pleno-vue/.github/workflows/tests.yml

name: Automated Tests

on:
  pull_request:
  push:
    branches:
      - master
  workflow_dispatch:
    inputs:
      mode:
        description: "What to run for a manual dispatch."
        required: true
        type: choice
        default: full
        options:
          - full
          - targeted
          - targeted-then-full
      target_specs:
        description: "Comma- or newline-separated Playwright spec paths under tests/e2e."
        required: false
        type: string
        default: "tests/e2e/superuser-department-overview.spec.js"
      target_projects:
        description: "JSON array of Playwright projects for targeted mode."
        required: false
        type: string
        default: '["chromium-desktop","chromium-mobile","chromium-tablet","webkit-mobile","webkit-desktop"]'
      target_grep:
        description: "Optional Playwright grep pattern for targeted mode."
        required: false
        type: string
        default: ""
      runner:
        description: "Runner pool for this manually dispatched test run"
        required: false
        default: "self-hosted"
        type: choice
        options:
          - self-hosted
          - github-hosted
  schedule:
    - cron: "0 2 * * *"

permissions:
  contents: read

concurrency:
  group: frontend-tests-${{ github.workflow }}-${{ github.event_name }}-${{ github.event_name == 'workflow_dispatch' && github.run_id || github.head_ref || github.ref_name }}
  cancel-in-progress: true

# Repository variables used as CI runner and credit controls:
# - FRONTEND_CI_STANDARD_RUNNER: JSON runs-on value for format/build/unit jobs.
# - FRONTEND_CI_E2E_RUNNER: JSON runs-on value for Playwright jobs.
# - FRONTEND_CI_PR_E2E_MAX_PARALLEL: numeric Playwright PR job parallelism.
# - FRONTEND_CI_FULL_E2E_MAX_PARALLEL: numeric full-suite job parallelism.
# GitHub-hosted example: ["ubuntu-22.04"], with PR parallelism 2 and full parallelism 1.
jobs:
  format-tests:
    runs-on: ${{ fromJSON(vars.FRONTEND_CI_STANDARD_RUNNER || '["self-hosted","Linux","X64","pleno","frontend"]') }}
    timeout-minutes: 15
    steps:
      - name: Repair self-hosted workspace permissions
        if: ${{ contains(vars.FRONTEND_CI_STANDARD_RUNNER || 'self-hosted', 'self-hosted') }}
        shell: bash
        run: |
          if [[ -d "$GITHUB_WORKSPACE" ]]; then
            sudo -n chown -R "$(id -u):$(id -g)" "$GITHUB_WORKSPACE" 2>/dev/null || true
            foreign_entry="$(find "$GITHUB_WORKSPACE" -mindepth 1 -maxdepth 2 ! -user "$(id -u)" -print -quit 2>/dev/null || true)"
            if [[ -n "$foreign_entry" ]]; then
              trash="$GITHUB_WORKSPACE/../_workspace-trash-$GITHUB_RUN_ID-$GITHUB_JOB"
              rm -rf "$trash" 2>/dev/null || true
              mv "$GITHUB_WORKSPACE" "$trash" 2>/dev/null || true
              mkdir -p "$GITHUB_WORKSPACE"
            fi
          fi

      - name: Checkout repository
        uses: actions/checkout@v5

      - name: Setup Node.js
        uses: actions/setup-node@v5
        with:
          node-version: 22

      - name: Check AI workflow sync
        run: node scripts/sync-ai-workflow.mjs --check

