Merge remote-tracking branch 'origin/main' into sync/main-into-workspace-team-20260805

Author: lefarcen

.github/actions/configure-ci-parallelism/action.yml

@@ -1,5 +1,5 @@
 name: Configure CI parallelism
-description: Export CI worker counts derived from nproc/2
+description: Export build worker counts derived from nproc/2 with a memory-safe Playwright cap
 
 runs:
   using: composite
@@ -14,14 +14,18 @@ runs:
         if [ "$workers" -lt 1 ]; then
           workers=1
         fi
+        playwright_workers="$workers"
+        if [ "$playwright_workers" -gt 2 ]; then
+          playwright_workers=2
+        fi
 
         {
           echo "OPEN_DESIGN_POSTINSTALL_CONCURRENCY=$workers"
           echo "OPEN_DESIGN_WORKSPACE_CONCURRENCY=$workers"
           echo "OD_CI_DAEMON_MAX_WORKERS=$workers"
           echo "OD_E2E_VITEST_MAX_WORKERS=$workers"
-          echo "OD_PLAYWRIGHT_WORKERS=$workers"
+          echo "OD_PLAYWRIGHT_WORKERS=$playwright_workers"
         } >> "$GITHUB_ENV"
 
         echo "workers=$workers" >> "$GITHUB_OUTPUT"
-        echo "nproc=$cpu_count workers=$workers"
+        echo "nproc=$cpu_count workers=$workers playwright_workers=$playwright_workers"

.github/actions/setup-playwright/action.yml

@@ -1,5 +1,5 @@
 name: Setup Playwright
-description: Restore Playwright browser cache and install browsers
+description: Use a preseeded Nexu browser when available, otherwise restore the browser cache and install browsers
 
 inputs:
   package-json-path:
@@ -16,8 +16,40 @@ inputs:
 runs:
   using: composite
   steps:
+    - name: Detect preinstalled Playwright
+      id: preinstalled-playwright
+      shell: bash
+      env:
+        RUNNER_LABELS_JSON: ${{ inputs.runner-labels }}
+      run: |
+        preinstalled_enabled=false
+
+        # The ARC tools image carries both the OS dependencies and Chromium.
+        # Keep this opt-in to the named Nexu profiles so a hosted runner with
+        # a restored browser cache still receives its OS dependencies.
+        case "$RUNNER_LABELS_JSON" in
+          *'"nexu-runners-'*)
+            if [ -n "${PLAYWRIGHT_BROWSERS_PATH:-}" ] && [ -d "$PLAYWRIGHT_BROWSERS_PATH" ]; then
+              chromium_bin="$(find "$PLAYWRIGHT_BROWSERS_PATH" -type f \
+                \( -name chrome -o -name chromium -o -name chrome-headless-shell \) \
+                -perm -111 -print -quit 2>/dev/null || true)"
+              if [ -n "$chromium_bin" ]; then
+                preinstalled_enabled=true
+              fi
+            fi
+            ;;
+        esac
+
+        echo "enabled=$preinstalled_enabled" >> "$GITHUB_OUTPUT"
+        if [ "$preinstalled_enabled" = "true" ]; then
+          echo "Using the Playwright browser preseeded in the Nexu runner image."
+        else
+          echo "No preseeded Playwright browser detected; using the workflow install path."
+        fi
+
     - name: Detect persistent Playwright cache
       id: persistent-playwright-cache
+      if: ${{ steps.preinstalled-playwright.outputs.enabled != 'true' }}
       shell: bash
       env:
         RUNNER_LABELS_JSON: ${{ inputs.runner-labels }}
@@ -41,6 +73,7 @@ runs:
 
     - name: Resolve Playwright version
       id: playwright-version
+      if: ${{ steps.preinstalled-playwright.outputs.enabled != 'true' }}
       shell: bash
       run: |
         version=$(node -p "const pkg = require('./${{ inputs.package-json-path }}'); const deps = { ...(pkg.dependencies || {}), ...(pkg.devDependencies || {}) }; (deps['@playwright/test'] || deps.playwright || '').replace(/[^0-9.]/g,'')")
@@ -51,12 +84,22 @@ runs:
         echo "version=$version" >> "$GITHUB_OUTPUT"
 
