From a483fe2aa7c211e94a7409046f1db716245ede0e Mon Sep 17 00:00:00 2001 From: e2e-fix-agent <> Date: Fri, 19 Jun 2026 09:31:09 +0000 Subject: [PATCH 01/10] feat(image): add gcloud CLI and pwtrace to code agent image MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The e2e-fix agent needs these tools for nightly failure analysis: - gcloud CLI (pinned v526.0.0): downloads test artifacts from GCS buckets where Prow stores nightly/PR E2E results. Only the base SDK is installed (no extra components). Auth is runtime-only — no credentials baked into the image. - pwtrace (pinned v0.3.0): Playwright trace analysis CLI that lets agents inspect browser actions, DOM state, console errors, and network requests from failed test traces. Both are version-pinned for reproducible builds and installed under USER root before dropping back to sandbox. Co-Authored-By: Claude Opus 4.6 --- images/code/Containerfile | 39 +++++++++++++++++++++++++++++++++++++++ 1 file changed, 39 insertions(+) diff --git a/images/code/Containerfile b/images/code/Containerfile index 891c8a5..097516a 100644 --- a/images/code/Containerfile +++ b/images/code/Containerfile @@ -4,6 +4,8 @@ # rhdh-plugins monorepo: # - corepack enabled with yarn pre-activated (avoids 10-15 min # bootstrap inside read-only /usr sandbox) +# - gcloud CLI for downloading E2E test artifacts from GCS +# - pwtrace for Playwright trace analysis during E2E failure debugging # - Node.js is already in the base image (installed by Claude Code) # # Yarn is available on PATH immediately — no runtime corepack setup needed. @@ -43,6 +45,43 @@ RUN mkdir -p "$COREPACK_HOME" \ && yarn --version \ && chmod -R 777 "$COREPACK_HOME" +# --------------------------------------------------------------------------- +# gcloud CLI — downloads E2E test artifacts from GCS buckets. +# Prow stores nightly/PR test results in gs://test-platform-results. +# The e2e-failure-analysis skill's download-artifacts.py calls +# `gcloud storage rsync` and `gcloud storage cp` to fetch them. +# +# Install only the base SDK (no extra components) to keep the image lean. +# Authentication is handled at runtime via service-account keys or +# workload identity — no credentials are baked into the image. +# +# Pin to a specific version for reproducible builds. +ARG GCLOUD_VERSION=526.0.0 +RUN apt-get update \ + && apt-get install -y --no-install-recommends \ + curl \ + python3 \ + && curl -sSL "https://dl.google.com/dl/cloudsdk/channels/rapid/downloads/google-cloud-cli-${GCLOUD_VERSION}-linux-$(uname -m | sed 's/aarch64/arm/;s/x86_64/x86_64/').tar.gz" \ + | tar -xz -C /opt \ + && /opt/google-cloud-sdk/install.sh \ + --quiet \ + --usage-reporting false \ + --command-completion false \ + --path-update false \ + && ln -s /opt/google-cloud-sdk/bin/gcloud /usr/local/bin/gcloud \ + && ln -s /opt/google-cloud-sdk/bin/gsutil /usr/local/bin/gsutil \ + && gcloud --version \ + && apt-get clean \ + && rm -rf /var/lib/apt/lists/* + +# --------------------------------------------------------------------------- +# pwtrace — Playwright trace analysis CLI for E2E failure debugging. +# Agents use this to inspect browser actions, DOM state, console errors, +# network requests, and screenshots from failed Playwright test traces. +# Pinned for reproducible builds; bump manually when a new release is needed. +RUN npm install -g pwtrace@0.3.0 \ + && pwtrace --version + # --------------------------------------------------------------------------- # openspec CLI — spec-driven