      - name: Install dependencies
        run: npm ci --legacy-peer-deps

      - name: Check frontend test formatting
        run: npm run format:tests:check

  build-and-unit:
    needs: format-tests
    runs-on: ${{ fromJSON(vars.FRONTEND_CI_STANDARD_RUNNER || '["self-hosted","Linux","X64","pleno","frontend"]') }}
    timeout-minutes: 30
    steps:
      - name: Repair self-hosted workspace permissions
        if: ${{ contains(vars.FRONTEND_CI_STANDARD_RUNNER || 'self-hosted', 'self-hosted') }}
        shell: bash
        run: |
          if [[ -d "$GITHUB_WORKSPACE" ]]; then
            sudo -n chown -R "$(id -u):$(id -g)" "$GITHUB_WORKSPACE" 2>/dev/null || true
            foreign_entry="$(find "$GITHUB_WORKSPACE" -mindepth 1 -maxdepth 2 ! -user "$(id -u)" -print -quit 2>/dev/null || true)"
            if [[ -n "$foreign_entry" ]]; then
              trash="$GITHUB_WORKSPACE/../_workspace-trash-$GITHUB_RUN_ID-$GITHUB_JOB"
              rm -rf "$trash" 2>/dev/null || true
              mv "$GITHUB_WORKSPACE" "$trash" 2>/dev/null || true
              mkdir -p "$GITHUB_WORKSPACE"
            fi
          fi

      - name: Checkout repository
        uses: actions/checkout@v5

      - name: Setup Node.js
        uses: actions/setup-node@v5
        with:
          node-version: 22

      - name: Install dependencies
        run: npm ci --legacy-peer-deps

      - name: Lint
        run: npm run lint

      - name: Check i18n source consistency
        run: npm run i18n:v2:check

      - name: Build sanity check
        run: npm run build

      - name: Unit tests
        run: npm run test:unit
        env:
          VITEST_BATCH_SIZE: 5

  e2e-targeted:
    if: >
      github.event_name == 'workflow_dispatch' &&
      (inputs.mode == 'targeted' || inputs.mode == 'targeted-then-full')
    needs: build-and-unit
    name: E2E-targeted-${{ matrix.project }}
    # Use GitHub-hosted runners to avoid self-hosted desktop contention and sleep/power events.
    runs-on: ubuntu-24.04
    timeout-minutes: 35
    strategy:
      fail-fast: false
      matrix:
        project: ${{ fromJSON(inputs.target_projects || '["chromium-desktop"]') }}
    env:
      MATRIX_PROJECT: ${{ matrix.project }}
      PLAYWRIGHT_ARTIFACT_NAMESPACE: e2e-targeted-${{ matrix.project }}
      PLAYWRIGHT_REPORTER_MODE: line-html
      PLAYWRIGHT_WORKERS: 1
      PLAYWRIGHT_VIDEO_MODE: on-first-retry
      TARGET_GREP: ${{ inputs.target_grep }}
      TARGET_SPECS: ${{ inputs.target_specs }}
      RUN_ID: ${{ github.run_id }}
    steps:
      - name: Normalize workspace permissions
        shell: bash
        run: |
          if [[ -d "$GITHUB_WORKSPACE" ]]; then
            sudo -n chown -R "$(id -u):$(id -g)" "$GITHUB_WORKSPACE" 2>/dev/null || true
            foreign_entry="$(find "$GITHUB_WORKSPACE" -mindepth 1 -maxdepth 2 ! -user "$(id -u)" -print -quit 2>/dev/null || true)"
            if [[ -n "$foreign_entry" ]]; then
              trash="$GITHUB_WORKSPACE/../_workspace-trash-$GITHUB_RUN_ID-$GITHUB_JOB"
              rm -rf "$trash" 2>/dev/null || true
              mv "$GITHUB_WORKSPACE" "$trash" 2>/dev/null || true
              mkdir -p "$GITHUB_WORKSPACE"
            fi
          fi

      - name: Checkout repository
        uses: actions/checkout@v5

      - name: Setup Node.js
        uses: actions/setup-node@v5
        with:
          node-version: 22

