ci: pin Chromium to an exact Chrome for Testing build (#217)

Skyvern-AI/rustwright-cloud#196

---------

Co-authored-by: suchintan <3853670+suchintan@users.noreply.github.com>

Author: suchintan

Dockerfile

@@ -68,12 +68,16 @@ RUN --mount=type=cache,target=/root/.cache/pip \
     --mount=type=cache,target=/workspace/target \
     python -m pip install --no-build-isolation -e ".[dev]"
 
+COPY .github/chromium-version ./.github/chromium-version
+
 RUN --mount=type=cache,target=/var/cache/rustwright-browsers \
     python -m rustwright.cli install-deps chromium \
     && mkdir -p "$RUSTWRIGHT_BROWSERS_PATH" \
     && case "$(uname -m)" in \
         aarch64|arm64) echo "Using Playwright's Linux arm64 Chromium for Rustwright runtime in this image." ;; \
-        *) RUSTWRIGHT_BROWSERS_PATH=/var/cache/rustwright-browsers python -m rustwright.cli install chromium \
+        *) chromium_version="$(tr -d '[:space:]' < .github/chromium-version)" \
+           && RUSTWRIGHT_BROWSERS_PATH=/var/cache/rustwright-browsers \
+              python -m rustwright.cli install chromium --version "$chromium_version" \
            && cp -a /var/cache/rustwright-browsers/. "$RUSTWRIGHT_BROWSERS_PATH"/ ;; \
        esac
 
@@ -102,10 +106,22 @@ RUN for root in "$RUSTWRIGHT_BROWSERS_PATH" "$PLAYWRIGHT_BROWSERS_PATH"; do \
 
 RUN case "$(uname -m)" in \
         aarch64|arm64) browser="$(find "$PLAYWRIGHT_BROWSERS_PATH" -path '*/chrome-linux/chrome' -type f | head -n 1)" ;; \
-        *) browser="$(find "$RUSTWRIGHT_BROWSERS_PATH" -path '*/chrome-linux64/chrome' -type f | head -n 1)" ;; \
+        *) chromium_version="$(tr -d '[:space:]' < .github/chromium-version)" \
+           && browser="$RUSTWRIGHT_BROWSERS_PATH/chromium-$chromium_version/chrome-linux64/chrome" ;; \
     esac \
     && test -n "$browser" \
-    && ln -sf "$browser" "$RUSTWRIGHT_CHROMIUM"
+    && test -x "$browser" \
+    && ln -sf "$browser" "$RUSTWRIGHT_CHROMIUM" \
+    && echo "Chromium executable: $RUSTWRIGHT_CHROMIUM" \
+    && resolved_version="$("$RUSTWRIGHT_CHROMIUM" --version)" \
+    && echo "Chromium version: $resolved_version" \
+    && case "$(uname -m)" in \
+         aarch64|arm64) ;; \
+         *) case "$resolved_version" in \
+              *"$chromium_version"*) ;; \
+              *) echo "Pinned Chromium mismatch: expected $chromium_version, got $resolved_version" >&2; exit 1 ;; \
+            esac ;; \
+       esac
 
 RUN --mount=type=cache,target=/root/.npm \
     if [ "$INSTALL_PUPPETEER" = "1" ]; then \

benchmarks/automation_cases.py

@@ -5133,7 +5133,7 @@ def mouse_wheel_dispatches_single_trusted_event_like_playwright(page):
 
     page.mouse.move(50, 50)
     page.mouse.wheel(0, 40)
-    page.wait_for_timeout(100)
+    page.wait_for_function("() => window.events.length >= 2", timeout=5_000)
 
     assert page.evaluate("window.events") == [
         {

mcp/src/actor.rs

@@ -6707,9 +6707,14 @@ mod tests {
     });
   }
   const detached = document.querySelector('#detach');
-  new IntersectionObserver(entries => {
-    if (entries.some(entry => entry.isIntersecting)) detached.remove();
-  }).observe(detached);
+  // Deliberately rely on the engine calling this property: synchronous removal makes
+  // its next snapshot see isConnected === false; async observer delivery races dispatch
+  // and the winner has changed between Chromium builds.
+  const nativeScrollIntoView = detached.scrollIntoView;
+  detached.scrollIntoView = function(options) {
+    nativeScrollIntoView.call(this, options);
+    this.remove();
+  };
   fetch('/capture?events=actionability-ready');
 </script>"#
             .to_owned()
@@ -7578,7 +7583,7 @@ mod tests {
                         && event["hit"] == Value::Bool(true))
             );
 
