From 3acaec8815e8345d1c15879803bf1bb6abc50fe3 Mon Sep 17 00:00:00 2001 From: Titus Fortner Date: Fri, 21 Aug 2026 20:48:23 -0500 Subject: [PATCH 1/2] [build] stop updating browsers and CDP during release preparation --- .github/workflows/pre-release.yml | 75 +++++++++------------------- Rakefile | 26 +++------- scripts/github-actions/verify_cdp.sh | 16 ++++++ scripts/update_cdp.py | 3 +- 4 files changed, 47 insertions(+), 73 deletions(-) create mode 100755 scripts/github-actions/verify_cdp.sh diff --git a/.github/workflows/pre-release.yml b/.github/workflows/pre-release.yml index b471133417add..bbe344ef43e70 100644 --- a/.github/workflows/pre-release.yml +++ b/.github/workflows/pre-release.yml @@ -6,14 +6,6 @@ on: tag: description: 'Release tag (e.g., selenium-4.28.0 or selenium-4.28.1-ruby)' required: true - chrome_channel: - description: 'Chrome Channel for CDP' - required: true - type: choice - default: "stable" - options: - - stable - - early-stable permissions: contents: read @@ -73,9 +65,24 @@ jobs: run: | git push origin --delete rust-release-${{ needs.parse-tag.outputs.version }} || true + verify-cdp: + name: Verify CDP is Current + needs: parse-tag + runs-on: ubuntu-latest + steps: + - name: Checkout the DevTools listing + uses: actions/checkout@v6 + with: + sparse-checkout: | + common/devtools/chromium + scripts/github-actions + persist-credentials: false + - name: Verify CDP covers the current Stable Chrome + run: ./scripts/github-actions/verify_cdp.sh + restrict-trunk: name: Restrict Trunk Branch - needs: parse-tag + needs: [parse-tag, verify-cdp] uses: ./.github/workflows/restrict-trunk.yml with: restrict: true @@ -114,39 +121,9 @@ jobs: secrets: SELENIUM_CI_TOKEN: ${{ secrets.SELENIUM_CI_TOKEN }} - update-devtools: - name: Update Devtools - needs: [parse-tag, commit-versions] - if: needs.parse-tag.outputs.language == 'all' - uses: ./.github/workflows/bazel.yml - with: - name: Update devtools - ref: staging/release-${{ needs.parse-tag.outputs.tag }} - run: ./go update_cdp ${{ inputs.chrome_channel }} && ./go rb:pin - artifact-name: patch-devtools - - commit-devtools: - name: Commit Devtools - needs: [parse-tag, update-devtools] - permissions: - contents: write - actions: read - uses: ./.github/workflows/commit-changes.yml - with: - artifact-name: patch-devtools - commit-message: "update devtools versions" - ref: staging/release-${{ needs.parse-tag.outputs.tag }} - push-branch: staging/release-${{ needs.parse-tag.outputs.tag }} - secrets: - SELENIUM_CI_TOKEN: ${{ secrets.SELENIUM_CI_TOKEN }} - calculate-changelog-depth: name: Calculate Changelog Depth - needs: [parse-tag, commit-versions, commit-devtools] - if: >- - always() && - needs.commit-versions.result == 'success' && - (needs.parse-tag.outputs.language != 'all' || needs.commit-devtools.result == 'success') + needs: [parse-tag, commit-versions] runs-on: ubuntu-latest outputs: depth: ${{ steps.calc.outputs.depth }} @@ -200,14 +177,12 @@ jobs: release-updates: name: Update ${{ matrix.name }} - needs: [parse-tag, commit-devtools, selenium-manager, calculate-changelog-depth] + needs: [parse-tag, commit-versions, selenium-manager, calculate-changelog-depth] + if: needs.parse-tag.outputs.language == 'all' strategy: fail-fast: false matrix: include: - - task: browsers - name: Pinned Browsers - run: ./go update_browsers - task: manager name: Selenium Manager Binaries run: ./go update_manager @@ -224,7 +199,7 @@ jobs: with: name: Update ${{ matrix.name }} ref: staging/release-${{ needs.parse-tag.outputs.tag }} - run: ${{ matrix.run }}${{ matrix.task == 'browsers' && format(' {0}', inputs.chrome_channel) || '' }} + run: ${{ matrix.run }} artifact-name: patch-${{ matrix.task }} fetch-depth: ${{ needs.calculate-changelog-depth.outputs.depth }} @@ -266,11 +241,9 @@ jobs: fi } apply_patch versions "bump versions" - apply_patch devtools "update devtools versions" apply_patch cddl "update cddl spec files" apply_patch changelogs "changelogs updated" apply_patch rust-changelogs "rust changelogs updated" - apply_patch