      - name: Run targeted Playwright specs in container
        shell: bash
        run: |
          set -euo pipefail
          case "$MATRIX_PROJECT" in
            chromium-mobile) project_offset=1 ;;
            chromium-desktop) project_offset=2 ;;
            chromium-tablet) project_offset=3 ;;
            webkit-mobile) project_offset=31 ;;
            webkit-desktop) project_offset=32 ;;
            webkit-tablet) project_offset=33 ;;
            firefox-mobile) project_offset=61 ;;
            firefox-desktop) project_offset=62 ;;
            firefox-tablet) project_offset=63 ;;
            *) echo "Unsupported Playwright project: $MATRIX_PROJECT" >&2; exit 1 ;;
          esac
          port_seed=$((20000 + (RUN_ID % 20000) + project_offset))
          lock_root="${PLAYWRIGHT_PORT_LOCK_ROOT:-/tmp/pleno-playwright-port-locks}"
          mkdir -p "$lock_root"
          chmod 1777 "$lock_root" 2>/dev/null || true
          find "$lock_root" -mindepth 1 -maxdepth 1 -type d -mmin +360 -exec rmdir {} \; 2>/dev/null || true
          playwright_port_lock=""
          playwright_dev_port=""
          for ((candidate = port_seed; candidate < port_seed + 1000; candidate += 1)); do
            lock_dir="${lock_root}/${candidate}.lock"
            if ! mkdir "$lock_dir" 2>/dev/null; then
              continue
            fi
            if ss -H -ltn "sport = :${candidate}" 2>/dev/null | grep -q .; then
              rmdir "$lock_dir" || true
              continue
            fi
            playwright_port_lock="$lock_dir"
            playwright_dev_port="$candidate"
            break
          done
          if [[ -z "$playwright_dev_port" ]]; then
            echo "Unable to find a free Playwright dev-server port." >&2
            exit 1
          fi
          trap 'if [[ -n "${playwright_port_lock:-}" ]]; then rmdir "$playwright_port_lock" 2>/dev/null || true; fi' EXIT
          if docker info >/dev/null 2>&1; then
            docker_cmd=(docker)
          elif sudo -n docker info >/dev/null 2>&1; then
            docker_cmd=(sudo docker)
          else
            echo "Docker is not available to the runner user, and sudo docker is not available." >&2
            exit 1
          fi
          mkdir -p output/playwright
          scripts/ci/runner-diagnostics.sh "before targeted Playwright ${MATRIX_PROJECT}" -- "${docker_cmd[@]}"
          SYSTEMD_INHIBIT_REASON="Frontend targeted Playwright ${MATRIX_PROJECT}" \
          scripts/ci/with-systemd-inhibit.sh "${docker_cmd[@]}" run --rm --ipc=host --network host \
            --volume "$PWD:/source:ro" \
            --volume "$PWD/output/playwright:/work/output/playwright" \
            --workdir /work \
            --env HOME=/tmp \
            --env CI="${CI:-}" \
            --env PLAYWRIGHT_ARTIFACT_NAMESPACE="$PLAYWRIGHT_ARTIFACT_NAMESPACE" \
            --env PLAYWRIGHT_REPORTER_MODE="$PLAYWRIGHT_REPORTER_MODE" \
            --env PLAYWRIGHT_WORKERS="$PLAYWRIGHT_WORKERS" \
            --env PLAYWRIGHT_VIDEO_MODE="$PLAYWRIGHT_VIDEO_MODE" \
            --env PLAYWRIGHT_DEV_PORT="$playwright_dev_port" \
            --env MATRIX_PROJECT="$MATRIX_PROJECT" \
            --env TARGET_GREP="$TARGET_GREP" \
            --env TARGET_SPECS="$TARGET_SPECS" \
            mcr.microsoft.com/playwright:v1.58.2-noble \
            bash -lc '
              set -euo pipefail
              tar --exclude=./output/playwright -C /source -cf - . | tar -C /work -xf -
              git config --global --add safe.directory /work
              install_dependencies() {
                local attempt
                for attempt in 1 2 3; do
                  if npm ci --legacy-peer-deps --fetch-retries=5 --fetch-retry-mintimeout=20000 --fetch-retry-maxtimeout=120000; then
                    return 0
                  fi
                  if [[ "$attempt" == "3" ]]; then
                    return 1
                  fi
                  echo "npm ci failed on attempt ${attempt}; retrying..." >&2
                  sleep 20
                done
              }
              install_dependencies
              ulimit -n 16384 || true
              mapfile -t spec_args < <(printf "%s\n" "$TARGET_SPECS" | tr "," "\n" | sed "s/^[[:space:]]*//;s/[[:space:]]*$//;/^$/d")
              if [[ "${#spec_args[@]}" -eq 0 && -z "${TARGET_GREP:-}" ]]; then
                echo "Provide at least one spec path or grep pattern." >&2
                exit 1
              fi
              for spec_path in "${spec_args[@]}"; do
                if [[ "$spec_path" == /* || "$spec_path" == *".."* || "$spec_path" != tests/e2e/* ]]; then
                  echo "Targeted spec must stay under tests/e2e: $spec_path" >&2
                  exit 1
                fi
                if [[ ! -f "$spec_path" ]]; then
                  echo "Targeted spec does not exist: $spec_path" >&2
                  exit 1
                fi
              done
              args=("${spec_args[@]}")
              if [[ -n "${TARGET_GREP:-}" ]]; then
                args+=(--grep "$TARGET_GREP")
              fi
              args+=(--project="$MATRIX_PROJECT")
              npx playwright test "${args[@]}"
            '

