chore(ci): Use Playwright Docker images instead of install-playwright action

.github/actions/ensure-playwright-image/action.yml

@@ -0,0 +1,113 @@
+name: 'Ensure Playwright Docker Image'
+description: 'Checks if the custom Playwright Docker image exists in GHCR. Builds and pushes it if missing.'
+
+inputs:
+  github_token:
+    description: 'GitHub token with packages:write permission'
+    required: true
+
+outputs:
+  image:
+    description: 'The full Docker image reference (e.g. ghcr.io/owner/repo/playwright:v1.56.0)'
+    value: ${{ steps.image.outputs.ref }}
+
+runs:
+  using: 'composite'
+  steps:
+    - name: Get versions
+      id: versions
+      run: |
+        PLAYWRIGHT_VERSION=$(node -p "
+          const pkg = require('./dev-packages/browser-integration-tests/package.json');
+          const v = (pkg.dependencies || {})['@playwright/test'] || (pkg.devDependencies || {})['@playwright/test'];
+          v.replace(/[~^]/, '')
+        ")
+        ROOT_PKG=$(node -p "JSON.stringify(require('./package.json').volta)")
+        NODE_VERSION=$(echo "$ROOT_PKG" | node -p "JSON.parse(require('fs').readFileSync(0,'utf8')).node")
+        YARN_VERSION=$(echo "$ROOT_PKG" | node -p "JSON.parse(require('fs').readFileSync(0,'utf8')).yarn")
+        echo "playwright=$PLAYWRIGHT_VERSION" >> $GITHUB_OUTPUT
+        echo "node=$NODE_VERSION" >> $GITHUB_OUTPUT
+        echo "yarn=$YARN_VERSION" >> $GITHUB_OUTPUT
+      shell: bash
+
+    - name: Verify @playwright/test version consistency
+      shell: bash
+      run: |
+        CANONICAL=$(node -p "
+          const pkg = require('./dev-packages/browser-integration-tests/package.json');
+          (pkg.dependencies || {})['@playwright/test'] || (pkg.devDependencies || {})['@playwright/test']
+        ")
+        echo "Canonical @playwright/test version: $CANONICAL"
+        MISMATCHES=0
+
+        check_version() {
+          local file="$1"
+          local version
+          version=$(node -p "
+            const pkg = require('./$file');
+            (pkg.dependencies || {})['@playwright/test'] ||
+            (pkg.devDependencies || {})['@playwright/test'] ||
+            (pkg.peerDependencies || {})['@playwright/test'] ||
+            'not found'
+          ")
+          if [ "$version" != "not found" ] && [ "$version" != "$CANONICAL" ]; then
+            echo "::error file=$file::@playwright/test version mismatch: $version (expected $CANONICAL)"
+            MISMATCHES=$((MISMATCHES + 1))
+          fi
+        }
+
+        check_version "dev-packages/test-utils/package.json"
+
+        for pkg in dev-packages/e2e-tests/test-applications/*/package.json; do
+          check_version "$pkg"
+        done
+
+        if [ "$MISMATCHES" -gt 0 ]; then
+          echo "Found $MISMATCHES package(s) with mismatched @playwright/test versions."
+          echo "All packages must use the same version as dev-packages/browser-integration-tests ($CANONICAL)."
+          exit 1
+        fi
+        echo "All @playwright/test versions are consistent ($CANONICAL)"
+
+    - name: Set image reference
+      id: image
+      shell: bash
+      run: |
+        DOCKERFILE_HASH=$(sha256sum .github/docker/playwright.Dockerfile | cut -c1-8)
+        TAG="v${{ steps.versions.outputs.playwright }}-${DOCKERFILE_HASH}"
+        echo "ref=ghcr.io/${{ github.repository }}/playwright:${TAG}" >> $GITHUB_OUTPUT
+
+    - name: Check if image already exists
+      id: check
+      shell: bash
+      run: |
+        if docker manifest inspect "${{ steps.image.outputs.ref }}" > /dev/null 2>&1; then
+          echo "exists=true" >> $GITHUB_OUTPUT
+          echo "Image ${{ steps.image.outputs.ref }} already exists, skipping build."
+        else
+          echo "exists=false" >> $GITHUB_OUTPUT
+          echo "Image ${{ steps.image.outputs.ref }} not found, will build."
+        fi
+      env:
+        DOCKER_CLI_EXPERIMENTAL: enabled
+
+    - name: Log in to GHCR
+      if: steps.check.outputs.exists == 'false'
+      uses: docker/login-action@v3
+      with:
+        registry: ghcr.io
+        username: ${{ github.actor }}
+        password: ${{ inputs.github_token }}
+
+    - name: Build and push
+      if: steps.check.outputs.exists == 'false'
+      uses: docker/build-push-action@v6
+      with:
+        file: .github/docker/playwright.Dockerfile
+        push: true
+        build-args: |
+          PLAYWRIGHT_VERSION=${{ steps.versions.outputs.playwright }}
+          NODE_VERSION=${{ steps.versions.outputs.node }}
+          YARN_VERSION=${{ steps.versions.outputs.yarn }}
+        tags: |
+          ${{ steps.image.outputs.ref }}