     - name: Cache Playwright browser binaries
-      if: ${{ steps.persistent-playwright-cache.outputs.enabled != 'true' }}
+      if: ${{ steps.preinstalled-playwright.outputs.enabled != 'true' && steps.persistent-playwright-cache.outputs.enabled != 'true' }}
       uses: actions/cache@v5.0.5
       with:
         path: ~/.cache/ms-playwright
         key: playwright-${{ runner.os }}-${{ steps.playwright-version.outputs.version }}
 
+    - name: Ensure preinstalled Playwright browser revision
+      if: ${{ steps.preinstalled-playwright.outputs.enabled == 'true' }}
+      shell: bash
+      env:
+        PACKAGE_JSON_PATH: ${{ inputs.package-json-path }}
+      run: |
+        package_dir="${PACKAGE_JSON_PATH%/*}"
+        pnpm -C "$package_dir" exec playwright install chromium
+
     - name: Install Playwright browsers
+      if: ${{ steps.preinstalled-playwright.outputs.enabled != 'true' }}
       shell: bash
       run: ${{ inputs.install-command }}

.github/scripts/runners.py

@@ -7,35 +7,36 @@
 
 GITHUB_HOSTED = ["ubuntu-24.04"]
 WINDOWS_HOSTED = ["windows-latest"]
-CONTABO_CONTROL = ["self-hosted", "Linux", "X64", "od-persistent-ci", "od-ci-hot-poc"]
-BLACKSMITH_4V = ["blacksmith-4vcpu-ubuntu-2404"]
+NEXU_SMALL = ["nexu-runners-small"]
+NEXU_MEDIUM = ["nexu-runners-medium"]
+NEXU_LARGE = ["nexu-runners-large"]
 
 
 def compact_json(value):
     return json.dumps(value, separators=(",", ":"))
 
 
 def normalize_mode(raw_mode):
-    mode = (raw_mode or "default").strip().lower()
+    mode = raw_mode or "default"
     if mode in {"default", "performance", "economic"}:
         return mode
     return "default"
 
 
 def resolve_contract(mode):
-    general_medium = BLACKSMITH_4V if mode == "performance" else GITHUB_HOSTED
-    hot_path = GITHUB_HOSTED if mode == "economic" else BLACKSMITH_4V
-    control = CONTABO_CONTROL if mode == "default" else GITHUB_HOSTED
+    control = GITHUB_HOSTED if mode == "economic" else NEXU_SMALL
+    workload = GITHUB_HOSTED if mode == "economic" else NEXU_MEDIUM
+    browser_workload = GITHUB_HOSTED if mode == "economic" else NEXU_LARGE
 
     return {
         "runs_on": {
             "control": control,
-            "general_medium": general_medium,
-            "workspace_unit": GITHUB_HOSTED,
+            "general_medium": workload,
+            "workspace_unit": workload,
             "windows_tools": WINDOWS_HOSTED,
-            "js_hot": hot_path,
-            "ui_hot": hot_path,
-            "visual_hot": hot_path,
+            "js_hot": workload,
+            "ui_hot": browser_workload,
+            "visual_hot": browser_workload,
         },
         "decision": {
             "schema_version": 1,