development tooling. # Used by agents working on repos with openspec/ directories. From 003ed329d9f4d5169a5dfd07bbdeca826721b218 Mon Sep 17 00:00:00 2001 From: e2e-fix-agent <> Date: Fri, 19 Jun 2026 09:34:10 +0000 Subject: [PATCH 02/10] refactor: simplify gcloud install, drop redundant apt deps curl and python3 are already in the base image. Use dpkg --print-architecture instead of uname+sed for the download URL. Co-Authored-By: Claude Opus 4.6 --- images/code/Containerfile | 40 ++++++++++++++++----------------------- 1 file changed, 16 insertions(+), 24 deletions(-) diff --git a/images/code/Containerfile b/images/code/Containerfile index 097516a..56d54d4 100644 --- a/images/code/Containerfile +++ b/images/code/Containerfile @@ -47,32 +47,24 @@ RUN mkdir -p "$COREPACK_HOME" \ # --------------------------------------------------------------------------- # gcloud CLI — downloads E2E test artifacts from GCS buckets. -# Prow stores nightly/PR test results in gs://test-platform-results. -# The e2e-failure-analysis skill's download-artifacts.py calls -# `gcloud storage rsync` and `gcloud storage cp` to fetch them. -# -# Install only the base SDK (no extra components) to keep the image lean. -# Authentication is handled at runtime via service-account keys or -# workload identity — no credentials are baked into the image. -# -# Pin to a specific version for reproducible builds. +# Prow stores results in gs://test-platform-results; the e2e-failure-analysis +# skill uses `gcloud storage rsync/cp` to fetch them. +# Auth is runtime-only (service-account key or workload identity). +# For public buckets, agents must run: +# gcloud config set auth/disable_credentials true +# before issuing gcloud storage commands. ARG GCLOUD_VERSION=526.0.0 -RUN apt-get update \ - && apt-get install -y --no-install-recommends \ - curl \ - python3 \ - && curl -sSL "https://dl.google.com/dl/cloudsdk/channels/rapid/downloads/google-cloud-cli-${GCLOUD_VERSION}-linux-$(uname -m | sed 's/aarch64/arm/;s/x86_64/x86_64/').tar.gz" \ - | tar -xz -C /opt \ - && /opt/google-cloud-sdk/install.sh \ - --quiet \ - --usage-reporting false \ - --command-completion false \ - --path-update false \ - && ln -s /opt/google-cloud-sdk/bin/gcloud /usr/local/bin/gcloud \ - && ln -s /opt/google-cloud-sdk/bin/gsutil /usr/local/bin/gsutil \ +# grpcio is installed into the active sandbox venv so that `gcloud storage` +# can load its gRPC transport layer (missing grpc causes an import error). +RUN curl -fsSL https://packages.cloud.google.com/apt/doc/apt-key.gpg \ + | gpg --dearmor -o /usr/share/keyrings/cloud.google.gpg \ + && echo "deb [signed-by=/usr/share/keyrings/cloud.google.gpg] https://packages.cloud.google.com/apt cloud-sdk main" \ + > /etc/apt/sources.list.d/google-cloud-sdk.list \ + && apt-get update -qq \ + && apt-get install -y --no-install-recommends google-cloud-cli=${GCLOUD_VERSION}-0 \ + && rm -rf /var/lib/apt/lists/* \ && gcloud --version \ - && apt-get clean \ - && rm -rf /var/lib/apt/lists/* + && pip3 install --quiet grpcio==1.81.1 # --------------------------------------------------------------------------- # pwtrace — Playwright trace analysis CLI for E2E failure debugging. From 572f30ea3c311c400f70a8e9073ade47e5e1a031 Mon Sep 17 00:00:00 2001 From: Subhash Khileri Date: Mon, 22 Jun 2026 15:23:32 +0530 Subject: [PATCH 03/10] remove gcloud --- images/code/Containerfile | 22 ---------------------- 1 file changed, 22 deletions(-) diff --git a/images/code/Containerfile b/images/code/Containerfile