@andwhy/e2e-pipeline 0.13.1 → 0.14.0

package/templates/github/workflows/checkly-heal.yml

@@ -1,22 +1,14 @@
 name: Checkly auto-heal
 
 # A failing Checkly monitor dispatches here (webhook alert channel →
-# repository_dispatch). The agent triages first: a stale or flaky test gets
-# fixed and opened as a human-review PR; a real production regression, a fix
-# needing behavioral app code, or any agent failure escalates to Slack
-# instead. Fixes may include behavior-neutral test hooks in app source
-# (data-testid) — the PR's own preview run (pr-playwright-tests.yml)
-# validates those; a diff guard aborts changes to protected paths
-# (.github, .claude, configs, lockfiles). The agent never pushes: branch,
-# commit, PR, and Slack are workflow steps.
+# repository_dispatch). The triage-and-heal agent, the diff guard, the PR
+# and the Slack notification live in the pipeline's reusable workflow, so a
+# pipeline release updates them without a change here. This file owns the
+# triggers, the permissions and the per-repo settings passed under `with`.
 # Needs repo secrets CHECKLY_API_KEY, CHECKLY_ACCOUNT_ID, SLACK_WEBHOOK_URL
-# (the org-shared e2e-channel webhook; values in 1Password); ANTHROPIC_API_KEY
-# is inherited from the organization (a repo secret of the same name
-# overrides it if the org value fails to authenticate). Slack messages
-# carry an [e2e:<repo>]
-# tag so Slack Workflow Builder rules route them from the shared channel to
-# project channels. Setup docs: the playwright-test-pipeline skill walks
-# through the Checkly webhook channel and the Slack rule.
+# (values in 1Password); ANTHROPIC_API_KEY is inherited from the organization.
+# Setup docs: the playwright-test-pipeline skill walks through the Checkly
+# webhook channel and the Slack rule.
 on:
   repository_dispatch:
     types: [checkly-alert]
@@ -39,405 +31,18 @@ permissions:
   pull-requests: write
   issues: write
 
-# One heal at a time; queued alerts (e.g. an outage failing several checks)
-# run serially and the dedup below makes repeats cheap no-ops.
-concurrency:
-  group: checkly-heal
-  cancel-in-progress: false
-
-env:
-  # The e2e test root. Changes outside it (behavior-neutral test hooks in app
-  # source) are allowed but flagged on the PR and in Slack.
-  # Match your playwright.config testDir.
-  E2E_ROOT: tests/e2e
-  # Paths the agent must never change — anything here aborts and escalates.
-  # Extended regex against the changed-file list.
-  PROTECTED_PATHS: '^(\.github/|\.claude/|\.mcp\.json$|.*\.config\.(ts|mjs|js|cjs)$|package\.json$|pnpm-lock\.yaml$|package-lock\.json$|yarn\.lock$|\.env)'
-  # How long a merged heal PR blocks a second silent attempt on the same check.
-  REPEAT_WINDOW_DAYS: 7
-
 jobs:
   heal:
-    # Recovery/degraded notifications are not work; only failures are.
-    if: >-
-      github.event_name == 'workflow_dispatch' ||
-      contains(github.event.client_payload.alert_type || 'ALERT_FAILURE', 'FAILURE')
-    runs-on: ubuntu-latest
-    timeout-minutes: 45
-
-    steps:
-      - name: Check out the default branch
-        uses: actions/checkout@v5
-        with:
-          fetch-depth: 0
-
-      # Dedup and repeat-offender guard. An open heal PR for this check means
-      # the alert is already handled. A heal PR merged recently means the fix
-      # did not hold — a second silent attempt would mask instability, so that
-      # escalates to a human instead.
