Repository navigation

Playwright (frontend-doctor scenarios) #160

Workflow file for this run

.github/workflows/playwright.yml at bf7acb2

	name: Playwright (frontend-doctor scenarios)

	# Heavier tier-3 scenarios: spins up the full local stack (DynamoDB Local
	# + MinIO + Redis + axum server + frontend WASM build) and drives each
	# scripted scenario through a headless Chromium. Scenarios share the
	# provisioned stack, so adding another one is ~30s of additional
	# wall-clock rather than another 8-10 min of setup.
	#
	# Scheduled nightly rather than per-push because the wasm toolchain +
	# trunk build + Playwright install pushes total wall-clock to ~8–10 min
	# on a cold cache. Run on-demand via the "Run workflow" button when
	# touching the document or spreadsheet flows.
	#
	# Current scenarios:
	# - trash-flow — delete → Trash → restore → purge loop.
	# - spreadsheet-paste — copy/paste ref translation + no clipboard
	# permission prompt.
	# - spreadsheet-features — M-S2 editor-UI smoke (toolbar, sheet
	# tabs, formula bar, header-click sort,
	# freeze rows via context menu).
	# - pivot-editor — M-S2 v2 pivot-table sidebar smoke
	# (insert via ctx menu, field-list
	# checkbox routing, delete clears).
	# - comment-live-sync — peer's REST-driven reply lands in another
	# tab's open CommentPopup without manual
	# reload.
	# - pre-sync-edit-preserved / first-keystrokes — #92 input races:
	# keystrokes typed during the WS handshake /
	# the instant the editor reports ready must
	# survive the initial sync, exactly.

	on:
	schedule:
	# 06:00 UTC daily (≈23:00 PT). Matches the "nightly" expectation.
	- cron: "0 6 * * *"
	workflow_dispatch:

	concurrency:
	group: playwright-frontend-doctor
	cancel-in-progress: true

	env:
	CARGO_TERM_COLOR: always
	RUST_BACKTRACE: 1
	# AWS SDK credential/endpoint shims so the server and setup_dev binary
	# talk to DynamoDB Local + MinIO instead of real AWS.
	AWS_ACCESS_KEY_ID: minioadmin
	AWS_SECRET_ACCESS_KEY: minioadmin
	AWS_REGION: us-east-1
	AWS_ENDPOINT_URL_DYNAMODB: http://127.0.0.1:8000
	AWS_ENDPOINT_URL_S3: http://127.0.0.1:9000
	# Server config
	DYNAMODB_TABLE_PREFIX: "ci-"
	S3_BUCKET: "ci-ogrenotes"
	REDIS_URL: "redis://127.0.0.1:6379"
	DEV_MODE: "true"
	JWT_SECRET: "ci-jwt-secret-that-is-at-least-32-bytes-long"
	OAUTH_CLIENT_ID: "ci-not-used"
	OAUTH_CLIENT_SECRET: "ci-not-used"
	OAUTH_REDIRECT_URI: "http://localhost:3000/auth/callback"
	SEARCH_INDEX_PATH: "/tmp/ogrenotes-ci-search"
	# Exercise the indexed search path used by deployed API instances. The
	# legacy scan can miss users created late in this long scenario suite.
	USER_SEARCH_INDEX_READS_ENABLED: "true"
	API_PORT: "3000"
	# Bump the per-IP rate-limit ceiling well above defaults. In CI
	# axum receives connections without X-Forwarded-For, so every
	# scenario shares the "unknown" bucket; the production 10/min
	# default for auth_refresh trips before the suite finishes.
	RATE_LIMIT_AUTH_REFRESH_PER_MIN: "60"
	RATE_LIMIT_AUTH_LOGIN_PER_MIN: "60"
	# Same shared-"unknown"-bucket reason: a disconnected WS during fast
	# typing storms the reconnect trigger on every keydown, so the default
	# 30/min WS-upgrade cap trips mid-scenario (the document-details flaky).
	RATE_LIMIT_WS_UPGRADE_PER_MIN: "60"
	# Phase 6 M-6.2 piece E: passed through to the API task so the
	# /api/v1/ask endpoint can stream against the real Claude API.
	# `secrets.ANTHROPIC_API_KEY` resolves to empty string on PRs
	# from forks (GitHub doesn't expose secrets to fork builds); the
	# ask-flow scenario step below skips when the env var is empty.
	ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}

	jobs:
	frontend-doctor:
	name: Playwright frontend-doctor
	runs-on: ubuntu-latest
	# 30 was too tight on a cold-cache day: the release build alone swings from
	# ~3 min (warm) to ~16.5 min (cold), and a cold run measured 30.6 min — so
	# it tripped the cap and was cancelled, which skips the rust-cache save
	# post-step, leaving the next run cold too (a self-perpetuating loop). 45
	# gives a cold run room to finish and repopulate the cache. The scenarios
	# themselves are ~2.5 min total and are not the bottleneck.
	timeout-minutes: 45
	steps:
	- uses: actions/checkout@v4

	# ─── System libs ──────────────────────────────────────────
	# samael's `xmlsec` feature wraps libxml2 + xmlsec1 for SAML
	# signature verification. The Dockerfile got these in commit
	# 45e086e; the playwright workflow was missed in that pass,
	# so every run since 2026-05-15 (when the feature went live)
	# has crashed the `cargo run --bin setup_dev` step before any
	# scenario could execute. Mirror the Dockerfile package set:
	# -dev headers + libclang for bindgen at compile time; the
	# xmlsec OpenSSL runtime is what the runtime binary
	# dlopens for the actual crypto backend.
	- name: Install xmlsec1 + clang (samael dependencies)
	run: bash scripts/ci-install-native-deps.sh librsvg2-bin imagemagick

