[Bug]: Storybook init can require `sudo` because of Playwright install

[JReinhold]

Describe the bug

When initting Storybook and getting addon-vitest, the addon's postinstall installs Playwright with dependencies:

storybook/code/addons/vitest/src/postinstall.ts

Lines 294 to 297 in bd03a61

	await packageManager.executeCommand({
	command: 'npx',
	args: ['playwright', 'install', 'chromium', '--with-deps'],
	});

This can lead to the terminal require sudo, because that can be necessary to install the browser dependencies. This requirement can scare some users off, because they are not just giving sudo to the playwright install, but to the whole init process, which is opaque to the user and less secure.

Additional context

Originally reported by @dominikg. I have not myself been able to reproduce this, it seems like Playwright refuses to install browsers on my machine, relying on some cached installs that I can't remove.

This the log shown:

› Configuring Playwright with Chromium (this might take some time):
  npx playwright install chromium --with-deps
[sudo] password for USER: 

If we don't add --with-deps it just downloads the binaries without using sudo. The deps are usually present from the system installed chromium and managed by the packaging system of the linux distro. It can lead to issues if the system installed chromium has deps that are incompatible from the one playwright wants to use, but that might not be an issue in practice.

[Sidnioulz]

I want to add to this that some commands, like yarn start in the monorepo, run install commands in quiet mode, so users don't even know it's Playwright asking for a password.

Besides, Playwright fails install on many Linux distros, and it tries for those distros to serve a 5 year old APT package for Ubuntu, which of course fails (all the package's dependencies have had multiple updates since then).

microsoft/playwright#26482 (comment) provides a command which apparently installs browsers without triggering this whole package download and sudo request. We might want to look into adding that --shell-only command if it has no relevant side effects for us.

[dominikg]

it's --only-shell https://playwright.dev/docs/test-cli#install-browsers

i think you can only run headless tests then. might work for repo internal ci scripts but not user facing scripts as users might want to execute with browser ui showing

[Sidnioulz]

it's --only-shell https://playwright.dev/docs/test-cli#install-browsers

i think you can only run headless tests then. might work for repo internal ci scripts but not user facing scripts as users might want to execute with browser ui showing

Thanks @dominikg! I suspect this might be enough for Addon Vitest, as it runs in CLI and outputs results in the UI and/or CLI. Let's see if the team believe --headed must be available by default.

[Sidnioulz]

Just tested rewriting addon-vitest's postinstall and sudo will keep being triggered until --with-deps is removed. Now, on my Arch system I can install with --only-shell and without --with-deps, and the addon runs fine because I already have playwright locally installed.

Obviously this means users without playwright will run into trouble.

One thing we could possibly do is use execa to run playwright --version and check if it's already installed; in which case --with-deps is redundant on Linux.

We could also try and detect distros. Playwright only supports Debian/Ubuntu so that shouldn't be too much of a stretch. Plenty of options to detect distros.

ANd if we figure out that users do need to install Playwright themselves, provide a big fat visible warning for them so they know they have to do it.

[dominikg]

is --with-deps required at all? they may not be needed or already present on the users system.

maybe run without it first, try to open a page w playwright and only if that fails with a chrome error prompt the user properly that sudo is required for playwright.

even though theg claim it only works w debian/ubuntu i haven't run into native issues with it on arch (manjaro) for years

[Sidnioulz]

even though theg claim it only works w debian/ubuntu i haven't run into native issues with it on arch (manjaro) for years

Agreed, it's the NPM install DX that's broken. They don't know how to install it so they prompt you into typing a password and start downloading an Ubuntu 20 package, then they cry wolf because the package is using different dependency versions from the ones locally installed.

Meanwhile, not installing Playwright via NPM results in a functional experience for me on Arch.

[samvv]

I just installed Storybook and I really didn't like that it asked for a root password, because I don't know how it will affect my system. Does it install something using pacman? Does it install something in /usr/bin? I just pressed Ctrl+C and did a manual npm install.

AFAICT the NPM install step is the last step in the installation of Storybook so everything appears to work.

[Sidnioulz]

Unfortunately it's not exactly the last step. It still does one or two things with Vitest config files afterwards.

@JReinhold, do you reckon it's doable to put the playwright install step at the very end of the process?

I just installed Storybook and I really didn't like that it asked for a root password, because I don't know how it will affect my system. Does it install something using pacman? Does it install something in /usr/bin? I just pressed Ctrl+C and did a manual npm install.

AFAICT the NPM install step is the last step in the installation of Storybook so everything appears to work.

Believe it or not, it tries to use apt-get to install a version of Chrome from 2020, patched for Ubuntu.

[mmirus]

I could be wrong, but I think that if the script detects you have Playwright installed it will skip that step and proceed with the rest of the process. Worth testing by running the setup again after installing Playwright.

[Sidnioulz]

I could be wrong, but I think that if the script detects you have Playwright installed it will skip that step and proceed with the rest of the process. Worth testing by running the setup again after installing Playwright.

If only! I have Playwright installed on Arch, and in fact running the commands they tell you to run after it fails to sudo and install Ubuntu packages uninstalls my existing Playwright browsers (before failing to "install" the Ubuntu 20 versions).

[JReinhold]

@valentinpalkovic would be the expert here!