --git a/.github/workflows/smoke-copilot-aoai-entra.lock.yml b/.github/workflows/smoke-copilot-aoai-entra.lock.yml index 3fe6a2173e2..dcad12e63ac 100644 --- a/.github/workflows/smoke-copilot-aoai-entra.lock.yml +++ b/.github/workflows/smoke-copilot-aoai-entra.lock.yml @@ -568,6 +568,7 @@ jobs: GH_AW_PROJECT_UTC: "-08:00" GH_AW_RUNTIME_FEATURES: ${{ vars.GH_AW_RUNTIME_FEATURES }} GH_AW_WORKFLOW_ID_SANITIZED: smokecopilotaoaientra + PLAYWRIGHT_MCP_SANDBOX: false outputs: agentic_engine_timeout: ${{ steps.detect-agent-errors.outputs.agentic_engine_timeout || 'false' }} ai_credits_rate_limit_error: ${{ steps.parse-mcp-gateway.outputs.ai_credits_rate_limit_error || 'false' }} diff --git a/.github/workflows/smoke-copilot-arm.lock.yml b/.github/workflows/smoke-copilot-arm.lock.yml index 00ab08b3fec..acef99f18e7 100644 --- a/.github/workflows/smoke-copilot-arm.lock.yml +++ b/.github/workflows/smoke-copilot-arm.lock.yml @@ -510,6 +510,7 @@ jobs: GH_AW_PROJECT_UTC: "-08:00" GH_AW_RUNTIME_FEATURES: ${{ vars.GH_AW_RUNTIME_FEATURES }} GH_AW_WORKFLOW_ID_SANITIZED: smokecopilotarm + PLAYWRIGHT_MCP_SANDBOX: false outputs: agentic_engine_timeout: ${{ steps.detect-agent-errors.outputs.agentic_engine_timeout || 'false' }} ai_credits_rate_limit_error: ${{ steps.parse-mcp-gateway.outputs.ai_credits_rate_limit_error || 'false' }} diff --git a/.github/workflows/smoke-copilot.lock.yml b/.github/workflows/smoke-copilot.lock.yml index 0277e3af28c..3a5e08ec8d6 100644 --- a/.github/workflows/smoke-copilot.lock.yml +++ b/.github/workflows/smoke-copilot.lock.yml @@ -573,6 +573,7 @@ jobs: GH_AW_PROJECT_UTC: "-08:00" GH_AW_RUNTIME_FEATURES: ${{ vars.GH_AW_RUNTIME_FEATURES }} GH_AW_WORKFLOW_ID_SANITIZED: smokecopilot + PLAYWRIGHT_MCP_SANDBOX: false outputs: agentic_engine_timeout: ${{ steps.detect-agent-errors.outputs.agentic_engine_timeout || 'false' }} ai_credits_rate_limit_error: ${{ steps.parse-mcp-gateway.outputs.ai_credits_rate_limit_error || 'false' }} diff --git a/.github/workflows/visual-regression-checker.lock.yml b/.github/workflows/visual-regression-checker.lock.yml index 51752d6c442..71e076e8484 100644 --- a/.github/workflows/visual-regression-checker.lock.yml +++ b/.github/workflows/visual-regression-checker.lock.yml @@ -433,6 +433,7 @@ jobs: GH_AW_PROJECT_UTC: "-08:00" GH_AW_RUNTIME_FEATURES: ${{ vars.GH_AW_RUNTIME_FEATURES }} GH_AW_WORKFLOW_ID_SANITIZED: visualregressionchecker + PLAYWRIGHT_MCP_SANDBOX: false outputs: agentic_engine_timeout: ${{ steps.detect-agent-errors.outputs.agentic_engine_timeout || 'false' }} ai_credits_rate_limit_error: ${{ steps.parse-mcp-gateway.outputs.ai_credits_rate_limit_error || 'false' }} diff --git a/.github/workflows/weekly-editors-health-check.lock.yml b/.github/workflows/weekly-editors-health-check.lock.yml index ce87bd7740f..706ce0cee1a 100644 --- a/.github/workflows/weekly-editors-health-check.lock.yml +++ b/.github/workflows/weekly-editors-health-check.lock.yml @@ -420,6 +420,7 @@ jobs: GH_AW_PROJECT_UTC: "-08:00" GH_AW_RUNTIME_FEATURES: ${{ vars.GH_AW_RUNTIME_FEATURES }} GH_AW_WORKFLOW_ID_SANITIZED: weeklyeditorshealthcheck + PLAYWRIGHT_MCP_SANDBOX: false outputs: agentic_engine_timeout: ${{ steps.detect-agent-errors.outputs.agentic_engine_timeout || 'false' }} ai_credits_rate_limit_error: ${{ steps.parse-mcp-gateway.outputs.ai_credits_rate_limit_error || 'false' }}