.github/actions/install-dependencies/action.yml

@@ -20,6 +20,7 @@ runs:
       with:
         path: ${{ env.CACHED_DEPENDENCY_PATHS }}
         key: ${{ steps.compute_lockfile_hash.outputs.hash }}
+        enableCrossOsArchive: true
 
     - name: Install dependencies
       if: steps.cache_dependencies.outputs.cache-hit != 'true'

.github/actions/restore-cache/action.yml

@@ -15,6 +15,7 @@ runs:
       with:
         path: ${{ env.CACHED_DEPENDENCY_PATHS }}
         key: ${{ inputs.dependency_cache_key }}
+        enableCrossOsArchive: true
 
     - name: Restore build artifacts
       uses: actions/download-artifact@v7

.github/docker/playwright.Dockerfile

@@ -0,0 +1,50 @@
+# Extend the GitHub Actions runner image (Ubuntu 24.04 based) to get an
+# environment close to what GHA hosted runners provide.
+FROM ghcr.io/actions/actions-runner:2.333.1
+
+ARG PLAYWRIGHT_VERSION
+ARG NODE_VERSION
+ARG YARN_VERSION
+
+# Prevent interactive prompts during package installation
+ENV DEBIAN_FRONTEND=noninteractive
+
+# Install zstd (required by actions/cache for compression), a JRE for Firebase
+# emulators (Firestore, etc. spawn `java -version`), and Node.js + Yarn at the
+# versions pinned in the repo's package.json.
+RUN sudo apt-get update && \
+    sudo apt-get install -y --no-install-recommends zstd openjdk-17-jre-headless && \
+    sudo rm -rf /var/lib/apt/lists/*
+RUN sudo curl -fsSL https://deb.nodesource.com/setup_${NODE_VERSION%%.*}.x | sudo bash - && \
+    sudo apt-get install -y --no-install-recommends nodejs && \
+    sudo rm -rf /var/lib/apt/lists/* && \
+    sudo npm install -g yarn@${YARN_VERSION}
+
+# Install Playwright browsers and their OS-level dependencies.
+# Use a fixed path so browsers are found regardless of HOME at runtime
+# (GHA sets HOME=/github/home inside containers, not /home/runner).
+ENV PLAYWRIGHT_BROWSERS_PATH=/opt/pw-browsers
+RUN sudo mkdir -p /opt/pw-browsers && \
+    sudo PLAYWRIGHT_BROWSERS_PATH=/opt/pw-browsers npx playwright@${PLAYWRIGHT_VERSION} install chromium webkit firefox --with-deps
+
+# Mark GitHub Actions workspace as safe for git (system-wide config so it
+# works regardless of HOME, which GHA overrides to /github/home).
+RUN sudo git config --system --add safe.directory '*'
+
+# Ensure /root exists and is owned by root. When running as --user root,
+# Firefox requires HOME to be owned by the current user. GHA sets
+# HOME=/github/home (owned by runner), but we can't override it.
+# The workflow sets HOME=/root via a step, and this ensures /root is ready.
+RUN mkdir -p /root
+
+# Docker CLI + Compose v2 for E2E apps that run `docker compose` against the
+# host daemon (workflows mount /var/run/docker.sock). Image is built amd64 on GHA.
+ARG DOCKER_VERSION=27.4.1
+ARG DOCKER_COMPOSE_VERSION=2.32.1
+RUN curl -fsSL "https://download.docker.com/linux/static/stable/x86_64/docker-${DOCKER_VERSION}.tgz" | sudo tar -xz -C /tmp && \
+    sudo mv /tmp/docker/docker /usr/local/bin/docker && \
+    sudo rm -rf /tmp/docker && \
+    sudo mkdir -p /usr/local/lib/docker/cli-plugins && \
+    sudo curl -fsSL "https://github.com/docker/compose/releases/download/v${DOCKER_COMPOSE_VERSION}/docker-compose-linux-x86_64" \
+        -o /usr/local/lib/docker/cli-plugins/docker-compose && \
+    sudo chmod +x /usr/local/lib/docker/cli-plugins/docker-compose