-            page.click("#partially-offscreen", ActionOptions::timeout(1_000.0))
+            page.click("#partially-offscreen", ActionOptions::timeout(3_000.0))
                 .expect("click partially-offscreen target at its hit-tested viewport point");
             let partially_offscreen = page
                 .evaluate(
@@ -7605,7 +7610,7 @@ mod tests {
             );
 
             assert_actionability(
-                page.click("#detach", ActionOptions::timeout(500.0))
+                page.click("#detach", ActionOptions::timeout(3_000.0))
                     .expect_err("detached target must not click"),
                 ActionabilityError::Detached,
             );
@@ -7702,7 +7707,7 @@ mod tests {
             );
             assert_eq!(evidence["buttonDown"], Value::Bool(false));
 
-            page.click("#following", ActionOptions::timeout(1_000.0))
+            page.click("#following", ActionOptions::timeout(3_000.0))
                 .expect("following click must work after late cancellation");
             assert_eq!(
                 page.evaluate(

python/rustwright/cli.py

@@ -9,6 +9,7 @@
 import os
 from pathlib import Path
 import platform
+import re
 import shutil
 import stat
 import subprocess
@@ -78,6 +79,9 @@
     "--quality",
 }
 CHROME_FOR_TESTING_URL = "https://googlechromelabs.github.io/chrome-for-testing/last-known-good-versions-with-downloads.json"
+CHROME_FOR_TESTING_DOWNLOAD_BASE_URL = "https://storage.googleapis.com/chrome-for-testing-public"
+CHROMIUM_VERSION_ENV = "RUSTWRIGHT_CHROMIUM_VERSION"
+CHROMIUM_VERSION_PATTERN = re.compile(r"\d+\.\d+\.\d+\.\d+")
 LINUX_TOOLS_DEPS = [
     "xvfb",
     "fonts-noto-color-emoji",
@@ -149,6 +153,10 @@ def _install_parser(program: str = "playwright") -> argparse.ArgumentParser:
     parser.add_argument("--with-deps", action="store_true", help="Accepted for Playwright CLI compatibility.")
     parser.add_argument("--dry-run", action="store_true", help="Print the resolved browser path without launching a download.")
     parser.add_argument("--force", action="store_true", help="Accepted for Playwright CLI compatibility.")
+    parser.add_argument(
+        "--version",
+        help=f"Install an exact Chrome for Testing version (or set {CHROMIUM_VERSION_ENV}).",
+    )
     parser.add_argument("--only-shell", action="store_true", help="Accepted for Playwright CLI compatibility.")
     parser.add_argument("--no-shell", action="store_true", help="Accepted for Playwright CLI compatibility.")
     return parser
@@ -392,8 +400,37 @@ def _ensure_browser_executable(executable: Path) -> None:
         raise RuntimeError(f"Could not mark Chromium executable at {executable} as executable: {exc}") from exc
 
 
-def _chrome_for_testing_download(platform_name: str | None = None) -> dict[str, str]:
+def _validate_chromium_version(version: str) -> str:
+    normalized = version.strip()
+    if not CHROMIUM_VERSION_PATTERN.fullmatch(normalized):
+        raise ValueError(
+            f"Invalid Chromium version {version!r}; expected a full Chrome for Testing version like 123.0.6312.86"
+        )
+    return normalized
+
+
+def _requested_chromium_version(cli_version: str | None) -> str | None:
+    if cli_version is not None:
+        return _validate_chromium_version(cli_version)
+    requested = os.environ.get(CHROMIUM_VERSION_ENV)
+    if requested is None or not requested.strip():
+        return None
+    return _validate_chromium_version(requested)
+
+
+def _chrome_for_testing_download(
+    platform_name: str | None = None,
+    *,
+    version: str | None = None,
+) -> dict[str, str]:
     platform_name = platform_name or _chrome_for_testing_platform()
+    if version is not None:
+        version = _validate_chromium_version(version)
+        return {
+            "version": version,
+            "url": f"{CHROME_FOR_TESTING_DOWNLOAD_BASE_URL}/{version}/{platform_name}/chrome-{platform_name}.zip",
+            "platform": platform_name,
+        }
     with url_request.urlopen(CHROME_FOR_TESTING_URL, timeout=30) as response:
         payload = json.loads(response.read().decode("utf-8"))
     stable = payload.get("channels", {}).get("Stable", {})
@@ -405,8 +442,17 @@ def _chrome_for_testing_download(platform_name: str | None = None) -> dict[str,
     raise RuntimeError(f"Could not find a Chrome for Testing download for {platform_name}")
 
