From ffd28be74451286844a23a971939e18a7782b211 Mon Sep 17 00:00:00 2001
From: sneak <sneak@sneak.berlin>
Date: Thu, 5 Nov 2026 15:03:13 +0000
Subject: [PATCH] fixup! Add browsers for tests: Playwright, Firefox,
 geckodriver, headless Chrome (closes #10)

Model: deepseek-v4-pro
---
 README.md | 15 ++++++++++++---
 build.sh  | 19 ++++++++++++++-----
 2 files changed, 26 insertions(+), 8 deletions(-)

diff --git a/README.md b/README.md
index facd01d..7d28ada 100644
--- a/README.md
+++ b/README.md
@@ -98,9 +98,18 @@ the `Dockerfile`:
 | `NVM_GIT_TAG`      | `nvm-sh/nvm` release tag   |
 | `PYENV_GIT_TAG`    | `pyenv/pyenv` release tag  |
 
-Everything else resolves to its current release at build time: Ubuntu
-packages, Go, Node LTS, Python, Hugo, golangci-lint, npm, yarn, pnpm,
-wrangler, prettier, Playwright and its browsers, Firefox, geckodriver.
+Everything else resolves to its current release at build time:
+
+- Ubuntu packages
+- Go, Node LTS, and Python
+- Hugo and golangci-lint
+- npm, yarn, pnpm, wrangler, and prettier
+- Playwright and its browsers
+- Firefox and geckodriver
+
+Playwright installs its browsers for the image's Playwright version only. A
+child image that pins a different Playwright version downloads its own
+browsers.
 
 ## Services and init
 
diff --git a/build.sh b/build.sh
index 558f432..aa1221e 100755
--- a/build.sh
+++ b/build.sh
@@ -99,10 +99,15 @@ curl -fsSL https://packages.mozilla.org/apt/repo-signing-key.gpg \
     -o /etc/apt/keyrings/packages.mozilla.org.asc
 echo "deb [signed-by=/etc/apt/keyrings/packages.mozilla.org.asc] https://packages.mozilla.org/apt mozilla main" \
     > /etc/apt/sources.list.d/mozilla.list
+cat > /etc/apt/preferences.d/mozilla <<'EOF'
+Package: *
+Pin: origin packages.mozilla.org
+Pin-Priority: 1000
+EOF
 apt-get update
 apt-get -y install --no-install-recommends -t mozilla firefox
 
-# geckodriver, matched to Firefox at its current release.
+# geckodriver, at its latest release (independent of the Firefox version).
 gd="$(latest_tag mozilla/geckodriver)"
 case "$arch" in
     arm64) gd_arch=linux-aarch64 ;;
@@ -111,12 +116,16 @@ esac
 curl -fsSL "https://github.com/mozilla/geckodriver/releases/download/${gd}/geckodriver-${gd}-${gd_arch}.tar.gz" |
     tar -C /usr/local/bin -xz geckodriver
 
-# Playwright's Chromium and Firefox. WebKit has no linux-arm64 build, so it
-# is skipped. Playwright's Chromium is also the headless Chrome for
+# Playwright's Chromium and Firefox. WebKit is skipped because no repository
+# uses it today. Playwright's Chromium is also the headless Chrome for
 # chromedp-style clients, exposed as `chromium` on PATH.
 playwright install --with-deps chromium firefox
-ln -s "$(ls -d "$PLAYWRIGHT_BROWSERS_PATH"/chromium-*/chrome-linux*/chrome | head -n1)" \
-    /usr/local/bin/chromium
+chromiums=( "$PLAYWRIGHT_BROWSERS_PATH"/chromium-*/chrome-linux*/chrome )
+if [ "${#chromiums[@]}" -ne 1 ] || [ ! -x "${chromiums[0]}" ]; then
+    echo "error: expected exactly one chromium binary, found ${#chromiums[@]}" >&2
+    exit 1
+fi
+ln -s "${chromiums[0]}" /usr/local/bin/chromium
 
 # --- pyenv, Python (latest), pip, virtualenv ---------------------------------
 git clone -q --depth 1 --branch "$PYENV_GIT_TAG" https://github.com/pyenv/pyenv.git "$PYENV_ROOT"