wip: e2e in ci

script/e2e-container

@@ -0,0 +1,63 @@
+#!/bin/sh
+# script/e2e-container: run one command in a container with this repo at
+# /work, and exit with that command's status. Our own extension to
+# scripts-to-rule-them-all, used by script/test-e2e and
+# script/test-e2e-firefox.
+#
+# It takes the arguments you would give `docker run`, minus the mount and
+# the working directory:
+#
+#     script/e2e-container --ipc=host -e HOME=/tmp "$IMAGE" node foo.js
+#
+# It exists because `docker run -v "$ROOT:/work"` cannot work under Gitea
+# Actions. The runner executes the job inside a container and hands it the
+# host's docker socket, so the source side of a -v is resolved by the host
+# daemon and not inside the job. The job's checkout lives on a docker
+# volume mounted at /workspace, which is not a host path at all: measured
+# on this repo's runner, `docker run -v "$PWD:/work" ... ls -la /work`
+# listed an empty directory. A suite started that way dies with "Cannot
+# find module" rather than testing anything.
+#
+# So the repo is copied in rather than mounted. That is one mechanism for
+# CI and for a laptop instead of two, which matters more than the copy:
+# the path CI takes is the path a developer exercises on every local run.
+# The copy costs about two seconds for this tree, against a suite that
+# takes tens of seconds.
+#
+# Nothing is copied back out. Neither suite writes anything under the repo
+# — the browser profile and every temp file live under HOME, which both
+# callers point at /tmp inside the container.
+set -eu
+
+ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
+
+CID=""
+
+cleanup() {
+    if [ -n "$CID" ]; then
+        docker rm -f "$CID" >/dev/null 2>&1 || true
+    fi
+}
+
+main() {
+    if [ "$#" -eq 0 ]; then
+        echo "e2e-container: usage: e2e-container <docker-run-arg>..." >&2
+        exit 2
+    fi
+
+    cd "$ROOT"
+
+    CID="$(docker create -w /work "$@")"
+    trap cleanup EXIT
+    trap 'cleanup; exit 130' INT TERM
+
+    # `docker cp <dir> <cid>:/work` with /work absent creates it and
+    # copies the contents of <dir> into it. A failure here is fatal under
+    # set -e, so the command below can never run against an empty /work.
+    docker cp . "$CID:/work"
+
+    # --attach propagates the container's exit status.
+    docker start --attach "$CID"
+}
+
+main "$@"

script/test-e2e

@@ -6,10 +6,13 @@
 # Deliberately NOT called by script/check or script/test: REPO_POLICIES.md
 # caps make test at 20 seconds and a browser suite does not fit. Run it
 # yourself before touching popup views; it is the only check that can see
-# a used-but-not-imported identifier blow up at runtime.
+# a used-but-not-imported identifier blow up at runtime. The e2e workflow
+# in .gitea/workflows/e2e.yml runs it on every push, as a job separate
+# from check so the 20-second cap stays intact.
 set -eu
 
-ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
+ROOT="$(cd "$SCRIPT_DIR/.." && pwd -P)"
 
 # mcr.microsoft.com/playwright:v1.56.0-noble, 2026-08-09
 #
@@ -49,14 +52,16 @@ main() {
     #   claim in tests/e2e/network.js and README.md — not deleting the
     #   probe. The image is pinned by digest, so this can only ever bite
     #   on a deliberate bump.
-    docker run --rm \
+    #
+    # script/e2e-container is `docker run` with the repo placed at /work;
+    # it copies rather than mounts, because a bind mount does not resolve
+    # under Gitea Actions. See the comment at the top of that script.
+    "$SCRIPT_DIR/e2e-container" \
         --ipc=host \
         --user "$(id -u):$(id -g)" \
         -e HOME=/tmp \
         -e PW_EXPERIMENTAL_SERVICE_WORKER_NETWORK_EVENTS=1 \
         -e "E2E_TRACE_NETWORK=${E2E_TRACE_NETWORK:-0}" \
-        -v "$ROOT:/work" \
-        -w /work \
         "$IMAGE" \
         node tests/e2e/run.js
 }

script/test-e2e-firefox

@@ -5,7 +5,9 @@
 #
 # Deliberately NOT called by script/check or script/test, for the same
 # reason as the Chrome suite: REPO_POLICIES.md caps make test at 20 seconds
-# and a browser suite does not fit.
+# and a browser suite does not fit. The e2e workflow in
+# .gitea/workflows/e2e.yml runs it on every push, as a job separate from
+# check so the 20-second cap stays intact.
 #
 # Unlike script/test-e2e this builds its image locally, because no
 # published image carries both a pinned Firefox and a matching geckodriver.
@@ -49,13 +51,17 @@ main() {
     # No --privileged. Firefox's sandbox logs
     # "CanCreateUserNamespace() clone() failure: EPERM" on startup here;
     # it is cosmetic and headless Firefox runs fine without it.
-    docker run --rm \
+    #
+    # script/e2e-container is `docker run` with the repo placed at /work;
+    # it copies rather than mounts, because a bind mount does not resolve
+    # under Gitea Actions. See the comment at the top of that script. The
+    # copy happens before the container starts, so --network none still
+    # covers everything the suite does.
+    "$SCRIPT_DIR/e2e-container" \
         --shm-size=1g \
         --network none \
         --user "$(id -u):$(id -g)" \
         -e HOME=/tmp \
-        -v "$ROOT:/work" \
-        -w /work \
         "$IMAGE" \
         node tests/e2e/firefox/run.js dist/firefox
 }