-      - name: Guard against duplicate and repeated heals
-        id: guard
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          CHECK_NAME: ${{ github.event.client_payload.check_name || inputs.check_name }}
-        run: |
-          slug=$(printf '%s' "$CHECK_NAME" | tr -c 'a-zA-Z0-9' '-' | tr -s '-' | sed 's/^-//;s/-$//' | cut -c1-40 | tr '[:upper:]' '[:lower:]')
-          echo "slug=${slug:-check}" >> "$GITHUB_OUTPUT"
-
-          open=$(gh pr list --state open --label checkly-heal --json headRefName \
-            --jq "[.[] | select(.headRefName | startswith(\"checkly-heal/$slug\"))] | length")
-          if [ "$open" -gt 0 ]; then
-            echo "mode=skip" >> "$GITHUB_OUTPUT"
-            echo "A heal PR for this check is already open — nothing to do." >> "$GITHUB_STEP_SUMMARY"
-            exit 0
-          fi
-
-          cutoff=$(date -u -d "$REPEAT_WINDOW_DAYS days ago" +%Y-%m-%dT%H:%M:%SZ)
-          recent=$(gh pr list --state merged --label checkly-heal --json headRefName,mergedAt \
-            --jq "[.[] | select((.headRefName | startswith(\"checkly-heal/$slug\")) and .mergedAt > \"$cutoff\")] | length")
-          if [ "$recent" -gt 0 ]; then
-            echo "mode=repeat" >> "$GITHUB_OUTPUT"
-            exit 0
-          fi
-          echo "mode=heal" >> "$GITHUB_OUTPUT"
-
-      - name: Set up pnpm
-        if: steps.guard.outputs.mode == 'heal'
-        uses: pnpm/action-setup@v4
-
-      - name: Set up Node
-        if: steps.guard.outputs.mode == 'heal'
-        uses: actions/setup-node@v5
-        with:
-          node-version: 22
-          cache: pnpm
-
-      # --ignore-scripts: only the tests run here; project postinstall hooks
-      # are not needed and may want CMS tokens CI does not have.
-      - name: Install dependencies
-        if: steps.guard.outputs.mode == 'heal'
-        run: pnpm install --frozen-lockfile --ignore-scripts
-
-      - name: Install Playwright browsers
-        if: steps.guard.outputs.mode == 'heal'
-        run: pnpm playwright install --with-deps chromium
-
-      # Checkly already diagnosed the failure — error, failing step, trace.
-      # Best effort: the agent reproduces from scratch when this is missing.
-      - name: Fetch the Checkly result and write agent context
-        if: steps.guard.outputs.mode == 'heal'
-        env:
-          CHECKLY_API_KEY: ${{ secrets.CHECKLY_API_KEY }}
-          CHECKLY_ACCOUNT_ID: ${{ secrets.CHECKLY_ACCOUNT_ID }}
-          CHECK_NAME: ${{ github.event.client_payload.check_name || inputs.check_name }}
-          CHECK_ID: ${{ github.event.client_payload.check_id || inputs.check_id }}
-          RESULT_ID: ${{ github.event.client_payload.result_id || inputs.result_id }}
-          RESULT_LINK: ${{ github.event.client_payload.result_link }}
-          ALERT_TYPE: ${{ github.event.client_payload.alert_type }}
-        run: |
-          mkdir -p .checkly-heal
-          if [ -n "$CHECK_ID" ] && [ -n "$RESULT_ID" ]; then
-            curl -sf --max-time 30 \
-              -H "Authorization: Bearer $CHECKLY_API_KEY" \
-              -H "X-Checkly-Account: $CHECKLY_ACCOUNT_ID" \
-              "https://api.checklyhq.com/v1/check-results/$CHECK_ID/$RESULT_ID" \
-              -o .checkly-heal/result.json \
-              || echo "Checkly result fetch failed — agent reproduces from scratch."
-          fi
-          jq -n \
-            --arg check_name "$CHECK_NAME" \
-            --arg alert_type "${ALERT_TYPE:-ALERT_FAILURE}" \
-            --arg result_link "${RESULT_LINK:-}" \
-            --arg result_file "$([ -f .checkly-heal/result.json ] && echo .checkly-heal/result.json)" \
-            '{check_name: $check_name, alert_type: $alert_type, result_link: $result_link, result_file: $result_file}' \
-            > .checkly-heal/context.json
-
-      # The agent gets test-fixing tools and Checkly credentials (for
-      # pw-test verification) — deliberately no GitHub token: it cannot push,
-      # comment, or open PRs even if it tries.