	# ─── Toolchain ────────────────────────────────────────────
	- name: Install Rust (stable + wasm32)
	uses: dtolnay/rust-toolchain@stable
	with:
	targets: wasm32-unknown-unknown

	- name: Cache cargo
	uses: Swatinem/rust-cache@v2
	with:
	env-vars: LIBCLANG_PATH OGRE_NATIVE_ABI
	workspaces: \|
	. -> target
	frontend -> target
	shared-key: playwright
	# Save the cache even when the job fails, so one bad run doesn't
	# leave the next one cold. (A cancelled run still skips the save —
	# the raised timeout above is what keeps us out of cancellation.)
	cache-on-failure: true

	# trunk auto-downloads wasm-bindgen when the build needs it, so the
	# action here gives us a single prebuilt trunk binary and nothing else.
	# Pinned: `version: latest` resolved to trunk 0.19.1 on one runner and
	# 0.21.14 on another ten minutes apart (2026-09-26). 0.19.1 ignores
	# index.html's data-wasm-opt-params, so its wasm-opt 116 rejected the
	# bulk-memory ops rustc now emits for wasm32. 0.21.14 matches local dev.
	- name: Install trunk
	uses: taiki-e/install-action@5488ac5a951645ce95062214902ac4b6bc1a1037 # v2
	with:
	tool: trunk@0.21.14

	- name: Setup Node 20
	uses: actions/setup-node@v4
	with:
	node-version: 20

	# ─── Infra ────────────────────────────────────────────────
	- name: Start infra (DynamoDB / MinIO / Redis)
	run: docker compose up -d

	- name: Wait for services
	run: \|
	for port in 8000 9000 6379; do
	echo "Waiting for port $port..."
	for i in $(seq 1 30); do
	if nc -z 127.0.0.1 "$port"; then
	echo " port $port ready"
	break
	fi
	sleep 1
	done
	done

	- name: Provision DynamoDB table + S3 bucket
	run: cargo run --locked --bin setup_dev -p ogrenotes-api

	# ─── Frontend build ───────────────────────────────────────
	# main.rs serves static assets from /app/frontend/dist. We symlink
	# the workspace's build output there so the single axum process
	# serves both the API and the SPA over port 3000 (matching the
	# Playwright scenario's same-origin assumption).
	- name: Build frontend (trunk)
	working-directory: frontend
	run: trunk build

	- name: Expose frontend dist at /app/frontend/dist
	run: \|
	sudo mkdir -p /app/frontend
	sudo ln -sfn "$(pwd)/frontend/dist" /app/frontend/dist

	# ─── Start API server ─────────────────────────────────────
	# Build and run are split so a slow cold compile doesn't eat into
	# the readiness-poll window. `cargo build` blocks until the binary
	# exists; `Start axum server` then just execs the already-compiled
	# artifact and backgrounds it.
	# Strip the `pdf` feature from the playwright build — no scenario
	# in doctor.js exercises PDF import/export, and `pdf-extract` +
	# `printpdf` together pull in ~70 transitive crates (allsorts,
	# azul-*, ouroboros) that pushed the cold cargo build past the
	# 30-minute job budget and trapped the workflow in a doom loop
	# (cold build → 30m timeout → no cache save → cold build again).
	# PDF correctness is verified by `crates/api/tests/test_import_pdf_e2e.rs`
	# under the regular CI workflow, which runs with the api crate's
	# default feature set (pdf on).
	- name: Build axum server (release)
	run: \|
	cargo build --release --locked --bin ogrenotes-api \
	--bin backfill_user_search_index \
	--no-default-features --features "dev-login,xlsx,docx"

	- name: Backfill user-search index
	run: ./target/release/backfill_user_search_index

	- name: Start axum server
	run: \|
	mkdir -p /tmp/ci-logs
	./target/release/ogrenotes-api \
	> /tmp/ci-logs/server.log 2>&1 &
	echo $! > /tmp/ci-logs/server.pid

	- name: Wait for server
	run: \|
	# 90 iterations × 2s = 3 min. Startup is normally <5s; the
	# headroom covers AWS-SDK / Redis / search-index warm-up on a
	# slow runner without masking a genuinely broken server.
	for i in $(seq 1 90); do
	if curl -sf http://127.0.0.1:3000/api/v1/auth/dev-login \
	-H 'content-type: application/json' \
	-d '{"email":"healthcheck@ci"}' >/dev/null; then
	echo "server ready"
	exit 0
	fi
	sleep 2
	done
	echo "server failed to start" >&2
	tail -n 200 /tmp/ci-logs/server.log
	exit 1

	# ─── Playwright ───────────────────────────────────────────
	- name: Install doctor deps
	working-directory: scripts/frontend-doctor
	run: npm install

	- name: Cache Playwright browsers
	uses: actions/cache@v4
	id: playwright-cache
	with:
	path: ~/.cache/ms-playwright
	# `-cf` = chromium+firefox. Bumped when Firefox was added for the
	# #90 history-pane guard: the old chromium-only cache would
	# otherwise hit and skip the binary-download step, leaving Firefox
	# missing (install-deps installs system libs, not the binary).
	key: playwright-${{ runner.os }}-1.49.0-cf

	# Firefox in addition to Chromium: the #90 history-pane panic is
	# Gecko-specific (reproduces in Firefox, clean in Chromium), so the
	# regression guard for it must run in Firefox.
	- name: Install Chromium + Firefox
	if: steps.playwright-cache.outputs.cache-hit != 'true'
	working-directory: scripts/frontend-doctor
	run: npx playwright install --with-deps chromium firefox

