Catch-up CI: cache Playwright browsers (unblocks staging deploys)

[cursor]

Parent issue: #23

Parent: search for issue titled “Epic Stack catch-up: tracking”.

Do this next after package 1/7 (#24) is merged to dev. It is not an Epic Stack port. It unblocks every later catch-up PR: merge-to-dev staging deploys needs the Playwright job, and that job has been hanging ~60 minutes on Install Playwright Browsers (then cancelled). Same hang on an origin/dev push, so it is not unique to the RR bump.

Read .cursor/skills/epic-stack-catch-up/SKILL.md before coding.

Goal

Make the Playwright job in .github/workflows/deploy.yml reliably get past browser install so lint / typecheck / vitest / Playwright can finish and dev can auto-deploy staging.

Do not skip Playwright. Do not drop e2e coverage on dependency PRs.

Why

Observed on 2026-08-19:

• PR Bump React Router to 7.18.2 for __manifest DoS CVEs #31 (package 1/7) first Playwright run did install browsers, then failed collection by parsing sprite.svg as JS (fixed in that PR with a test-only stub — do not redo unless it regressed).
• A later run of the same PR, and a push to origin/dev, sat on 📥 Install Playwright Browsers (npm run test:e2e:install → npx playwright install --with-deps chromium) until the 60-minute job timeout / cancel. Tests never started.

There is no cache of ~/.cache/ms-playwright. Epic Stack’s workflow is the same uncached install; this issue is our CI reliability, not a file copy from upstream.

Do this

Branch off current origin/dev. PR into dev.

1. Cache Playwright browsers, keyed by runner OS + @playwright/test version (so package 6/7’s Playwright bump refills once, on purpose).
2. On cache hit, do not re-download browsers. Still install OS deps if needed (npx playwright install-deps chromium) unless you verify the ubuntu-22.04 image already has them.
3. On cache miss, install Chromium (keep --with-deps if required). Prefer failing the install step in ~10–15 minutes over eating the full 60-minute job timeout with a silent hang.
4. Keep timeout-minutes: 60 on the job (tests need it). Add a step-level timeout on install if Actions supports it for that step.
5. Do not change test files, app code, or playwright.config.ts unless install/cache requires a one-line script tweak in package.json.
6. Do not skip the Playwright job, and do not make it continue-on-error.

Suggested shape (adapt; do not paste blindly if Playwright’s current CI docs differ):

- name: 📥 Get Playwright version
  id: playwright-version
  run: echo "version=$(node -e "console.log(require('@playwright/test/package.json').version)")" >> "$GITHUB_OUTPUT"

- name: 🏦 Cache Playwright browsers
  id: playwright-cache
  uses: actions/cache@v4
  with:
    path: ~/.cache/ms-playwright
    key: playwright-${{ runner.os }}-${{ steps.playwright-version.outputs.version }}

- name: 📥 Install Playwright Browsers
  if: steps.playwright-cache.outputs.cache-hit != 'true'
  timeout-minutes: 15
  run: npm run test:e2e:install

- name: 📥 Install Playwright OS deps
  if: steps.playwright-cache.outputs.cache-hit == 'true'
  timeout-minutes: 10
  run: npx playwright install-deps chromium

If the first cache-miss install still hangs, say so in the PR with the log snippet (download vs apt --with-deps). Do not “fix” it by deleting Playwright from needs.

Files allowed

• .github/workflows/deploy.yml
• package.json only if you split test:e2e:install into install vs install-deps scripts
• playwright.config.ts only if a documented Playwright CI requirement appears (prefer not)

Do not

• Do not bump @playwright/test, Vite, Express, Sentry, Prisma, or React Router
• Do not skip Playwright on PRs
• Do not start packages 2–7
• Do not use PR P/patn dev stack updater #21 as a base
• Do not edit dashboard, Fly, or app routes

Acceptance

• Playwright job gets past browser install in well under 60 minutes on a PR (cache miss once, cache hit on a follow-up push if needed)
• Lint, typecheck, vitest still run; Playwright still required for deploy
• Cache key includes @playwright/test version
• PR targets dev

Staging smoke (human, after merge to dev)

• Confirm the dev workflow’s Playwright job completes (not cancelled on Install Browsers)
• Staging deploy can proceed when the rest of CI is green

---

PR target: dev (never main). Implement only this issue.