      - name: Runner diagnostics after Playwright failure
        if: failure() || cancelled()
        continue-on-error: true
        run: scripts/ci/runner-diagnostics.sh "after targeted Playwright ${{ matrix.project }}"

      - name: Upload Playwright report
        if: failure() || cancelled()
        continue-on-error: true
        uses: actions/upload-artifact@v4
        with:
          name: playwright-report-targeted-${{ matrix.project }}
          path: |
            output/playwright/${{ env.PLAYWRIGHT_ARTIFACT_NAMESPACE }}-*
            output/playwright/${{ env.PLAYWRIGHT_ARTIFACT_NAMESPACE }}
          if-no-files-found: ignore
          retention-days: 1

  e2e-pr:
    if: >
      always() &&
      github.event_name != 'schedule' &&
      needs.build-and-unit.result == 'success' &&
      !(github.event_name == 'workflow_dispatch' && inputs.mode == 'targeted') &&
      (
        github.event_name != 'workflow_dispatch' ||
        inputs.mode == 'full' ||
        needs.e2e-targeted.result == 'success'
      )
    needs: [build-and-unit, e2e-targeted]
    name: E2E-pr-${{ matrix.suite }}-${{ matrix.project }}
    runs-on: ${{ fromJSON(vars.FRONTEND_CI_E2E_RUNNER || '["self-hosted","Linux","X64","pleno","frontend","docker"]') }}
    timeout-minutes: 45
    strategy:
      fail-fast: false
      max-parallel: ${{ fromJSON(vars.FRONTEND_CI_PR_E2E_MAX_PARALLEL || '2') }}
      matrix:
        suite: [core, changed]
        project: [chromium-desktop, chromium-mobile]
    env:
      PLAYWRIGHT_ARTIFACT_NAMESPACE: e2e-pr-${{ matrix.suite }}-${{ matrix.project }}
      PLAYWRIGHT_REPORTER_MODE: line-html
      PLAYWRIGHT_WORKERS: 1
      PLAYWRIGHT_VIDEO_MODE: on-first-retry
    steps:
      - name: Repair self-hosted workspace permissions
        if: ${{ contains(vars.FRONTEND_CI_E2E_RUNNER || 'self-hosted', 'self-hosted') }}
        shell: bash
        run: |
          if [[ -d "$GITHUB_WORKSPACE" ]]; then
            sudo -n chown -R "$(id -u):$(id -g)" "$GITHUB_WORKSPACE" 2>/dev/null || true
            foreign_entry="$(find "$GITHUB_WORKSPACE" -mindepth 1 -maxdepth 2 ! -user "$(id -u)" -print -quit 2>/dev/null || true)"
            if [[ -n "$foreign_entry" ]]; then
              trash="$GITHUB_WORKSPACE/../_workspace-trash-$GITHUB_RUN_ID-$GITHUB_JOB"
              rm -rf "$trash" 2>/dev/null || true
              mv "$GITHUB_WORKSPACE" "$trash" 2>/dev/null || true
              mkdir -p "$GITHUB_WORKSPACE"
            fi
          fi

      - name: Checkout repository
        uses: actions/checkout@v5
        with:
          fetch-depth: 0

