ci: pin browser-tests to ubuntu-latest (fix Playwright deps on CodeBuild)#1736
Merged
Conversation
…ild) #1715 moved every job onto the CodeBuild-hosted runner. The browser-tests job runs `npx playwright install chromium --with-deps`, which shells out to the system package manager to install Chromium's OS-level shared libraries. The CodeBuild runner image has no apt-get and Playwright doesn't recognize its distro, so the step deterministically fails: BEWARE: your OS is not officially supported by Playwright ... sh: line 1: apt-get: command not found Failed to install browsers Error: Installation process exited with code: 127 The e2e matrix passes because it never touches Playwright. Pin only browser-tests back to GitHub-hosted ubuntu-latest (a Playwright-supported OS where --with-deps works), same pattern already used for codeql and ci-failure-issue. Constraint: CodeBuild runner image lacks apt-get and is an unrecognized distro Rejected: Custom Playwright CodeBuild image | larger change, needs CodeBuild project image support Rejected: Manually install libs via yum in-job | fragile, guesses the distro Confidence: high Scope-risk: narrow Directive: browser-tests makes real AWS calls (sts + `agentcore dev`); if ubuntu-latest shared IPs trip the service WAF (the 403s #1715 was avoiding), revisit with a custom Playwright-capable CodeBuild image rather than reverting this pin Not-tested: whether ubuntu-latest reintroduces WAF 403s under current traffic
jesseturner21
temporarily deployed
to
e2e-testing
GitHub Actions
Inactive
github-actions
Bot
added
the
agentcore-harness-reviewing
tejaskash
approved these changes
Jul 10, 2026
github-actions
Bot
removed
the
agentcore-harness-reviewing
agentcore-devx-automation
Bot
added
the
claude-security-reviewing
Contributor
Package TarballHow to installgh release download pr-1736-tarball --repo aws/agentcore-cli --pattern "*.tgz" --dir /tmp/pr-tarball
npm install -g /tmp/pr-tarball/aws-agentcore-0.23.0.tgz |
Contributor
|
Claude Security Review: no high-confidence findings. (run) |
agentcore-devx-automation
Bot
removed
the
claude-security-reviewing
Contributor
Coverage Report
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
Browser tests have been failing on
mainsince #1715 (`ci: run all workflows on CodeBuild-hosted runners`).The e2e matrix passes; only browser-tests fails, at the Install Playwright browsers step:
```
$ npx playwright install chromium --with-deps
BEWARE: your OS is not officially supported by Playwright; installing dependencies for ubuntu24.04-x64 as a fallback.
Installing dependencies...
sh: line 1: apt-get: command not found
Failed to install browsers
Error: Installation process exited with code: 127
```
(failing run)
Root cause
--with-depsshells out to the system package manager to install Chromium's OS-level shared libraries. On the GitHub-hostedubuntu-latestrunner that worked (apt-get present, recognized distro). #1715 moved this job onto the CodeBuild-hosted runner, whose image has noapt-getand isn't a Playwright-recognized distro — so the step exits 127 deterministically. e2e jobs are unaffected because they never touch Playwright.Fix
Pin only
browser-testsback toubuntu-latest— a Playwright-supported OS where--with-depsworks. This mirrors the pattern #1715 already uses forcodeqlandci-failure-issue. All other jobs stay on CodeBuild.Tradeoff / follow-up
browser-tests makes real AWS calls (`sts get-caller-identity` + `agentcore dev`). If ubuntu-latest shared IPs reintroduce the service WAF 403s that #1715 was avoiding, the better fix is a custom Playwright-capable CodeBuild image (deps baked in, drop `--with-deps`) rather than reverting this pin. Not reproduced under current traffic.