.github/workflows/ci.yml

@@ -31,7 +31,14 @@ concurrency:
 jobs:
   runners:
     name: Resolve runner profiles
-    runs-on: ubuntu-24.04
+    # Resolve on the Nexu ARC fleet for trusted branches, but preserve the
+    # hosted bootstrap path for external forks and explicit economic mode.
+    runs-on: >-
+      ${{ ((github.event_name == 'pull_request'
+        && github.event.pull_request.head.repo.full_name != github.repository)
+        || vars.OD_CI_RUNNER_MODE == 'economic')
+        && 'ubuntu-24.04'
+        || 'nexu-runners-small' }}
     outputs:
       runs_on: ${{ steps.runners.outputs.runs_on }}
       decision: ${{ steps.runners.outputs.decision }}

apps/desktop/tests/main/updater.test.ts

@@ -32,7 +32,6 @@ import {
 import { installerObservationSummaryPath } from "../../src/main/installer-observations.js";
 
 type FixtureServer = {
-  artifactRanges: () => string[];
   artifactRequests: () => number;
   close: () => Promise<void>;
   metadataRequests: () => number;
@@ -117,7 +116,6 @@ async function createUpdaterFixture(options: {
   const payloadPath = platform === "win" ? "/payload.7z" : "/payload.zip";
   const payloadBody = Buffer.from(options.payloadBody ?? "open design updater payload fixture");
   const payloadDigest = createHash("sha256").update(payloadBody).digest("hex");
-  const artifactRanges: string[] = [];
   let artifactRequests = 0;
   let metadataRequests = 0;
   const server = createServer((request, response) => {
@@ -173,7 +171,6 @@ async function createUpdaterFixture(options: {
       artifactRequests += 1;
       const failArtifactAttempts = options.failArtifactAttempts ?? (options.failFirstArtifactWithTerminated === true ? 1 : 0);
       const range = typeof request.headers.range === "string" ? request.headers.range : undefined;
-      if (range != null) artifactRanges.push(range);
       const match = range == null ? null : /^bytes=(\d+)-$/.exec(range);
       const start = match?.[1] == null ? 0 : Number(match[1]);
       const ranged = range != null && Number.isInteger(start) && start >= 0 && start < artifactBody.byteLength;
@@ -217,7 +214,6 @@ async function createUpdaterFixture(options: {
   });
   const address = serverAddress(server);
   return {
-    artifactRanges: () => artifactRanges,
     artifactRequests: () => artifactRequests,
     close: async () => {
       await new Promise<void>((resolveClose, rejectClose) => {
@@ -2472,7 +2468,7 @@ describe("desktop updater", () => {
     }
   });
 
-  it("resumes an interrupted artifact download before surfacing an error", async () => {
+  it("recovers from an interrupted artifact download without surfacing an error", async () => {
     const root = makeRoot();
     const fixture = await createUpdaterFixture({
       artifactBody: "open design updater fixture with retry",
@@ -2496,7 +2492,9 @@ describe("desktop updater", () => {
       expect(checked.state).toBe(DESKTOP_UPDATE_STATES.DOWNLOADED);
       expect(checked.error).toBeUndefined();
       expect(fixture.artifactRequests()).toBe(2);
-      expect(fixture.artifactRanges()).toEqual([expect.stringMatching(/^bytes=\d+-$/)]);
+      // Byte-range resumption is covered by @open-design/download. At this
+      // integration boundary, a full retry is also valid when the interrupted
+      // response did not persist any partial bytes before the stream failed.
       expect(logger.warn).not.toHaveBeenCalled();
     } finally {
       await fixture.close();

apps/web/tests/components/App.connectors.test.tsx

@@ -237,6 +237,14 @@ const baseConfig: AppConfig = {
   agentCliEnv: {},
 };
 
+async function clickCurrentPrivacyChoice(name: string) {
+  // App bootstrap can rerender the banner while the async findByRole call is
+  // resolving. Re-query synchronously before dispatching the event so the
+  // click lands on the currently mounted button.
+  await screen.findByRole('button', { name });
+  fireEvent.click(screen.getByRole('button', { name }));
+}
+
 describe('App connectors settings flows', () => {
   beforeEach(() => {
     useRouteMock.mockReturnValue(homeRouteMock);
@@ -400,7 +408,7 @@ describe('App connectors settings flows', () => {
       expect(mockedSyncConfigToDaemon).toHaveBeenCalled();
     });
     mockedSyncConfigToDaemon.mockClear();
-    fireEvent.click(await screen.findByRole('button', { name: 'Share' }));
+    await clickCurrentPrivacyChoice('Share');
 