      - name: Resolve Playwright diff refs
        id: playwright-diff
        shell: bash
        env:
          DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
          EVENT_NAME: ${{ github.event_name }}
          HEAD_SHA: ${{ github.sha }}
          PR_BASE_SHA: ${{ github.event.pull_request.base.sha }}
          PR_HEAD_SHA: ${{ github.event.pull_request.head.sha }}
          PUSH_BEFORE_SHA: ${{ github.event.before }}
        run: |
          set -euo pipefail
          zero_sha="0000000000000000000000000000000000000000"
          if [[ "$EVENT_NAME" == "pull_request" && -n "$PR_BASE_SHA" ]]; then
            base_ref="$PR_BASE_SHA"
            head_ref="$PR_HEAD_SHA"
          elif [[ -z "$PUSH_BEFORE_SHA" || "$PUSH_BEFORE_SHA" == "$zero_sha" ]]; then
            git fetch --no-tags --prune origin "$DEFAULT_BRANCH"
            base_ref="origin/$DEFAULT_BRANCH"
            head_ref="$HEAD_SHA"
          else
            base_ref="$PUSH_BEFORE_SHA"
            head_ref="$HEAD_SHA"
          fi
          if [[ "$EVENT_NAME" == "pull_request" && -n "$PR_HEAD_SHA" ]]; then
            head_ref="$PR_HEAD_SHA"
          else
            head_ref="$HEAD_SHA"
          fi
          echo "base=$base_ref" >> "$GITHUB_OUTPUT"
          echo "head=$head_ref" >> "$GITHUB_OUTPUT"

      - name: Setup Node.js
        uses: actions/setup-node@v5
        with:
          node-version: 22

      - name: Run Playwright PR suite in container
        shell: bash
        env:
          DIFF_BASE_REF: ${{ steps.playwright-diff.outputs.base }}
          DIFF_HEAD_REF: ${{ steps.playwright-diff.outputs.head }}
          MATRIX_SUITE: ${{ matrix.suite }}
          MATRIX_PROJECT: ${{ matrix.project }}
          RUN_ID: ${{ github.run_id }}
        run: |
          set -euo pipefail
          case "$MATRIX_SUITE" in
            core) suite_offset=0 ;;
            changed) suite_offset=10 ;;
            *) echo "Unsupported Playwright PR suite: $MATRIX_SUITE" >&2; exit 1 ;;
          esac
          case "$MATRIX_PROJECT" in
            chromium-desktop) project_offset=1 ;;
            chromium-mobile) project_offset=2 ;;
            *) echo "Unsupported Playwright PR project: $MATRIX_PROJECT" >&2; exit 1 ;;
          esac
          port_seed=$((20000 + (RUN_ID % 20000) + suite_offset + project_offset))
          lock_root="${PLAYWRIGHT_PORT_LOCK_ROOT:-/tmp/pleno-playwright-port-locks}"
          mkdir -p "$lock_root"
          chmod 1777 "$lock_root" 2>/dev/null || true
          find "$lock_root" -mindepth 1 -maxdepth 1 -type d -mmin +360 -exec rmdir {} \; 2>/dev/null || true
          playwright_port_lock=""
          playwright_dev_port=""
          for ((candidate = port_seed; candidate < port_seed + 1000; candidate += 1)); do
            lock_dir="${lock_root}/${candidate}.lock"
            if ! mkdir "$lock_dir" 2>/dev/null; then
              continue
            fi
            if ss -H -ltn "sport = :${candidate}" 2>/dev/null | grep -q .; then
              rmdir "$lock_dir" || true
              continue
            fi
