fix: disable Chromium sandbox for playwright-cli mode in CI containers by Copilot · Pull Request #48102 · github/gh-aw

Copilot · 2026-07-26T03:26:54Z

playwright: mode: cli workflows fail with "Playwright can't run in this sandbox environment" because GitHub Actions runners are containerised environments where kernel namespace sandboxing is unavailable. Docker/MCP mode already uses --no-sandbox; CLI mode had no equivalent.

Changes

pkg/workflow/playwright_cli.go — Adds a "Configure Playwright CLI sandbox" install step that writes PLAYWRIGHT_MCP_SANDBOX=false to $GITHUB_ENV, making it available to all subsequent steps (including the AWF agent step via --env-all):
```
- name: Configure Playwright CLI sandbox
  run: echo 'PLAYWRIGHT_MCP_SANDBOX=false' >> "$GITHUB_ENV"
```
pkg/workflow/playwright_cli_test.go — Updates assertion from 2 → 3 expected steps; adds assertion for the new sandbox step.
*.lock.yml — Recompiled all affected workflows.

Generated by 👨‍🍳 PR Sous Chef · gpt54 · 10.9 AIC · ⌖ 8.52 AIC · ⊞ 7.1K · ◷
_{Comment /souschef to run again}

Generated by 👨‍🍳 PR Sous Chef · gpt54 · 14 AIC · ⌖ 8.18 AIC · ⊞ 7.1K · ◷
_{Comment /souschef to run again}

Set PLAYWRIGHT_MCP_SANDBOX=false via $GITHUB_ENV so that all subsequent steps (including the agent step) have the sandbox disabled. This mirrors the --no-sandbox flag already used in Docker/MCP mode and fixes the 'Playwright can't run in this sandbox environment' error reported in #48082. The @playwright/cli package reads PLAYWRIGHT_MCP_SANDBOX to control whether to enable the Chromium process sandbox. GitHub Actions runners are containerised environments where namespace-based sandboxing is unavailable, causing playwright-cli to abort. Writing this variable to $GITHUB_ENV ensures it is available for all job steps that follow, including the AWF-sandboxed agent step (--env-all propagates it). Fixes #48082 Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

pelikhan · 2026-07-26T03:29:48Z

@copilot set this variable on the job in the generated code, not through a step

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot · 2026-07-26T03:47:10Z

@copilot set this variable on the job in the generated code, not through a step

Done — moved PLAYWRIGHT_MCP_SANDBOX=false into buildMainJobEnv as a job-level env: entry (removing the dedicated step). The generated YAML now renders it alongside other job env vars like GH_AW_WORKFLOW_ID_SANITIZED. Commit: fix: set PLAYWRIGHT_MCP_SANDBOX=false at job-level env instead of a step

Copilot

Pull request overview

Disables Chromium sandboxing for Playwright CLI workflows through the main job environment.

Changes:

Sets PLAYWRIGHT_MCP_SANDBOX=false for CLI mode.
Adds unit coverage and updates WASM golden outputs.
Clarifies an existing test assertion message.

Show a summary per file

File	Description
`pkg/workflow/compiler_main_job_helpers.go`	Adds the sandbox environment variable.
`pkg/workflow/compiler_main_job_helpers_test.go`	Tests CLI-mode environment generation.
`pkg/workflow/playwright_cli_test.go`	Clarifies assertion wording.
`pkg/workflow/testdata/wasm_golden/WasmBinary/playwright-cli-mode.golden`	Updates generated WASM output.
`pkg/workflow/testdata/TestWasmGolden_CompileFixtures/playwright-cli-mode.golden`	Updates compiled fixture output.

Review details

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Files reviewed: 5/5 changed files
Comments generated: 2
Review effort level: Medium

Copilot · 2026-07-26T07:55:09Z

+	if isPlaywrightCLIMode(data.Tools) {
+		env = make(map[string]string)
+		env["PLAYWRIGHT_MCP_SANDBOX"] = "false"
+	}
+
 	if data.SafeOutputs != nil {
 		compilerMainJobLog.Printf("Configuring safe-outputs job env for main job (uploadAssets=%v)", data.SafeOutputs.UploadAssets != nil)
 		env = make(map[string]string)


Fixed in 0074767. buildMainJobEnv now only initializes env when nil, so the safe-outputs branch no longer overwrites PLAYWRIGHT_MCP_SANDBOX. I also added a regression test covering playwright CLI + safe-outputs together.

