From 2a7a0e87bacb13cf0f3c3560dd4e5506e90797c1 Mon Sep 17 00:00:00 2001
From: Brady Pratt <bpratt@redhat.com>
Date: Thu, 16 Jul 2026 19:36:57 -0500
Subject: [PATCH] ci(quay): publish Playwright runner images

Build the Playwright runner from its repository-owned Dockerfile and regenerate the Quay image jobs with both Dockerfile paths in sparse checkout.

Promote the Quay server and Playwright runner after master merges using both the moving latest tag and immutable commit tags.
---
 .../config/quay/quay/quay-quay-master.yaml    | 19 ++----
 .../quay/quay-quay-master-postsubmits.yaml    | 65 +++++++++++++++++++
 .../quay/quay-quay-master-presubmits.yaml     |  2 +
 3 files changed, 73 insertions(+), 13 deletions(-)
 create mode 100644 ci-operator/jobs/quay/quay/quay-quay-master-postsubmits.yaml

diff --git a/ci-operator/config/quay/quay/quay-quay-master.yaml b/ci-operator/config/quay/quay/quay-quay-master.yaml
index 6e00812f9a932..6b9b5301c3b1a 100644
--- a/ci-operator/config/quay/quay/quay-quay-master.yaml
+++ b/ci-operator/config/quay/quay/quay-quay-master.yaml
@@ -20,21 +20,14 @@ images:
   items:
   - dockerfile_path: Dockerfile
     to: quay-server
-  - dockerfile_literal: |
-      FROM src
-      RUN dnf module enable -y nodejs:20 && \
-          dnf install -y nodejs \
-          alsa-lib atk at-spi2-atk cups-libs libdrm libXcomposite \
-          libXdamage libXrandr mesa-libgbm pango nss nss-util nspr \
-          libxkbcommon libXfixes libXcursor libXext libXi libXtst \
-          libwayland-client && \
-          dnf clean all
-      WORKDIR /go/src/github.com/quay/quay/web
-      RUN npm ci
-      ENV PLAYWRIGHT_BROWSERS_PATH=/opt/playwright
-      RUN npx playwright install chromium
+  - dockerfile_path: web/playwright/Dockerfile
     from: src
     to: quay-playwright-runner
+promotion:
+  to:
+  - namespace: quay
+    tag: latest
+    tag_by_commit: true
 releases:
   latest:
     candidate:
diff --git a/ci-operator/jobs/quay/quay/quay-quay-master-postsubmits.yaml b/ci-operator/jobs/quay/quay/quay-quay-master-postsubmits.yaml
new file mode 100644
index 0000000000000..9c8dc4443d1e6
--- /dev/null
+++ b/ci-operator/jobs/quay/quay/quay-quay-master-postsubmits.yaml
@@ -0,0 +1,65 @@
+postsubmits:
+  quay/quay:
+  - agent: kubernetes
+    always_run: true
+    branches:
+    - ^master$
+    cluster: build01
+    decorate: true
+    decoration_config:
+      sparse_checkout_files:
+      - Dockerfile
+      - web/playwright/Dockerfile
+    labels:
+      ci-operator.openshift.io/is-promotion: "true"
+      ci.openshift.io/generator: prowgen
+      job-release: "4.21"
+    max_concurrency: 1
+    name: branch-ci-quay-quay-master-images
+    spec:
+      containers:
+      - args:
+        - --gcs-upload-secret=/secrets/gcs/service-account.json
+        - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson
+        - --image-mirror-push-secret=/etc/push-secret/.dockerconfigjson
+        - --promote
+        - --report-credentials-file=/etc/report/credentials
+        - --target=[images]
+        command:
+        - ci-operator
+        image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest
+        imagePullPolicy: Always
+        name: ""
+        resources:
+          requests:
+            cpu: 10m
+        volumeMounts:
+        - mountPath: /secrets/gcs
+          name: gcs-credentials
+          readOnly: true
+        - mountPath: /secrets/manifest-tool
+          name: manifest-tool-local-pusher
+          readOnly: true
+        - mountPath: /etc/pull-secret
+          name: pull-secret
+          readOnly: true
+        - mountPath: /etc/push-secret
+          name: push-secret
+          readOnly: true
+        - mountPath: /etc/report
+          name: result-aggregator
+          readOnly: true
+      serviceAccountName: ci-operator
+      volumes:
+      - name: manifest-tool-local-pusher
+        secret:
+          secretName: manifest-tool-local-pusher
+      - name: pull-secret
+        secret:
+          secretName: registry-pull-credentials
+      - name: push-secret
+        secret:
+          secretName: registry-push-credentials-ci-central
+      - name: result-aggregator
+        secret:
+          secretName: result-aggregator
diff --git a/ci-operator/jobs/quay/quay/quay-quay-master-presubmits.yaml b/ci-operator/jobs/quay/quay/quay-quay-master-presubmits.yaml
index f402b7cd9e9b3..d696d7b0cb29a 100644
--- a/ci-operator/jobs/quay/quay/quay-quay-master-presubmits.yaml
+++ b/ci-operator/jobs/quay/quay/quay-quay-master-presubmits.yaml
@@ -11,6 +11,7 @@ presubmits:
     decoration_config:
       sparse_checkout_files:
       - Dockerfile
+      - web/playwright/Dockerfile
     labels:
       ci.openshift.io/generator: prowgen
       job-release: "4.21"
@@ -68,6 +69,7 @@ presubmits:
     decoration_config:
       sparse_checkout_files:
       - Dockerfile
+      - web/playwright/Dockerfile
       timeout: 4h0m0s
     labels:
       ci-operator.openshift.io/cloud: aws