-      - name: Run the triage-and-heal agent
-        if: steps.guard.outputs.mode == 'heal'
-        id: agent
-        timeout-minutes: 35
-        env:
-          ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
-          CHECKLY_API_KEY: ${{ secrets.CHECKLY_API_KEY }}
-          CHECKLY_ACCOUNT_ID: ${{ secrets.CHECKLY_ACCOUNT_ID }}
-        run: |
-          npm install -g @anthropic-ai/claude-code@2
-          # Transcript lives OUTSIDE .checkly-heal so it survives whatever the
-          # agent does to its working directory, and outside the repo tree so
-          # the diff guard never counts it. stream-json writes each event as it
-          # happens — a run killed by the timeout still leaves the full history
-          # (plain json buffers everything and a kill leaves an empty file).
-          claude -p "$(cat .github/prompts/checkly-heal.md)" \
-            --model claude-opus-5 \
-            --allowedTools "Bash,Read,Edit,Write,Glob,Grep" \
-            --permission-mode dontAsk \
-            --max-turns 150 \
-            --output-format stream-json --verbose \
-            > /tmp/checkly-heal-agent-output.json || echo "claude exited non-zero: $?" | tee -a "$GITHUB_STEP_SUMMARY"
-          # Diagnostics go to the job log AND the summary: the log is readable
-          # over the API, the summary only in the browser.
-          {
-            echo "### Agent step diagnostics"
-            echo '```'
-            ls -la .checkly-heal 2>&1 || echo ".checkly-heal missing"
-            tail -c 2000 /tmp/checkly-heal-agent-output.json 2>/dev/null || echo "no agent output"
-            echo '```'
-          } | tee -a "$GITHUB_STEP_SUMMARY"
-
-      # The guard is deterministic on purpose: the PR path requires an outcome
-      # file claiming a fix AND a diff clear of protected paths. App-source
-      # changes (test hooks) are allowed but derived from the diff, not the
-      # agent's claim, and flagged downstream. Everything else — protected
-      # paths, missing outcome, other classifications — escalates.
-      # always(): a killed agent step (timeout, cancel) must still produce a
-      # classification, or Slack reports an unexplained failure.
-      - name: Read the outcome and guard the diff
-        if: always() && steps.guard.outputs.mode == 'heal'
-        id: outcome
-        env:
-          AGENT_CONCLUSION: ${{ steps.agent.conclusion }}
-        run: |
-          classification="agent-failed"
-          summary="The heal agent did not produce an outcome."
-          if [ "$AGENT_CONCLUSION" = "success" ] && [ -f .checkly-heal/outcome.json ] && jq -e . .checkly-heal/outcome.json > /dev/null 2>&1; then
-            classification=$(jq -r '.classification // "agent-failed"' .checkly-heal/outcome.json)
-            summary=$(jq -r '.summary // ""' .checkly-heal/outcome.json)
-          else
-            # No trustworthy outcome — say WHY, so the Slack message diagnoses
-            # itself. An outcome written before a kill is unverified: escalate
-            # rather than open a PR for it.
-            if [ "$AGENT_CONCLUSION" = "skipped" ]; then
-              summary="The heal agent never ran — a setup step failed before it."
-            elif [ "$AGENT_CONCLUSION" != "success" ]; then
-              summary="The heal agent was killed before finishing (step conclusion: ${AGENT_CONCLUSION:-unknown} — usually the 35-minute timeout)."
