ci: bounded retries around playwright browser install — flaky CDN, progress accumulates

.gitea/workflows/ci.yml

@@ -104,8 +104,19 @@ jobs:
           path: $HOME/.cache/ms-playwright
           key: ${{ runner.os }}-pw-browsers-${{ hashFiles('package.json') }}
 
+      # Retried: cdn.playwright.dev is flaky from this runner — Playwright's internal 5-retry
+      # window (~40-90s) is often not enough, but runs get through with a longer one. Progress
+      # accumulates across attempts: playwright skips already-installed browsers.
       - name: Install browsers (local)
-        run: npx playwright install --with-deps chromium
+        run: |
+          set -u
+          ok=0
+          for i in 1 2 3 4 5 6; do
+            if npx playwright install --with-deps chromium; then ok=1; break; fi
+            echo "::warning::browser install attempt $i/6 failed (flaky cdn.playwright.dev) — retrying in 5s" >&2
+            sleep 5
+          done
+          [ "$ok" = "1" ] || { echo "::error::browser install failed after 6 attempts" >&2; exit 1; }
 
       # Cache the base image on the shared daemon up front: a single loud failure here
       # beats a 6-minute BuildKit "failed to solve" when the daemon's outbound net is down.

CHANGELOG.md

@@ -15,6 +15,7 @@
 - **CI e2e step bypasses proxies for the in-network app host** (`NO_PROXY`/`no_proxy=app,localhost,127.0.0.1,.kkhost.pl`) and prints proxy/DNS/curl diagnostics before the suite — run #18 showed Chromium getting `ERR_SSL_PROTOCOL_ERROR` on http://app:3000 while node-side HTTP worked (9 API-only tests passed), pointing at a TLS-terminating proxy env var that Chromium honors but Node's HTTP client ignores
 - **CI e2e targets the app at a static in-network IP** (`172.39.0.10`, pinned subnet `172.39.0.0/24` created by "Prepare e2e network"; stale networks with other subnets are recreated) instead of the DNS alias — Chromium got `ERR_SSL_PROTOCOL_ERROR` via the hostname while node-side HTTP worked, so DNS is removed from the equation; post-deploy connectivity diagnostics added as a CI-gated globalSetup (`e2e/ci-diagnostics.ts`, no-op locally) comparing node resolution/HTTP against Chromium navigation on both hostname and static IP
 - **CI caches Playwright browser binaries across runs** (`$HOME/.cache/ms-playwright` via actions/cache): the flaky runner uplink makes the ~187 MiB Chrome-for-Testing download unreliable (runs #20/#21 died mid-download at "Install browsers"); also removed the no-op "Save deps cache" step — on this runner caches marked by a restore step are uploaded automatically at job end, so an explicit save never did anything
+- **CI browser install runs in a bounded 6-attempt loop** — cdn.playwright.dev is flaky from the runner and Playwright's internal retry window (~40–90s) was often insufficient (runs #21–#23), while longer windows get through (runs #12/#18); already-installed browsers are skipped so progress accumulates across attempts
 - Verified: unit suite 234 green locally; e2e not run locally by design (would deploy to production) — first real pass happens in the PR's CI run
 
 ## v0.12.2 — 2026-09-18 14:06