            playwright_port_lock="$lock_dir"
            playwright_dev_port="$candidate"
            break
          done
          if [[ -z "$playwright_dev_port" ]]; then
            echo "Unable to find a free Playwright dev-server port." >&2
            exit 1
          fi
          trap 'if [[ -n "${playwright_port_lock:-}" ]]; then rmdir "$playwright_port_lock" 2>/dev/null || true; fi' EXIT
          if docker info >/dev/null 2>&1; then
            docker_cmd=(docker)
          elif sudo -n docker info >/dev/null 2>&1; then
            docker_cmd=(sudo docker)
          else
            echo "Docker is not available to the runner user, and sudo docker is not available." >&2
            exit 1
          fi
          mkdir -p output/playwright
          scripts/ci/runner-diagnostics.sh "before Playwright PR ${MATRIX_SUITE}/${MATRIX_PROJECT}" -- "${docker_cmd[@]}"
          SYSTEMD_INHIBIT_REASON="Frontend Playwright PR ${MATRIX_SUITE}/${MATRIX_PROJECT}" \
          scripts/ci/with-systemd-inhibit.sh "${docker_cmd[@]}" run --rm --ipc=host --network host \
            --volume "$PWD:/source:ro" \
            --volume "$PWD/output/playwright:/work/output/playwright" \
            --workdir /work \
            --env HOME=/tmp \
            --env CI="${CI:-}" \
            --env PLAYWRIGHT_ARTIFACT_NAMESPACE="$PLAYWRIGHT_ARTIFACT_NAMESPACE" \
            --env PLAYWRIGHT_REPORTER_MODE="$PLAYWRIGHT_REPORTER_MODE" \
            --env PLAYWRIGHT_WORKERS="$PLAYWRIGHT_WORKERS" \
            --env PLAYWRIGHT_VIDEO_MODE="$PLAYWRIGHT_VIDEO_MODE" \
            --env PLAYWRIGHT_DEV_PORT="$playwright_dev_port" \
            --env MATRIX_SUITE="$MATRIX_SUITE" \
            --env MATRIX_PROJECT="$MATRIX_PROJECT" \
            --env DIFF_BASE_REF="$DIFF_BASE_REF" \
            --env DIFF_HEAD_REF="$DIFF_HEAD_REF" \
            mcr.microsoft.com/playwright:v1.58.2-noble \
            bash -lc '
              set -euo pipefail
              tar --exclude=./output/playwright -C /source -cf - . | tar -C /work -xf -
              git config --global --add safe.directory /work
              install_dependencies() {
                local attempt
                for attempt in 1 2 3; do
                  if npm ci --legacy-peer-deps --fetch-retries=5 --fetch-retry-mintimeout=20000 --fetch-retry-maxtimeout=120000; then
                    return 0
                  fi
                  if [[ "$attempt" == "3" ]]; then
                    return 1
                  fi
                  echo "npm ci failed on attempt ${attempt}; retrying..." >&2
                  sleep 20
                done
              }
              install_dependencies
              ulimit -n 16384 || true
              if [[ "$MATRIX_SUITE" == "core" ]]; then
                npx playwright test --grep @smoke --project="$MATRIX_PROJECT"
                npm run test:e2e:pr -- --core-only --project="$MATRIX_PROJECT"
              else
                npm run test:e2e:pr -- --changed-only --project="$MATRIX_PROJECT" --base="$DIFF_BASE_REF" --head="$DIFF_HEAD_REF"
              fi
            '