	- name: Install browser system deps (cache hit)
	if: steps.playwright-cache.outputs.cache-hit == 'true'
	working-directory: scripts/frontend-doctor
	run: npx playwright install-deps chromium firefox

	- name: Doctor failure reporting browser regressions
	working-directory: scripts/frontend-doctor
	run: npm run test:browser

	- name: Collaboration content and native history regressions
	working-directory: scripts/frontend-doctor
	run: node collab-preservation.cjs http://127.0.0.1:3000

	- name: Internationalization browser regressions
	working-directory: scripts/frontend-doctor
	env:
	DEBUG: pw:browser
	run: \|
	set -o pipefail
	cargo run --locked --manifest-path ../../frontend/Cargo.toml --example i18n_fixtures > /tmp/ogre-i18n-fixtures.json
	python3 ../with-test-cleanup.py -- node i18n-check.cjs 2>&1 \| tee /tmp/ci-logs/i18n-browser.log

	- name: Internationalization live persistence and collaboration
	working-directory: scripts/frontend-doctor
	run: python3 ../with-test-cleanup.py -- node i18n-live-check.cjs http://127.0.0.1:3000

	- name: Run trash-flow scenario
	id: trash-flow
	working-directory: scripts/frontend-doctor
	run: \|
	node doctor.js \
	--scenario trash-flow \
	--base-url http://127.0.0.1:3000 \
	--out ../../artifacts/doctor/trash-flow

	# `if: always()` so a trash-flow failure doesn't hide a separate
	# spreadsheet-paste failure. Both scenarios exit non-zero
	# independently and the job as a whole fails if either fails.
	# But: if trash-flow was skipped (because an earlier setup step
	# like `Wait for server` or `Install doctor deps` failed), running
	# this scenario just produces a confusing secondary error — so
	# only run when trash-flow actually got to execute.
	- name: Run spreadsheet-paste scenario
	id: spreadsheet-paste
	if: always() && (steps.trash-flow.outcome == 'success' \|\| steps.trash-flow.outcome == 'failure')
	working-directory: scripts/frontend-doctor
	run: \|
	node doctor.js \
	--scenario spreadsheet-paste \
	--base-url http://127.0.0.1:3000 \
	--out ../../artifacts/doctor/spreadsheet-paste

	# M-S2 editor-UI smoke: toolbar (format painter), sheet-tab
	# bar, formula bar, header-click sort, freeze rows via
	# context menu. Catches DOM regressions on the M-S2 features
	# without needing a full per-feature scenario.
	- name: Run spreadsheet-features scenario
	id: spreadsheet-features
	if: always() && (steps.trash-flow.outcome == 'success' \|\| steps.trash-flow.outcome == 'failure')
	working-directory: scripts/frontend-doctor
	run: \|
	node doctor.js \
	--scenario spreadsheet-features \
	--base-url http://127.0.0.1:3000 \
	--out ../../artifacts/doctor/spreadsheet-features

	# #76: spreadsheet mount/unmount reclaim. Repeatedly navigate
	# between two spreadsheet docs (each navigation unmounts the
	# previous grid and runs its on_cleanup), then copy/paste on the
	# surviving doc — a second spawn_local that must find the engine
	# still live. Asserts no panic / no use-after-free, not heap
	# numbers (usedJSHeapSize is too noisy to gate on).
	- name: Run spreadsheet-lifecycle scenario
	id: spreadsheet-lifecycle
	if: always() && (steps.trash-flow.outcome == 'success' \|\| steps.trash-flow.outcome == 'failure')
	working-directory: scripts/frontend-doctor
	run: \|
	node doctor.js \
	--scenario spreadsheet-lifecycle \
	--base-url http://127.0.0.1:3000 \
	--out ../../artifacts/doctor/spreadsheet-lifecycle

	# #134: focus/expand toggle round-trip. Enter + exit focus mode via
	# both the single header button (which must flip ⤢ ↔ ✕) and
	# Ctrl+Shift+F, asserting the chrome hides/shows and — importantly —
	# nothing panics on teardown (the focus-exit closure-drop class).
	- name: Run focus-mode scenario
	id: focus-mode
	if: always() && (steps.trash-flow.outcome == 'success' \|\| steps.trash-flow.outcome == 'failure')
	working-directory: scripts/frontend-doctor
	run: \|
	node doctor.js \
	--scenario focus-mode \
	--base-url http://127.0.0.1:3000 \
	--out ../../artifacts/doctor/focus-mode

	# Regression for the menu-bar backdrop-intercept bug: with a menu open,
	# clicking another menu name must switch to it in one click (the
	# full-screen backdrop used to swallow the click and only close).
	- name: Run menu-switch scenario
	id: menu-switch
	if: always() && (steps.trash-flow.outcome == 'success' \|\| steps.trash-flow.outcome == 'failure')
	working-directory: scripts/frontend-doctor
	run: \|
	node doctor.js \
	--scenario menu-switch \
	--base-url http://127.0.0.1:3000 \
	--out ../../artifacts/doctor/menu-switch

	# #146: Document-menu Rename + Duplicate. On a spreadsheet (explicit,
	# assertable title): rename via the prompt updates the title; duplicate
	# navigates to a new doc with a "<title> copy" name and copied cell.
	- name: Run doc-actions scenario
	id: doc-actions
	if: always() && (steps.trash-flow.outcome == 'success' \|\| steps.trash-flow.outcome == 'failure')
	working-directory: scripts/frontend-doctor
	run: \|
	node doctor.js \
	--scenario doc-actions \
	--base-url http://127.0.0.1:3000 \
	--out ../../artifacts/doctor/doc-actions