     await waitFor(() => {
       expect(mockedSyncConfigToDaemon).toHaveBeenCalledWith(
@@ -428,7 +436,7 @@ describe('App connectors settings flows', () => {
       expect(mockedSyncConfigToDaemon).toHaveBeenCalled();
     });
     mockedSyncConfigToDaemon.mockClear();
-    fireEvent.click(await screen.findByRole('button', { name: 'Share' }));
+    await clickCurrentPrivacyChoice('Share');
 
     await waitFor(() => {
       expect(mockedSyncConfigToDaemon).toHaveBeenCalledWith(
@@ -456,7 +464,7 @@ describe('App connectors settings flows', () => {
       expect(mockedSyncConfigToDaemon).toHaveBeenCalled();
     });
     mockedSyncConfigToDaemon.mockClear();
-    fireEvent.click(await screen.findByRole('button', { name: 'Share' }));
+    await clickCurrentPrivacyChoice('Share');
 
     await waitFor(() => {
       expect(mockedSyncConfigToDaemon).toHaveBeenCalledWith(
@@ -477,7 +485,7 @@ describe('App connectors settings flows', () => {
       expect(mockedSyncConfigToDaemon).toHaveBeenCalled();
     });
     mockedSyncConfigToDaemon.mockClear();
-    fireEvent.click(await screen.findByRole('button', { name: "Don't share" }));
+    await clickCurrentPrivacyChoice("Don't share");
 
     await waitFor(() => {
       expect(mockedSyncConfigToDaemon).toHaveBeenCalledWith(
@@ -504,7 +512,7 @@ describe('App connectors settings flows', () => {
       expect(mockedSyncConfigToDaemon).toHaveBeenCalled();
     });
     mockedSyncConfigToDaemon.mockClear();
-    fireEvent.click(await screen.findByRole('button', { name: "Don't share" }));
+    await clickCurrentPrivacyChoice("Don't share");
 
     await waitFor(() => {
       expect(mockedSyncConfigToDaemon).toHaveBeenCalledWith(

e2e/tests/actions-cache-workflows.test.ts

@@ -3,6 +3,7 @@ import { readFile } from "node:fs/promises";
 import { describe, expect, it } from "vitest";
 
 const setupWorkspaceAction = new URL("../../.github/actions/setup-workspace/action.yml", import.meta.url);
+const setupPlaywrightAction = new URL("../../.github/actions/setup-playwright/action.yml", import.meta.url);
 const cacheMaintenanceWorkflow = new URL("../../.github/workflows/cache-maintenance.yml", import.meta.url);
 const landingPageCiWorkflow = new URL("../../.github/workflows/landing-page-ci.yml", import.meta.url);
 const visualBaselineWorkflow = new URL("../../.github/workflows/visual-baseline.yml", import.meta.url);
@@ -16,6 +17,17 @@ function sectionBetween(content: string, start: string, end: string): string {
 }
 
 describe("GitHub Actions cache workflows", () => {
+  it("[P1] uses preseeded Playwright only for a ready Nexu runner image", async () => {
+    const action = await readFile(setupPlaywrightAction, "utf8");
+
+    expect(action).toContain("*'\"nexu-runners-'*");
+    expect(action).toContain("PLAYWRIGHT_BROWSERS_PATH");
+    expect(action).toContain("steps.preinstalled-playwright.outputs.enabled == 'true'");
+    expect(action).toContain("steps.preinstalled-playwright.outputs.enabled != 'true'");
+    expect(action).toContain('pnpm -C "$package_dir" exec playwright install chromium');
+    expect(action).toContain("run: ${{ inputs.install-command }}");
+  });
+
   it("[P1] keeps pnpm cache writes on explicit trusted main seed jobs", async () => {
     const action = await readFile(setupWorkspaceAction, "utf8");