[build] update CDP from daily pin browser workflow

.github/workflows/bazel.yml

@@ -91,11 +91,17 @@ on:
         required: false
         type: boolean
         default: false
+    outputs:
+      output:
+        description: Value the run script writes to $GITHUB_OUTPUT as "output=..."; empty when unused
+        value: ${{ jobs.bazel.outputs.output }}
 
 jobs:
   bazel:
     name: ${{ inputs.name }}
     runs-on: ${{ contains(inputs.os, '-') && inputs.os || format('{0}-latest', inputs.os) }}
+    outputs:
+      output: ${{ steps.run-bazel.outputs.output }}
     env:
       GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
       SEL_M2_USER: ${{ secrets.SEL_M2_USER }}

.github/workflows/ci-ruby.yml

@@ -2,6 +2,12 @@ name: CI - Ruby
 
 on:
   workflow_call:
+    inputs:
+      smoke:
+        description: Run smoke tests only (callers pass false to run the full matrix)
+        required: false
+        type: boolean
+        default: true
   workflow_dispatch:
     inputs:
       smoke:
@@ -25,7 +31,7 @@ jobs:
   # covers truffleruby and the most recent MRI release.
   unit-tests:
     name: Unit Tests
-    if: github.event_name == 'schedule' || (github.event_name == 'workflow_dispatch' && !inputs.smoke)
+    if: github.event_name == 'schedule' || !inputs.smoke
     uses: ./.github/workflows/bazel.yml
     strategy:
       fail-fast: false
@@ -48,7 +54,7 @@ jobs:
 
   smoke:
     name: ${{ matrix.os }}-smoke
-    if: github.event_name != 'schedule' && (github.event_name != 'workflow_dispatch' || inputs.smoke)
+    if: github.event_name != 'schedule' && inputs.smoke
     uses: ./.github/workflows/bazel.yml
     strategy:
       fail-fast: false
@@ -79,7 +85,7 @@ jobs:
 
   os-tests-full:
     name: ${{ matrix.os }}-full
-    if: github.event_name == 'schedule' || (github.event_name == 'workflow_dispatch' && !inputs.smoke)
+    if: github.event_name == 'schedule' || !inputs.smoke
     uses: ./.github/workflows/bazel.yml
     strategy:
       fail-fast: false

.github/workflows/ci.yml

@@ -140,6 +140,8 @@ jobs:
     needs: read-targets
     uses: ./.github/workflows/ci-ruby.yml
     if: needs.read-targets.outputs.rb != ''
+    with:
+      smoke: ${{ !(github.head_ref == 'pinned-browser-updates' && contains(github.event.pull_request.title, '(major)')) }}
 
   rust:
     name: Rust

.github/workflows/pin-browsers.yml

@@ -13,7 +13,7 @@ jobs:
     uses: ./.github/workflows/bazel.yml
     with:
       name: Pin Browsers
-      run: bazel run //scripts:pinned_browsers
+      run: ./scripts/github-actions/update_browsers.sh
       artifact-name: pinned-browsers
 
   create-pr:
@@ -49,9 +49,9 @@ jobs:
           commit-message: "Update pinned browser versions"
           author: Selenium CI Bot <selenium-ci@users.noreply.github.com>
           base: trunk
-          title: "[build] Automated Browser Version Update"
+          title: "[build] Automated Browser Version Update${{ contains(needs.update.outputs.output, 'major') && ' (major)' || '' }}${{ contains(needs.update.outputs.output, 'cdp') && ' with CDP' || '' }}"
           body: |
-            This is an automated pull request to update pinned browsers and drivers
+            This is an automated pull request to update pinned browsers and drivers.${{ contains(needs.update.outputs.output, 'major') && ' Major Chrome/Firefox bump: CI runs the full Ruby matrix.' || '' }}${{ contains(needs.update.outputs.output, 'cdp') && ' Chrome DevTools (CDP) was regenerated to match.' || '' }}
 
             Merge after verifying the new browser versions are properly passing the tests
           branch: "pinned-browser-updates"

scripts/github-actions/update_browsers.sh

@@ -0,0 +1,66 @@
+#!/usr/bin/env bash
+# Refresh pinned browsers/drivers; when a new stable Chrome major has no checked-in DevTools
+# version, regenerate CDP so the two never drift. Writes the job "output" as space-separated tags
+# the PR reports: "major" on a Chrome/Firefox major bump (CI then runs the full Ruby matrix) and
+# "cdp" when DevTools was regenerated.
+#
+# set -e is load-bearing: if update_cdp fails the job fails before "output" is written, so
+# create-pr is skipped and a Chrome bump can never land ahead of its CDP.
+set -euo pipefail
+
+old="$RUNNER_TEMP/repositories-old.bzl"
+git show HEAD:common/repositories.bzl > "$old"
+
+bazel run //scripts:pinned_browsers
+
+# Sorted-unique major versions of one family in a repositories.bzl; $1 = file, $2 = ERE matching
+# "<download-url marker><major digits>".
+majors_for() { grep -oE "$2" "$1" | grep -oE '[0-9]+$' | sort -un; }
+
+# Only Chrome and Firefox majors warrant the full matrix: they ship ~monthly and are the likeliest
+# to break the bindings. Edge tracks Chromium; driver-only and build/patch bumps do not count. Each
+# ERE matches the marker preceding the major in the download URLs pinned in repositories.bzl.
+declare -A families=(
+  [chrome]='chrome-for-testing-public/[0-9]+'
+  [firefox]='(firefox/releases/|Firefox%20)[0-9]+'
+)
+
+# New stable Chrome is the lowest pinned major (beta runs ahead). Tolerate a no-match (|| true) so a
+# marker/format change in repositories.bzl fails with a clear message, not a bare pipefail exit.
+chrome_majors=$(majors_for common/repositories.bzl "${families[chrome]}") || true
+chrome=${chrome_majors%%$'\n'*}
+if [ -z "$chrome" ]; then
+  echo "::error::Could not parse a stable Chrome major from common/repositories.bzl (pattern: ${families[chrome]})" >&2
+  exit 1
+fi
+echo "Stable Chrome major: v${chrome}"
+
+# Regenerate CDP when the stable Chrome major has no checked-in devtools dir.
+regen_cdp=false
+if [ -d "common/devtools/chromium/v${chrome}" ]; then
+  echo "DevTools for Chrome v${chrome} already present; skipping CDP regeneration"
+else
+  echo "No DevTools for Chrome v${chrome}; regenerating CDP"
+  bazel run //scripts:update_cdp -- --chrome_channel=Stable
+  # update_cdp resolves the Stable channel itself; verify it produced this major's dir so a Stable
+  # release mid-run can't leave us pinning Chrome ahead of its DevTools (blocks the PR if it did).
+  if [ ! -d "common/devtools/chromium/v${chrome}" ]; then
+    echo "::error::CDP regeneration did not produce common/devtools/chromium/v${chrome}; refusing to pin Chrome ahead of its DevTools" >&2
+    exit 1
+  fi
+  regen_cdp=true
+fi
+
+major=false
+for pattern in "${families[@]}"; do
+  if [ "$(majors_for "$old" "$pattern")" != "$(majors_for common/repositories.bzl "$pattern")" ]; then
+    major=true
+    break
+  fi
+done
+
+output=""
+[ "$major" = true ] && output="major"
+[ "$regen_cdp" = true ] && output="${output:+$output }cdp"
+echo "Update tags: ${output:-none}"
+echo "output=$output" >> "$GITHUB_OUTPUT"