wip: e2e in ci

script/test-e2e

@@ -6,18 +6,33 @@
 # Deliberately NOT called by script/check or script/test: REPO_POLICIES.md
 # caps make test at 20 seconds and a browser suite does not fit. Run it
 # yourself before touching popup views; it is the only check that can see
-# a used-but-not-imported identifier blow up at runtime.
+# a used-but-not-imported identifier blow up at runtime. The e2e workflow
+# in .gitea/workflows/e2e.yml runs it on every push, as a job separate
+# from check so that cap and the local fast path both stay intact.
+#
+# Docker is the only prerequisite. The repo reaches the container as a
+# build context and the extension is built inside it, so nothing here
+# depends on the node, yarn or make on the machine that starts the run.
+# That is not a convenience: it is what makes the CI job possible. The
+# Gitea runner executes the job in a container against the host's docker
+# socket, so a `docker run -v "$PWD:/work"` source path is resolved by the
+# host daemon and mounts an empty directory (measured on this repo's
+# runner), and the runner image ships node 18, which cannot install this
+# repo's dependencies at all.
 set -eu
 
-ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
+ROOT="$(cd "$SCRIPT_DIR/.." && pwd -P)"
 
-# mcr.microsoft.com/playwright:v1.56.0-noble, 2026-08-09
-#
-# The playwright-core devDependency is pinned to the matching Playwright
-# version (1.56.0) and the two must be bumped together: the browsers ship
-# inside this image, and playwright-core looks for the exact browser
-# revision its own version expects. A mismatch fails at launch.
-IMAGE="mcr.microsoft.com/playwright@sha256:35246d87a7c88ea9b771c65d33171b2611b02a8253b4b12ce6f94376c55f99f2"
+IMAGE="$("$SCRIPT_DIR/projectname")-e2e-chrome"
+
+IIDFILE=""
+
+cleanup() {
+    if [ -n "$IIDFILE" ]; then
+        rm -f "$IIDFILE"
+    fi
+}
 
 main() {
     cd "$ROOT"
@@ -27,14 +42,23 @@ main() {
         exit 1
     fi
 
-    echo "Building extension for e2e..."
-    yarn run build 2>&1
+    IIDFILE="$(mktemp)"
+    trap cleanup EXIT
+    trap 'cleanup; exit 130' INT TERM
+
+    echo "Building the Chrome e2e image (extension included)..."
+    docker build --iidfile "$IIDFILE" -t "$IMAGE" -f tests/e2e/Dockerfile .
 
     echo "Running e2e suite in the pinned Playwright container..."
+    # The image is run by ID, not by tag: on a machine where two clones of
+    # this repo run the suite at once, the tag can be moved by the other
+    # build between this build and this run, and the suite would then
+    # silently test the other checkout.
+    #
     # --ipc=host: Chromium's shared-memory needs more than the default
     #   64MB /dev/shm or renderers crash.
-    # --user: keep files the suite touches owned by the caller, not root.
-    # HOME=/tmp: the mapped uid has no home directory in the image.
+    # HOME=/tmp: root's home is not writable in every base image and the
+    #   browser profile goes under it.
     # PW_EXPERIMENTAL_SERVICE_WORKER_NETWORK_EVENTS=1: without it,
     #   ctx.route() intercepts page requests only, and every fetch made by
     #   the MV3 background service worker — including the phishing
@@ -51,13 +75,10 @@ main() {
     #   on a deliberate bump.
     docker run --rm \
         --ipc=host \
-        --user "$(id -u):$(id -g)" \
         -e HOME=/tmp \
         -e PW_EXPERIMENTAL_SERVICE_WORKER_NETWORK_EVENTS=1 \
         -e "E2E_TRACE_NETWORK=${E2E_TRACE_NETWORK:-0}" \
-        -v "$ROOT:/work" \
-        -w /work \
-        "$IMAGE" \
+        "$(cat "$IIDFILE")" \
         node tests/e2e/run.js
 }