	# #144: favorites — star the doc, assert the header toggle goes active
	# and the doc shows up in the sidebar Favorites list (live), then unstar.
	- name: Run favorites scenario
	id: favorites
	if: always() && (steps.trash-flow.outcome == 'success' \|\| steps.trash-flow.outcome == 'failure')
	working-directory: scripts/frontend-doctor
	run: \|
	node doctor.js \
	--scenario favorites \
	--base-url http://127.0.0.1:3000 \
	--out ../../artifacts/doctor/favorites

	# #147: in-app Find & Replace — type repeated text, open the bar (Edit
	# menu + Ctrl+F), assert the live match count, navigate, Replace All,
	# and verify the editor model actually changed.
	- name: Run find-replace scenario
	id: find-replace
	if: always() && (steps.trash-flow.outcome == 'success' \|\| steps.trash-flow.outcome == 'failure')
	working-directory: scripts/frontend-doctor
	run: \|
	node doctor.js \
	--scenario find-replace \
	--base-url http://127.0.0.1:3000 \
	--out ../../artifacts/doctor/find-replace

	# #139: Show Line Numbers — number each visual line (more numbers than
	# blocks once a paragraph wraps) in one uniform font; Show Page Breaks
	# no longer paints a full-width rule through the text.
	- name: Run line-numbers scenario
	id: line-numbers
	if: always() && (steps.trash-flow.outcome == 'success' \|\| steps.trash-flow.outcome == 'failure')
	working-directory: scripts/frontend-doctor
	run: \|
	node doctor.js \
	--scenario line-numbers \
	--base-url http://127.0.0.1:3000 \
	--out ../../artifacts/doctor/line-numbers

	# #141: Document Details panel — opens from the Document menu and shows
	# metadata rows incl. a live word/character count of the typed text.
	- name: Run document-details scenario
	id: document-details
	if: always() && (steps.trash-flow.outcome == 'success' \|\| steps.trash-flow.outcome == 'failure')
	working-directory: scripts/frontend-doctor
	run: \|
	node doctor.js \
	--scenario document-details \
	--base-url http://127.0.0.1:3000 \
	--out ../../artifacts/doctor/document-details

	# #145: Expand — the header ↗ hides the doc header and shows a floating
	# collapse button (.expanded on app-layout); the FAB exits.
	- name: Run expand scenario
	id: expand
	if: always() && (steps.trash-flow.outcome == 'success' \|\| steps.trash-flow.outcome == 'failure')
	working-directory: scripts/frontend-doctor
	run: \|
	node doctor.js \
	--scenario expand \
	--base-url http://127.0.0.1:3000 \
	--out ../../artifacts/doctor/expand

	# #143: subscript/superscript toolbar toggles render <sub>/<sup> in the
	# editor and are mutually exclusive.
	- name: Run subscript scenario
	id: subscript
	if: always() && (steps.trash-flow.outcome == 'success' \|\| steps.trash-flow.outcome == 'failure')
	working-directory: scripts/frontend-doctor
	run: \|
	node doctor.js \
	--scenario subscript \
	--base-url http://127.0.0.1:3000 \
	--out ../../artifacts/doctor/subscript

	# M-S2 v2 pivot-table sidebar smoke: insert a pivot via ctx
	# menu, field-list checkbox default-routes by type, delete
	# clears the editor. Skips drag-drop (HTML5 dnd in headless
	# Chromium is fragile) — checkbox-driven path is reliable.
	- name: Run pivot-editor scenario
	id: pivot-editor
	if: always() && (steps.trash-flow.outcome == 'success' \|\| steps.trash-flow.outcome == 'failure')
	working-directory: scripts/frontend-doctor
	run: \|
	node doctor.js \
	--scenario pivot-editor \
	--base-url http://127.0.0.1:3000 \
	--out ../../artifacts/doctor/pivot-editor

	# Same skip-on-setup-failure rule as spreadsheet-paste: the
	# scenario only makes sense if the server actually came up. We
	# gate on trash-flow having reached a real outcome (success or
	# failure) — that's our proxy for "stack is provisioned and
	# serving HTTP."
	- name: Run comment-live-sync scenario
	id: comment-live-sync
	if: always() && (steps.trash-flow.outcome == 'success' \|\| steps.trash-flow.outcome == 'failure')
	working-directory: scripts/frontend-doctor
	run: \|
	node doctor.js \
	--scenario comment-live-sync \
	--base-url http://127.0.0.1:3000 \
	--out ../../artifacts/doctor/comment-live-sync

	# ─── May 2026 UI batch — six new spreadsheet scenarios ────
	# Each targets one or more specific issues fixed in the
	# recent batch that previously only had engine-level
	# coverage. See `scripts/frontend-doctor/doctor.js` for
	# scenario bodies and gates.

