fix: keep CI green after relicense

.gitattributes

@@ -0,0 +1,3 @@
+# Keep test fixture bodies byte-stable across platforms (Windows checkout must not inject CRLF).
+src/PlaywrightNative.TestServer/wwwroot/** text eol=lf
+*.json text eol=lf

.github/workflows/dotnet.yml

@@ -15,6 +15,10 @@ on:
     - '**.csproj'
     - '**.runsettings'
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
 env:
   DOTNET_VERSION: '10.0.x'
   # Pin BrowserFetcher's cache to a job-local path so actions/cache can
@@ -23,7 +27,7 @@ env:
 
 jobs:
   build:
-    name: ${{ matrix.browser }}-${{ matrix.mode }}-${{ matrix.os }}
+    name: ${{ matrix.browser }}-${{ matrix.mode }}-${{ matrix.os }}${{ matrix.shardTotal && format('-shard{0}of{1}', matrix.shardIndex, matrix.shardTotal) || '' }}
     runs-on: ${{ matrix.os }}
     strategy:
       fail-fast: false
@@ -32,23 +36,107 @@ jobs:
           # Chromium — full coverage on Linux + Windows, headless + headful.
           - { os: ubuntu-latest,  browser: chromium, mode: headless }
           - { os: ubuntu-latest,  browser: chromium, mode: headful  }
-          - { os: windows-latest, browser: chromium, mode: headless }
-          - { os: windows-latest, browser: chromium, mode: headful  }
+          # Windows runs much slower per-test than Linux and never reaches
+          # the end of the suite before the org's CI timeout kills the job
+          # (observed: ~40% done at the ~2h cutoff). Split into shards by
+          # test class so each one finishes with headroom to spare.
+          - { os: windows-latest, browser: chromium, mode: headless, shardIndex: 1, shardTotal: 4 }
+          - { os: windows-latest, browser: chromium, mode: headless, shardIndex: 2, shardTotal: 4 }
+          - { os: windows-latest, browser: chromium, mode: headless, shardIndex: 3, shardTotal: 4 }
+          - { os: windows-latest, browser: chromium, mode: headless, shardIndex: 4, shardTotal: 4 }
+          - { os: windows-latest, browser: chromium, mode: headful,  shardIndex: 1, shardTotal: 4 }
+          - { os: windows-latest, browser: chromium, mode: headful,  shardIndex: 2, shardTotal: 4 }
+          - { os: windows-latest, browser: chromium, mode: headful,  shardIndex: 3, shardTotal: 4 }
+          - { os: windows-latest, browser: chromium, mode: headful,  shardIndex: 4, shardTotal: 4 }
           # WebKit — full test suite against the protocol stack.
           # macOS + Linux headless. Expect failures until WebKit catches up.
-          - { os: macos-14,       browser: webkit,   mode: headless }
+          # macOS also hits the CI timeout even at a 3-way split (observed:
+          # one shard still ~92% done at cutoff -- it draws a disproportionate
+          # cluster of client-cert/TLS tests that hang ~30s each on macOS's
+          # Kestrel TLS 1.3 limitation). 5-way spreads that load thinner.
+          - { os: macos-14,       browser: webkit,   mode: headless, shardIndex: 1, shardTotal: 5 }
+          - { os: macos-14,       browser: webkit,   mode: headless, shardIndex: 2, shardTotal: 5 }
+          - { os: macos-14,       browser: webkit,   mode: headless, shardIndex: 3, shardTotal: 5 }
+          - { os: macos-14,       browser: webkit,   mode: headless, shardIndex: 4, shardTotal: 5 }
+          - { os: macos-14,       browser: webkit,   mode: headless, shardIndex: 5, shardTotal: 5 }
           - { os: ubuntu-latest,  browser: webkit,   mode: headless }
     steps:
     - uses: actions/checkout@v4
+    # builds.dotnet.microsoft.com occasionally fails to serve the Windows SDK
+    # zip (transient CDN / network). Retry a few times before failing the job.
     - name: Setup .NET
+      id: setup-dotnet-1
+      continue-on-error: true
+      uses: actions/setup-dotnet@v4
+      with:
+        dotnet-version: ${{ env.DOTNET_VERSION }}