-            fi
-            agent_error=$(jq -r 'select(.is_error == true) | .result // empty' /tmp/checkly-heal-agent-output.json 2>/dev/null | head -c 300)
-            [ -n "$agent_error" ] && summary="$summary Agent error: $agent_error"
-          fi
-
-          files=$(git status --porcelain | awk '{print $NF}' | grep -v "^\.checkly-heal/" || true)
-          protected=$(printf '%s' "$files" | grep -Ec "$PROTECTED_PATHS" || true)
-          changed=$(printf '%s' "$files" | grep -c . || true)
-          app_change=$(printf '%s' "$files" | grep -cv "^$E2E_ROOT/" || true)
-
-          if [ "$classification" = "healed" ] || [ "$classification" = "flaky" ]; then
-            if [ "$protected" -gt 0 ]; then
-              classification="agent-failed"
-              summary="Diff guard tripped: protected files (.github, .claude, configs, lockfiles) were changed. Nothing was pushed."
-            elif [ "$changed" -eq 0 ]; then
-              classification="agent-failed"
-              summary="The agent reported a fix but changed no files."
-            fi
-          fi
-
-          echo "app_change=$([ "$app_change" -gt 0 ] && echo true || echo false)" >> "$GITHUB_OUTPUT"
-          echo "classification=$classification" >> "$GITHUB_OUTPUT"
-          {
-            echo "summary<<CHECKLY_HEAL_EOF"
-            echo "$summary"
-            echo "CHECKLY_HEAL_EOF"
-          } >> "$GITHUB_OUTPUT"
-          echo "## Checkly auto-heal: $classification" >> "$GITHUB_STEP_SUMMARY"
-          echo "$summary" >> "$GITHUB_STEP_SUMMARY"
-
-      - name: Open the heal PR for human review
-        if: >-
-          steps.guard.outputs.mode == 'heal' &&
-          (steps.outcome.outputs.classification == 'healed' ||
-           steps.outcome.outputs.classification == 'flaky')
-        id: pr
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          CHECK_NAME: ${{ github.event.client_payload.check_name || inputs.check_name }}
-          RESULT_LINK: ${{ github.event.client_payload.result_link }}
-          SLUG: ${{ steps.guard.outputs.slug }}
-          CLASSIFICATION: ${{ steps.outcome.outputs.classification }}
-          APP_CHANGE: ${{ steps.outcome.outputs.app_change }}
-        run: |
-          branch="checkly-heal/$SLUG-${{ github.run_id }}"
-          git config user.name "github-actions[bot]"
-          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
-          git checkout -b "$branch"
-          # Stage everything, then unstage the agent's scratch dir. An
-          # ':(exclude).checkly-heal' pathspec looks equivalent but exits 1
-          # when the path is gitignored (as init makes it), which killed
-          # every PR step before a commit existed.
-          git add -A
-          git reset -q -- .checkly-heal
-          git commit -m "Heal Checkly check: $CHECK_NAME"
-          git push -u origin "$branch"
-
-          gh label create checkly-heal --force \
-            --description "Automated fix for a failing Checkly monitor" \
-            --color BFD4F2 || true
-
-          case "$CLASSIFICATION" in
-            flaky) kind="a flaky test (hardened, stability proven with repeated runs)" ;;
-            *)     kind="a stale test" ;;
-          esac
-          {
-            echo "A Checkly monitor failed and the auto-heal agent classified it as $kind. **Human review required — do not merge unread.**"
-            echo ""
-            echo "- Check: \`$CHECK_NAME\`"
-            [ -n "$RESULT_LINK" ] && echo "- Failing result: $RESULT_LINK"
-            echo "- Heal run: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}"
-            if [ "$APP_CHANGE" = "true" ]; then
-              echo ""
-              echo "> [!IMPORTANT]"
-              echo "> This fix includes app-source changes (behavior-neutral test hooks such as \`data-testid\`). Production does not carry them yet, so the authoritative validation is **this PR's own preview run** (pr-playwright-tests) — check it before merging."
-            fi
-            echo ""
-            jq -r '.details // ""' .checkly-heal/outcome.json
-          } > pr-body.md
-
-          url=$(gh pr create \
-            --title "Heal Checkly check: $CHECK_NAME" \
-            --body-file pr-body.md \
-            --label checkly-heal)
-          echo "url=$url" >> "$GITHUB_OUTPUT"
-
-      # The single alert path: every outcome that needs eyes lands in Slack,
-      # written after triage. Runs on step failure too (always() + the guard
-      # conditions), so a crashed agent still alerts.