	- name: Run spreadsheet-keyboard scenario (#60 Ctrl+Y)
	id: spreadsheet-keyboard
	if: always() && (steps.trash-flow.outcome == 'success' \|\| steps.trash-flow.outcome == 'failure')
	working-directory: scripts/frontend-doctor
	run: \|
	node doctor.js \
	--scenario spreadsheet-keyboard \
	--base-url http://127.0.0.1:3000 \
	--out ../../artifacts/doctor/spreadsheet-keyboard

	- name: Run spreadsheet-headers scenario (#58 status bar, #59 col-click)
	id: spreadsheet-headers
	if: always() && (steps.trash-flow.outcome == 'success' \|\| steps.trash-flow.outcome == 'failure')
	working-directory: scripts/frontend-doctor
	run: \|
	node doctor.js \
	--scenario spreadsheet-headers \
	--base-url http://127.0.0.1:3000 \
	--out ../../artifacts/doctor/spreadsheet-headers

	- name: Run spreadsheet-toolbar scenario (#56 format dropdown, #64 bold)
	id: spreadsheet-toolbar
	if: always() && (steps.trash-flow.outcome == 'success' \|\| steps.trash-flow.outcome == 'failure')
	working-directory: scripts/frontend-doctor
	run: \|
	node doctor.js \
	--scenario spreadsheet-toolbar \
	--base-url http://127.0.0.1:3000 \
	--out ../../artifacts/doctor/spreadsheet-toolbar

	- name: Run spreadsheet-freeze scenario (#61 off-by-one)
	id: spreadsheet-freeze
	if: always() && (steps.trash-flow.outcome == 'success' \|\| steps.trash-flow.outcome == 'failure')
	working-directory: scripts/frontend-doctor
	run: \|
	node doctor.js \
	--scenario spreadsheet-freeze \
	--base-url http://127.0.0.1:3000 \
	--out ../../artifacts/doctor/spreadsheet-freeze

	- name: Run spreadsheet-sheet-tabs scenario (#65 right-click delete)
	id: spreadsheet-sheet-tabs
	if: always() && (steps.trash-flow.outcome == 'success' \|\| steps.trash-flow.outcome == 'failure')
	working-directory: scripts/frontend-doctor
	run: \|
	node doctor.js \
	--scenario spreadsheet-sheet-tabs \
	--base-url http://127.0.0.1:3000 \
	--out ../../artifacts/doctor/spreadsheet-sheet-tabs

	- name: Run spreadsheet-remote-cursor scenario (#63 presence)
	id: spreadsheet-remote-cursor
	if: always() && (steps.trash-flow.outcome == 'success' \|\| steps.trash-flow.outcome == 'failure')
	working-directory: scripts/frontend-doctor
	run: \|
	node doctor.js \
	--scenario spreadsheet-remote-cursor \
	--base-url http://127.0.0.1:3000 \
	--out ../../artifacts/doctor/spreadsheet-remote-cursor

	- name: Run spreadsheet cursor delayed-handshake regression
	id: spreadsheet-remote-cursor-delayed
	if: always() && (steps.trash-flow.outcome == 'success' \|\| steps.trash-flow.outcome == 'failure')
	working-directory: scripts/frontend-doctor
	run: \|
	node doctor.js \
	--scenario spreadsheet-remote-cursor-delayed \
	--base-url http://127.0.0.1:3000 \
	--out ../../artifacts/doctor/spreadsheet-remote-cursor-delayed

	- name: Run mobile-spreadsheet-keyboards scenario (M-P3 piece E)
	id: mobile-spreadsheet-keyboards
	if: always() && (steps.trash-flow.outcome == 'success' \|\| steps.trash-flow.outcome == 'failure')
	working-directory: scripts/frontend-doctor
	run: \|
	node doctor.js \
	--scenario mobile-spreadsheet-keyboards \
	--base-url http://127.0.0.1:3000 \
	--out ../../artifacts/doctor/mobile-spreadsheet-keyboards

	- name: Run command-palette-actions scenario (M-P4 piece D)
	id: command-palette-actions
	if: always() && (steps.trash-flow.outcome == 'success' \|\| steps.trash-flow.outcome == 'failure')
	working-directory: scripts/frontend-doctor
	run: \|
	node doctor.js \
	--scenario command-palette-actions \
	--base-url http://127.0.0.1:3000 \
	--out ../../artifacts/doctor/command-palette-actions

	- name: Run embed-youtube scenario (M-P6 piece D)
	id: embed-youtube
	if: always() && (steps.trash-flow.outcome == 'success' \|\| steps.trash-flow.outcome == 'failure')
	working-directory: scripts/frontend-doctor
	run: \|
	node doctor.js \
	--scenario embed-youtube \
	--base-url http://127.0.0.1:3000 \
	--out ../../artifacts/doctor/embed-youtube

	- name: Run bulk-delete scenario (M-P7 piece D)
	id: bulk-delete
	if: always() && (steps.trash-flow.outcome == 'success' \|\| steps.trash-flow.outcome == 'failure')
	working-directory: scripts/frontend-doctor
	run: \|
	node doctor.js \
	--scenario bulk-delete \
	--base-url http://127.0.0.1:3000 \
	--out ../../artifacts/doctor/bulk-delete

	# M-P8 piece D: axe-core conformance gate. Walks home, editor,
	# and command-palette-open surfaces with the WCAG 2.1 A + AA
	# rule set. Threshold is zero serious + zero critical
	# violations per surface; minor/moderate findings land in the
	# uploaded axe-results.json artifact but don't fail the gate
	# (the team takes those as a follow-up backlog).
	- name: Run a11y-audit scenario (M-P8 piece D)
	id: a11y-audit
	if: always() && (steps.trash-flow.outcome == 'success' \|\| steps.trash-flow.outcome == 'failure')
	working-directory: scripts/frontend-doctor
	run: \|
	node doctor.js \
	--scenario a11y-audit \
	--base-url http://127.0.0.1:3000 \
	--out ../../artifacts/doctor/a11y-audit

	# Settings → Appearance layout guard: the theme buttons must render
	# inside the panel card (regression for the .settings-page
	# fit-content collapse — see scenarioSettingsAppearance in doctor.js).
	- name: Run settings-appearance scenario
	id: settings-appearance
	if: always() && (steps.trash-flow.outcome == 'success' \|\| steps.trash-flow.outcome == 'failure')
	working-directory: scripts/frontend-doctor
	run: \|
	node doctor.js \
	--scenario settings-appearance \
	--base-url http://127.0.0.1:3000 \
	--out ../../artifacts/doctor/settings-appearance

