DOMPurify/.github/workflows/legacy-browsers.yml at f40d2e4a1bf788ee643065f7fc2b94ba9c11dd29 · cure53/DOMPurify · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
name: Legacy Browsers

# Old-engine coverage, Playwright-only (no external grid). Each matrix row pins a
# Playwright RELEASE, which is a matched Chromium/Firefox/WebKit snapshot from
# that era (exact versions below). It drives the same served QUnit suite as the
# main browser job, in library mode via test/browser/legacy-runner.js.
#
#   Playwright  Chromium  Firefox  WebKit   approx age
#   1.50.1      133       134      18.2     ~1.5 years
#   1.44.1      125       125      17.4     ~2 years
#   1.40.0      120       119      17.4     ~2.5 years
#   1.35.1      115       113      16.4     ~3 years
#   1.30.0      110       108      16.4     ~3.5 years
# Playwright's floor is ~1.10 (Chromium ~89 / Firefox ~85 / WebKit ~14.1, 2021);
# nothing older is reachable without a grid.
#
# Non-blocking by design (continue-on-error): early-warning on push to main, plus
# weekly drift detection, plus on-demand pre-release pre-flight. It never runs on
# pull_request, so it is not a required check and does not touch the
# build-and-test-skip.yml mirroring.

on:
  push:
    # Only the lines that carry the Playwright test harness (server.js +
    # legacy-runner.js + the QUnit page globals). 2.x predates the Playwright
    # migration and runs its own legacy coverage, so it is deliberately excluded.
    branches: [main, 3.x]
    paths-ignore:
      - '**/*.md'
      - 'demos/**'
      - 'website/**'
  schedule:
    - cron: '0 6 * * 1' # Mondays 06:00 UTC
  workflow_dispatch:

permissions:
  contents: read

concurrency:
  group: legacy-browsers-${{ github.ref }}
  cancel-in-progress: false

jobs:
  legacy-browsers:
    # ubuntu-22.04 (not -latest): every pinned Playwright here predates Ubuntu
    # 24.04's renamed apt packages, so each release's own `install --with-deps`
    # resolves cleanly on 22.04. The runner OS does not affect the browser engine
    # under test (the engine is a downloaded binary), so this costs no coverage.
    # If 22.04 is ever retired, move the oldest rows to a pinned container image.
    runs-on: ubuntu-22.04
    continue-on-error: true

    strategy:
      fail-fast: false
      matrix:
        include:
          - { pw: playwright-1-50-1, node: '20.x' } # Chromium 133 / FF 134 / WebKit 18.2
          - { pw: playwright-1-44-1, node: '20.x' } # Chromium 125 / FF 125 / WebKit 17.4  (~2 yrs)
          - { pw: playwright-1-40-0, node: '18.x' } # Chromium 120 / FF 119 / WebKit 17.4
          - { pw: playwright-1-35-1, node: '18.x' } # Chromium 115 / FF 113 / WebKit 16.4
          - { pw: playwright-1-30-0, node: '18.x' } # Chromium 110 / FF 108 / WebKit 16.4

    steps:
      - name: Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
        with:
          egress-policy: audit

      - name: Checkout
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false

      - name: Setup Node.js ${{ matrix.node }}
        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: ${{ matrix.node }}
          cache: npm

      # No build step: dist/ is committed and kept in sync with src/ by
      # build-and-test.yml, so the legacy job tests the artifact that actually
      # ships. The root npm ci only needs to provide qunit + jquery for the
      # served page. (EBADENGINE warnings on the Node 18 rows are harmless: we
      # serve static assets and run the pinned Playwright, never the >=20 build
      # toolchain.)
      - name: Install Dependencies
        run: npm ci --ignore-scripts

      # The older Playwright snapshots are pinned by integrity hash in
      # test/legacy-playwright/package-lock.json (each is an npm alias to an
      # exact version), so `npm ci` installs hash-verified tarballs rather than
      # whatever the registry currently serves for that version.
      - name: Install pinned legacy Playwright snapshots
        working-directory: test/legacy-playwright
        run: npm ci --ignore-scripts

      - name: Install browsers for ${{ matrix.pw }}
        run: node test/legacy-playwright/node_modules/${{ matrix.pw }}/cli.js install --with-deps chromium firefox webkit

      # legacy-runner.js self-starts test/browser/server.js and stops it on exit.
      - name: Run suite on legacy engines
        run: PW_MODULE="$GITHUB_WORKSPACE/test/legacy-playwright/node_modules/${{ matrix.pw }}" node test/browser/legacy-runner.js