chore: update screenshot updater to use MX 11 and latest atlas theme

[gjulivan]

Pull request type

---

Description

[github-actions]

AI Code Review

⚠️ Approved with suggestions — low-severity items only, safe to merge

---

What was reviewed

File	Change
automation/run-e2e/docker/mxbuild.Dockerfile	Adds font libs and arch-aware LD_PRELOAD setup for libSkiaSharp
automation/run-e2e/lib/atlas.mjs	New shared module: version-aware Atlas 3/4 download and apply
automation/run-e2e/lib/ci.mjs	Passes mendixVersion through to updateTestProject and createDeploymentBundle
automation/run-e2e/lib/config.mjs	Removes atlas constants now centralised in atlas.mjs
automation/run-e2e/lib/dev.mjs	Passes process.env.MENDIX_VERSION to updateTestProject
automation/run-e2e/lib/docker-utils.mjs	Adds needsDesignPropertyRename gate around mx rename-design-properties
automation/run-e2e/lib/update-test-project.mjs	Simplified — delegates atlas work to updateAtlas()
automation/scripts/update-screenshots-local.mjs	Removes duplicated atlas logic, shares atlas.mjs with CI runner

Skipped (out of scope): dist/, pnpm-lock.yaml

---

Findings

⚠️ Low — Double temp dir creation leaks an empty directory

File: automation/run-e2e/lib/atlas.mjs lines 111–112 and 136–137
Problem: usetmp() is called twice: once for outPath (the extraction target) and once inline for the download path. The second call creates a second orphaned temp dir that is never cleaned up — the finally block in downloadAndExtract only removes the zip file, not its parent directory.

// Current (both updateAtlasTheme and updateAtlasThemesource)
const outPath = await usetmp();
await downloadAndExtract(url, join(await usetmp(), "AtlasTheme.zip"), outPath);
//                             ^^^^^^^^^^^^^^^^^^^^^ second temp dir leaks

// Fix: reuse outPath for the download file too
const outPath = await usetmp();
await downloadAndExtract(url, join(outPath, "AtlasTheme.zip"), outPath);

The orphaned dirs are empty after the zip is removed, so this is harmless in practice, but it's still a silent resource leak.

---

⚠️ Low — exec with template string for chmod (prefer args array)

File: automation/run-e2e/lib/atlas.mjs line 152
Problem: exec is shelljs's shell-invoked command; embedding projectDir in the string means paths with spaces or special characters would break silently.

// Current
exec(`chmod -R +w "${join(projectDir, dir)}"`, { silent: true });

// Fix — the old update-screenshots-local.mjs used the safer form:
import { spawnSync } from "node:child_process";
spawnSync("chmod", ["-R", "+w", join(projectDir, dir)], { stdio: "pipe" });

projectDir is config.testProjectDir ("tests/testProject") today so there is no actual breakage, but the pattern is fragile for any future caller that passes a path with spaces.

---

⚠️ Low — updateProjectAtlas swallows theme failure before themesource runs

File: automation/scripts/update-screenshots-local.mjs around line 395
Problem: The old code had two independent try/catch blocks — theme failure and themesource failure were both caught independently, so a failed theme download did not prevent a successful themesource update. The new updateAtlas() runs both steps sequentially; if updateAtlasTheme throws, updateAtlasThemesource is never reached. The outer catch in updateProjectAtlas then swallows both failures with a single warning line and continues. A partial Atlas state (old theme, new themesource or vice-versa) will produce silent mismatch failures later.
Fix: Either keep independent error handling inside updateAtlas, or at least log a clearer warning that both steps were skipped, not just one.

---

⚠️ Low — PR description is empty

File: PR body
Note: No PR type is selected (all section comments remain commented-out) and the Description section is blank. The PR title uses conventional commits format (chore: …) which is fine, but the checklist items about CHANGELOG and docs updates are left unanswered. Given this is a pure automation change with no widget behavior change, a CHANGELOG entry is not required — but the description should at minimum explain what the PR does and why (MX 11 + Atlas 4 support).

---

Positives

• getAtlasConfig is clean and easy to extend: adding MX 12 support is a one-liner.
• Consolidating the duplicated Atlas download logic from two separate scripts into one shared atlas.mjs is the right call — the old update-screenshots-local.mjs had its own copy with diverged Atlas tags.
• The Dockerfile mxlibs.sh workaround for libSkiaSharp.so is well explained with an inline comment and handles both amd64 and arm64 path layouts.
• Propagating mendixVersion all the way through ci.mjs → createDeploymentBundle → needsDesignPropertyRename ensures the mx rename-design-properties step is only injected when actually needed, which avoids breaking MX 10 builds.
• Token-optional fetch with a clear rate-limit warning is a good UX improvement over the old hard gate on GH_TOKEN.