+    - name: Wait before Setup .NET retry
+      if: steps.setup-dotnet-1.outcome == 'failure'
+      shell: bash
+      run: sleep 20
+    - name: Setup .NET (retry 2)
+      id: setup-dotnet-2
+      if: steps.setup-dotnet-1.outcome == 'failure'
+      continue-on-error: true
+      uses: actions/setup-dotnet@v4
+      with:
+        dotnet-version: ${{ env.DOTNET_VERSION }}
+    - name: Wait before Setup .NET final retry
+      if: steps.setup-dotnet-1.outcome == 'failure' && steps.setup-dotnet-2.outcome == 'failure'
+      shell: bash
+      run: sleep 40
+    - name: Setup .NET (retry 3)
+      if: steps.setup-dotnet-1.outcome == 'failure' && steps.setup-dotnet-2.outcome == 'failure'
       uses: actions/setup-dotnet@v4
       with:
         dotnet-version: ${{ env.DOTNET_VERSION }}
+    - name: Install ffmpeg (Windows)
+      if: matrix.os == 'windows-latest'
+      shell: pwsh
+      run: |
+        # Bypass Chocolatey — community.chocolatey.org regularly 504s on the
+        # ffmpeg package and can still exit 0, which made retries ineffective.
+        $ErrorActionPreference = 'Stop'
+        $zip = Join-Path $env:RUNNER_TEMP 'ffmpeg.zip'
+        $dir = Join-Path $env:RUNNER_TEMP 'ffmpeg'
+        $url = 'https://github.com/BtbN/FFmpeg-Builds/releases/download/latest/ffmpeg-master-latest-win64-gpl.zip'
+        New-Item -ItemType Directory -Force -Path $dir | Out-Null
+        $downloaded = $false
+        for ($attempt = 1; $attempt -le 5; $attempt++) {
+          Write-Host "Downloading ffmpeg (attempt $attempt/5) from $url"
+          try {
+            Invoke-WebRequest -Uri $url -OutFile $zip -UseBasicParsing
+            $downloaded = $true
+            break
+          } catch {
+            Write-Warning "Download failed: $($_.Exception.Message)"
+            if ($attempt -eq 5) { throw }
+            Start-Sleep -Seconds (15 * $attempt)
+          }
+        }
+        if (-not $downloaded) { throw 'ffmpeg download failed' }
+        Expand-Archive -Path $zip -DestinationPath $dir -Force
+        $bin = Get-ChildItem -Path $dir -Recurse -Filter 'ffmpeg.exe' | Select-Object -First 1
+        if (-not $bin) { throw 'ffmpeg.exe not found after extract' }
+        Add-Content -Path $env:GITHUB_PATH -Value $bin.Directory.FullName
+        & $bin.FullName -version
+        $probe = Join-Path $bin.Directory.FullName 'ffprobe.exe'
+        if (Test-Path $probe) { & $probe -version }
+    - name: Install ffmpeg (macOS)
+      if: startsWith(matrix.os, 'macos')
+      run: |
+        brew install ffmpeg
+        # Recent Homebrew ffmpeg bottles omit --enable-libwebp; cwebp covers
+        # screenshot WebP recoding when ffmpeg lacks that encoder.
+        brew install webp
+        ffmpeg -version
+        ffprobe -version
+        cwebp -version
     - name: Install system dependencies (Linux, Chromium)
       if: matrix.os == 'ubuntu-latest' && matrix.browser == 'chromium'
       run: |
         sudo apt-get update
-        sudo apt-get install -y libgbm-dev xvfb
+        sudo apt-get install -y libgbm-dev xvfb ffmpeg webp
     - name: Install system dependencies (Linux, WebKit)
       if: matrix.os == 'ubuntu-latest' && matrix.browser == 'webkit'
       run: |
@@ -62,6 +150,8 @@ jobs:
         # missing package means the browser will crash at runtime with an
         # obscure dynamic-loader error.
         sudo apt-get install -y \
+          ffmpeg \
+          webp \
           gstreamer1.0-libav gstreamer1.0-plugins-bad gstreamer1.0-plugins-base gstreamer1.0-plugins-good \
           libatk-bridge2.0-0t64 libatk1.0-0t64 libatomic1 libavif16 libcairo-gobject2 libcairo2 \
           libdbus-1-3 libdrm2 libenchant-2-2 libepoxy0 libevent-2.1-7t64 libflite1 \
@@ -84,18 +174,37 @@ jobs:
