From 123c33db2cd0d98e488fcf7d85bf7a6724c5d4fd Mon Sep 17 00:00:00 2001
From: Maximilian Mayer <office@maximilianmayer.at>
Date: Thu, 10 Sep 2026 19:30:41 +0200
Subject: [PATCH 1/2] ci: run Playwright tests in GitHub Actions

Signed-off-by: Maximilian Mayer <office@maximilianmayer.at>
---
 .github/workflows/playwright.yml | 64 ++++++++++++++++++++++++++++++++
 playwright.config.ts             | 14 ++++---
 2 files changed, 73 insertions(+), 5 deletions(-)
 create mode 100644 .github/workflows/playwright.yml

diff --git a/.github/workflows/playwright.yml b/.github/workflows/playwright.yml
new file mode 100644
index 0000000..df4dd7b
--- /dev/null
+++ b/.github/workflows/playwright.yml
@@ -0,0 +1,64 @@
+# SPDX-FileCopyrightText: 2026 LibreCode coop and contributors
+# SPDX-License-Identifier: AGPL-3.0-or-later
+
+name: Playwright
+
+on:
+  pull_request:
+  push:
+    branches:
+      - main
+
+permissions:
+  contents: read
+
+concurrency:
+  group: playwright-${{ github.head_ref || github.run_id }}
+  cancel-in-progress: true
+
+jobs:
+  e2e:
+    runs-on: ubuntu-latest
+    name: Playwright e2e
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+
+      - name: Read package.json node and npm engines version
+        uses: skjnldsv/read-package-engines-version-actions@8205673bab74a63eb9b8093402fd9e0e018663a1 # v2.2
+        id: versions
+        with:
+          fallbackNode: '^24'
+          fallbackNpm: '^11'
+
+      - name: Set up node ${{ steps.versions.outputs.nodeVersion }}
+        uses: actions/setup-node@v4
+        with:
+          node-version: ${{ steps.versions.outputs.nodeVersion }}
+
+      - name: Set up npm ${{ steps.versions.outputs.npmVersion }}
+        run: npm i -g 'npm@${{ steps.versions.outputs.npmVersion }}'
+
+      - name: Install dependencies
+        env:
+          CYPRESS_INSTALL_BINARY: 0
+          PUPPETEER_SKIP_DOWNLOAD: true
+        run: npm ci
+
+      - name: Install Playwright browser
+        run: npx playwright install --with-deps chromium
+
+      - name: Run Playwright tests
+        run: npm run test:e2e
+
+      - name: Upload Playwright report
+        if: ${{ !cancelled() }}
+        uses: actions/upload-artifact@v4
+        with:
+          name: playwright-report
+          path: |
+            playwright-report/
+            test-results/
+          retention-days: 7
diff --git a/playwright.config.ts b/playwright.config.ts
index c82d9a1..93b3f33 100644
--- a/playwright.config.ts
+++ b/playwright.config.ts
@@ -5,20 +5,24 @@ import { defineConfig, devices } from "@playwright/test";
 
 export default defineConfig({
   testDir: "e2e",
+  forbidOnly: !!process.env.CI,
+  retries: process.env.CI ? 2 : 0,
+  reporter: [['html', { open: 'never' }], ['list']],
   use: {
     baseURL: "http://localhost:5173/",
-    trace: "on-first-retry"
+    trace: "on-first-retry",
+    screenshot: "only-on-failure",
+    locale: "en-US",
   },
   projects: [
     {
       name: 'chromium',
       use: { ...devices['Desktop Chrome'] },
     },
-],
+  ],
   webServer: {
     command: "npm run dev",
     url: "http://localhost:5173/",
-    reuseExistingServer: !process.env.CI
-  }
-
+    reuseExistingServer: !process.env.CI,
+  },
 });

From c68e00dc5911a42e747f1e2ccca5392764a8454f Mon Sep 17 00:00:00 2001
From: Maximilian Mayer <office@maximilianmayer.at>
Date: Thu, 10 Sep 2026 21:35:00 +0200
Subject: [PATCH 2/2] ci: pin actions to commit SHAs and add github-actions to
 Dependabot

Signed-off-by: Maximilian Mayer <office@maximilianmayer.at>
---
 .github/dependabot.yml           | 6 ++++++
 .github/workflows/playwright.yml | 6 +++---
 2 files changed, 9 insertions(+), 3 deletions(-)

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index e55dee4..154b099 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -13,3 +13,9 @@ updates:
     directory: "/"
     schedule:
       interval: "daily"
+
+  # Maintain dependencies for GitHub Actions
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "daily"
diff --git a/.github/workflows/playwright.yml b/.github/workflows/playwright.yml
index df4dd7b..94eed59 100644
--- a/.github/workflows/playwright.yml
+++ b/.github/workflows/playwright.yml
@@ -22,7 +22,7 @@ jobs:
     name: Playwright e2e
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
         with:
           persist-credentials: false
 
@@ -34,7 +34,7 @@ jobs:
           fallbackNpm: '^11'
 
       - name: Set up node ${{ steps.versions.outputs.nodeVersion }}
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
           node-version: ${{ steps.versions.outputs.nodeVersion }}
 
@@ -55,7 +55,7 @@ jobs:
 
       - name: Upload Playwright report
         if: ${{ !cancelled() }}
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: playwright-report
           path: |