From 6bbdec2a4ef8b09b8501748ad46b98b95bc611b3 Mon Sep 17 00:00:00 2001
From: Patrick Erichsen <patrick.a.erichsen@gmail.com>
Date: Thu, 18 Jun 2026 17:40:55 -0700
Subject: [PATCH] ci: shard local-auth playwright gate (#2743)

---
 .github/workflows/ci.yml | 81 +++++++++++++++++++++++++++++++++++++---
 1 file changed, 75 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 421b506b..a091d193 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -94,8 +94,16 @@ jobs:
 
       - uses: ./.github/actions/setup-bun
 
+      - name: Cache Playwright browsers
+        uses: actions/cache@v5
+        with:
+          path: ~/.cache/ms-playwright
+          key: ${{ runner.os }}-playwright-${{ hashFiles('bun.lock') }}
+          restore-keys: |
+            ${{ runner.os }}-playwright-
+
       - name: Install Playwright browsers
-        run: bunx playwright install --with-deps chromium
+        run: bunx playwright install chromium
 
       - name: Browser e2e
         run: bun run ci:playwright-smoke
@@ -108,26 +116,87 @@ jobs:
           path: playwright-report/
           if-no-files-found: ignore
 
-  playwright-local-auth:
-    name: playwright-local-auth
+  playwright-local-auth-shard:
+    name: playwright-local-auth / ${{ matrix.name }}
     runs-on: ubuntu-latest
     timeout-minutes: 30
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - name: delete-account
+            spec: e2e/local-auth/delete-account-resources.pw.test.ts
+          - name: delete-org
+            spec: e2e/local-auth/delete-org-resources.pw.test.ts
+          - name: header-profile-link
+            spec: e2e/local-auth/header-profile-link.pw.test.ts
+          - name: malicious-skill-ban
+            spec: e2e/local-auth/malicious-skill-ban-flow.pw.test.ts
+          - name: manage-context-proof
+            spec: e2e/local-auth/manage-context-proof.pw.test.ts
+          - name: plugin-inspector-findings
+            spec: e2e/local-auth/plugin-inspector-findings.pw.test.ts
+          - name: publish-generated-card
+            spec: e2e/local-auth/publish-skill-lifecycle.pw.test.ts
+            grep: publishing a skill queues scan
+          - name: publish-new-version
+            spec: e2e/local-auth/publish-skill-lifecycle.pw.test.ts
+            grep: skill publishers can create a skill
+          - name: skill-star-sync
+            spec: e2e/local-auth/skill-star-sync.pw.test.ts
+          - name: version-delete
+            spec: e2e/local-auth/version-delete.pw.test.ts
 
     steps:
       - uses: actions/checkout@v6
 
       - uses: ./.github/actions/setup-bun
 
+      - name: Cache Playwright browsers
+        uses: actions/cache@v5
+        with:
+          path: ~/.cache/ms-playwright
+          key: ${{ runner.os }}-playwright-${{ hashFiles('bun.lock') }}
+          restore-keys: |
+            ${{ runner.os }}-playwright-
+
       - name: Install Playwright browsers
-        run: bunx playwright install --with-deps chromium
+        run: bunx playwright install chromium
 
       - name: Local-auth browser e2e
-        run: bun run test:pw:local-auth
+        env:
+          PLAYWRIGHT_GREP: ${{ matrix.grep || '' }}
+          PLAYWRIGHT_SPEC: ${{ matrix.spec }}
+        run: |
+          set -euo pipefail
+          args=(--project=chromium "$PLAYWRIGHT_SPEC")
+          if [[ -n "$PLAYWRIGHT_GREP" ]]; then
+            args+=(--grep "$PLAYWRIGHT_GREP")
+          fi
+          bun run test:pw:local-auth -- "${args[@]}"
 
       - name: Upload Playwright report
         if: ${{ !cancelled() }}
         uses: actions/upload-artifact@v7
         with:
-          name: playwright-local-auth-report
+          name: playwright-local-auth-report-${{ matrix.name }}
           path: playwright-report/
           if-no-files-found: ignore
+
+  playwright-local-auth:
+    name: playwright-local-auth
+    runs-on: ubuntu-latest
+    needs: playwright-local-auth-shard
+    if: ${{ always() }}
+    timeout-minutes: 5
+
+    steps:
+      - name: Check local-auth shards
+        env:
+          LOCAL_AUTH_RESULT: ${{ needs.playwright-local-auth-shard.result }}
+        run: |
+          if [[ "$LOCAL_AUTH_RESULT" != "success" ]]; then
+            echo "playwright-local-auth shards finished with result: $LOCAL_AUTH_RESULT"
+            exit 1
+          fi
+          echo "playwright-local-auth shards passed."