fix: migrate playwright-go to mxschmitt/playwright-go (CDN shutdown)

[kdacosta0]

Summary

• Migrate playwright-community/playwright-go → mxschmitt/playwright-go (one-line change)
• The Playwright /builds/driver CDN (azureedge) has been shut down — playwright install fails with 404
• The module moved to mxschmitt/playwright-go which downloads the driver from npm + nodejs.org instead (PR #615)

Related PRs

• sigstore-e2e: fix: migrate playwright-go to mxschmitt/playwright-go v0.6100.0 sigstore-e2e#80
• releases: https://github.com/securesign/releases/pull/291
• Jira: SECURESIGN-4984

🤖 Generated with Claude Code

[qodo-for-securesign]

PR Summary by Qodo

Fix Playwright install by migrating to mxschmitt/playwright-go

🐞 Bug fix ⚙️ Configuration changes 🕐 Less than 10 minutes

AI Description

• Switch Playwright Go module path to avoid the deprecated azureedge driver CDN
• Restore playwright install chromium in integration-test job provisioning
• Keep existing workflow intact while changing only the install source

Diagram

graph TD
  A["sigstore-e2e task"] --> B["Playwright installer"] --> C["Chromium driver"]
  B --> D["npm registry"]
  B --> E["nodejs.org"]

Loading

High-Level Assessment

The following are alternative approaches to this PR:

1. Pre-bake Playwright browsers/driver into the test image

• ➕ Eliminates runtime downloads and CDN/registry outage risk
• ➕ Speeds up CI by avoiding repeated installs
• ➖ Requires maintaining a custom image and update cadence
• ➖ Larger images and potential multi-arch complexity

2. Host an internal mirror for Playwright driver assets

• ➕ Central control over availability and retention
• ➕ Can pin and audit artifacts for supply-chain policies
• ➖ Operational overhead (storage, publishing, access control)
• ➖ Extra plumbing in CI to point installers at the mirror

Recommendation: Proceed with the current one-line migration to mxschmitt/playwright-go: it is the smallest change that directly fixes the 404 failure caused by the retired azureedge CDN, while keeping the existing Go-based install workflow. Consider pre-baking or mirroring only if CI stability or network policy requirements justify the added maintenance burden.

Files changed (1) +1 / -1

Bug fix (1) +1 / -1

sigstore-e2e.yamlUpdate Playwright Go module path for chromium install step +1/-1

Update Playwright Go module path for chromium install step

• Replaces the 'go run' target from 'playwright-community/playwright-go' to 'mxschmitt/playwright-go' for the 'playwright install chromium' provisioning step. This avoids the retired driver CDN used by the previous module and restores install reliability in CI.

tasks/integration-test/sigstore-e2e.yaml

[qodo-for-securesign]

Code Review by Qodo

🐞 Bugs (2) 📘 Rule violations (0) 📜 Skill insights (0)

Context used

⚠️ Tickets: not configured — ticket URL found in PR but could not be fetched — check ticket provider credentials

1. Unpinned module execution 🐞 Bug ☼ Reliability

Description

go run github.com/mxschmitt/playwright-go/... is invoked without an explicit version, so CI will
resolve and execute whatever @latest is at runtime and can break unexpectedly when upstream
releases change behavior or requirements. This also undermines the task’s otherwise pinned-by-digest
approach for dependencies.

Code

tasks/integration-test/sigstore-e2e.yaml[152]

+        go run github.com/mxschmitt/playwright-go/cmd/playwright install chromium

Relevance

⭐ Low

Same task previously merged with unversioned go run Playwright install; no history of pinning this
(PRs 479,480).

PR-#479
PR-#480

ⓘ Recommendations generated based on similar findings in past PRs

Evidence

The task executes an unversioned go run of the Playwright installer, while other dependencies
(images) are pinned by digest, indicating an expectation of reproducibility that this violates.

tasks/integration-test/sigstore-e2e.yaml[74-105]
tasks/integration-test/sigstore-e2e.yaml[142-154]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

### Issue description
The task runs a remote Go module via `go run` without specifying a version, making the pipeline non-reproducible and prone to upstream breakage.

### Issue Context
This Tekton task pins container images by digest but leaves the `playwright` installer tool unpinned.

### Fix
Pin the module version explicitly (or make it a Task param with a pinned default), e.g.:
- `PLAYWRIGHT_GO_VERSION=vX.Y.Z`
- `go run github.com/mxschmitt/playwright-go/cmd/playwright@${PLAYWRIGHT_GO_VERSION} install chromium`

### Fix Focus Areas
- tasks/integration-test/sigstore-e2e.yaml[142-154]

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

2. Remote code runs with creds 🐞 Bug ⛨ Security

Description

The task downloads and executes a public Go module (go run github.com/mxschmitt/playwright-go/...)
inside the same step that mounts cluster credentials and sets KUBECONFIG, so any compromise or
malicious change upstream would run with access to those credentials. This is an avoidable
supply-chain risk introduced by switching to a new external module source without pinning/isolation.

Code

tasks/integration-test/sigstore-e2e.yaml[152]

+        go run github.com/mxschmitt/playwright-go/cmd/playwright install chromium

Relevance

⭐ Low

This Playwright go run executes in the sigstore-e2e task and was previously merged without
isolation despite credentials (PRs 479,480).

PR-#479
PR-#480

ⓘ Recommendations generated based on similar findings in past PRs

Evidence

The step explicitly mounts /credentials and sets KUBECONFIG, then runs go run on a GitHub
module path, meaning downloaded code executes in the same trust boundary as the cluster credentials.

tasks/integration-test/sigstore-e2e.yaml[103-116]
tasks/integration-test/sigstore-e2e.yaml[152-153]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

### Issue description
A remotely-fetched module is executed via `go run` in a step that has mounted cluster credentials (`/credentials`) and `KUBECONFIG` set, expanding the CI supply-chain attack surface.

### Issue Context
The `execute-tas-e2e` step both:
- mounts credentials and configures `KUBECONFIG`
- runs `go run .../cmd/playwright install chromium`

### Fix
Do one (or more) of the following:
1) Split Playwright install into a separate Tekton step **without** the credentials volume mount and without `KUBECONFIG`.
2) Pin the module version (`...@vX.Y.Z`) to prevent arbitrary upstream changes.
3) Prefer a prebuilt, pinned installer artifact (or a pinned container image/tooling step) rather than `go run` from the network.

### Fix Focus Areas
- tasks/integration-test/sigstore-e2e.yaml[103-116]
- tasks/integration-test/sigstore-e2e.yaml[142-154]

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---