diff --git a/.github/workflows/blog-auditor.lock.yml b/.github/workflows/blog-auditor.lock.yml index 05afb23d75a..e4c9f847885 100644 --- a/.github/workflows/blog-auditor.lock.yml +++ b/.github/workflows/blog-auditor.lock.yml @@ -1170,7 +1170,7 @@ jobs: "playwright": { "command": "npx", "args": [ - "@playwright/mcp@latest", + "@playwright/mcp@1.56.1", "--output-dir", "/tmp/gh-aw/mcp-logs/playwright", "--allowed-origins", diff --git a/.github/workflows/cloclo.lock.yml b/.github/workflows/cloclo.lock.yml index 4088bbab622..b84bef521cb 100644 --- a/.github/workflows/cloclo.lock.yml +++ b/.github/workflows/cloclo.lock.yml @@ -2276,7 +2276,7 @@ jobs: "playwright": { "command": "npx", "args": [ - "@playwright/mcp@latest", + "@playwright/mcp@1.56.1", "--output-dir", "/tmp/gh-aw/mcp-logs/playwright", "--allowed-origins", diff --git a/.github/workflows/daily-multi-device-docs-tester.lock.yml b/.github/workflows/daily-multi-device-docs-tester.lock.yml index 784a9778701..8a1b8d20f92 100644 --- a/.github/workflows/daily-multi-device-docs-tester.lock.yml +++ b/.github/workflows/daily-multi-device-docs-tester.lock.yml @@ -1180,7 +1180,7 @@ jobs: "playwright": { "command": "npx", "args": [ - "@playwright/mcp@latest", + "@playwright/mcp@1.56.1", "--output-dir", "/tmp/gh-aw/mcp-logs/playwright", "--allowed-origins", diff --git a/.github/workflows/dependabot-go-checker.lock.yml b/.github/workflows/dependabot-go-checker.lock.yml index e307e8f38a6..e6b161b3890 100644 --- a/.github/workflows/dependabot-go-checker.lock.yml +++ b/.github/workflows/dependabot-go-checker.lock.yml @@ -3,7 +3,7 @@ # gh aw compile # For more information: https://github.com/githubnext/gh-aw/blob/main/.github/instructions/github-agentic-workflows.instructions.md # -# Checks for Go module dependency updates and analyzes Dependabot PRs for compatibility and breaking changes +# Checks for Go module and NPM dependency updates and analyzes Dependabot PRs for compatibility and breaking changes # # Job Dependency Graph: # ```mermaid @@ -33,7 +33,7 @@ # - actions/upload-artifact@v5 (330a01c490aca151604b8cf639adc76d48f6c5d4) # https://github.com/actions/upload-artifact/commit/330a01c490aca151604b8cf639adc76d48f6c5d4 -name: "Dependabot Go Module Dependency Checker" +name: "Dependabot Dependency Checker" "on": schedule: - cron: "0 9 * * 1,3,5" @@ -49,7 +49,7 @@ permissions: concurrency: group: "gh-aw-${{ github.workflow }}" -run-name: "Dependabot Go Module Dependency Checker" +run-name: "Dependabot Dependency Checker" jobs: activation: @@ -1105,14 +1105,15 @@ jobs: mkdir -p "$PROMPT_DIR" # shellcheck disable=SC2006,SC2287 cat > "$GH_AW_PROMPT" << 'PROMPT_EOF' - # Dependabot Go Module Dependency Checker + # Dependabot Dependency Checker ## Objective - Check for available Go module updates using Dependabot, evaluate their safety, and create issues for safe updates. + Check for available Go module and NPM dependency updates using Dependabot, evaluate their safety, and create issues for safe updates. ## Current Context - **Repository**: ${GH_AW_EXPR_D892F163} - **Go Module File**: `go.mod` in repository root + - **NPM Packages**: Check for `@playwright/mcp` updates in constants.go ## Your Tasks @@ -1125,6 +1126,19 @@ jobs: - Security vulnerability information (if any) - Changelog or release notes (if available via web-fetch) + ### Phase 1.5: Check Playwright NPM Package Updates + 1. Check the current `@playwright/mcp` version in `pkg/constants/constants.go`: + - Look for `DefaultPlaywrightVersion` constant + - Extract the current version number + 2. Check for newer versions on NPM: + - Use web-fetch to query `https://registry.npmjs.org/@playwright/mcp` + - Compare the latest version with the current version in constants.go + - Get release information and changelog if available + 3. Evaluate the update: + - Check if it's a patch, minor, or major version update + - Look for breaking changes in release notes + - Consider security fixes and improvements + ### Phase 2: Evaluate Update Safety For each dependency update, evaluate: @@ -1282,6 +1296,53 @@ jobs: - Verify cross-platform compatibility ``` + ### Example 3: Playwright NPM Package Update + + ```markdown + ## Summary + Update `@playwright/mcp` package from 1.56.1 to 1.57.0 + + ## Current State + - **Package**: @playwright/mcp + - **Current Version**: 1.56.1 (in pkg/constants/constants.go - DefaultPlaywrightVersion) + - **Proposed Version**: 1.57.0 + - **Update Type**: Minor + + ## Safety Assessment + ✅ **Safe to update** + - Minor version update (1.56.1 -> 1.57.0) + - No breaking changes mentioned in release notes + - Includes bug fixes and new features + - Backward compatible + + ## Changes + - Added support for new Playwright features + - Improved MCP server stability + - Bug fixes in browser automation + - Performance improvements + + ## Links + - [NPM Package](https://www.npmjs.com/package/@playwright/mcp) + - [Release Notes](https://github.com/microsoft/playwright/releases/tag/v1.57.0) + - [Source Repository](https://github.com/microsoft/playwright) + + ## Recommended Action + ```bash + # Update the constant in pkg/constants/constants.go + # Change: const DefaultPlaywrightVersion = "1.56.1" + # To: const DefaultPlaywrightVersion = "1.57.0" + + # Then run tests to verify + make test-unit + ``` + + ## Testing Notes + - Run unit tests: `make test-unit` + - Verify Playwright MCP configuration generation + - Test browser automation workflows with playwright tool + - Check that version is correctly used in compiled workflows + ``` + PROMPT_EOF - name: Append XPIA security instructions to prompt env: @@ -1483,7 +1544,7 @@ jobs: model: "", version: "", agent_version: "0.0.358", - workflow_name: "Dependabot Go Module Dependency Checker", + workflow_name: "Dependabot Dependency Checker", experimental: false, supports_tools_allowlist: true, supports_http_transport: true, @@ -3748,7 +3809,7 @@ jobs: GH_AW_AGENT_OUTPUT: ${{ env.GH_AW_AGENT_OUTPUT }} GH_AW_ISSUE_TITLE_PREFIX: "[Dependabot] " GH_AW_ISSUE_LABELS: "dependencies,go" - GH_AW_WORKFLOW_NAME: "Dependabot Go Module Dependency Checker" + GH_AW_WORKFLOW_NAME: "Dependabot Dependency Checker" with: github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }} script: | @@ -4106,8 +4167,8 @@ jobs: - name: Setup threat detection uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8 env: - WORKFLOW_NAME: "Dependabot Go Module Dependency Checker" - WORKFLOW_DESCRIPTION: "Checks for Go module dependency updates and analyzes Dependabot PRs for compatibility and breaking changes" + WORKFLOW_NAME: "Dependabot Dependency Checker" + WORKFLOW_DESCRIPTION: "Checks for Go module and NPM dependency updates and analyzes Dependabot PRs for compatibility and breaking changes" with: script: | const fs = require('fs'); @@ -4342,7 +4403,7 @@ jobs: uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8 env: