From b6462e9b2368d88a11968dd1178a5ba2e51f622a Mon Sep 17 00:00:00 2001 From: Simon Knott Date: Wed, 5 Aug 2026 21:52:37 +0200 Subject: [PATCH 1/3] devops: add 7-day Dependabot cooldown for npm (#42134) --- .github/dependabot.yml | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 2c48305b7ebfa..74efe116f108d 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -9,3 +9,13 @@ updates: interval: "weekly" cooldown: default-days: 7 + + - package-ecosystem: "npm" + directory: "/" + groups: + npm: + patterns: ["*"] + schedule: + interval: "weekly" + cooldown: + default-days: 7 From 4acdb2f958218de5a7e56fc7423618e4a463e6b4 Mon Sep 17 00:00:00 2001 From: Yury Semikhatsky Date: Wed, 5 Aug 2026 14:40:12 -0700 Subject: [PATCH 2/3] devops: add ESRP pipeline for publishing npm alpha versions (#42144) --- .azure-pipelines/publish.yml | 137 +++++++++++++++++++++++++++++++++++ 1 file changed, 137 insertions(+) create mode 100644 .azure-pipelines/publish.yml diff --git a/.azure-pipelines/publish.yml b/.azure-pipelines/publish.yml new file mode 100644 index 0000000000000..3ce29019b33a8 --- /dev/null +++ b/.azure-pipelines/publish.yml @@ -0,0 +1,137 @@ +# Publishes @next (alpha) versions of all npm packages via ESRP. Manual trigger only. +trigger: none + +pr: none + +resources: + repositories: + - repository: 1esPipelines + type: git + name: 1ESPipelineTemplates/1ESPipelineTemplates + ref: refs/tags/release + +extends: + template: v1/1ES.Official.PipelineTemplate.yml@1esPipelines + parameters: + pool: + name: DevDivPlaywrightAzurePipelinesUbuntu2204 + os: linux + sdl: + sourceAnalysisPool: + # SDL tools require windows, see https://aka.ms/AAo6v8e + name: DevDivPlaywrightAzurePipelinesWindows2022 + os: windows + stages: + - stage: Stage + jobs: + - job: Build + displayName: "Build npm packages" + templateContext: + outputs: + - output: pipelineArtifact + path: $(Build.ArtifactStagingDirectory)/esrp-build + artifact: esrp-build + steps: + - checkout: self + displayName: "Checkout code" + + - task: Bash@3 + displayName: "Check the branch is main" + inputs: + targetType: "inline" + script: | + if [[ "$BUILD_SOURCE_BRANCH" != "refs/heads/main" ]]; then + echo "Alpha versions can only be published from main." + echo "Unexpected branch: $BUILD_SOURCE_BRANCH" + exit 1 + fi + env: + BUILD_SOURCE_BRANCH: $(Build.SourceBranch) + + - task: UseNode@1 + inputs: + version: '26.x' + displayName: "Install Node.js" + + - task: Bash@3 + displayName: "setup .npmrc" + inputs: + targetType: "inline" + script: | + echo "registry=https://devdiv.pkgs.visualstudio.com/DevDiv/_packaging/DevDiv_PublicPackages/npm/registry/" >> .npmrc + + - task: npmAuthenticate@0 + displayName: "authenticate the private npm registry" + inputs: + workingFile: .npmrc + + - script: npm ci + displayName: "npm ci" + + - script: npm run build + displayName: "npm run build" + + - task: Bash@3 + displayName: "Set alpha version with commit timestamp" + inputs: + targetType: "inline" + script: | + set -e + node utils/build/update_canary_version.js --alpha --commit-timestamp + node utils/workspace.js --ensure-consistent + VERSION=$(node utils/workspace.js --get-version) + if [[ "$VERSION" != *-alpha-* ]]; then + echo "ERROR: unexpected version '$VERSION', must be an alpha version" + exit 1 + fi + + - task: Bash@3 + displayName: "Pack all packages" + inputs: + targetType: "inline" + script: | + set -e + mkdir -p "$(Build.ArtifactStagingDirectory)/esrp-build" + node utils/workspace.js --list-public-package-paths | while read package; do + # ESRP runs `npm publish` without a --tag argument, so the dist-tag + # has to be baked into each tarball via publishConfig.tag. + node -e " + const fs = require('fs'); + const file = process.argv[1] + '/package.json'; + const pkg = JSON.parse(fs.readFileSync(file, 'utf8')); + pkg.publishConfig = { ...pkg.publishConfig, tag: 'next' }; + fs.writeFileSync(file, JSON.stringify(pkg, null, 2) + '\n'); + " "$package" + npm pack --pack-destination="$(Build.ArtifactStagingDirectory)/esrp-build" "$package" + done + ls -la "$(Build.ArtifactStagingDirectory)/esrp-build" + + - job: Publish + displayName: "ESRP Release to npm" + dependsOn: Build + templateContext: + type: releaseJob + isProduction: true + inputs: + - input: pipelineArtifact + artifactName: esrp-build + targetPath: $(Build.ArtifactStagingDirectory)/esrp-build + steps: + - checkout: none + - task: EsrpRelease@11 + inputs: + connectedservicename: 'Playwright-ESRP-PME' + usemanagedidentity: true + keyvaultname: 'playwright-esrp-pme' + signcertname: 'ESRP-Release-Sign' + clientid: '13434a40-7de4-4c23-81a3-d843dc81c2c5' + intent: 'PackageDistribution' + contenttype: 'npm' + folderlocation: '$(Build.ArtifactStagingDirectory)/esrp-build' + waitforreleasecompletion: true + owners: 'yurys@microsoft.com' + approvers: 'yurys@microsoft.com' + serviceendpointurl: 'https://api.esrp.microsoft.com' + mainpublisher: 'Playwright' + domaintenantid: '975f013f-7f24-47e8-a7d3-abc4752bf346' + displayName: 'ESRP Release to npm' From 3eead79d679c1b862c3aa57f2f23ddf03203a4b2 Mon Sep 17 00:00:00 2001 From: Yury Semikhatsky Date: Wed, 5 Aug 2026 15:48:07 -0700 Subject: [PATCH 3/3] devops: authenticate stable-test-runner npm registry in ESRP pipeline (#42146) --- .azure-pipelines/publish.yml | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/.azure-pipelines/publish.yml b/.azure-pipelines/publish.yml index 3ce29019b33a8..9084641a45646 100644 --- a/.azure-pipelines/publish.yml +++ b/.azure-pipelines/publish.yml @@ -59,12 +59,18 @@ extends: targetType: "inline" script: | echo "registry=https://devdiv.pkgs.visualstudio.com/DevDiv/_packaging/DevDiv_PublicPackages/npm/registry/" >> .npmrc + echo "registry=https://devdiv.pkgs.visualstudio.com/DevDiv/_packaging/DevDiv_PublicPackages/npm/registry/" >> tests/playwright-test/stable-test-runner/.npmrc - task: npmAuthenticate@0 displayName: "authenticate the private npm registry" inputs: workingFile: .npmrc + - task: npmAuthenticate@0 + displayName: "authenticate the private npm registry for stable-test-runner" + inputs: + workingFile: tests/playwright-test/stable-test-runner/.npmrc + - script: npm ci displayName: "npm ci"