-      - name: Notify Slack
-        if: always() && steps.guard.outputs.mode != 'skip'
-        env:
-          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
-          CHECK_NAME: ${{ github.event.client_payload.check_name || inputs.check_name }}
-          RESULT_LINK: ${{ github.event.client_payload.result_link }}
-          MODE: ${{ steps.guard.outputs.mode }}
-          CLASSIFICATION: ${{ steps.outcome.outputs.classification }}
-          SUMMARY: ${{ steps.outcome.outputs.summary }}
-          APP_CHANGE: ${{ steps.outcome.outputs.app_change }}
-          PR_URL: ${{ steps.pr.outputs.url }}
-          RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
-          BRANCH: checkly-heal/${{ steps.guard.outputs.slug }}-${{ github.run_id }}
-        run: |
-          # A fix only reaches review through a PR. When the PR step failed,
-          # "fix ready for review" would be false: report the failure and
-          # offer the re-run instead.
-          outcome="$CLASSIFICATION"
-          if { [ "$CLASSIFICATION" = "healed" ] || [ "$CLASSIFICATION" = "flaky" ]; } && [ -z "$PR_URL" ]; then
-            outcome="pr-failed"
-          fi
-
-          case "${MODE}:${outcome}" in
-            repeat:*)
-              title=":rotating_light: *\`$CHECK_NAME\` is failing again*"
-              body="A heal PR for this check merged within the last $REPEAT_WINDOW_DAYS days, so no second automatic fix was attempted. This needs a developer." ;;
-            *:pr-failed)
-              title=":rotating_light: *\`$CHECK_NAME\` failed — fix made, but the PR could not be opened*"
-              body="The agent classified this as $CLASSIFICATION and made a fix, then opening the PR failed, so nothing reached review. If branch \`$BRANCH\` exists, open the PR from it; otherwise check the run logs and re-run the heal. Agent diagnosis: $SUMMARY" ;;
-            *:healed)
-              title=":wrench: *\`$CHECK_NAME\` failed — fix ready for review*"
-              body="$SUMMARY" ;;
-            *:flaky)
-              title=":wrench: *\`$CHECK_NAME\` was flaky — test hardened, fix ready for review*"
-              body="$SUMMARY" ;;
-            *:regression)
-              title=":rotating_light: *\`$CHECK_NAME\` failed — production regression*"
-              body="The test is correct; the site is broken. $SUMMARY" ;;
-            *:needs-app-change)
-              title=":warning: *\`$CHECK_NAME\` failed — fix needs an app code change*"
-              body="$SUMMARY" ;;
-            *:not-reproducible)
-              # Transient blip, nothing to act on — summary only, no ping.
-              echo "Not reproducible — no Slack notification." >> "$GITHUB_STEP_SUMMARY"
-              exit 0 ;;
-            *)
-              title=":rotating_light: *\`$CHECK_NAME\` failed and the auto-heal run did not finish cleanly*"
-              body="${SUMMARY:-Check the run logs.} This needs a developer." ;;
-          esac
-
-          # Repeat mode skips the agent, so there is no outcome classification;
-          # label it as what it is rather than defaulting to agent-failed.
-          label="${CLASSIFICATION:-agent-failed}"
-          [ "$MODE" = "repeat" ] && label="repeat-offender"
-          # agent-failed also renders the Re-run heal button.
-          [ "$outcome" = "pr-failed" ] && label="agent-failed"
-
-          # Failing test titles, best effort from the Checkly result's embedded
-          # Playwright report — the recursive search tolerates schema changes,
-          # and an empty result simply omits the field.
