[kixelated]

Problem

Smoke's flake was pinned to May while npm Playwright must exactly match its packaged Chromium. Dependabot can discover a newer smoke lock, but its lock-only update cannot safely auto-merge ahead of the matching npm pin.

Approach

Add a weekly/manual workflow that updates both files, validates freshness and real browser startup, and opens or refreshes one draft PR. Refreshed proposals are always returned to draft. A local just update-toolchain command performs the same update, deriving the exact stable version by evaluating the existing shell hook without building its toolchains. Scheduled failures use the existing alert path. The Dependabot auto-merge workflow refuses smoke-flake proposals and directs maintainers to this coupled updater; its pending smoke entry in #6169 is unchanged.

Run the updater now: smoke nixpkgs moves from May 27 to October 20, and Playwright moves from 1.59.1 to the matching 1.64.1. The updater's refusal and coupling tests run through just freshness, already exercised by nightly Smoke. Remove the completed quest and its reference.

Impact

• Consumer: the existing published-package browser smoke lane uses the refreshed toolchain and matching Playwright pin now. Maintainers can use one local command or dispatch the workflow for later updates.
• Public API and wire: none. Only smoke tooling, pins, and update policy change.
• Updates remain draft proposals; the workflow never enqueues or merges them. It reuses the existing moq-bot credentials and mints a write token only after Nix evaluation.

Validation

• The real updater and freshness check pass with Playwright 1.64.1.
• Three updater tests cover coupled writes, preserved latest MoQ dependencies, malformed/ambiguous versions, and failed lock updates.
• just gh check, markdown, shellcheck, shfmt, and justfile formatting pass. The auto-merge query refuses smoke locks and accepts unrelated updates.
• just ci passes after rebasing onto the repaired main branch.
• just check-toolchain passes with the refreshed smoke shell and a real Chromium launch. The full published-package media matrix was not run locally; Smoke runs manually on a proposed branch and automatically on main.

Alternatives

A handwritten pair of bumps leaves the same recurring drift. Updating untrusted Dependabot checkouts with write credentials adds complexity; the scheduled job evaluates the default branch and uses a maintained pinned PR action instead.

Follow-ups

No new quests or API decisions. This does not touch the Pages cleanup owned by #6207.

(Written by GPT-6)

[kixelated]

Quest completed with the coupled updater, initial lock/Playwright refresh, and guarded Dependabot auto-merge. The real freshness check, updater tests, workflow/alert checks, markdown, and shell/recipe checks pass. No public API or wire change and no open API decisions.

The PR remains draft while the baseline stale quest links are addressed by #6205 and the existing Smoke workflow validates the changed published-package toolchain. No new follow-up quests are needed.

(Written by GPT-6)

[coderabbitai]

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 21 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used all 4 included reviews currently available.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: fae90a62-90c0-4544-9bd5-f0f72e0592bd

📥 Commits

Reviewing files that changed from the base of the PR and between 9b8de43 and 06f2958.

⛔ Files ignored due to path filters: 1

• test/smoke/flake.lock is excluded by !**/*.lock

📒 Files selected for processing: 11

• .github/workflows/alert.yml
• .github/workflows/dependabot.yml
• .github/workflows/smoke-toolchain.yml
• quest/m1/README.md
• quest/m1/smoke-dependabot.md
• test/smoke/README.md
• test/smoke/clients/js/package.json
• test/smoke/freshness.sh
• test/smoke/justfile
• test/smoke/update.py
• test/smoke/update.test.py

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: f0d10fe88f

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-21T22:35:21.805504Z	3e34786	New commits

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[kixelated]

The coupled updater is complete. just ci and just --justfile test/smoke/justfile check-toolchain pass; the latter checked freshness and launched the actual Nix Chromium. Both review findings are fixed, and Codex's latest automatic review returned a thumbs-up. No API or wire changes; no remaining decisions or follow-up quests.

(Written by GPT-6)

[kixelated]

Merge summary for head 06f2958.

• Codex reviewed 3e34786 with no findings (thumbs-up); both earlier P2 threads are answered and resolved. Draft refreshes use draft: always-true; Smoke on the generated PR stays a documented manual dispatch, with the full matrix guaranteed post-merge by Smoke's test/smoke/** push trigger.
• Since that review, one trivial change: the updater's branch is smoke/toolchain-update (named by role, not a vendor), and the weekly moq-bot commit and PR body no longer claim model authorship. actionlint passes.
• No public API or wire change.

Follow-up: moq-dev/moq#6169 adds a Dependabot nix entry for test/smoke; with this coupled updater that entry is redundant (its lock-only PRs are refused auto-merge here), so it can be dropped there.

(Written by Claude Opus 5.5)