	# M-6.2 piece E: end-to-end agentic Ask flow. Real Claude API
	# call (paid). Gated on ANTHROPIC_API_KEY being set so PRs
	# from forks (which can't access repo secrets) don't fail —
	# the env var resolves to empty for fork builds, the `if`
	# below skips, and the scenario doesn't run at all.
	- name: Run ask-flow scenario (M-6.2 piece E)
	id: ask-flow
	if: always() && env.ANTHROPIC_API_KEY != '' && (steps.trash-flow.outcome == 'success' \|\| steps.trash-flow.outcome == 'failure')
	working-directory: scripts/frontend-doctor
	run: \|
	node doctor.js \
	--scenario ask-flow \
	--base-url http://127.0.0.1:3000 \
	--out ../../artifacts/doctor/ask-flow

	# Persist-on-refresh regression guard for the d92dac4 / 108d4fc
	# fix arc — see scenarioSustainedTypeReload in doctor.js for the
	# rationale.
	- name: Run sustained-type-reload scenario
	id: sustained-type-reload
	if: always() && (steps.trash-flow.outcome == 'success' \|\| steps.trash-flow.outcome == 'failure')
	working-directory: scripts/frontend-doctor
	run: \|
	node doctor.js \
	--scenario sustained-type-reload \
	--base-url http://127.0.0.1:3000 \
	--out ../../artifacts/doctor/sustained-type-reload

	# #92: typing-during-handshake guard (deterministic — holds the
	# first SyncStep2 via routeWebSocket). Written for the 07147fa fix
	# arc but never wired into CI; the is_synced() gate on the
	# debounced sender silently regressed it. See
	# scenarioPreSyncEditPreserved in doctor.js.
	- name: Run pre-sync-edit-preserved scenario (#92)
	id: pre-sync-edit-preserved
	if: always() && (steps.trash-flow.outcome == 'success' \|\| steps.trash-flow.outcome == 'failure')
	working-directory: scripts/frontend-doctor
	run: \|
	node doctor.js \
	--scenario pre-sync-edit-preserved \
	--base-url http://127.0.0.1:3000 \
	--out ../../artifacts/doctor/pre-sync-edit-preserved

	# #92: natural-timing mount race — types the instant
	# [data-editor-ready] lands and asserts the EXACT text (drops and
	# reorders both fail), live and after reload, across several
	# fresh docs. See scenarioFirstKeystrokes in doctor.js.
	- name: Run first-keystrokes scenario (#92)
	id: first-keystrokes
	if: always() && (steps.trash-flow.outcome == 'success' \|\| steps.trash-flow.outcome == 'failure')
	working-directory: scripts/frontend-doctor
	run: \|
	node doctor.js \
	--scenario first-keystrokes \
	--base-url http://127.0.0.1:3000 \
	--out ../../artifacts/doctor/first-keystrokes

	# Firefox-only: the #90 history-pane close panic is Gecko-specific
	# (clean in Chromium). Guards against regression of the deferred
	# modal-close teardown in history_viewer.rs.
	- name: Run history-pane scenario (Firefox, #90)
	id: history-pane
	if: always() && (steps.trash-flow.outcome == 'success' \|\| steps.trash-flow.outcome == 'failure')
	working-directory: scripts/frontend-doctor
	env:
	DOCTOR_BROWSER: firefox
	run: \|
	node doctor.js \
	--scenario history-pane \
	--base-url http://127.0.0.1:3000 \
	--out ../../artifacts/doctor/history-pane

	# Firefox-only: the delete-from-menu confirm-dialog close panic is
	# the same Gecko-specific class as #90. Guards the deferred
	# ConfirmDialog close path.
	- name: Run delete-document scenario (Firefox)
	id: delete-document
	if: always() && (steps.trash-flow.outcome == 'success' \|\| steps.trash-flow.outcome == 'failure')
	working-directory: scripts/frontend-doctor
	env:
	DOCTOR_BROWSER: firefox
	run: \|
	node doctor.js \
	--scenario delete-document \
	--base-url http://127.0.0.1:3000 \
	--out ../../artifacts/doctor/delete-document

	# Firefox-only: ConfirmDialog/dialog close panic class. The share
	# dialog guards the same `a11y::defer_close` click-close path the
	# CommentPopup uses, so it covers the comment-popup fix too. The
	# dedicated comment-popup scenario (driven via the spreadsheet
	# cell-comment submenu + create_thread round-trip) is flaky on the CI
	# runner — kept in doctor.js for manual runs, not gated here.
	- name: Run share-dialog scenario (Firefox)
	id: share-dialog
	if: always() && (steps.trash-flow.outcome == 'success' \|\| steps.trash-flow.outcome == 'failure')
	working-directory: scripts/frontend-doctor
	env:
	DOCTOR_BROWSER: firefox
	run: \|
	node doctor.js \
	--scenario share-dialog \
	--base-url http://127.0.0.1:3000 \
	--out ../../artifacts/doctor/share-dialog

	# Block deep links (#b= fragments): copy-link menu action, scroll +
	# flash on a valid fragment, missing-block toast (shown + auto-
	# dismissed), and foreign/malformed-hash inertness. Promoted from
	# the ad-hoc probe-block-links.mjs.
	- name: Run block-links scenario
	id: block-links
	if: always() && (steps.trash-flow.outcome == 'success' \|\| steps.trash-flow.outcome == 'failure')
	working-directory: scripts/frontend-doctor
	run: \|
	node doctor.js \
	--scenario block-links \
	--base-url http://127.0.0.1:3000 \
	--out ../../artifacts/doctor/block-links