index 56d54d4..9706c28 100644 --- a/images/code/Containerfile +++ b/images/code/Containerfile @@ -4,7 +4,6 @@ # rhdh-plugins monorepo: # - corepack enabled with yarn pre-activated (avoids 10-15 min # bootstrap inside read-only /usr sandbox) -# - gcloud CLI for downloading E2E test artifacts from GCS # - pwtrace for Playwright trace analysis during E2E failure debugging # - Node.js is already in the base image (installed by Claude Code) # @@ -45,27 +44,6 @@ RUN mkdir -p "$COREPACK_HOME" \ && yarn --version \ && chmod -R 777 "$COREPACK_HOME" -# --------------------------------------------------------------------------- -# gcloud CLI — downloads E2E test artifacts from GCS buckets. -# Prow stores results in gs://test-platform-results; the e2e-failure-analysis -# skill uses `gcloud storage rsync/cp` to fetch them. -# Auth is runtime-only (service-account key or workload identity). -# For public buckets, agents must run: -# gcloud config set auth/disable_credentials true -# before issuing gcloud storage commands. -ARG GCLOUD_VERSION=526.0.0 -# grpcio is installed into the active sandbox venv so that `gcloud storage` -# can load its gRPC transport layer (missing grpc causes an import error). -RUN curl -fsSL https://packages.cloud.google.com/apt/doc/apt-key.gpg \ - | gpg --dearmor -o /usr/share/keyrings/cloud.google.gpg \ - && echo "deb [signed-by=/usr/share/keyrings/cloud.google.gpg] https://packages.cloud.google.com/apt cloud-sdk main" \ - > /etc/apt/sources.list.d/google-cloud-sdk.list \ - && apt-get update -qq \ - && apt-get install -y --no-install-recommends google-cloud-cli=${GCLOUD_VERSION}-0 \ - && rm -rf /var/lib/apt/lists/* \ - && gcloud --version \ - && pip3 install --quiet grpcio==1.81.1 - # --------------------------------------------------------------------------- # pwtrace — Playwright trace analysis CLI for E2E failure debugging. # Agents use this to inspect browser actions, DOM state, console errors, From eb476fb686e3fac7701bc39f54f323d69e50c02f Mon Sep 17 00:00:00 2001 From: Subhash Khileri Date: Mon, 13 Jul 2026 23:45:57 +0530 Subject: [PATCH 04/10] feat(image): replace pwtrace with Playwright CLI + Chromium MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Replace the pwtrace npm package with the official Playwright CLI (1.59.1) and baked-in Chromium browser. pwtrace was a thin wrapper; the official `npx playwright trace` (added in Playwright 1.59) is the upstream equivalent with full feature parity. Most trace subcommands (actions, requests, console, errors) are pure Node.js JSON parsing and don't need a browser. But `trace snapshot` and `trace screenshot` launch headless Chromium to render frozen DOM snapshots, run accessibility tree queries, and capture screenshots — so the browser binary must be pre-installed. - PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD=1 prevents npm install auto-download - `npx playwright install chromium --with-deps` installs browser + apt deps - PLAYWRIGHT_BROWSERS_PATH=/opt/playwright-browsers for sandbox user access - Pinned to 1.59.1 matching the E2E test suite version Assisted-by: Claude Code Co-Authored-By: Claude Code --- images/code/Containerfile | 27 ++++++++++++++++++++------- 1 file changed, 20 insertions(+), 7 deletions(-) diff --git a/images/code/Containerfile b/images/code/Containerfile index 9706c28..d56bb2e 100644 --- a/images/code/Containerfile +++ b/images/code/Containerfile @@ -4,7 +4,7 @@ # rhdh-plugins monorepo: # - corepack enabled with yarn pre-activated (avoids 