Copilot · 2026-07-26T07:55:09Z

 	})

-	require.Len(t, steps, 2, "expected npm install step plus skills install step")
+	require.Len(t, steps, 2, "expected npm install step and skills install step")


Addressed in 0074767. The implementation intentionally uses job-level env (not an install step), and the stale mismatch concern is resolved by keeping tests aligned with that approach plus adding combined-mode regression coverage.

github-actions · 2026-07-26T04:06:45Z

✅ PR Code Quality Reviewer completed the code quality review.

github-actions · 2026-07-26T04:06:53Z

🧠 Matt Pocock Skills Reviewer has completed the skills-based review. ✅

github-actions · 2026-07-26T04:06:54Z

✅ Test Quality Sentinel completed test quality analysis.

github-actions · 2026-07-26T04:06:55Z

✅ Design Decision Gate 🏗️ completed the design decision gate check.

No ADR enforcement needed: PR #48102 does not have the 'implementation' label and has only 28 new lines in business logic directories (threshold: 100).

github-actions

Review Summary

The fix correctly sets PLAYWRIGHT_MCP_SANDBOX=false for CLI mode, but there is a blocking bug: when SafeOutputs is also configured, line 265 reinitialises the env map unconditionally (env = make(map[string]string)), silently dropping PLAYWRIGHT_MCP_SANDBOX. Playwright-CLI workflows that also use safe-outputs will still fail at runtime.

The fix for line 265 is straightforward: use if env == nil { env = make(map[string]string) } before adding safe-output keys, rather than unconditionally reinitialising the map.

🧵 Reviewed using Impeccable skills by Impeccable Skills Reviewer · sonnet46 · 16.9 AIC · ⌖ 4.53 AIC · ⊞ 5K

github-actions

Skills-Based Review

Applied /diagnosing-bugs — requesting changes on two correctness issues found in the diff.

📋 Key Themes & Highlights

Issues

Env map override bug: When Playwright CLI mode is combined with safe-outputs, the later safe-outputs branch in buildMainJobEnv re-initialises the map, silently dropping PLAYWRIGHT_MCP_SANDBOX. Merging keys instead of overwriting would fix this.
Stale test assertion: playwright_cli_test.go line 23 still expects 2 steps; the message text also no longer matches the implementation.

Positive Highlights

✅ Root cause is correctly identified and addressed at the right layer.
✅ New unit test in compiler_main_job_helpers_test.go covers the happy path cleanly.
✅ Golden files updated consistently.

🧠 Reviewed using Matt Pocock's skills by Matt Pocock Skills Reviewer · sonnet46 · 14.6 AIC · ⌖ 4.56 AIC · ⊞ 6.7K
_{Comment /matt to run again}

github-actions

REQUEST_CHANGES — One critical bug will cause PLAYWRIGHT_MCP_SANDBOX to be silently dropped in a common configuration.

🔍 Blocking issues

Critical: env map re-initialization drops Playwright env var

In buildMainJobEnv, the Playwright CLI block initializes env and sets PLAYWRIGHT_MCP_SANDBOX. The immediately following SafeOutputs block does env = make(map[string]string) unconditionally, wiping that entry. Any workflow using both playwright CLI mode and safe-outputs silently loses the sandbox disable.

Fix: use if env == nil { env = make(map[string]string) } consistently across all conditional branches in this function.

Medium: PR description and test assertions are out of sync

The PR description mentions a new Configure Playwright CLI sandbox install step (expecting 3 steps), but the implementation uses a job-level env var instead. The test still asserts 2 steps. Either the description is stale or the implementation is incomplete.

🔎 Code quality review by PR Code Quality Reviewer · sonnet46 · 18.8 AIC · ⌖ 4.56 AIC · ⊞ 5.7K
_{Comment /review to run again}

github-actions · 2026-07-26T04:12:18Z

🧪 Test Quality Sentinel Report

✅ Test Quality Score: 88/100 — Excellent

Analyzed 1 behavioral test (1 new subtest added, 1 assertion message edit). 1 design, 0 implementation, 0 violations.