	# DocMention paste matrix (doc/anchor/dangling/no-access/in-sentence),
	# single-undo restoring the raw URL, chip glyphs, context-menu
	# actions, SPA click-nav, missing (trashed) state, and Convert to
	# Plain Link. Promoted from the ad-hoc probe-doc-mentions.mjs.
	- name: Run doc-mentions scenario
	id: doc-mentions
	if: always() && (steps.trash-flow.outcome == 'success' \|\| steps.trash-flow.outcome == 'failure')
	working-directory: scripts/frontend-doctor
	run: \|
	node doctor.js \
	--scenario doc-mentions \
	--base-url http://127.0.0.1:3000 \
	--out ../../artifacts/doctor/doc-mentions

	# Presentations P1 (deck editor): create deck → canvas at real size
	# (regression net for the 0×0 flex collapse) → add title-content
	# slide → in-frame typing via the embedded editor → Escape →
	# reload → text + thumb count persisted. First green run
	# 2026-08-01 against a local stack (PR #186).
	- name: Run deck-basics scenario
	id: deck-basics
	if: always() && (steps.trash-flow.outcome == 'success' \|\| steps.trash-flow.outcome == 'failure')
	working-directory: scripts/frontend-doctor
	run: \|
	node doctor.js \
	--scenario deck-basics \
	--base-url http://127.0.0.1:3000 \
	--out ../../artifacts/doctor/deck-basics

	# Frames render the full editor block set (spec:
	# docs/superpowers/specs/2026-08-01-deck-frame-blocks-design.md):
	# slash-menu mermaid insert inside a frame editor, image upload
	# via filechooser with durable blob-ref resolution on the canvas,
	# both surviving Escape and a full reload.
	- name: Run deck-blocks scenario
	id: deck-blocks
	if: always() && (steps.trash-flow.outcome == 'success' \|\| steps.trash-flow.outcome == 'failure')
	working-directory: scripts/frontend-doctor
	run: \|
	node doctor.js \
	--scenario deck-blocks \
	--base-url http://127.0.0.1:3000 \
	--out ../../artifacts/doctor/deck-blocks

	# Present mode (P2): full-screen stage at real size, keyboard
	# navigation, Escape back to the editor, presenter view panels +
	# timer, and PDF slide export over the API.
	- name: Run deck-present scenario
	id: deck-present
	if: always() && (steps.trash-flow.outcome == 'success' \|\| steps.trash-flow.outcome == 'failure')
	working-directory: scripts/frontend-doctor
	run: \|
	node doctor.js \
	--scenario deck-present \
	--base-url http://127.0.0.1:3000 \
	--out ../../artifacts/doctor/deck-present

	# ─── Previously orphaned scenarios ─────────────────────────
	# These existed in doctor.js but were never invoked by any
	# workflow. Wired 2026-09-02. Still NOT wired, because the CI
	# server can't satisfy their preconditions: admin-console
	# (ADMIN_EMAILS), mfa-flow (MFA key config), semantic-search
	# (qdrant + embeddings), import-job-round-trip (worker process),
	# collab-sync (needs a pre-created --doc-id and two-tab setup).

	# Atom caret class: typing past a block atom must not swallow or
	# duplicate the keystroke.
	- name: Run type-past-atom scenario
	id: type-past-atom
	if: always() && (steps.trash-flow.outcome == 'success' \|\| steps.trash-flow.outcome == 'failure')
	working-directory: scripts/frontend-doctor
	run: \|
	node doctor.js \
	--scenario type-past-atom \
	--base-url http://127.0.0.1:3000 \
	--out ../../artifacts/doctor/type-past-atom

	- name: Run code-block-enter scenario
	id: code-block-enter
	if: always() && (steps.trash-flow.outcome == 'success' \|\| steps.trash-flow.outcome == 'failure')
	working-directory: scripts/frontend-doctor
	run: \|
	node doctor.js \
	--scenario code-block-enter \
	--base-url http://127.0.0.1:3000 \
	--out ../../artifacts/doctor/code-block-enter

	- name: Run document table structure regression
	if: always() && (steps.trash-flow.outcome == 'success' \|\| steps.trash-flow.outcome == 'failure')
	working-directory: scripts/frontend-doctor
	run: node test-table-structure.cjs --base-url http://127.0.0.1:3000

	- name: Run merged document table structure regression
	if: always() && (steps.trash-flow.outcome == 'success' \|\| steps.trash-flow.outcome == 'failure')
	working-directory: scripts/frontend-doctor
	run: node test-merged-table-structure.cjs --base-url http://127.0.0.1:3000

	- name: Run calendar-block scenario
	id: calendar-block
	if: always() && (steps.trash-flow.outcome == 'success' \|\| steps.trash-flow.outcome == 'failure')
	working-directory: scripts/frontend-doctor
	run: \|
	node doctor.js \
	--scenario calendar-block \
	--base-url http://127.0.0.1:3000 \
	--out ../../artifacts/doctor/calendar-block

	- name: Run kanban-block scenario
	id: kanban-block
	if: always() && (steps.trash-flow.outcome == 'success' \|\| steps.trash-flow.outcome == 'failure')
	working-directory: scripts/frontend-doctor
	run: \|
	node doctor.js \
	--scenario kanban-block \
	--base-url http://127.0.0.1:3000 \
	--out ../../artifacts/doctor/kanban-block

