Updated CI to mirror playwright image to GHCR

.github/actions/mirror-container-image/action.yml

@@ -0,0 +1,29 @@
+name: 'Mirror Container Image'
+description: 'Mirror an upstream container image into GHCR'
+inputs:
+  source-image:
+    description: 'Fully-qualified source image reference'
+    required: true
+  target-image:
+    description: 'Fully-qualified target image reference'
+    required: true
+
+runs:
+  using: 'composite'
+  steps:
+    - name: Mirror image
+      shell: bash
+      env:
+        SOURCE_IMAGE: ${{ inputs.source-image }}
+        TARGET_IMAGE: ${{ inputs.target-image }}
+      run: |
+        set -euo pipefail
+
+        echo "Pulling source image: $SOURCE_IMAGE"
+        docker pull "$SOURCE_IMAGE"
+
+        echo "Tagging image as: $TARGET_IMAGE"
+        docker tag "$SOURCE_IMAGE" "$TARGET_IMAGE"
+
+        echo "Pushing mirrored image: $TARGET_IMAGE"
+        docker push "$TARGET_IMAGE"

.github/workflows/ci.yml

@@ -74,6 +74,9 @@ jobs:
           echo "Setting BASE_COMMIT to $BASE_COMMIT"
           echo "BASE_COMMIT=$BASE_COMMIT" >> $GITHUB_ENV
 
+      - name: Fetch base commit
+        run: git fetch --no-tags --depth=1 origin "${BASE_COMMIT}"
+
       - name: Check user org membership
         id: check_user_org_membership
         if: github.event_name == 'pull_request'
@@ -191,6 +194,25 @@ jobs:
       - name: Install dependencies
         run: bash .github/scripts/install-deps.sh
 
+      - name: Resolve Playwright image
+        id: playwright
+        run: |
+          set -euo pipefail
+
+          PLAYWRIGHT_VERSION="$(node -p "require('./e2e/package.json').devDependencies['@playwright/test']")"
+          echo "version=$PLAYWRIGHT_VERSION" >> "$GITHUB_OUTPUT"
+
+          # Check if the image already exists in GHCR (anonymous OCI registry check)
+          TOKEN="$(curl -sf "https://ghcr.io/token?service=ghcr.io&scope=repository:tryghost/playwright:pull" | jq -r .token)" || TOKEN=""
+          HTTP_CODE="$(curl -so /dev/null -w "%{http_code}" -H "Authorization: Bearer $TOKEN" \
+            "https://ghcr.io/v2/tryghost/playwright/manifests/v${PLAYWRIGHT_VERSION}-noble")"
+
+          if [ "$HTTP_CODE" = "200" ]; then
+            echo "image-exists=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "image-exists=false" >> "$GITHUB_OUTPUT"
+          fi
+
 
     outputs:
       changed_admin: ${{ steps.changed.outputs.admin }}
@@ -216,6 +238,41 @@ jobs:
       dependency_cache_key: ${{ env.cachekey }}
       node_version: ${{ env.NODE_VERSION }}
       node_test_matrix: ${{ steps.node_matrix.outputs.matrix }}
+      playwright_version: ${{ steps.playwright.outputs.version }}
+      playwright_image_exists: ${{ steps.playwright.outputs.image-exists }}
+
+  job_mirror_playwright_image:
+    name: Mirror Playwright image
+    runs-on: ubuntu-latest
+    needs: [job_setup]
+    if: needs.job_setup.outputs.is_tag != 'true' && needs.job_setup.outputs.playwright_image_exists != 'true'
+    permissions:
+      contents: read
+      packages: write
+    steps:
+      - name: Checkout
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+
+      - name: Login to GHCR
+        if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
+        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Mirror Playwright image
+        if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
+        uses: ./.github/actions/mirror-container-image
+        with:
+          source-image: mcr.microsoft.com/playwright:v${{ needs.job_setup.outputs.playwright_version }}-noble
+          target-image: ghcr.io/tryghost/playwright:v${{ needs.job_setup.outputs.playwright_version }}-noble
+
+      - name: Fail when Playwright image cannot be mirrored
+        if: github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name != github.repository
+        run: |
+          echo "::error::Playwright v${{ needs.job_setup.outputs.playwright_version }}-noble is not mirrored in GHCR yet. Publish ghcr.io/tryghost/playwright:v${{ needs.job_setup.outputs.playwright_version }}-noble before running E2E for this branch."
+          exit 1
 
