ci on Linux: --no-sandbox for the Chromium storebound starts itself as root on Linux or in a container (sandboxArgs; Chromium refuses root without it), never on macOS / Windows / a normal user; workflow caches Playwright's browsers; capture-web prints the capture's stderr when a run fails

.forgejo/workflows/ci.yml

@@ -61,7 +61,16 @@ jobs:
           rustup component add clippy
           bun --version && cargo --version
           bun install --frozen-lockfile
-      - name: Headless Chromium (desktop boot check)
+      # Playwright's Chromium and headless shell (~280 MB), keyed by the locked playwright version; the system
+      # libraries and fonts (--with-deps) are installed on every run, the job container starts clean
+      - uses: actions/cache@v4
+        with:
+          path: ~/.cache/ms-playwright
+          key: playwright-${{ runner.os }}-${{ hashFiles('bun.lock') }}
+          restore-keys: playwright-${{ runner.os }}-
+      # the job runs as root in a container: storebound adds --no-sandbox to the Chromium it starts itself there
+      # (cli/shots/browser.ts sandboxArgs), Playwright's own launches already pass it
+      - name: Headless Chromium (browser tests, desktop boot check)
         run: bunx playwright install --with-deps chromium
       - name: bun run ci
         run: bun run ci