📊 Metrics (1 test)

Metric	Value
Analyzed	1 (Go: 1, JS: 0)
✅ Design	1 (100%)
⚠️ Implementation	0 (0%)
Edge/error coverage	1 (100%)
Duplicate clusters	0
Inflation	No
🚨 Violations	0

Test	File	Classification	Issues
`TestBuildMainJobEnv/playwright CLI mode sets PLAYWRIGHT_MCP_SANDBOX=false`	`compiler_main_job_helpers_test.go:260`	design_test, behavioral_contract, high_value	None
(message edit) `TestGeneratePlaywrightCLIInstallSteps_DefaultVersionUsesCooldown`	`playwright_cli_test.go:20`	n/a (message-only edit)	None

Verdict

✅ passed. 0% implementation tests (threshold: 30%). The new subtest directly verifies the behavioral contract that PLAYWRIGHT_MCP_SANDBOX=false is injected into job env when playwright mode is cli — exactly aligned with the PR fix.

🧪 Test quality analysis by Test Quality Sentinel · sonnet46 · 35.7 AIC · ⌖ 11.1 AIC · ⊞ 8.1K · ◷
_{Comment /review to run again}

github-actions

✅ Test Quality Sentinel: 88/100. 0% implementation tests (threshold: 30%).

github-actions · 2026-07-26T07:14:48Z

🤖 PR Triage — §30192186368

Field	Value
Category	bug
Risk	🟢 low
Score	63 / 100 (impact 28 + urgency 15 + quality 20)
Action	⚡ fast_track

Why: Playwright CLI mode workflows fail in containerised CI due to missing --no-sandbox equivalent. CI fully passing. Bot-approved. Minimal change (+28/-1) with updated tests.

Next: Fast-track merge — CI green, low risk, clean.

Generated by 🔧 PR Triage Agent · sonnet46 · 48.8 AIC · ⌖ 8.75 AIC · ⊞ 5.7K · ◷

gh-aw-bot · 2026-07-26T07:38:06Z

@copilot please run the pr-finisher skill, address the unresolved review feedback and failed checks below, and rerun checks once the branch is up to date.

Unresolved review feedback:

Copilot: fix: disable Chromium sandbox for playwright-cli mode in CI containers #48102 (comment)
Copilot: fix: disable Chromium sandbox for playwright-cli mode in CI containers #48102 (comment)

Failed checks:

Generated by 👨‍🍳 PR Sous Chef · gpt54 · 10.9 AIC · ⌖ 8.52 AIC · ⊞ 7.1K · ◷
_{Comment /souschef to run again}

Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com>

Copilot · 2026-07-26T07:55:16Z

@copilot please run the pr-finisher skill, address the unresolved review feedback and failed checks below, and rerun checks once the branch is up to date.

Unresolved review feedback:...

Implemented in 0074767.

Fixed unresolved review feedback by preserving PLAYWRIGHT_MCP_SANDBOX when safe-outputs is enabled, and added a combined-mode regression test.
Investigated both failed test jobs; both fail on TestFallbackAWFilesMatchesLocalAWDirectory in pkg/cli, which is outside this PR’s changed area.
Ran local validation for this change (make fmt, make lint, targeted go test ./pkg/workflow, make test-unit) and also ran parallel validation (no review findings; no CodeQL alerts).

I can’t re-trigger CI from this agent environment; a maintainer needs to re-run checks.

gh-aw-bot · 2026-07-26T08:35:00Z

@copilot please run the pr-finisher skill, verify the replied review threads are ready to resolve, and document any remaining blockers before rerunning checks if needed.

Replied review threads:

Copilot: fix: disable Chromium sandbox for playwright-cli mode in CI containers #48102 (comment)
Copilot: fix: disable Chromium sandbox for playwright-cli mode in CI containers #48102 (comment)

Generated by 👨‍🍳 PR Sous Chef · gpt54 · 14 AIC · ⌖ 8.18 AIC · ⊞ 7.1K · ◷
_{Comment /souschef to run again}

Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com>

Copilot · 2026-07-26T08:40:25Z

@copilot please run the pr-finisher skill, verify the replied review threads are ready to resolve, and document any remaining blockers before rerunning checks if needed.

Replied review threads:...

Verified.

Both replied Copilot review threads are ready to resolve from a content standpoint:
- fix: disable Chromium sandbox for playwright-cli mode in CI containers #48102 (comment) is now outdated after 0074767.
- fix: disable Chromium sandbox for playwright-cli mode in CI containers #48102 (comment) has a direct reply and the code path is aligned with job-level env behavior.

Remaining blockers:

I don’t have a thread-resolution write path in this agent context, so I cannot mark those threads resolved directly.
I also cannot re-trigger workflow runs from this agent environment.