10-15 min # bootstrap inside read-only /usr sandbox) -# - pwtrace for Playwright trace analysis during E2E failure debugging +# - Playwright CLI + Chromium for trace analysis during E2E failure debugging # - Node.js is already in the base image (installed by Claude Code) # # Yarn is available on PATH immediately — no runtime corepack setup needed. @@ -45,12 +45,25 @@ RUN mkdir -p "$COREPACK_HOME" \ && chmod -R 777 "$COREPACK_HOME" # --------------------------------------------------------------------------- -# pwtrace — Playwright trace analysis CLI for E2E failure debugging. -# Agents use this to inspect browser actions, DOM state, console errors, -# network requests, and screenshots from failed Playwright test traces. -# Pinned for reproducible builds; bump manually when a new release is needed. -RUN npm install -g pwtrace@0.3.0 \ - && pwtrace --version +# Playwright + Chromium — trace analysis for E2E failure debugging. +# +# Most trace CLI commands (actions, requests, console, errors) are pure +# Node.js JSON parsing. But `trace snapshot` and `trace screenshot` need +# a real headless Chromium to render the frozen DOM, run accessibility +# tree queries, and capture screenshots. +# +# PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD=1 during npm install prevents the +# automatic download — we use `npx playwright install chromium --with-deps` +# explicitly so system dependencies (libs for headless Chrome) are also +# installed via apt. +ARG PLAYWRIGHT_VERSION=1.59.1 +ENV PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD=1 \ + PLAYWRIGHT_BROWSERS_PATH=/opt/playwright-browsers +RUN npm install -g "playwright@${PLAYWRIGHT_VERSION}" \ + && mkdir -p "${PLAYWRIGHT_BROWSERS_PATH}" \ + && npx playwright install chromium --with-deps \ + && npx playwright --version \ + && chmod -R 755 "${PLAYWRIGHT_BROWSERS_PATH}" # --------------------------------------------------------------------------- # openspec CLI — spec-driven development tooling. From 8c38c84072dac5516a6cab8117aa74c4440cb409 Mon Sep 17 00:00:00 2001 From: Subhash Khileri Date: Tue, 14 Jul 2026 12:16:06 +0530 Subject: [PATCH 05/10] fix(image): bump Playwright to 1.61.1 for chromium v1228 The workspace @playwright/test peer dep resolves to 1.61.1 which needs chromium_headless_shell-1228. The previous 1.59.1 installed v1217, causing "Executable doesn't exist" when running trace snapshot. Assisted-by: Claude Code Co-Authored-By: Claude Code --- images/code/Containerfile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/images/code/Containerfile b/images/code/Containerfile index d56bb2e..c00b328 100644 --- a/images/code/Containerfile +++ b/images/code/Containerfile @@ -56,7 +56,7 @@ RUN mkdir -p "$COREPACK_HOME" \ # automatic download — we use `npx playwright install chromium --with-deps` # explicitly so system dependencies (libs for headless Chrome) are also # installed via apt. -ARG PLAYWRIGHT_VERSION=1.59.1 +ARG PLAYWRIGHT_VERSION=1.61.1 ENV PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD=1 \ PLAYWRIGHT_BROWSERS_PATH=/opt/playwright-browsers RUN npm install -g "playwright@${PLAYWRIGHT_VERSION}" \ From 8c6f4320a4ff054b2c0204e8f5eac6b9c1d94c3d Mon Sep 17 00:00:00 2001 From: Subhash Khileri Date: Tue, 14 Jul 2026 14:50:53 +0530 Subject: [PATCH 06/10] fix(image): install playwright browsers at /sandbox/ for sandbox visibility OpenShell sandbox isolation hides /opt/ from the agent. Move browsers to /sandbox/playwright-browsers/ and symlink playwright binary to /sandbox/bin/ so both are accessible inside the sandbox. Assisted-by: Claude Code Co-Authored-By: Claude Code --- images/code/Containerfile | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/images/code/Containerfile b/images/code/Containerfile index c00b328..9a02620 100644 --- a/images/code/Containerfile +++ b/images/code/Containerfile @@ -58,12 +58,15 @@ RUN mkdir -p "$COREPACK_HOME" \ # installed via apt. ARG PLAYWRIGHT_VERSION=1.61.1 ENV PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD=1 \ - PLAYWRIGHT_BROWSERS_PATH=/opt/playwright-browsers + PLAYWRIGHT_BROWSERS_PATH=/sandbox/playwright-browsers RUN npm install -g "playwright@${PLAYWRIGHT_VERSION}" \ && mkdir -p "${PLAYWRIGHT_BROWSERS_PATH}" \ && npx playwright install chromium --with-deps \ && npx playwright --version \ - && chmod -R 755 "${PLAYWRIGHT_BROWSERS_PATH}" + && chmod -R 777 "${PLAYWRIGHT_BROWSERS_PATH}" \ + && mkdir -p /sandbox/bin \ + && ln -s /usr/bin/playwright /sandbox/bin/playwright \ + && chmod 755 /sandbox/bin # --------------------------------------------------------------------------- # openspec CLI — spec-driven development tooling. From c0a017024bb5ff6118a3792e4f08181a838aa2b4 Mon Sep 17 00:00:00 2001 From: Subhash Khileri Date: Tue, 14 Jul 2026 17:01:08 +0530 Subject: [PATCH 07/10] fix(image): remove /sandbox/bin symlink, npx uses PLAYWRIGHT_BROWSERS_PATH MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The symlink to /usr/bin/playwright was broken in the sandbox because OpenShell hides /usr/. npx playwright already respects the PLAYWRIGHT_BROWSERS_PATH env var to find chromium — no global binary needed. Assisted-by: Claude Code Co-Authored-By: Claude Code --- images/code/Containerfile | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-) diff --git a/images/code/Containerfile b/images/code/Containerfile index 9a02620..f375c84 100644 --- a/images/code/Containerfile +++ b/images/code/Containerfile @@ -63,10 +63,7 @@ RUN npm install -g "playwright@${PLAYWRIGHT_VERSION}" \ && mkdir -p "${PLAYWRIGHT_BROWSERS_PATH}" \ && npx playwright install chromium --with-deps \ && npx playwright --version \ - && chmod -R 777 "${PLAYWRIGHT_BROWSERS_PATH}" \ - && mkdir -p /sandbox/bin \ - && ln -s /usr/bin/playwright /sandbox/bin/playwright \ - && chmod 755 /sandbox/bin + && chmod -R 777 "${PLAYWRIGHT_BROWSERS_PATH}" # --------------------------------------------------------------------------- # openspec CLI — spec-driven development tooling. From 1f157d9a38af5df59d6f427c786afa66d4d35c85 Mon Sep 17 00:00:00 2001 From: Subhash Khileri Date: Tue, 14 Jul 2026 17:58:10 +0530 Subject: [PATCH 08/10] =?UTF-8?q?fix(image):=20install=20playwright=20brow?= =?UTF-8?q?sers=20at=20/tmp/=20=E2=80=94=20survives=20sandbox=20isolation?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit OpenShell mounts its own filesystem over /sandbox/ at sandbox creation, discarding any content our derived image adds there. /tmp/ is NOT mounted over, so content installed to /tmp/playwright-browsers/ persists into the sandbox. Verified: /tmp/corepack/ (from base image) is accessible in sandbox, confirming /tmp/ is preserved. Also adds /tmp/bin/playwright symlink for direct invocation. Assisted-by: Claude Code Co-Authored-By: Claude Code --- images/code/Containerfile | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/images/code/Containerfile b/images/code/Containerfile index f375c84..0817b9d 100644 --- a/images/code/Containerfile +++ b/images/code/Containerfile @@ -58,12 +58,15 @@ RUN mkdir -p "$COREPACK_HOME" \ # installed via apt. ARG PLAYWRIGHT_VERSION=1.61.1 ENV PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD=1 \ - PLAYWRIGHT_BROWSERS_PATH=/sandbox/playwright-browsers + PLAYWRIGHT_BROWSERS_PATH=/tmp/playwright-browsers RUN npm install -g "playwright@${PLAYWRIGHT_VERSION}" \ && mkdir -p "${PLAYWRIGHT_BROWSERS_PATH}" \ && npx playwright install chromium --with-deps \ && npx playwright --version \ - && chmod -R 777 "${PLAYWRIGHT_BROWSERS_PATH}" + && chmod -R 777 "${PLAYWRIGHT_BROWSERS_PATH}" \ + && mkdir -p /tmp/bin \ + && ln -s "$(which playwright)" /tmp/bin/playwright \ + && chmod 755 /tmp/bin # --------------------------------------------------------------------------- # openspec CLI — spec-driven development tooling. From 61e81ffaa9d8cf58386cfe52daf978106ac719dd Mon Sep 17 00:00:00 2001 From: Subhash Khileri Date: Wed, 15 Jul 2026 15:40:00 +0530 Subject: [PATCH 09/10] fix(image): move playwright browsers to /sandbox/playwright-browsers MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Both /tmp and /sandbox survive from derived image layers, but /sandbox is more semantically appropriate for the sandbox user's space. Also removed the /tmp/bin symlink — /usr/bin/playwright (from npm install -g) is directly accessible in the sandbox. Assisted-by: Claude Code Co-Authored-By: Claude Code --- images/code/Containerfile | 7 ++----- 1 file changed, 2 insertions(+), 5 deletions(-) diff --git a/images/code/Containerfile b/images/code/Containerfile index 0817b9d..f375c84 100644 --- a/images/code/Containerfile +++ b/images/code/Containerfile @@ -58,15 +58,12 @@ RUN mkdir -p "$COREPACK_HOME" \ # installed via apt. ARG PLAYWRIGHT_VERSION=1.61.1 ENV PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD=1 \ - PLAYWRIGHT_BROWSERS_PATH=/tmp/playwright-browsers + PLAYWRIGHT_BROWSERS_PATH=/sandbox/playwright-browsers RUN npm install -g "playwright@${PLAYWRIGHT_VERSION}" \ && mkdir -p "${PLAYWRIGHT_BROWSERS_PATH}" \ && npx playwright install chromium --with-deps \ && npx playwright --version \ - && chmod -R 777 "${PLAYWRIGHT_BROWSERS_PATH}" \ - && mkdir -p /tmp/bin \ - && ln -s "$(which playwright)" /tmp/bin/playwright \ - && chmod 755 /tmp/bin + && chmod -R 777 "${PLAYWRIGHT_BROWSERS_PATH}" # --------------------------------------------------------------------------- # openspec CLI — spec-driven development tooling. From e5c0e88fd2207f9b90028e4758a669309faac349 Mon Sep 17 00:00:00 2001 From: Subhash Khileri Date: Wed, 15 Jul 2026 15:50:26 +0530 Subject: [PATCH 10/10] =?UTF-8?q?revert:=20restore=20/tmp/playwright-brows?= =?UTF-8?q?ers=20=E2=80=94=20/sandbox=20path=20unreliable?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit OpenShell resets /sandbox during initialization, wiping derived-layer additions. /tmp survives reliably. Verified end-to-end. Assisted-by: Claude Code Co-Authored-By: Claude Code --- images/code/Containerfile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/images/code/Containerfile b/images/code/Containerfile index f375c84..a8676f8 100644 --- a/images/code/Containerfile +++ b/images/code/Containerfile @@ -58,7 +58,7 @@ RUN mkdir -p "$COREPACK_HOME" \ # installed via apt. ARG PLAYWRIGHT_VERSION=1.61.1 ENV PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD=1 \ - PLAYWRIGHT_BROWSERS_PATH=/sandbox/playwright-browsers + PLAYWRIGHT_BROWSERS_PATH=/tmp/playwright-browsers RUN npm install -g "playwright@${PLAYWRIGHT_VERSION}" \ && mkdir -p "${PLAYWRIGHT_BROWSERS_PATH}" \ && npx playwright install chromium --with-deps \