-          failed_tests=""
-          if [ -f .checkly-heal/result.json ]; then
-            failed_tests=$(jq -r '[.. | objects | select((.status? == "failed") or (.outcome? == "unexpected")) | .title? // empty] | unique | .[0:3] | join(", ")' .checkly-heal/result.json 2>/dev/null || true)
-          fi
-
-          # Plain-text fallback: what notifications, search, and the Slack
-          # routing rule see — the Workflow Builder rule matches the [e2e:<repo>]
-          # tag here and forwards this text, so it stays a complete message.
-          repo="${GITHUB_REPOSITORY##*/}"
-          text="[e2e:$repo] $title — $body"
-          [ -n "$PR_URL" ] && text="$text\nPR: $PR_URL"
-          text="$text\nRun: $RUN_URL"
-
-          if [ -z "$SLACK_WEBHOOK_URL" ]; then
-            echo "SLACK_WEBHOOK_URL is not set — notification skipped:" >> "$GITHUB_STEP_SUMMARY"
-            printf '%b\n' "$text" >> "$GITHUB_STEP_SUMMARY"
-            exit 0
-          fi
-
-          # Block Kit body: title, classification/repo fields, failing tests
-          # when known, the diagnosis, and link buttons assembled per outcome —
-          # a button never renders without its target.
-          jq -n \
-            --arg text "$(printf '%b' "$text")" \
-            --arg title "$title" \
-            --arg body "$body" \
-            --arg classification "$label" \
-            --arg repo "$repo" \
-            --arg failed "$failed_tests" \
-            --arg app_change "$APP_CHANGE" \
-            --arg pr "$PR_URL" \
-            --arg run "$RUN_URL" \
-            --arg result "$RESULT_LINK" \
-            --arg rerun "${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}/actions/workflows/checkly-heal.yml" \
-            '
-            def btn($label; $url): {type: "button", text: {type: "plain_text", text: $label}, url: $url};
-            {
-              text: $text,
-              blocks: (
-                [
-                  {type: "section", text: {type: "mrkdwn", text: $title}},
-                  {type: "section", fields: ([
-                    {type: "mrkdwn", text: ("*Classification*\n" + $classification)},
-                    {type: "mrkdwn", text: ("*Repository*\n" + $repo)}
-                  ] + (if $failed != "" then
-                    [{type: "mrkdwn", text: ("*Failed test*\n" + $failed)}]
-                  else [] end))}
-                ]
-                + (if $body != "" then
-                    [{type: "section", text: {type: "mrkdwn", text: $body}}]
-                  else [] end)
-                + (if $app_change == "true" then
-                    [{type: "context", elements: [{type: "mrkdwn", text: "Includes app-side test hooks — the PR'\''s preview run validates them."}]}]
-                  else [] end)
-                + [{type: "actions", elements: (
-                    (if $pr != "" then [btn("Review PR"; $pr)] else [] end)
-                    + [btn("View run"; $run)]
-                    + (if $result != "" then [btn("Checkly result"; $result)] else [] end)
-                    + (if $classification == "agent-failed" then [btn("Re-run heal"; $rerun)] else [] end)
-                  )}]
-                + [{type: "context", elements: [{type: "mrkdwn", text: ("[e2e:" + $repo + "]")}]}]
-              )
-            }' \
-            | curl -sf --max-time 15 -X POST -H "Content-Type: application/json" -d @- "$SLACK_WEBHOOK_URL" \
-            || echo "Slack notification failed — see summary." >> "$GITHUB_STEP_SUMMARY"
-
-      - name: Upload agent artifacts
-        if: always() && steps.guard.outputs.mode == 'heal'
-        uses: actions/upload-artifact@v4
-        with:
-          name: checkly-heal-${{ github.run_id }}
-          path: |
-            .checkly-heal/
-            /tmp/checkly-heal-agent-output.json
-          # .checkly-heal is a dot-directory; without this it is silently
-          # excluded and the debug artifact loses context/outcome/result.
-          include-hidden-files: true
-          if-no-files-found: ignore
-          retention-days: 14
+    uses: why-agency/why-e2e-pipeline/.github/workflows/reusable-checkly-heal.yml@main
+    with:
+      check_name: ${{ github.event.client_payload.check_name || inputs.check_name }}
+      check_id: ${{ github.event.client_payload.check_id || inputs.check_id }}
+      result_id: ${{ github.event.client_payload.result_id || inputs.result_id }}
+      # Per-repo settings, defaults shown. Uncomment to change.