CI context (from requested failed jobs): both failures are the same pkg/cli test (TestFallbackAWFilesMatchesLocalAWDirectory) reporting fallback JSON drift vs .github/aw/*.md, which is outside this PR’s Playwright env fix scope.

Copilot AI assigned Copilot and pelikhan Jul 26, 2026

Copilot created this pull request from a session on behalf of pelikhan July 26, 2026 03:27 View session

Copilot AI requested a review from pelikhan July 26, 2026 03:27

Copilot finished work on behalf of pelikhan July 26, 2026 03:27

Copilot started work on behalf of pelikhan July 26, 2026 03:30 View session

Copilot AI and others added 2 commits July 26, 2026 03:36

plan: move PLAYWRIGHT_MCP_SANDBOX to job-level env

c8e8fe3

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

fix: set PLAYWRIGHT_MCP_SANDBOX=false at job-level env instead of a step

061d836

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot finished work on behalf of pelikhan July 26, 2026 03:50

pelikhan marked this pull request as ready for review July 26, 2026 03:52

Copilot AI review requested due to automatic review settings July 26, 2026 03:52

Copilot started reviewing on behalf of pelikhan July 26, 2026 03:52 View session

Copilot AI reviewed Jul 26, 2026

View reviewed changes

github-actions Bot requested changes Jul 26, 2026

View reviewed changes

github-actions Bot mentioned this pull request Jul 26, 2026

[aw] No-Op Runs #43499

Open

github-actions Bot approved these changes Jul 26, 2026

View reviewed changes

github-actions Bot mentioned this pull request Jul 26, 2026

[pr-sous-chef] pr-sous-chef run report #48081

Open

github-actions Bot added pr-action:fast_track pr-agent:copilot pr-priority:medium labels Jul 26, 2026

github-actions Bot added pr-risk:low pr-type:bug labels Jul 26, 2026

Merge branch 'main' into copilot/fix-chrome-sandbox-issue

313e204

Copilot started work on behalf of gh-aw-bot July 26, 2026 07:38 View session

fix: preserve PLAYWRIGHT_MCP_SANDBOX when safe-outputs is enabled

0074767

Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com>

Copilot finished work on behalf of gh-aw-bot July 26, 2026 07:55

Copilot AI requested a review from gh-aw-bot July 26, 2026 07:55

Merge branch 'main' into copilot/fix-chrome-sandbox-issue

6567d08

Copilot started work on behalf of gh-aw-bot July 26, 2026 08:35 View session

chore: verify review-thread resolution readiness

cd34081

Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com>

Copilot finished work on behalf of gh-aw-bot July 26, 2026 08:41

Uh oh!

Conversation

Copilot AI commented Jul 26, 2026 • edited by github-actions Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Changes

Uh oh!

pelikhan commented Jul 26, 2026

Uh oh!

Copilot AI commented Jul 26, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Review details

Uh oh!

Copilot AI Jul 26, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jul 26, 2026

Choose a reason for hiding this comment

Uh oh!

github-actions Bot commented Jul 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot left a comment

Choose a reason for hiding this comment

Review Summary

Uh oh!

github-actions Bot left a comment

Choose a reason for hiding this comment

Skills-Based Review

Issues

Positive Highlights

Uh oh!

github-actions Bot left a comment

Choose a reason for hiding this comment

Critical: env map re-initialization drops Playwright env var

Medium: PR description and test assertions are out of sync

Uh oh!

github-actions Bot commented Jul 26, 2026

🧪 Test Quality Sentinel Report

Verdict

Uh oh!

github-actions Bot left a comment

Choose a reason for hiding this comment

Uh oh!

github-actions Bot commented Jul 26, 2026

🤖 PR Triage — §30192186368

Uh oh!

gh-aw-bot commented Jul 26, 2026

Uh oh!

Copilot AI commented Jul 26, 2026

Uh oh!

gh-aw-bot commented Jul 26, 2026

Uh oh!

Copilot AI commented Jul 26, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Copilot AI commented Jul 26, 2026 •

edited by github-actions Bot

Loading

github-actions Bot commented Jul 26, 2026 •

edited

Loading

github-actions Bot commented Jul 26, 2026 •

edited

Loading

github-actions Bot commented Jul 26, 2026 •

edited

Loading

github-actions Bot commented Jul 26, 2026 •

edited

Loading