      - name: Runner diagnostics after Playwright failure
        if: failure() || cancelled()
        continue-on-error: true
        run: scripts/ci/runner-diagnostics.sh "after Playwright PR ${{ matrix.suite }}/${{ matrix.project }}"

      - name: Upload Playwright report
        if: failure() || cancelled()
        continue-on-error: true
        uses: actions/upload-artifact@v4
        with:
          name: playwright-report-pr-${{ matrix.suite }}-${{ matrix.project }}
          path: |
            output/playwright/${{ env.PLAYWRIGHT_ARTIFACT_NAMESPACE }}-*
            output/playwright/${{ env.PLAYWRIGHT_ARTIFACT_NAMESPACE }}
          if-no-files-found: ignore
          retention-days: 1

  e2e-full:
    if: >
      always() &&
      (github.event_name == 'schedule' || github.event_name == 'workflow_dispatch' || github.ref_name == github.event.repository.default_branch) &&
      !(github.event_name == 'workflow_dispatch' && inputs.mode == 'targeted') &&
      needs.build-and-unit.result == 'success' &&
      (github.event_name == 'schedule' || needs.e2e-pr.result == 'success') &&
      (
        github.event_name != 'workflow_dispatch' ||
        inputs.mode == 'full' ||
        needs.e2e-targeted.result == 'success'
      )
    needs: [build-and-unit, e2e-pr, e2e-targeted]
    name: E2E-full-${{ matrix.browser_label }}-${{ matrix.device }}-${{ matrix.role }}
    runs-on: ${{ fromJSON(vars.FRONTEND_CI_E2E_RUNNER || '["self-hosted","Linux","X64","pleno","frontend","docker"]') }}
    timeout-minutes: 60
    strategy:
      fail-fast: false
      max-parallel: ${{ fromJSON(vars.FRONTEND_CI_FULL_E2E_MAX_PARALLEL || '1') }}
      matrix:
        browser: [chromium, webkit, firefox]
        device: [mobile, desktop, tablet]
        role: [superuser, admin, customer, subuser]
        include:
          - browser: chromium
            browser_label: Chromium
            browser_install: chromium
          - browser: webkit
            browser_label: WebKit
            browser_install: webkit
          - browser: firefox
            browser_label: Firefox
            browser_install: firefox
    env:
      PLAYWRIGHT_ARTIFACT_NAMESPACE: e2e-full-${{ matrix.browser }}-${{ matrix.device }}-${{ matrix.role }}
      PLAYWRIGHT_REPORTER_MODE: line-html
      PLAYWRIGHT_WORKERS: 1
      PLAYWRIGHT_VIDEO_MODE: off
    steps:
      - name: Repair self-hosted workspace permissions
        if: ${{ contains(vars.FRONTEND_CI_E2E_RUNNER || 'self-hosted', 'self-hosted') }}
        shell: bash
        run: |
          if [[ -d "$GITHUB_WORKSPACE" ]]; then
            sudo -n chown -R "$(id -u):$(id -g)" "$GITHUB_WORKSPACE" 2>/dev/null || true
            foreign_entry="$(find "$GITHUB_WORKSPACE" -mindepth 1 -maxdepth 2 ! -user "$(id -u)" -print -quit 2>/dev/null || true)"
            if [[ -n "$foreign_entry" ]]; then
              trash="$GITHUB_WORKSPACE/../_workspace-trash-$GITHUB_RUN_ID-$GITHUB_JOB"
              rm -rf "$trash" 2>/dev/null || true
              mv "$GITHUB_WORKSPACE" "$trash" 2>/dev/null || true
              mkdir -p "$GITHUB_WORKSPACE"
            fi
          fi

      - name: Checkout repository
        uses: actions/checkout@v5

      - name: Setup Node.js
        uses: actions/setup-node@v5
        with:
          node-version: 22

