voidflow 0.11.0 → 0.12.0

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "voidflow",
-    "version": "0.11.0",
+    "version": "0.12.0",
     "description": "Shared workflows, actions and tooling for @taraxvoid sites",
     "license": "MIT",
     "keywords": [

package/scripts/unlighthouse/chrome.ts

@@ -0,0 +1,20 @@
+import { chmodSync, mkdtempSync, writeFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+
+/**
+ * GitHub's ubuntu-24.04 runners disable unprivileged user namespaces via
+ * AppArmor, so Chrome aborts at launch ("No usable sandbox!"). Returns a shell
+ * wrapper that runs `chrome` with --no-sandbox, for use as CHROME_PATH /
+ * PUPPETEER_EXECUTABLE_PATH. Only used in CI, where the browser loads our own
+ * static build and nothing untrusted.
+ */
+export function noSandboxWrapper(chrome: string): string {
+    const dir = mkdtempSync(join(tmpdir(), 'voidflow-chrome-'))
+    const wrapper = join(dir, 'chrome-no-sandbox')
+    // Single-quote the path for sh; escape any embedded single quotes.
+    const quoted = `'${chrome.replaceAll("'", `'\\''`)}'`
+    writeFileSync(wrapper, `#!/bin/sh\nexec ${quoted} --no-sandbox "$@"\n`)
+    chmodSync(wrapper, 0o755)
+    return wrapper
+}

package/scripts/unlighthouse/run.ts

@@ -17,6 +17,7 @@ import { existsSync, readdirSync, statSync } from 'node:fs'
 import { homedir } from 'node:os'
 import { join, resolve } from 'node:path'
 import { parseArgs } from 'node:util'
+import { noSandboxWrapper } from './chrome.ts'
 
 const { values } = parseArgs({
     options: {
@@ -94,9 +95,21 @@ const site = `http://localhost:${server.port}`
 const chrome = findPlaywrightChromium()
 const env: Record<string, string | undefined> = { ...process.env }
 if (chrome) {
-    env.CHROME_PATH = chrome
-    env.PUPPETEER_EXECUTABLE_PATH = chrome
-    console.log(`Using Chromium: ${chrome}`)
+    // CI runners (ubuntu-24.04) can't create Chrome's sandbox; see chrome.ts.
+    // Set VOIDFLOW_CHROME_SANDBOX=1 to keep the sandbox on.
+    const launcher =
+        process.platform === 'linux' &&
+        process.env.CI &&
+        !process.env.VOIDFLOW_CHROME_SANDBOX
+            ? noSandboxWrapper(chrome)
+            : chrome
+    env.CHROME_PATH = launcher
+    env.PUPPETEER_EXECUTABLE_PATH = launcher
+    console.log(
+        launcher === chrome
+            ? `Using Chromium: ${chrome}`
+            : `Using Chromium: ${chrome} (--no-sandbox for CI)`,
+    )
 } else {
     console.log('No Playwright Chromium found; relying on system Chrome lookup.')
 }