+      # e2e_root: tests/e2e            # match your playwright.config testDir
+      # heal_commit_scope: tests       # fix(<scope>): heal check "<name>"
+      # repeat_window_days: 7
+      # node_version: "22"
+      # pnpm_version: ""               # set when package.json has no packageManager
+      # install_command: pnpm install --frozen-lockfile --ignore-scripts
+    secrets: inherit

package/templates/github/workflows/pr-playwright-tests.yml

@@ -1,14 +1,17 @@
 name: PR Playwright tests
 
-# Runs the suite against the PR's own Vercel preview. `deployment_status`
-# fires once the preview is live and carries its URL; the preview is built
-# from the PR branch, so the PR's changes exist on the target.
+# Runs the suite against the PR's own Vercel preview and comments the result
+# on the PR. The work happens in the pipeline's reusable workflow, so a
+# pipeline release updates it without a change here. This file owns the
+# trigger and the permissions only.
 # Needs repo secret VERCEL_AUTOMATION_BYPASS_SECRET when previews are
-# protected; the scaffolded helper turns it into Vercel's bypass cookie.
+# protected. Optional repo variable PREVIEW_LOCALE_HOST: which production
+# domain's locale config preview hosts resolve to.
 on:
   deployment_status
 
-# Vercel's payload has no branch, only the SHA — the job below resolves it.
+# Vercel's payload has no branch, only the SHA — the reusable workflow
+# resolves it.
 run-name: Playwright · ${{ github.event.deployment.environment }}
 
 permissions:
@@ -16,142 +19,13 @@ permissions:
   pull-requests: write
 
 jobs:
-  resolve-branch:
-    if: >-
-      github.event.deployment_status.state == 'success' &&
-      github.event.deployment.environment == 'Preview'
-    runs-on: ubuntu-latest
-    timeout-minutes: 2
-    outputs:
-      branch: ${{ steps.pr.outputs.branch }}
-      label: ${{ steps.pr.outputs.label }}
-      number: ${{ steps.pr.outputs.number }}
-    steps:
-      - name: Resolve the PR branch for this commit
-        id: pr
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          SHA: ${{ github.event.deployment.ref }}
-          REPO: ${{ github.repository }}
-        run: |
-          # No associated PR (plain branch push) falls back to the SHA.
-          pr=$(gh api "repos/$REPO/commits/$SHA/pulls" --jq \
-            'if length > 0 then "\(.[0].number)\t\(.[0].head.ref)\t\(.[0].title)" else "" end' \
-            2>/dev/null || true)
-          branch=$(printf '%s' "$pr" | cut -f2)
-          number=$(printf '%s' "$pr" | cut -f1)
-          title=$(printf '%s' "$pr" | cut -f3)
-
-          echo "branch=${branch:-$SHA}" >> "$GITHUB_OUTPUT"
-          echo "number=${number}" >> "$GITHUB_OUTPUT"
-          if [ -n "$number" ]; then
-            echo "label=#${number} ${title}" >> "$GITHUB_OUTPUT"
-          else
-            echo "label=${branch:-$SHA}" >> "$GITHUB_OUTPUT"
-          fi
-
   playwright:
-    name: Playwright · ${{ needs.resolve-branch.outputs.label }}
-    needs: resolve-branch
-    # A re-push cancels the stale run instead of racing an outdated preview.
-    concurrency:
-      group: pr-playwright-${{ needs.resolve-branch.outputs.branch }}
-      cancel-in-progress: true
-    runs-on: ubuntu-latest
-    # Red informs, branch protection decides — the check is not required.
