sneak
329f3e1558
Nothing automatic ran either e2e suite, so every browser-level guarantee in this wallet -- WebAssembly under the shipped CSP, the recovery-phrase and private-key DOM wipes, the ConfirmTx spend gate, the dApp approval round trips -- held only when a human or an agent remembered to run it by hand. .gitea/workflows/e2e.yml adds two jobs, e2e-chrome and e2e-firefox, one per browser so a Chrome failure cannot hide the Firefox result. They are separate from the check workflow: REPO_POLICIES.md caps make test at 20 seconds and script/cibuild is a docker build whose Dockerfile runs make check, so neither the cap nor the local fast path is touched. make check is byte-for-byte unchanged. Neither suite could run on the runner as it stood, and the reason is not docker-in-docker. The runner executes a job inside a container against the HOST's docker daemon, and the job's checkout lives on a docker volume rather than a host path, so `docker run -v "$PWD:/work"` is resolved by the host, silently succeeds and mounts an empty directory -- measured on this runner. The runner image's node is also too old to install this repo's dependencies. Both suites therefore ship the repo to the daemon as a build context and build the extension inside the pinned image, which leaves docker as the only prerequisite on a runner or a laptop. The suites themselves are unchanged; only how the repo reaches the container is. Both scripts now build with --iidfile and run the image by ID rather than by tag, so two clones running a suite at once on the same host cannot swap it under each other. The jobs report, they do not gate. Whether a check blocks a merge is Gitea branch protection, which this repo does not configure, so a failure is a red mark a reviewer must account for. Nothing can pass vacuously: no continue-on-error, no `|| true`, and both scripts exit non-zero when docker is missing, when the image build fails and when the browser fails to start. Wiring this up measured something that has to be said rather than absorbed: the Chrome suite is flaky under load. Two of six runs of unmutated code on a loaded machine lost the approval popup out from under the dApp signing wait. It is filed as #287 and not papered over here -- no retry wrapper, no longer timeout, no weakened assertion -- and it is the reason e2e-chrome cannot become a required check yet. README and the workflow say so where a reader meets them.
78 lines
3.1 KiB
Docker
78 lines
3.1 KiB
Docker
# Firefox end-to-end image: stock Firefox plus geckodriver on a node base,
|
|
# with this repo and a freshly built extension inside it, built by
|
|
# script/test-e2e-firefox. The harness itself has no dependencies, so
|
|
# nothing is installed for it.
|
|
#
|
|
# The build context is the repo root. The repo is baked in rather than
|
|
# bind-mounted because a bind mount does not resolve under Gitea Actions:
|
|
# the runner runs the job in a container against the HOST's docker socket,
|
|
# so the source side of a -v is resolved by the host daemon while the job's
|
|
# checkout lives on a docker volume that is not a host path -- the mount
|
|
# silently succeeds and /work is empty. Baking the build in is also the
|
|
# only way this suite can have both a built extension and the
|
|
# `--network none` it runs under, since a container with no network cannot
|
|
# install anything.
|
|
#
|
|
# All three external artifacts are pinned by digest, and are fetched in
|
|
# layers above the repo copy, so editing the harness or any source file
|
|
# re-runs only the two cheap layers at the bottom. The Firefox version in
|
|
# particular must not float: -remote-allow-system-access is mandatory on
|
|
# 153 and was not on 142, so the flag the harness passes is
|
|
# version-coupled.
|
|
|
|
# node:22-bookworm-slim, 2026-08-12
|
|
FROM node@sha256:d649c27dae7ba0137b3cef5dd75baa422c08dc3d9e3fc0c23dfb172dc3cc6436
|
|
|
|
ENV DEBIAN_FRONTEND=noninteractive
|
|
|
|
# Firefox's shared-library dependencies on a slim base, plus the two tools
|
|
# needed to fetch and unpack the pinned tarballs.
|
|
RUN apt-get update \
|
|
&& apt-get install -y --no-install-recommends \
|
|
ca-certificates \
|
|
curl \
|
|
libasound2 \
|
|
libdbus-glib-1-2 \
|
|
libgtk-3-0 \
|
|
libx11-xcb1 \
|
|
libxt6 \
|
|
libxtst6 \
|
|
xz-utils \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
|
|
# Firefox 153.0.3, linux-x86_64, en-US
|
|
ARG FIREFOX_URL=https://ftp.mozilla.org/pub/firefox/releases/153.0.3/linux-x86_64/en-US/firefox-153.0.3.tar.xz
|
|
ARG FIREFOX_SHA256=22b312280900bfb174b685ece32c7b3c6d72e7f8e53d6d30f21ac41a8dc500a2
|
|
RUN curl -fsSL -o /tmp/firefox.tar.xz "$FIREFOX_URL" \
|
|
&& echo "$FIREFOX_SHA256 /tmp/firefox.tar.xz" | sha256sum -c - \
|
|
&& tar -xJf /tmp/firefox.tar.xz -C /opt \
|
|
&& rm /tmp/firefox.tar.xz \
|
|
&& /opt/firefox/firefox --version
|
|
|
|
# geckodriver v0.36.0, linux64
|
|
ARG GECKODRIVER_URL=https://github.com/mozilla/geckodriver/releases/download/v0.36.0/geckodriver-v0.36.0-linux64.tar.gz
|
|
ARG GECKODRIVER_SHA256=0bde38707eb0a686a20c6bd50f4adcc7d60d4f73c60eb83ee9e0db8f65823e04
|
|
RUN curl -fsSL -o /tmp/geckodriver.tar.gz "$GECKODRIVER_URL" \
|
|
&& echo "$GECKODRIVER_SHA256 /tmp/geckodriver.tar.gz" | sha256sum -c - \
|
|
&& tar -xzf /tmp/geckodriver.tar.gz -C /usr/local/bin \
|
|
&& rm /tmp/geckodriver.tar.gz \
|
|
&& geckodriver --version
|
|
|
|
ENV FIREFOX_BIN=/opt/firefox/firefox
|
|
ENV GECKODRIVER=/usr/local/bin/geckodriver
|
|
|
|
WORKDIR /work
|
|
|
|
# Same layering as the root Dockerfile: script/bootstrap installs the
|
|
# prerequisites and the dependencies, and the manifests are copied first so
|
|
# that layer is cached until they change.
|
|
COPY script/ script/
|
|
COPY package.json yarn.lock ./
|
|
RUN script/bootstrap
|
|
|
|
COPY . .
|
|
|
|
RUN make build
|
|
|
|
CMD ["node", "tests/e2e/firefox/run.js", "dist/firefox"]
|