You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
test(e2e): fix flaky attachments UI tests with web-first wait (#1327)
## Summary
Fixes the flaky **E2E UI Tests** failure on `attachments.e2e.test.ts`
(the "should display attachments from fixture directory" test timed out
with an empty body in PR #1326's CI run, passing only on re-run).
## Root cause
Every test in the file asserted `body.textContent() !== ""` by reading
`textContent()` **once**, right after the `<body>` element attached. In
an SPA the body shell exists before React's first paint, so this races
the initial render with **no auto-retry**. The passing tests
incidentally got settle time (the `sendTestEnvelope` fixture sleeps
500ms, or `waitForTimeout(1000)`); the failing test sends no envelope,
so it had no slack and flaked under CI load.
## Fix
- Add a web-first `waitForAppReady(page)` helper in `fixtures.ts` that
asserts the navigation sidebar (`nav[aria-label="Navigation"]`) is
visible. The sidebar (`TelemetrySidebar`) renders **unconditionally**
once the app mounts, independent of telemetry data, so Playwright's
auto-retrying `toBeVisible()` eliminates the render race.
- Replace the fragile one-shot `body.textContent()` checks throughout
`attachments.e2e.test.ts` with `waitForAppReady(page)`.
This is also a **stronger** assertion: if the UI crashed into the
`ErrorBoundary` fallback (which renders no nav), these tests now
correctly fail instead of passing on non-empty body text.
## Verification
- Lint (biome) + TypeScript check pass on the changed files.
- ⚠️ I could not run the Playwright UI suite locally — this environment
couldn't download the chromium browser (CDN download stalled/retried
repeatedly). CI has browsers preinstalled and is the exact environment
where the flake occurred; I'll confirm stability by running the E2E UI
job here (including re-runs).
***esbuild override cap in getsentry/spotlight — resolved at 0.28.1**: The pnpm override \`"esbuild": ">=0.25.0 <0.28.0"\` was a deliberate cap to avoid esbuild#4436 (erroring on destructuring for old targets). Trap: bumping to \`>=0.28.1\` looks risky because 0.28.x retained that behavior. Fix: the regression did NOT reappear in practice — website build succeeded without adding \`target: "es2020"\`. Override is now \`"esbuild": ">=0.28.1"\`, resolving Dependabot alerts #279 and #280.
13
+
***esbuild override cap in getsentry/spotlight — resolved at 0.28.1**: The pnpm override \`"esbuild": ">=0.25.0 <0.28.0"\` was a deliberate cap to avoid esbuild#4436 (erroring on destructuring for old targets). Trap: bumping to \`>=0.28.1\` looks risky because 0.28.x retained that behavior. Fix: the regression did NOT reappear in practice — website build succeeded without adding \`target: "es2020"\`. Override is now \`"esbuild": ">=0.28.1"\`, resolving Dependabot alerts #279 and #280. These alerts were merged via PR #1323 on 2026-06-16 and will auto-close without further action.
***plist override breaks electron-builder osx-sign**: Forcing \`plist>=3.1.1\` via pnpm overrides bumps it to v5.x, which breaks \`@electron/osx-sign@1.0.5\` (used by \`electron-builder@24.13.3\`) due to incompatible CJS \`require()\` and new \`exports\` map. Fix: remove the \`plist\` override and instead override \`@xmldom/xmldom\` directly to \`>=0.8.13\` (first patched 0.8.x version). This keeps \`plist@3.1.0\` for osx-sign compatibility while eliminating the \`@xmldom/xmldom\` vulnerability.
***Security dep-bump workflow in getsentry/spotlight**: Pattern for resolving Dependabot alerts: (1) fetch alerts via \`gh api /repos/{owner}/{repo}/dependabot/alerts\`; (2) plan fix in \`.opencode/plans/\`; (3) bump pnpm override in root \`package.json\`; (4) run \`pnpm install\`, verify lockfile, run full \`pnpm build\` + \`vitest run\`; (5) create branch \`security/deps-\<pkg>-\<version>\` off main, commit, push, open PR. Untracked \`.opencode/\` and \`packages/website/content.config.ts\` are intentionally excluded from security commits.
21
+
***Security dep-bump workflow in getsentry/spotlight**: Pattern for resolving Dependabot alerts in getsentry/spotlight: (1) fetch alerts via \`gh api /repos/{owner}/{repo}/dependabot/alerts\`; (2) plan fix in \`.opencode/plans/\`; (3) bump pnpm overrides in root \`package.json\` AND bump direct deps in affected \`packages/\*/package.json\` where needed (e.g. astro direct dep); (4) run \`pnpm install\`, verify lockfile, run full \`pnpm build\` + \`vitest run\`; (5) create branch \`security/deps-\<descriptor>\` off main, commit, push, open PR. Vite major-version overrides must be bounded (e.g. \`<8\`) to prevent accidental major jumps. Untracked \`.opencode/\` and \`packages/website/content.config.ts\` are intentionally excluded from security commits. E2E UI test flakes are known — rerun before investigating.
0 commit comments