 
-def _download_chromium(*, force: bool = False, dry_run: bool = False) -> dict[str, object]:
-    download = _chrome_for_testing_download()
+def _download_chromium(
+    *,
+    force: bool = False,
+    dry_run: bool = False,
+    version: str | None = None,
+) -> dict[str, object]:
+    download = (
+        _chrome_for_testing_download(version=version)
+        if version is not None
+        else _chrome_for_testing_download()
+    )
     platform_name = download["platform"]
     install_dir = _browser_cache_dir() / f"chromium-{download['version']}"
     executable = install_dir / _chrome_for_testing_executable(platform_name)
@@ -866,6 +912,40 @@ def install(argv: Sequence[str], *, program: str = "playwright") -> int:
     if not ok:
         print(message, file=sys.stderr)
         return 1
+    try:
+        pinned_version = _requested_chromium_version(args.version)
+    except ValueError as exc:
+        print(exc, file=sys.stderr)
+        return 1
+    if pinned_version is not None:
+        if any(browser != "chromium" for browser in browsers):
+            print(
+                "An exact Chromium version can only be used with the chromium install target.",
+                file=sys.stderr,
+            )
+            return 1
+        try:
+            result = _download_chromium(
+                force=bool(args.force),
+                dry_run=bool(args.dry_run),
+                version=pinned_version,
+            )
+        except Exception as exc:
+            print(
+                f"Could not install pinned Chromium {pinned_version}. Rustwright will not fall back to a system "
+                f"browser or a different Chrome for Testing build. Details: {exc}",
+                file=sys.stderr,
+            )
+            return 1
+        if args.with_deps:
+            print("Rustwright does not install OS packages; ensure Chromium runtime dependencies are present.")
+        if args.dry_run:
+            print(f"Rustwright would download pinned Chromium {pinned_version} from: {result['url']}")
+            print(result["executable"])
+        else:
+            verb = "installed" if result["downloaded"] else "found"
+            print(f"Rustwright {verb} pinned Chromium {pinned_version} executable: {result['executable']}")
+        return 0
     if any(browser in BRANDED_INSTALL_BROWSERS for browser in browsers):
         status = 0
         for browser in browsers:

tests/test_rustwright_sync_api.py

@@ -9969,7 +9969,7 @@ def test_locator_click_dispatches_trusted_mouse_sequence_by_default(page, monkey
         """
     )
 
-    page.locator("#go").click(timeout=1_000)
+    page.locator("#go").click(timeout=3_000)
 
     events = page.evaluate("window.events")
     assert [event["type"] for event in events] == [
@@ -25309,6 +25309,147 @@ def read(self):
         assert os.access(executable, os.X_OK)
 