GH_AW_AGENT_OUTPUT: ${{ env.GH_AW_AGENT_OUTPUT }} - GH_AW_WORKFLOW_NAME: "Dependabot Go Module Dependency Checker" + GH_AW_WORKFLOW_NAME: "Dependabot Dependency Checker" with: github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }} script: | diff --git a/.github/workflows/dependabot-go-checker.md b/.github/workflows/dependabot-go-checker.md index 5acf1c28c75..5d6a1611e92 100644 --- a/.github/workflows/dependabot-go-checker.md +++ b/.github/workflows/dependabot-go-checker.md @@ -1,5 +1,5 @@ --- -description: Checks for Go module dependency updates and analyzes Dependabot PRs for compatibility and breaking changes +description: Checks for Go module and NPM dependency updates and analyzes Dependabot PRs for compatibility and breaking changes on: schedule: # Run every other business day: Monday, Wednesday, Friday at 9 AM UTC @@ -30,14 +30,15 @@ tools: bash: [":*"] --- -# Dependabot Go Module Dependency Checker +# Dependabot Dependency Checker ## Objective -Check for available Go module updates using Dependabot, evaluate their safety, and create issues for safe updates. +Check for available Go module and NPM dependency updates using Dependabot, evaluate their safety, and create issues for safe updates. ## Current Context - **Repository**: ${{ github.repository }} - **Go Module File**: `go.mod` in repository root +- **NPM Packages**: Check for `@playwright/mcp` updates in constants.go ## Your Tasks @@ -50,6 +51,19 @@ Check for available Go module updates using Dependabot, evaluate their safety, a - Security vulnerability information (if any) - Changelog or release notes (if available via web-fetch) +### Phase 1.5: Check Playwright NPM Package Updates +1. Check the current `@playwright/mcp` version in `pkg/constants/constants.go`: + - Look for `DefaultPlaywrightVersion` constant + - Extract the current version number +2. Check for newer versions on NPM: + - Use web-fetch to query `https://registry.npmjs.org/@playwright/mcp` + - Compare the latest version with the current version in constants.go + - Get release information and changelog if available +3. Evaluate the update: + - Check if it's a patch, minor, or major version update + - Look for breaking changes in release notes + - Consider security fixes and improvements + ### Phase 2: Evaluate Update Safety For each dependency update, evaluate: @@ -206,3 +220,50 @@ go mod tidy - Test system-specific functionality - Verify cross-platform compatibility ``` + +### Example 3: Playwright NPM Package Update + +```markdown +## Summary +Update `@playwright/mcp` package from 1.56.1 to 1.57.0 + +## Current State +- **Package**: @playwright/mcp +- **Current Version**: 1.56.1 (in pkg/constants/constants.go - DefaultPlaywrightVersion) +- **Proposed Version**: 1.57.0 +- **Update Type**: Minor + +## Safety Assessment +✅ **Safe to update** +- Minor version update (1.56.1 -> 1.57.0) +- No breaking changes mentioned in release notes +- Includes bug fixes and new features +- Backward compatible + +## Changes +- Added support for new Playwright features +- Improved MCP server stability +- Bug fixes in browser automation +- Performance improvements + +## Links +- [NPM Package](https://www.npmjs.com/package/@playwright/mcp) +- [Release Notes](https://github.com/microsoft/playwright/releases/tag/v1.57.0) +- [Source Repository](https://github.com/microsoft/playwright) + +## Recommended Action +```bash +# Update the constant in pkg/constants/constants.go +# Change: const DefaultPlaywrightVersion = "1.56.1" +# To: const DefaultPlaywrightVersion = "1.57.0" + +# Then run tests to verify +make test-unit +``` + +## Testing Notes +- Run unit tests: `make test-unit` +- Verify Playwright MCP configuration generation +- Test browser automation workflows with playwright tool +- Check that version is correctly used in compiled workflows +``` diff --git a/.github/workflows/unbloat-docs.lock.yml b/.github/workflows/unbloat-docs.lock.yml index b808ba2d0df..d098c28ad60 100644 --- a/.github/workflows/unbloat-docs.lock.yml +++ b/.github/workflows/unbloat-docs.lock.yml @@ -1988,7 +1988,7 @@ jobs: "playwright": { "command": "npx", "args": [ - "@playwright/mcp@latest", + "@playwright/mcp@1.56.1", "--output-dir", "/tmp/gh-aw/mcp-logs/playwright", "--allowed-origins", diff --git a/pkg/constants/constants.go b/pkg/constants/constants.go index 2c5d4abd8b5..33dd3a54102 100644 --- a/pkg/constants/constants.go +++ b/pkg/constants/constants.go @@ -29,6 +29,9 @@ const DefaultGitHubMCPServerVersion = "v0.20.2" // DefaultFirewallVersion is the default version of the gh-aw-firewall (AWF) binary const DefaultFirewallVersion = "v0.1.1" +// DefaultPlaywrightVersion is the default version of the @playwright/mcp package +const DefaultPlaywrightVersion = "1.56.1" + // DefaultBunVersion is the default version of Bun for runtime setup const DefaultBunVersion = "1.1" diff --git a/pkg/workflow/custom_engine_test.go b/pkg/workflow/custom_engine_test.go index 0ff7477353c..4a49c38c2a8 100644 --- a/pkg/workflow/custom_engine_test.go +++ b/pkg/workflow/custom_engine_test.go @@ -301,7 +301,7 @@ func TestCustomEngineRenderPlaywrightMCPConfigWithDomainConfiguration(t *testing } // Check that it contains Playwright MCP npx configuration - if !strings.Contains(output, "@playwright/mcp@latest") { + if !strings.Contains(output, "@playwright/mcp@1.56.1") { t.Errorf("Expected Playwright MCP npx package in output") } @@ -352,7 +352,7 @@ func TestCustomEngineRenderPlaywrightMCPConfigDefaultDomains(t *testing.T) { } // Check that it contains Playwright MCP npx configuration - if !strings.Contains(output, "@playwright/mcp@latest") { + if !strings.Contains(output, "@playwright/mcp@1.56.1") { t.Errorf("Expected Playwright MCP npx package in output") } diff --git a/pkg/workflow/mcp-config.go b/pkg/workflow/mcp-config.go index b588cff0233..04928eba75f 100644 --- a/pkg/workflow/mcp-config.go +++ b/pkg/workflow/mcp-config.go @@ -36,8 +36,8 @@ func renderPlaywrightMCPConfigWithOptions(yaml *strings.Builder, playwrightTool } // Determine version to use - respect version configuration if provided - playwrightPackage := "@playwright/mcp@latest" - if includeCopilotFields && args.ImageVersion != "" && args.ImageVersion != "latest" { + playwrightPackage := "@playwright/mcp@" + constants.DefaultPlaywrightVersion + if includeCopilotFields && args.ImageVersion != "" && args.ImageVersion != constants.DefaultPlaywrightVersion { playwrightPackage = "@playwright/mcp@" + args.ImageVersion } @@ -203,7 +203,7 @@ func renderPlaywrightMCPConfigTOML(yaml *strings.Builder, playwrightTool any) { yaml.WriteString(" [mcp_servers.playwright]\n") yaml.WriteString(" command = \"npx\"\n") yaml.WriteString(" args = [\n") - yaml.WriteString(" \"@playwright/mcp@latest\",\n") + yaml.WriteString(" \"@playwright/mcp@" + constants.DefaultPlaywrightVersion + "\",\n") yaml.WriteString(" \"--output-dir\",\n") yaml.WriteString(" \"/tmp/gh-aw/mcp-logs/playwright\"") if len(args.AllowedDomains) > 0 { diff --git a/pkg/workflow/mcp_config_refactor_test.go b/pkg/workflow/mcp_config_refactor_test.go index 7f7c57d54c0..e5fdd2ff45d 100644 --- a/pkg/workflow/mcp_config_refactor_test.go +++ b/pkg/workflow/mcp_config_refactor_test.go @@ -48,7 +48,7 @@ func TestRenderPlaywrightMCPConfigWithOptions(t *testing.T) { `"playwright": {`, `"command": "npx"`, `"args": [`, - `"@playwright/mcp@latest"`, + `"@playwright/mcp@1.56.1"`, `"--output-dir"`, `"/tmp/gh-aw/mcp-logs/playwright"`, ` },`, @@ -269,7 +269,7 @@ func TestRenderPlaywrightMCPConfigTOML(t *testing.T) { `[mcp_servers.playwright]`, `command = "npx"`, `args = [`, - `"@playwright/mcp@latest"`, + `"@playwright/mcp@1.56.1"`, `"--output-dir"`, `"/tmp/gh-aw/mcp-logs/playwright"`, }, diff --git a/pkg/workflow/mcp_config_shared_test.go b/pkg/workflow/mcp_config_shared_test.go index fe9ae9ff3d7..7881198c8d8 100644 --- a/pkg/workflow/mcp_config_shared_test.go +++ b/pkg/workflow/mcp_config_shared_test.go @@ -23,7 +23,7 @@ func TestRenderPlaywrightMCPConfigShared(t *testing.T) { wantContains: []string{ `"playwright": {`, `"command": "npx"`, - `"@playwright/mcp@latest"`, + `"@playwright/mcp@1.56.1"`, `"--output-dir"`, `"/tmp/gh-aw/mcp-logs/playwright"`, `"--allowed-origins"`, @@ -50,7 +50,7 @@ func TestRenderPlaywrightMCPConfigShared(t *testing.T) { wantContains: []string{ `"playwright": {`, `"command": "npx"`, - `"@playwright/mcp@latest"`, + `"@playwright/mcp@1.56.1"`, }, wantEnding: "},\n", }, diff --git a/pkg/workflow/mcp_renderer.go b/pkg/workflow/mcp_renderer.go index c220d291ffb..1aab5870ace 100644 --- a/pkg/workflow/mcp_renderer.go +++ b/pkg/workflow/mcp_renderer.go @@ -117,7 +117,7 @@ func (r *MCPConfigRendererUnified) renderPlaywrightTOML(yaml *strings.Builder, p yaml.WriteString(" [mcp_servers.playwright]\n") yaml.WriteString(" command = \"npx\"\n") yaml.WriteString(" args = [\n") - yaml.WriteString(" \"@playwright/mcp@latest\",\n") + yaml.WriteString(" \"@playwright/mcp@" + constants.DefaultPlaywrightVersion + "\",\n") yaml.WriteString(" \"--output-dir\",\n") yaml.WriteString(" \"/tmp/gh-aw/mcp-logs/playwright\"") if len(args.AllowedDomains) > 0 { diff --git a/pkg/workflow/mcp_servers.go b/pkg/workflow/mcp_servers.go index 2334168064d..bdf462f14e2 100644 --- a/pkg/workflow/mcp_servers.go +++ b/pkg/workflow/mcp_servers.go @@ -320,7 +320,7 @@ func getGitHubAllowedTools(githubTool any) []string { } func getPlaywrightDockerImageVersion(playwrightTool any) string { - playwrightDockerImageVersion := "latest" // Default Playwright Docker image version + playwrightDockerImageVersion := constants.DefaultPlaywrightVersion // Default Playwright package version // Extract version setting from tool properties if toolConfig, ok := playwrightTool.(map[string]any); ok { if versionSetting, exists := toolConfig["version"]; exists { diff --git a/pkg/workflow/version_field_test.go b/pkg/workflow/version_field_test.go index 64962d7ee4e..a33eb1e0864 100644 --- a/pkg/workflow/version_field_test.go +++ b/pkg/workflow/version_field_test.go @@ -48,8 +48,8 @@ func TestVersionField(t *testing.T) { "allowed_domains": []any{"example.com"}, } result = getPlaywrightDockerImageVersion(playwrightToolDefault) - if result != "latest" { - t.Errorf("Expected default latest, got %s", result) + if result != "1.56.1" { + t.Errorf("Expected default 1.56.1, got %s", result) } })