	- name: Run kanban-drag scenario
	id: kanban-drag
	if: always() && (steps.trash-flow.outcome == 'success' \|\| steps.trash-flow.outcome == 'failure')
	working-directory: scripts/frontend-doctor
	run: \|
	node doctor.js \
	--scenario kanban-drag \
	--base-url http://127.0.0.1:3000 \
	--out ../../artifacts/doctor/kanban-drag

	- name: Run kanban-wip-limit scenario
	id: kanban-wip-limit
	if: always() && (steps.trash-flow.outcome == 'success' \|\| steps.trash-flow.outcome == 'failure')
	working-directory: scripts/frontend-doctor
	run: \|
	node doctor.js \
	--scenario kanban-wip-limit \
	--base-url http://127.0.0.1:3000 \
	--out ../../artifacts/doctor/kanban-wip-limit

	- name: Run kanban-column-reorder scenario
	id: kanban-column-reorder
	if: always() && (steps.trash-flow.outcome == 'success' \|\| steps.trash-flow.outcome == 'failure')
	working-directory: scripts/frontend-doctor
	run: \|
	node doctor.js \
	--scenario kanban-column-reorder \
	--base-url http://127.0.0.1:3000 \
	--out ../../artifacts/doctor/kanban-column-reorder

	- name: Run kanban-card-metadata scenario
	id: kanban-card-metadata
	if: always() && (steps.trash-flow.outcome == 'success' \|\| steps.trash-flow.outcome == 'failure')
	working-directory: scripts/frontend-doctor
	run: \|
	node doctor.js \
	--scenario kanban-card-metadata \
	--base-url http://127.0.0.1:3000 \
	--out ../../artifacts/doctor/kanban-card-metadata

	# Firefox-only: same modal-close panic class as history-pane,
	# exercised through the comment composer's ✕ and backdrop.
	- name: Run comment-popup scenario (Firefox)
	id: comment-popup
	if: always() && (steps.trash-flow.outcome == 'success' \|\| steps.trash-flow.outcome == 'failure')
	working-directory: scripts/frontend-doctor
	env:
	DOCTOR_BROWSER: firefox
	run: \|
	node doctor.js \
	--scenario comment-popup \
	--base-url http://127.0.0.1:3000 \
	--out ../../artifacts/doctor/comment-popup

	# Document → Export must download via authenticated fetch, not a
	# bearer-less window.open (2026-05-28 401 class).
	- name: Run menu-export-downloads scenario
	id: menu-export-downloads
	if: always() && (steps.trash-flow.outcome == 'success' \|\| steps.trash-flow.outcome == 'failure')
	working-directory: scripts/frontend-doctor
	run: \|
	node doctor.js \
	--scenario menu-export-downloads \
	--base-url http://127.0.0.1:3000 \
	--out ../../artifacts/doctor/menu-export-downloads

	- name: Run Mermaid modal collaboration and mobile regression
	if: always() && (steps.trash-flow.outcome == 'success' \|\| steps.trash-flow.outcome == 'failure')
	working-directory: scripts/frontend-doctor
	run: \|
	node test-mermaid-modal.cjs \
	--base-url http://127.0.0.1:3000 \
	--out ../../artifacts/doctor/mermaid-modal

	- name: Run Mermaid semantics and keyboard accessibility regression
	if: always() && (steps.trash-flow.outcome == 'success' \|\| steps.trash-flow.outcome == 'failure')
	working-directory: scripts/frontend-doctor
	run: node test-mermaid-semantics.cjs --base-url http://127.0.0.1:3000

	- name: Verify Mermaid rendered fixture freshness
	run: cargo test -p ogrenotes-mermaid --test golden --test theme --locked

	- name: Run Mermaid CLI PNG regression
	working-directory: scripts/frontend-doctor
	run: \|
	node test-mermaid-png.cjs --out ../../artifacts/doctor/mermaid-png

	- name: Run Mermaid ImageMagick fallback regression
	working-directory: scripts/frontend-doctor
	run: \|
	python3 configure-mermaid-imagemagick.py /tmp/mermaid-imagemagick
	export MAGICK_CONFIGURE_PATH=/tmp/mermaid-imagemagick/config
	export MERMAID_CLI_PATH=/tmp/mermaid-imagemagick/bin
	export REFERENCE_MAGICK="$(command -v convert)"
	node test-mermaid-png.cjs --out ../../artifacts/doctor/mermaid-png-imagemagick

	- name: Run Mermaid rendered contrast regression
	if: always() && (steps.trash-flow.outcome == 'success' \|\| steps.trash-flow.outcome == 'failure')
	working-directory: scripts/frontend-doctor
	run: \|
	node test-mermaid-contrast.cjs --out ../../artifacts/doctor/mermaid-contrast

	# ─── Teardown / artifacts ─────────────────────────────────
	- name: Stop axum server
	if: always()
	run: \|
	if [ -f /tmp/ci-logs/server.pid ]; then
	kill "$(cat /tmp/ci-logs/server.pid)" \|\| true
	fi

	- name: Upload doctor artifacts
	if: always()
	uses: actions/upload-artifact@v4
	with:
	name: frontend-doctor-artifacts
	path: \|
	artifacts/doctor/**
	/tmp/ci-logs/server.log
	/tmp/ci-logs/i18n-browser.log
	if-no-files-found: warn
	retention-days: 14

	- name: Compose logs on failure
	if: failure()
	run: docker compose logs --no-color

	- name: Stop infra
	if: always()
	run: docker compose down -v

Navigation Menu

Repository navigation

Playwright (frontend-doctor scenarios) #160

Workflow file

Playwright (frontend-doctor scenarios) #160

Uh oh!

Workflow file for this run