   job_app_version_bump_check:
     name: Check app version bump

.github/workflows/cleanup-ghcr.yml

@@ -35,7 +35,7 @@ jobs:
     runs-on: ubuntu-latest
     strategy:
       matrix:
-        package: [ghost, ghost-core, ghost-development]
+        package: [ghost, ghost-core, ghost-development, playwright]
     steps:
       - name: Delete old non-release versions
         env:
@@ -60,6 +60,11 @@ jobs:
             if ! batch=$(gh api \
               "/orgs/${ORG}/packages/container/${PACKAGE}/versions?per_page=100&page=${page}" \
               --jq '.' 2>&1); then
+              if echo "$batch" | grep -qiE '404|package.*not found'; then
+                echo "::notice::Package ${ORG}/${PACKAGE} does not exist yet; skipping."
+                break
+              fi
+
               if [ "$page" = "1" ]; then
                 echo "::error::API request failed: ${batch}"
                 exit 1
@@ -77,13 +82,15 @@ jobs:
             page=$((page + 1))
           done
 
+          all_versions=$(echo "$all_versions" | jq 'sort_by(.updated_at) | reverse')
           total=$(echo "$all_versions" | jq 'length')
           echo "Total versions: ${total}"
 
           # Classify versions
           keep=0
           delete=0
           delete_ids=""
+          index=0
 
           for row in $(echo "$all_versions" | jq -r '.[] | @base64'); do
             _jq() { echo "$row" | base64 -d | jq -r "$1"; }
@@ -92,28 +99,40 @@ jobs:
             updated=$(_jq '.updated_at')
             tags=$(_jq '[.metadata.container.tags[]] | join(",")')
 
-            # Keep versions with semver tags (v1.2.3, 1.2.3, 1.2)
-            if echo "$tags" | grep -qE '(^|,)v?[0-9]+\.[0-9]+\.[0-9]+(,|$)' || \
-               echo "$tags" | grep -qE '(^|,)[0-9]+\.[0-9]+(,|$)'; then
-              keep=$((keep + 1))
-              continue
-            fi
+            if [ "$PACKAGE" = "playwright" ]; then
+              if [ "$index" -lt "$MIN_KEEP" ] || [[ "$updated" > "$cutoff" ]]; then
+                keep=$((keep + 1))
+                index=$((index + 1))
+                continue
+              fi
+            else
+              # Keep versions with semver tags (v1.2.3, 1.2.3, 1.2)
+              if echo "$tags" | grep -qE '(^|,)v?[0-9]+\.[0-9]+\.[0-9]+(,|$)' || \
+                 echo "$tags" | grep -qE '(^|,)[0-9]+\.[0-9]+(,|$)'; then
+                keep=$((keep + 1))
+                index=$((index + 1))
+                continue
+              fi
 
-            # Keep versions with 'latest' or 'main' or cache-main tags
-            if echo "$tags" | grep -qE '(^|,)(latest|main|cache-main)(,|$)'; then
-              keep=$((keep + 1))
-              continue
-            fi
+              # Keep versions with 'latest' or 'main' or cache-main tags
+              if echo "$tags" | grep -qE '(^|,)(latest|main|cache-main)(,|$)'; then
+                keep=$((keep + 1))
+                index=$((index + 1))
+                continue
+              fi
 
-            # Keep versions newer than cutoff
-            if [[ "$updated" > "$cutoff" ]]; then
-              keep=$((keep + 1))
-              continue
+              # Keep versions newer than cutoff
+              if [[ "$updated" > "$cutoff" ]]; then
+                keep=$((keep + 1))
+                index=$((index + 1))
+                continue
+              fi
             fi
 
             # This version is eligible for deletion
             delete=$((delete + 1))
             delete_ids="${delete_ids} ${id}"
+            index=$((index + 1))
 
             tag_display="${tags:-<untagged>}"
             if [ "$DRY_RUN" = "true" ]; then

e2e/scripts/load-playwright-container-env.sh

@@ -11,7 +11,7 @@ REPO_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
 cd "$REPO_ROOT"
 
 PLAYWRIGHT_VERSION="$(node -p 'require("./e2e/package.json").devDependencies["@playwright/test"]')"
-PLAYWRIGHT_IMAGE="mcr.microsoft.com/playwright:v${PLAYWRIGHT_VERSION}-noble"
+PLAYWRIGHT_IMAGE="${PLAYWRIGHT_IMAGE:-ghcr.io/tryghost/playwright:v${PLAYWRIGHT_VERSION}-noble}"
 WORKSPACE_PATH="${GITHUB_WORKSPACE:-$REPO_ROOT}"
 
 export SCRIPT_DIR