 
+def test_cli_exact_chromium_version_uses_direct_download_url():
+    from rustwright import cli
+
+    download = cli._chrome_for_testing_download("linux64", version="123.0.6312.86")
+
+    assert download == {
+        "version": "123.0.6312.86",
+        "url": (
+            "https://storage.googleapis.com/chrome-for-testing-public/"
+            "123.0.6312.86/linux64/chrome-linux64.zip"
+        ),
+        "platform": "linux64",
+    }
+
+
+def test_cli_install_pinned_chromium_bypasses_system_browser(monkeypatch, capsys):
+    from rustwright import cli
+
+    calls = []
+    monkeypatch.setenv("RUSTWRIGHT_CHROMIUM_VERSION", "124.0.6367.91")
+    monkeypatch.setattr(
+        cli,
+        "_chromium_executable_path",
+        lambda: pytest.fail("pinned install must not resolve a system browser"),
+    )
+    monkeypatch.setattr(
+        cli,
+        "_download_chromium",
+        lambda **kwargs: calls.append(kwargs)
+        or {
+            "executable": "/cache/chromium-124.0.6367.91/chrome-linux64/chrome",
+            "downloaded": True,
+            "url": "https://example.test/124.0.6367.91/chrome-linux64.zip",
+        },
+    )
+
+    assert cli.install(["chromium"]) == 0
+
+    assert calls == [{"force": False, "dry_run": False, "version": "124.0.6367.91"}]
+    output = capsys.readouterr().out
+    assert "installed pinned Chromium 124.0.6367.91 executable" in output
+
+
+def test_cli_install_version_flag_overrides_environment(monkeypatch, capsys):
+    from rustwright import cli
+
+    calls = []
+    monkeypatch.setenv("RUSTWRIGHT_CHROMIUM_VERSION", "124.0.6367.91")
+    monkeypatch.setattr(
+        cli,
+        "_chromium_executable_path",
+        lambda: pytest.fail("pinned install must not resolve a system browser"),
+    )
+    monkeypatch.setattr(
+        cli,
+        "_download_chromium",
+        lambda **kwargs: calls.append(kwargs)
+        or {
+            "executable": "/cache/chromium-125.0.6422.60/chrome-linux64/chrome",
+            "downloaded": False,
+            "url": "https://example.test/125.0.6422.60/chrome-linux64.zip",
+        },
+    )
+
+    assert cli.install(["chromium", "--version", "125.0.6422.60", "--dry-run"]) == 0
+
+    assert calls == [{"force": False, "dry_run": True, "version": "125.0.6422.60"}]
+    output = capsys.readouterr().out
+    assert "would download pinned Chromium 125.0.6422.60" in output
+    assert output.rstrip().endswith("/cache/chromium-125.0.6422.60/chrome-linux64/chrome")
+
+
+def test_cli_install_pinned_chromium_fails_without_fallback(monkeypatch, capsys):
+    from rustwright import cli
+
+    monkeypatch.setenv("RUSTWRIGHT_CHROMIUM_VERSION", "126.0.6478.55")
+    monkeypatch.setattr(
+        cli,
+        "_chromium_executable_path",
+        lambda: pytest.fail("pinned install must not resolve a system browser"),
+    )
+    monkeypatch.setattr(
+        cli,
+        "_download_chromium",
+        lambda **kwargs: (_ for _ in ()).throw(RuntimeError("HTTP 404")),
+    )
+
+    assert cli.install(["chromium"]) == 1
+
+    error = capsys.readouterr().err
+    assert "Could not install pinned Chromium 126.0.6478.55" in error
+    assert "will not fall back to a system browser or a different Chrome for Testing build" in error
+    assert "HTTP 404" in error
+
+
+def test_cli_install_rejects_invalid_pinned_chromium_version(monkeypatch, capsys):
+    from rustwright import cli
+
+    monkeypatch.setenv("RUSTWRIGHT_CHROMIUM_VERSION", "stable")
+    monkeypatch.setattr(
+        cli,
+        "_download_chromium",
+        lambda **kwargs: pytest.fail("invalid pinned version must fail before download resolution"),
+    )
+
+    assert cli.install(["chromium"]) == 1
+
+    assert "expected a full Chrome for Testing version" in capsys.readouterr().err
+
+
+def test_cli_install_rejects_explicit_empty_chromium_version(monkeypatch, capsys):
+    from rustwright import cli
+
+    monkeypatch.delenv("RUSTWRIGHT_CHROMIUM_VERSION", raising=False)
+    monkeypatch.setattr(
+        cli,
+        "_download_chromium",
+        lambda **kwargs: pytest.fail("invalid pinned version must fail before download resolution"),
+    )
+
+    assert cli.install(["chromium", "--version", ""]) == 1
+
+    assert "expected a full Chrome for Testing version" in capsys.readouterr().err
+
+
+def test_cli_install_empty_version_environment_keeps_unpinned_behavior(monkeypatch, capsys):
+    from rustwright import cli
+
+    monkeypatch.setenv("RUSTWRIGHT_CHROMIUM_VERSION", "")
+    monkeypatch.setattr(cli, "_chromium_executable_path", lambda: "/usr/bin/chromium")
+    monkeypatch.setattr(
+        cli,
+        "_download_chromium",
+        lambda **kwargs: pytest.fail("empty pin must preserve system-browser resolution"),
+    )
+
+    assert cli.install(["chromium"]) == 0
+
+    assert "Rustwright found Chromium executable: /usr/bin/chromium" in capsys.readouterr().out
+
+
 def test_cli_chrome_for_testing_platform_rejects_linux_arm64(monkeypatch):
     from rustwright import cli