      - name: Run full Playwright slice in container
        shell: bash
        env:
          MATRIX_ROLE: ${{ matrix.role }}
          MATRIX_BROWSER: ${{ matrix.browser }}
          MATRIX_DEVICE: ${{ matrix.device }}
          RUN_ID: ${{ github.run_id }}
        run: |
          set -euo pipefail
          case "$MATRIX_ROLE" in
            superuser) role_offset=0 ;;
            admin) role_offset=100 ;;
            customer) role_offset=200 ;;
            subuser) role_offset=300 ;;
            *) echo "Unsupported Playwright role: $MATRIX_ROLE" >&2; exit 1 ;;
          esac
          case "$MATRIX_BROWSER" in
            chromium) browser_offset=0 ;;
            webkit) browser_offset=30 ;;
            firefox) browser_offset=60 ;;
            *) echo "Unsupported Playwright browser: $MATRIX_BROWSER" >&2; exit 1 ;;
          esac
          case "$MATRIX_DEVICE" in
            mobile) device_offset=1 ;;
            desktop) device_offset=2 ;;
            tablet) device_offset=3 ;;
            *) echo "Unsupported Playwright device: $MATRIX_DEVICE" >&2; exit 1 ;;
          esac
          port_seed=$((20000 + (RUN_ID % 20000) + role_offset + browser_offset + device_offset))
          lock_root="${PLAYWRIGHT_PORT_LOCK_ROOT:-/tmp/pleno-playwright-port-locks}"
          mkdir -p "$lock_root"
          chmod 1777 "$lock_root" 2>/dev/null || true
          find "$lock_root" -mindepth 1 -maxdepth 1 -type d -mmin +360 -exec rmdir {} \; 2>/dev/null || true
          playwright_port_lock=""
          playwright_dev_port=""
          for ((candidate = port_seed; candidate < port_seed + 1000; candidate += 1)); do
            lock_dir="${lock_root}/${candidate}.lock"
            if ! mkdir "$lock_dir" 2>/dev/null; then
              continue
            fi
            if ss -H -ltn "sport = :${candidate}" 2>/dev/null | grep -q .; then
              rmdir "$lock_dir" || true
              continue
            fi
            playwright_port_lock="$lock_dir"
            playwright_dev_port="$candidate"
            break
          done
          if [[ -z "$playwright_dev_port" ]]; then
            echo "Unable to find a free Playwright dev-server port." >&2
            exit 1
          fi
          trap 'if [[ -n "${playwright_port_lock:-}" ]]; then rmdir "$playwright_port_lock" 2>/dev/null || true; fi' EXIT
          if docker info >/dev/null 2>&1; then
            docker_cmd=(docker)
          elif sudo -n docker info >/dev/null 2>&1; then
            docker_cmd=(sudo docker)
          else
            echo "Docker is not available to the runner user, and sudo docker is not available." >&2
            exit 1
          fi
          mkdir -p output/playwright
          scripts/ci/runner-diagnostics.sh "before Playwright full ${MATRIX_BROWSER}/${MATRIX_DEVICE}/${MATRIX_ROLE}" -- "${docker_cmd[@]}"
          SYSTEMD_INHIBIT_REASON="Frontend Playwright full ${MATRIX_BROWSER}/${MATRIX_DEVICE}/${MATRIX_ROLE}" \
          scripts/ci/with-systemd-inhibit.sh "${docker_cmd[@]}" run --rm --ipc=host --network host \
            --volume "$PWD:/source:ro" \
            --volume "$PWD/output/playwright:/work/output/playwright" \
            --workdir /work \
            --env HOME=/tmp \
            --env CI="${CI:-}" \
            --env PLAYWRIGHT_ARTIFACT_NAMESPACE="$PLAYWRIGHT_ARTIFACT_NAMESPACE" \
            --env PLAYWRIGHT_REPORTER_MODE="$PLAYWRIGHT_REPORTER_MODE" \
            --env PLAYWRIGHT_WORKERS="$PLAYWRIGHT_WORKERS" \
            --env PLAYWRIGHT_VIDEO_MODE="$PLAYWRIGHT_VIDEO_MODE" \
            --env PLAYWRIGHT_DEV_PORT="$playwright_dev_port" \
            --env MATRIX_ROLE="$MATRIX_ROLE" \
            --env MATRIX_BROWSER="$MATRIX_BROWSER" \
            --env MATRIX_DEVICE="$MATRIX_DEVICE" \
            mcr.microsoft.com/playwright:v1.58.2-noble \
            bash -lc '
              set -euo pipefail
              tar --exclude=./output/playwright -C /source -cf - . | tar -C /work -xf -
              git config --global --add safe.directory /work
              install_dependencies() {
                local attempt
                for attempt in 1 2 3; do
                  if npm ci --legacy-peer-deps --fetch-retries=5 --fetch-retry-mintimeout=20000 --fetch-retry-maxtimeout=120000; then
                    return 0
                  fi
                  if [[ "$attempt" == "3" ]]; then
                    return 1
                  fi
                  echo "npm ci failed on attempt ${attempt}; retrying..." >&2
                  sleep 20
                done
              }
              install_dependencies
              ulimit -n 16384 || true
              npm run test:e2e:full:slice -- --role="$MATRIX_ROLE" --project="$MATRIX_BROWSER-$MATRIX_DEVICE"
            '

      - name: Runner diagnostics after Playwright failure
        if: failure() || cancelled()
        continue-on-error: true
        run: scripts/ci/runner-diagnostics.sh "after Playwright full ${{ matrix.browser }}/${{ matrix.device }}/${{ matrix.role }}"

      - name: Upload Playwright report
        if: failure() || cancelled()
        continue-on-error: true
        uses: actions/upload-artifact@v4
        with:
          name: playwright-report-full-${{ matrix.browser }}-${{ matrix.device }}-${{ matrix.role }}
          path: |
            output/playwright/${{ env.PLAYWRIGHT_ARTIFACT_NAMESPACE }}/report
            output/playwright/${{ env.PLAYWRIGHT_ARTIFACT_NAMESPACE }}/test-results
            output/playwright/test-lists/${{ matrix.browser }}-${{ matrix.device }}-${{ matrix.role }}.txt
          if-no-files-found: ignore
          retention-days: 1