ci: improve workflow (#458)

* ci: improve ci workflow to use playwrights chromium and minimal permissions

* fix: call playwrights chromium with flags that work and ensure same deps are installed

* ci: harden release action by limiting permissions

Author: dominikg

.github/workflows/ci.yml

@@ -8,10 +8,20 @@ on:
   pull_request:
     branches:
       - main
+
 env:
   # we call `pnpm playwright install` instead
   PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD: '1'
 
+# cancel in-progress runs on new commits to same PR (gitub.event.number)
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.number || github.sha }}
+  cancel-in-progress: true
+
+# use min permissions
+permissions:
+  contents: read # to fetch code (actions/checkout)
+
 jobs:
   # "checks" job runs on linux + 16 only and checks that install, build, lint and audit work
   # it also primes the pnpm store cache for linux, important for downstream tests

.github/workflows/release.yml

@@ -5,8 +5,13 @@ on:
     branches:
       - main
 
+permissions: {}
+
 jobs:
   release:
+    permissions:
+      contents: write # to create release (changesets/action)
+      pull-requests: write # to create pull request (changesets/action)
     # prevents this action from running on forks
     if: github.repository == 'sveltejs/vite-plugin-svelte'
     name: Release

packages/e2e-tests/vitestGlobalSetup.ts

@@ -23,11 +23,9 @@ const buildPackagesUnderTest = async () => {
 const syncNodeModules = async () => {
 	// tests use symbolic linked node_modules directories. make sure the workspace is up for it
 	console.log('syncing node_modules');
-	await execa(
-		'pnpm',
-		['install', '--prefer-frozen-lockfile', '--prefer-offline', '--no-lockfile', '--silent'],
-		{ stdio: 'inherit' }
-	);
+	await execa('pnpm', ['install', '--frozen-lockfile', '--prefer-offline', '--silent'], {
+		stdio: 'inherit'
+	});
 	console.log('syncing node_modules done');
 };
 

packages/e2e-tests/vitestSetup.ts

@@ -83,21 +83,21 @@ beforeAll(
 		if (!suite.filepath.includes('e2e-tests')) {
 			return;
 		}
+		try {
+			const wsEndpoint = fs.readFileSync(path.join(DIR, 'wsEndpoint'), 'utf-8');
+			if (!wsEndpoint) {
+				throw new Error('wsEndpoint not found');
+			}
 
-		const wsEndpoint = fs.readFileSync(path.join(DIR, 'wsEndpoint'), 'utf-8');
-		if (!wsEndpoint) {
-			throw new Error('wsEndpoint not found');
-		}
+			browser = await chromium.connect(wsEndpoint);
+			page = await browser.newPage();
 
-		browser = await chromium.connect(wsEndpoint);
-		page = await browser.newPage();
+			const testPath = suite.filepath;
+			const segments = testPath.split('/');
+			const testName = segments.includes('e2e-tests')
+				? segments[segments.indexOf('e2e-tests') + 1]
+				: null;
 
-		const testPath = suite.filepath;
-		const segments = testPath.split('/');
-		const testName = segments.includes('e2e-tests')
-			? segments[segments.indexOf('e2e-tests') + 1]
-			: null;
-		try {
 			// if this is a test placed under e2e-tests/xxx/__tests__
 			// start a vite server in that directory.
 			if (testName) {