-    timeout-minutes: 10
-
-    steps:
-      - name: Check out the deployed ref
-        uses: actions/checkout@v5
-        with:
-          ref: ${{ github.event.deployment.ref }}
-
-      - name: Set up pnpm
-        uses: pnpm/action-setup@v4
-
-      - name: Set up Node
-        uses: actions/setup-node@v5
-        with:
-          node-version: 22
-          cache: pnpm
-
-      # --ignore-scripts: only the tests run here; project postinstall hooks
-      # are not needed and may want CMS tokens CI does not have.
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile --ignore-scripts
-
-      - name: Install Playwright browsers
-        run: pnpm playwright install --with-deps chromium
-
-      # Chrome only for speed; Firefox/Edge run on Checkly against production.
-      # --global-timeout instead of a step timeout so reports still flush.
-      - name: Run Playwright tests against the preview
-        id: tests
-        timeout-minutes: 9
-        env:
-          BASE_URL: ${{ github.event.deployment_status.target_url }}
-          VERCEL_AUTOMATION_BYPASS_SECRET: ${{ secrets.VERCEL_AUTOMATION_BYPASS_SECRET }}
-          # Which production domain's locale config preview hosts resolve to
-          # (repo variable, optional — specs default to the primary domain).
-          PREVIEW_LOCALE_HOST: ${{ vars.PREVIEW_LOCALE_HOST }}
-          PLAYWRIGHT_JSON_OUTPUT_NAME: playwright-results.json
-        run: |
-          pnpm playwright test \
-            --project=Chrome \
-            --global-timeout 360000 \
-            --reporter=list,html,json
-
-      - name: Upload HTML report
-        if: always()
-        uses: actions/upload-artifact@v4
-        with:
-          name: playwright-report-${{ github.run_id }}
-          path: |
-            playwright-report/
-            playwright-results.json
-          if-no-files-found: warn
-          retention-days: 7
-
-      # Reporting only — must not turn the check red.
-      - name: Comment the result on the PR
-        if: always() && needs.resolve-branch.outputs.number != ''
-        continue-on-error: true
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          REPO: ${{ github.repository }}
-          PR: ${{ needs.resolve-branch.outputs.number }}
-          PREVIEW_URL: ${{ github.event.deployment_status.target_url }}
-          RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
-        run: |
-          node .github/scripts/playwright-pr-comment.mjs \
-            playwright-results.json > comment.md
-
-          # Update the existing comment so re-pushes do not stack.
-          marker='<!-- playwright-preview-report -->'
-          id=$(gh api "repos/$REPO/issues/$PR/comments" --paginate \
-            --jq "map(select(.body | startswith(\"$marker\"))) | .[0].id // empty")
-
-          if [ -n "$id" ]; then
-            gh api -X PATCH "repos/$REPO/issues/comments/$id" -F body=@comment.md
-          else
-            gh api -X POST "repos/$REPO/issues/$PR/comments" -F body=@comment.md
-          fi
-
-      - name: Write result to job summary
-        if: always()
-        env:
-          OUTCOME: ${{ steps.tests.outcome }}
-          PREVIEW_URL: ${{ github.event.deployment_status.target_url }}
-        run: |
-          {
-            echo "## Playwright (preview)"
-            echo ""
-            echo "- Target: $PREVIEW_URL"
-            echo "- Browser: Chrome only"
-            if [ "$OUTCOME" = "success" ]; then
-              echo "- Result: all tests passed"
-            else
-              echo "- Result: **failures present** — see the uploaded \`playwright-report\` artifact"
-            fi
-          } >> "$GITHUB_STEP_SUMMARY"
+    uses: why-agency/why-e2e-pipeline/.github/workflows/reusable-pr-playwright-tests.yml@main
+    with:
+      preview_locale_host: ${{ vars.PREVIEW_LOCALE_HOST }}
+      # Per-repo settings, defaults shown. Uncomment to change.
+      # node_version: "22"             # match the repo's engines/.nvmrc
+      # pnpm_version: ""               # set when package.json has no packageManager
+      # install_command: pnpm install --frozen-lockfile --ignore-scripts
+      # skip_branches: ""              # e.g. "review|development" for environment branches
+    secrets: inherit