         # No restore-keys fallback: we want a stale cache to be a clean miss
         # rather than a partial restore that masks broken binaries.
     - name: Create HTTPS certificate (Linux)
-      if: matrix.os == 'ubuntu-latest' && matrix.browser == 'chromium'
+      if: matrix.os == 'ubuntu-latest'
       run: |
         mkdir -p src/PlaywrightNative.TestServer
         dotnet dev-certs https --clean
+        # PKCS12 with private key for Kestrel. Public DER alone makes the
+        # handshake abort (ERR_CONNECTION_CLOSED / TLS EOF).
+        dotnet dev-certs https -ep src/PlaywrightNative.TestServer/key.pfx -p playwright
         dotnet dev-certs https -ep src/PlaywrightNative.TestServer/testCert.cer
-        sudo openssl x509 -inform der -in src/PlaywrightNative.TestServer/testCert.cer -out /usr/local/share/ca-certificates/testCert.crt -outform pem
-        sudo update-ca-certificates
+        # Do NOT install testCert into the system CA store. WebKit/libsoup
+        # trusts OS CAs, so a system-trusted "bad SSL" cert makes page.goto
+        # succeed and breaks ShouldFailWhenNavigatingToBadSsl /
+        # ignoreHTTPSErrors isolation (caughtException null). Chromium keeps
+        # its own root store and was unaffected. Tests that need HTTPS to
+        # succeed must use IgnoreHTTPSErrors (upstream parity).
     - name: Create HTTPS certificate (Windows)
       if: matrix.os == 'windows-latest'
       shell: pwsh
       run: |
         dotnet dev-certs https --clean
+        # Export PKCS12 so SimpleServer.LoadHttpsCertificate can feed Kestrel a
+        # private key. Public-only testCert.cer / PEM rematerialization still
+        # yields ERR_CONNECTION_CLOSED on Windows runners.
+        New-Item -ItemType Directory -Force -Path src/PlaywrightNative.TestServer | Out-Null
+        dotnet dev-certs https -ep src/PlaywrightNative.TestServer/key.pfx -p playwright
+        dotnet dev-certs https -ep src/PlaywrightNative.TestServer/testCert.cer
+    - name: Create HTTPS certificate (macOS)
+      if: startsWith(matrix.os, 'macos')
+      run: |
+        mkdir -p src/PlaywrightNative.TestServer
+        dotnet dev-certs https --clean
+        dotnet dev-certs https -ep src/PlaywrightNative.TestServer/key.pfx -p playwright
         dotnet dev-certs https -ep src/PlaywrightNative.TestServer/testCert.cer
     - name: Check formatting
       if: ${{ matrix.os == 'ubuntu-latest' && matrix.browser == 'chromium' && matrix.mode == 'headless' }}
@@ -106,7 +215,36 @@ jobs:
         chmod +x ./.github/workflows/no-puppeteer.sh
         ./.github/workflows/no-puppeteer.sh
     - name: Build
-      run: dotnet build ./src/PlaywrightNative.sln
+      run: dotnet build ./src/PlaywrightNative.sln -c Release
+    - name: Compute test shard filter
+      if: matrix.shardTotal
+      shell: bash
+      env:
+        # Git Bash's MSYS layer auto-converts any argument that looks like a
+        # POSIX path (e.g. "/ListFullyQualifiedTests") into a bogus Windows
+        # path before exec'ing a native tool. Disable that for this step.
+        MSYS_NO_PATHCONV: "1"
+      run: |
+        # List every test's fully-qualified name straight from the built
+        # assembly (dotnet test --list-tests only prints the bare method
+        # name, which collides across classes and isn't safe to filter on).
+        # $RUNNER_TEMP (not /tmp) so the path is already OS-native on Windows.
+        all_tests="$RUNNER_TEMP/all_tests.txt"
+        dotnet vstest src/PlaywrightNative.Tests/bin/Release/net10.0/PlaywrightNative.Tests.dll \
+          /ListFullyQualifiedTests "/ListTestsTargetPath:$all_tests"
+        # Drop the trailing ".MethodName" (and any TestCase "(...)" suffix)
+        # to get one entry per test class, then assign classes to shards by
