@taraxvoid/voidflow 0.11.0-next → 0.11.1

package/README.md

@@ -204,14 +204,14 @@ remotes:
     configs:
       - lefthook/site.yml
 
-# Site-specific differences override the remote by name, e.g. skip tests that
-# need a built dist/ before commit:
-pre-commit:
-  commands:
-    unit:
-      run: bun run test:unit -- --exclude 'test/build.test.ts'
 ```
 
+Lefthook merges `lefthook.yml`, then remotes, then `lefthook-local.yml`, so a
+site's own `lefthook.yml` can add commands (for example image compression) but
+cannot override ones defined here. Differences go through `package.json`
+scripts: define `test:unit:precommit` (for example excluding tests that need a
+built `dist/`) and the pre-commit unit step runs it instead of `test:unit`.
+
 Install the binary through mise (`lefthook = "<version>"` in `mise.toml`) and
 set `"prepare": "lefthook install"` so `bun install` wires the hooks. `ref`
 cannot be a commit SHA; pin a release tag.
@@ -287,7 +287,7 @@ Semver, released with [release-please](https://github.com/googleapis/release-ple
 | maintenance | `release/N.x` | `0.9.4` | `release-N.x` |
 
 release-please keeps a standing release PR open on each channel's branch, updated as commits land.
-Merging it bumps `package.json` (and [`CHANGELOG.md`](CHANGELOG.md) on stable), tags `vX.Y.Z` (`vX.Y.Z-next[.N]` on `next`),
+Merging it bumps `package.json` (and [`CHANGELOG.md`](CHANGELOG.md) on stable), tags `vX.Y.Z`,
 creates the GitHub release and publishes to npm and JSR under the channel's dist-tag. The PR is
 opened with the org's release-bot GitHub App token (`RELEASE_BOT_CLIENT_ID` /
 `RELEASE_BOT_APP_PRIVATE_KEY`) so CI runs on it.

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@taraxvoid/voidflow",
-    "version": "0.11.0-next",
+    "version": "0.11.1",
     "description": "Shared workflows, actions and tooling for @taraxvoid sites",
     "license": "MIT",
     "keywords": [

package/scripts/unlighthouse/chrome.ts

@@ -0,0 +1,20 @@
+import { chmodSync, mkdtempSync, writeFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+
+/**
+ * GitHub's ubuntu-24.04 runners disable unprivileged user namespaces via
+ * AppArmor, so Chrome aborts at launch ("No usable sandbox!"). Returns a shell
+ * wrapper that runs `chrome` with --no-sandbox, for use as CHROME_PATH /
+ * PUPPETEER_EXECUTABLE_PATH. Only used in CI, where the browser loads our own
+ * static build and nothing untrusted.
+ */
+export function noSandboxWrapper(chrome: string): string {
+    const dir = mkdtempSync(join(tmpdir(), 'voidflow-chrome-'))
+    const wrapper = join(dir, 'chrome-no-sandbox')
+    // Single-quote the path for sh; escape any embedded single quotes.
+    const quoted = `'${chrome.replaceAll("'", `'\\''`)}'`
+    writeFileSync(wrapper, `#!/bin/sh\nexec ${quoted} --no-sandbox "$@"\n`)
+    chmodSync(wrapper, 0o755)
+    return wrapper
+}

package/scripts/unlighthouse/run.ts

@@ -17,6 +17,7 @@ import { existsSync, readdirSync, statSync } from 'node:fs'
 import { homedir } from 'node:os'
 import { join, resolve } from 'node:path'
 import { parseArgs } from 'node:util'
+import { noSandboxWrapper } from './chrome.ts'
 
 const { values } = parseArgs({
     options: {
@@ -94,9 +95,21 @@ const site = `http://localhost:${server.port}`
 const chrome = findPlaywrightChromium()
 const env: Record<string, string | undefined> = { ...process.env }
 if (chrome) {
-    env.CHROME_PATH = chrome
-    env.PUPPETEER_EXECUTABLE_PATH = chrome
-    console.log(`Using Chromium: ${chrome}`)
+    // CI runners (ubuntu-24.04) can't create Chrome's sandbox; see chrome.ts.
+    // Set VOIDFLOW_CHROME_SANDBOX=1 to keep the sandbox on.
+    const launcher =
+        process.platform === 'linux' &&
+        process.env.CI &&
+        !process.env.VOIDFLOW_CHROME_SANDBOX
+            ? noSandboxWrapper(chrome)
+            : chrome
+    env.CHROME_PATH = launcher
+    env.PUPPETEER_EXECUTABLE_PATH = launcher
+    console.log(
+        launcher === chrome
+            ? `Using Chromium: ${chrome}`
+            : `Using Chromium: ${chrome} (--no-sandbox for CI)`,
+    )
 } else {
     console.log('No Playwright Chromium found; relying on system Chrome lookup.')
 }