@taraxvoid/voidflow 0.11.0 → 0.12.0

package/README.md

@@ -107,10 +107,11 @@ static directory on a free port and runs
 [Unlighthouse](https://unlighthouse.dev/) against it, reusing Playwright's
 Chromium. It exits non-zero if a category budget in the site's config fails.
 
-In the site's `package.json` (pin the tag):
+Add `@taraxvoid/voidflow` as a devDependency and call the bin from the site's
+`package.json`:
 
 ```json
-"test:e2e:lighthouse": "bun run build && bunx --package @taraxvoid/voidflow@0.8.1 unlighthouse-runner --dir dist"
+"test:e2e:lighthouse": "bun run build && unlighthouse-runner --dir dist"
 ```
 
 Options: `--dir` (default `dist`, use `dist/client` for Cloudflare adapter
@@ -126,12 +127,20 @@ change. Sites implement that script with the shared check, which runs
 `license-checker` in the site's repo root and fails on GPL, AGPL, SSPL and
 similar copyleft licenses (LGPL is allowed).
 
-In the site's `package.json` (pin the tag):
+With `@taraxvoid/voidflow` as a devDependency, call the bin from the site's
+`package.json`:
 
 ```json
-"check:licenses": "bunx --package @taraxvoid/voidflow@<version> check-licenses"
+"check:licenses": "check-licenses"
 ```
 
+Don't use `bunx --package @taraxvoid/voidflow@<version> ...` for these. It
+duplicates the version pin outside the lockfile and Renovate, and `bunx` reads
+the global `~/.bunfig.toml` rather than the site's, so a global
+`minimumReleaseAge` that doesn't exclude `@taraxvoid/voidflow` blocks it
+locally (including in the pre-commit hook) for 3 days after every release.
+The devDependency's bins are installed under the site's own `bunfig.toml`.
+
 ### Playwright preview config
 
 Shared `playwright.config` for Astro sites that run e2e against
@@ -182,12 +191,12 @@ remote's `ref` tag, and tool versions in a `justfile` (annotate the line above
 with `# renovate: datasource=... depName=...`). Requires the Renovate GitHub App
 on the repo.
 
-||||||| 4041a59
 ## Git hooks (lefthook)
 
 [`lefthook/site.yml`](lefthook/site.yml) is the shared hook set for the site
 stack, consumed as a lefthook remote. It calls the site's own `package.json`
-scripts (`bun run --if-present`, so a missing script is skipped):
+scripts (`<pm> run --if-present`, so a missing script is skipped; `<pm>` is pnpm
+when the repo has a `pnpm-lock.yaml`, bun otherwise):
 
 - `pre-commit`: dependency guard, `format` (formatted files are re-staged),
   `lint:actions`, `check`, `test:unit`, and `check:licenses` / `audit` when the

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@taraxvoid/voidflow",
-    "version": "0.11.0",
+    "version": "0.12.0",
     "description": "Shared workflows, actions and tooling for @taraxvoid sites",
     "license": "MIT",
     "keywords": [

package/scripts/unlighthouse/chrome.ts

@@ -0,0 +1,20 @@
+import { chmodSync, mkdtempSync, writeFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+
+/**
+ * GitHub's ubuntu-24.04 runners disable unprivileged user namespaces via
+ * AppArmor, so Chrome aborts at launch ("No usable sandbox!"). Returns a shell
+ * wrapper that runs `chrome` with --no-sandbox, for use as CHROME_PATH /
+ * PUPPETEER_EXECUTABLE_PATH. Only used in CI, where the browser loads our own
+ * static build and nothing untrusted.
+ */
+export function noSandboxWrapper(chrome: string): string {
+    const dir = mkdtempSync(join(tmpdir(), 'voidflow-chrome-'))
+    const wrapper = join(dir, 'chrome-no-sandbox')
+    // Single-quote the path for sh; escape any embedded single quotes.
+    const quoted = `'${chrome.replaceAll("'", `'\\''`)}'`
+    writeFileSync(wrapper, `#!/bin/sh\nexec ${quoted} --no-sandbox "$@"\n`)
+    chmodSync(wrapper, 0o755)
+    return wrapper
+}

package/scripts/unlighthouse/run.ts

@@ -17,6 +17,7 @@ import { existsSync, readdirSync, statSync } from 'node:fs'
 import { homedir } from 'node:os'
 import { join, resolve } from 'node:path'
 import { parseArgs } from 'node:util'
+import { noSandboxWrapper } from './chrome.ts'
 
 const { values } = parseArgs({
     options: {
@@ -94,9 +95,21 @@ const site = `http://localhost:${server.port}`
 const chrome = findPlaywrightChromium()
 const env: Record<string, string | undefined> = { ...process.env }
 if (chrome) {
-    env.CHROME_PATH = chrome
-    env.PUPPETEER_EXECUTABLE_PATH = chrome
-    console.log(`Using Chromium: ${chrome}`)
+    // CI runners (ubuntu-24.04) can't create Chrome's sandbox; see chrome.ts.
+    // Set VOIDFLOW_CHROME_SANDBOX=1 to keep the sandbox on.
+    const launcher =
+        process.platform === 'linux' &&
+        process.env.CI &&
+        !process.env.VOIDFLOW_CHROME_SANDBOX
+            ? noSandboxWrapper(chrome)
+            : chrome
+    env.CHROME_PATH = launcher
+    env.PUPPETEER_EXECUTABLE_PATH = launcher
+    console.log(
+        launcher === chrome
+            ? `Using Chromium: ${chrome}`
+            : `Using Chromium: ${chrome} (--no-sandbox for CI)`,
+    )
 } else {
     console.log('No Playwright Chromium found; relying on system Chrome lookup.')
 }