+        # position in a stable sort -- deterministic across the shardTotal
+        # jobs of a single run without the shards needing to coordinate.
+        all_classes="$RUNNER_TEMP/all_classes.txt"
+        sed -E 's/\.[A-Za-z0-9_]+(\([^)]*\))?$//' "$all_tests" | sort -u > "$all_classes"
+        echo "Discovered $(wc -l < "$all_classes") test classes"
+        shard_classes="$RUNNER_TEMP/shard_classes.txt"
+        awk -v shard="${{ matrix.shardIndex }}" -v total="${{ matrix.shardTotal }}" \
+          'NR % total == (shard - 1) { print }' "$all_classes" > "$shard_classes"
+        echo "Shard ${{ matrix.shardIndex }}/${{ matrix.shardTotal }}: $(wc -l < "$shard_classes") classes"
+        filter=$(awk '{ printf "%sFullyQualifiedName~%s.", (NR > 1 ? "|" : ""), $0 }' "$shard_classes")
+        echo "TEST_FILTER=$filter" >> "$GITHUB_ENV"
     - name: Disable AppArmor (Linux)
       if: matrix.os == 'ubuntu-latest'
       run: echo 0 | sudo tee /proc/sys/kernel/apparmor_restrict_unprivileged_userns || true
@@ -115,29 +253,37 @@ jobs:
       env:
         PRODUCT: CHROMIUM
       run: |
-        dotnet test ./src/PlaywrightNative.Tests/PlaywrightNative.Tests.csproj --no-build -f net10.0 -s src/PlaywrightNative.Tests/test.runsettings
+        dotnet test ./src/PlaywrightNative.Tests/PlaywrightNative.Tests.csproj --no-build -c Release -f net10.0 -s src/PlaywrightNative.Tests/test.runsettings
     - name: Test (Chromium, Linux headful)
       if: ${{ matrix.browser == 'chromium' && matrix.os == 'ubuntu-latest' && matrix.mode == 'headful' }}
       env:
         PRODUCT: CHROMIUM
+        HEADLESS: "false"
       run: |
         xvfb-run --auto-servernum --server-args="-screen 0 1280x960x24" -- \
-          dotnet test ./src/PlaywrightNative.Tests/PlaywrightNative.Tests.csproj --no-build -f net10.0 -s src/PlaywrightNative.Tests/test.runsettings
+          dotnet test ./src/PlaywrightNative.Tests/PlaywrightNative.Tests.csproj --no-build -c Release -f net10.0 -s src/PlaywrightNative.Tests/test.runsettings
     - name: Test (Chromium, Windows)
       if: ${{ matrix.browser == 'chromium' && matrix.os == 'windows-latest' }}
+      shell: bash
       env:
         PRODUCT: CHROMIUM
+        HEADLESS: ${{ matrix.mode == 'headless' && 'true' || 'false' }}
       run: |
-        dotnet test ./src/PlaywrightNative.Tests/PlaywrightNative.Tests.csproj --no-build -f net10.0 -s src/PlaywrightNative.Tests/test.runsettings
+        dotnet test ./src/PlaywrightNative.Tests/PlaywrightNative.Tests.csproj --no-build -c Release -f net10.0 -s src/PlaywrightNative.Tests/test.runsettings ${TEST_FILTER:+--filter "$TEST_FILTER"}
     - name: Test (WebKit)
       if: matrix.browser == 'webkit'
+      shell: bash
       env:
         PRODUCT: WEBKIT
       run: |
+        # Raise the soft FD limit. Failed tests dispose+relaunch the worker
+        # browser; without enough headroom, macOS runners hit EMFILE mid-suite
+        # even after pipe/transport disposal fixes.
+        ulimit -n 65536 || true
         # Known-failing tests on WebKit are marked in PlaywrightNative.Nunit's
         # TestExpectations.local.json (browser+platform+mode aware). The JSON
         # currently covers WK feature gaps (ExposeFunction, AddInitScript,
         # AddScriptTag/AddStyleTag, EmulateMedia, PDF, screenshots, SetContent,
         # SetViewportSize) and the macOS-14 inner-target hang. Retire entries
         # as the underlying work lands.
-        dotnet test ./src/PlaywrightNative.Tests/PlaywrightNative.Tests.csproj --no-build -f net10.0 -s src/PlaywrightNative.Tests/test.runsettings
+        dotnet test ./src/PlaywrightNative.Tests/PlaywrightNative.Tests.csproj --no-build -c Release -f net10.0 -s src/PlaywrightNative.Tests/test.runsettings ${TEST_FILTER:+--filter "$TEST_FILTER"}

.gitignore

@@ -227,6 +227,7 @@ ClientBin/
 *.dbproj.schemaview
 *.jfm
 *.pfx
+!src/PlaywrightNative.Tests/Assets/**/*.pfx
 *.publishsettings
 orleans.codegen.cs
 

src/PlaywrightNative.NUnit/BrowserExecutable.cs

@@ -45,6 +45,7 @@ public static class BrowserExecutable
     private static bool _chromiumResolved;
     private static bool _webkitResolved;
     private static bool _firefoxResolved;
+    private static bool _ffmpegResolved;
 
     /// <summary>
     /// Gets the resolved Chromium executable path, or <c>null</c> when unavailable.
@@ -62,12 +63,20 @@ public static class BrowserExecutable
     public static string FirefoxExecutablePath { get; private set; }
 
     /// <summary>
-    /// Ensures Chromium is resolved, and WebKit/Firefox when <c>PRODUCT</c>/<c>BROWSER</c>
-    /// selects them.
+    /// Gets the resolved ffmpeg executable path, or <c>null</c> when unavailable.
+    /// </summary>
+    public static string FfmpegExecutablePath { get; private set; }
+
+    /// <summary>
+    /// Ensures Chromium and ffmpeg are resolved, and WebKit/Firefox when
+    /// <c>PRODUCT</c>/<c>BROWSER</c> selects them. ffmpeg is fetched unconditionally
+    /// (official installs it by default alongside every browser) so WebP/screencast
+    /// helpers can find it via <see cref="Helpers.FfmpegLocator"/> regardless of product.
     /// </summary>
     public static async Task EnsureCurrentProductAsync()
     {
         await EnsureAsync("chromium").ConfigureAwait(false);
+        await EnsureAsync("ffmpeg").ConfigureAwait(false);
 
         string browserName = ResolveBrowserName();
         if (browserName == "webkit")
@@ -112,6 +121,16 @@ public static async Task EnsureAsync(string browserName)
                         _webkitResolved = true;
                     }
 
+                    break;
+                case "ffmpeg":
+                    if (!_ffmpegResolved)
+                    {
+                        FfmpegExecutablePath = await ResolveBrowserAsync(
+                            SupportedBrowser.Ffmpeg,
+                            "PLAYWRIGHT_FFMPEG_PATH").ConfigureAwait(false);
+                        _ffmpegResolved = true;
+                    }
+
                     break;
                 default:
                     if (!_chromiumResolved)
@@ -170,7 +189,11 @@ public static async Task<BrowserTypeLaunchOptions> CreateLaunchOptionsAsync(stri
             Assert.Ignore($"{label} executable not available (download skipped or failed).");
         }
 
-        return new BrowserTypeLaunchOptions { ExecutablePath = path };
+        bool headless = !string.Equals(
+            Environment.GetEnvironmentVariable("HEADLESS"),
+            "false",
+            StringComparison.OrdinalIgnoreCase);
+        return new BrowserTypeLaunchOptions { ExecutablePath = path, Headless = headless };
     }
 
     /// <summary>
@@ -229,9 +252,12 @@ private static async Task<string> ResolveBrowserAsync(SupportedBrowser browser,
                 return downloadedPath;
             }
         }
-        catch
+        catch (Exception ex)
         {
             // Network unreachable, archive corrupt, or extraction failed.
+            // Surface the reason so CI logs explain skipped browser tests.
+            TestContext.Progress.WriteLine(
+                $"BrowserExecutable: failed to download {browser}: {ex.Message}");
         }
 
         return null;
@@ -260,6 +286,11 @@ public class BrowserExecutableFixture
     /// </summary>
     public static string FirefoxExecutablePath => BrowserExecutable.FirefoxExecutablePath;
 
+    /// <summary>
+    /// Gets <see cref="BrowserExecutable.FfmpegExecutablePath"/>.
+    /// </summary>
+    public static string FfmpegExecutablePath => BrowserExecutable.FfmpegExecutablePath;
+
     /// <summary>
     /// Prefetches browsers for the current product.
     /// </summary>

src/PlaywrightNative.NUnit/BrowserService.cs

@@ -58,5 +58,17 @@ private static async Task<IBrowser> CreateBrowserAsync(string browserName, Brows
 
     public Task ResetAsync() => Task.CompletedTask;
 
-    public Task DisposeAsync() => Browser.CloseAsync();
+    public async Task DisposeAsync()
+    {
+        // Prefer full disposal so pipe transports / process handles are released.
+        // CloseAsync alone historically left AnonymousPipeServerStream FDs open,
+        // and WorkerAwareTest disposes the browser after every failed test.
+        if (Browser is IAsyncDisposable asyncDisposable)
+        {
+            await asyncDisposable.DisposeAsync().ConfigureAwait(false);
+            return;
+        }
+
+        await Browser.CloseAsync().ConfigureAwait(false);
+    }
 }