browsers "update pinned browser versions" apply_patch manager "update selenium manager versions" apply_patch authors "update authors file" rm -rf patches @@ -296,11 +269,9 @@ jobs: | Component | Status | |-----------|--------| | Versions | ${{ steps.apply.outputs.versions == 'true' && '✅ Updated' || '⏭️ Skipped (no changes)' }} | - | CDP version | ${{ needs.parse-tag.outputs.language != 'all' && 'N/A' || (steps.apply.outputs.devtools == 'true' && '✅ Updated' || '⏭️ Skipped (no changes)') }} | | CDDL spec files | ${{ needs.parse-tag.outputs.language != 'all' && 'N/A' || (steps.apply.outputs.cddl == 'true' && '✅ Updated' || '⏭️ Skipped (no changes)') }} | | Changelogs | ${{ steps.apply.outputs.changelogs == 'true' && '✅ Updated' || '⏭️ Skipped (no changes)' }} | | Rust Changelogs | ${{ needs.parse-tag.outputs.language != 'all' && 'N/A' || (steps.apply.outputs.rust-changelogs == 'true' && '✅ Updated' || '⏭️ Skipped (no changes)') }} | - | Pinned Browsers | ${{ needs.parse-tag.outputs.language != 'all' && 'N/A' || (steps.apply.outputs.browsers == 'true' && '✅ Updated' || '⏭️ Skipped (no changes)') }} | | Selenium Manager | ${{ needs.parse-tag.outputs.language != 'all' && 'N/A' || (steps.apply.outputs.manager == 'true' && '✅ Updated' || '⏭️ Skipped (no changes)') }} | | Authors | ${{ needs.parse-tag.outputs.language != 'all' && 'N/A' || (steps.apply.outputs.authors == 'true' && '✅ Updated' || '⏭️ Skipped (no changes)') }} | @@ -324,7 +295,7 @@ jobs: unlock-trunk-on-failure: name: Unlock Trunk on Failure - needs: [parse-tag, restrict-trunk, generate-rust-version, push-rust-version, selenium-manager, update-versions, commit-versions, update-devtools, commit-devtools, calculate-changelog-depth, update-changelogs, release-updates, create-pr] + needs: [parse-tag, restrict-trunk, generate-rust-version, push-rust-version, selenium-manager, update-versions, commit-versions, calculate-changelog-depth, update-changelogs, release-updates, create-pr] if: always() && needs.restrict-trunk.result == 'success' && needs.create-pr.result != 'success' uses: ./.github/workflows/restrict-trunk.yml with: @@ -337,7 +308,7 @@ jobs: on-prerelease-failure: name: On Pre-release Failure runs-on: ubuntu-latest - needs: [parse-tag, restrict-trunk, generate-rust-version, push-rust-version, selenium-manager, update-versions, commit-versions, update-devtools, commit-devtools, calculate-changelog-depth, update-changelogs, release-updates, create-pr] + needs: [parse-tag, verify-cdp, restrict-trunk, generate-rust-version, push-rust-version, selenium-manager, update-versions, commit-versions, calculate-changelog-depth, update-changelogs, release-updates, create-pr] if: failure() || cancelled() steps: - name: Slack Notification @@ -349,9 +320,9 @@ jobs: SLACK_USERNAME: GitHub Workflows SLACK_TITLE: "Release preparation failed: ${{ needs.parse-tag.outputs.tag }}" SLACK_MESSAGE: | + • CDP Current: ${{ needs.verify-cdp.result }} • Selenium Manager: ${{ needs.selenium-manager.result }} • Versions: ${{ needs.commit-versions.result }} - • Devtools: ${{ needs.commit-devtools.result }} • Changelogs: ${{ needs.update-changelogs.result }} • Release Updates: ${{ needs.release-updates.result }} • Create PR: ${{ needs.create-pr.result }} diff --git a/Rakefile b/Rakefile index 5b4e941aa958b..9669f5c179e0e 100644 --- a/Rakefile +++ b/Rakefile @@ -52,16 +52,10 @@ end task default: [:grid] task grid: [:'java:grid'] -# ./go update_browser stable -# ./go update_browser beta desc 'Update pinned browser versions' -task :update_browsers, [:channel] do |_task, arguments| - chrome_channel = arguments[:channel] || 'Stable' - chrome_channel = 'beta' if chrome_channel == 'early-stable' - args = ['--', "--chrome_channel=#{chrome_channel.capitalize}"] - +task :update_browsers do |_task, _arguments| puts 'pinning updated browsers and drivers' - Bazel.execute('run', args, '//scripts:pinned_browsers') + Bazel.execute('run', [], '//scripts:pinned_browsers') end desc 'Update Selenium Manager to latest release' @@ -83,13 +77,9 @@ task :update_cddl do |_task, _arguments| end desc 'Update Chrome DevTools support' -task :update_cdp, [:channel] do |_task, arguments| - chrome_channel = arguments[:channel] || 'stable' - chrome_channel = 'beta' if chrome_channel == 'early-stable' - args = ['--', "--chrome_channel=#{chrome_channel.capitalize}"] - - puts "Updating Chrome DevTools references to include latest from #{chrome_channel} channel" - Bazel.execute('run', args, '//scripts:update_cdp') +task :update_cdp do |_task, _arguments| + puts 'Updating Chrome DevTools references to include the latest from the Stable channel' + Bazel.execute('run', [], '//scripts:update_cdp') end task ios_driver: 'appium:build' @@ -110,17 +100,15 @@ task :update do end # Equivalent to `.github/workflows/pre-release.yml` in a single command -# Example: `./go pre_release selenium-4.31.0 early-stable` +# Example: `./go pre_release selenium-4.31.0` # Example: `./go pre_release selenium-4.31.1-ruby` desc 'Update everything in preparation for a release' -task :pre_release, [:tag, :channel] do |_task, arguments| +task :pre_release, [:tag] do |_task, arguments| parsed = SeleniumRake.parse_tag(arguments[:tag]) version = parsed[:version] language = parsed[:language] if parsed[:patch].zero? - Rake::Task['update_browsers'].invoke(arguments[:channel]) - Rake::Task['update_cdp'].invoke(arguments[:channel]) Rake::Task['update_cddl'].invoke Rake::Task['update_manager'].invoke Rake::Task['authors'].invoke diff --git a/scripts/github-actions/verify_cdp.sh b/scripts/github-actions/verify_cdp.sh new file mode 100755 index 0000000000000..a28f97cadb225 --- /dev/null +++ b/scripts/github-actions/verify_cdp.sh @@ -0,0 +1,16 @@ +#!/usr/bin/env bash +# Fail if the current Stable Chrome major has no checked-in DevTools, so a release can't ship a +# CDP that predates the browser most users are on. Comparing majors means routine Chrome patch +# bumps never hold up a release; only a promotion the daily Pin Browsers workflow has yet to land. +set -euo pipefail + +versions_url="https://googlechromelabs.github.io/chrome-for-testing/last-known-good-versions.json" +major=$(curl -fsS "$versions_url" | jq -r '.channels.Stable.version | split(".")[0]') + +root=$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd) +if [ ! -d "${root}/common/devtools/chromium/v${major}" ]; then + echo "::error::No CDP for Chrome v${major}; merge the pending browser update before releasing" >&2 + exit 1 +fi + +echo "CDP for Chrome v${major} is checked in" diff --git a/scripts/update_cdp.py b/scripts/update_cdp.py index 56bf9548888f8..9281e6d9e8864 100755 --- a/scripts/update_cdp.py +++ b/scripts/update_cdp.py @@ -17,8 +17,7 @@ def get_chrome_milestone(): """Get the Chrome milestone from the channel. - This is the same method from pinned_browser. Use --chrome_channel=Beta if - using early stable release. + This is the same method from pinned_browser. """ parser = argparse.ArgumentParser() parser.add_argument("--chrome_channel", default="Stable", help="Set the Chrome channel") From a17e371f202b0051bfdc6d5d272173264b6bba60 Mon Sep 17 00:00:00 2001 From: Titus Fortner Date: Sat, 22 Aug 2026 11:20:18 -0500 Subject: [PATCH 2/2] [build] limit the CDP gate to full releases and harden its parsing --- .github/workflows/pre-release.yml | 1 + scripts/github-actions/verify_cdp.sh | 9 ++++++++- 2 files changed, 9 insertions(+), 1 deletion(-) diff --git a/.github/workflows/pre-release.yml b/.github/workflows/pre-release.yml index bbe344ef43e70..44ae4be801dae 100644 --- a/.github/workflows/pre-release.yml +++ b/.github/workflows/pre-release.yml @@ -78,6 +78,7 @@ jobs: scripts/github-actions persist-credentials: false - name: Verify CDP covers the current Stable Chrome + if: needs.parse-tag.outputs.language == 'all' run: ./scripts/github-actions/verify_cdp.sh restrict-trunk: diff --git a/scripts/github-actions/verify_cdp.sh b/scripts/github-actions/verify_cdp.sh index a28f97cadb225..1900586d1b978 100755 --- a/scripts/github-actions/verify_cdp.sh +++ b/scripts/github-actions/verify_cdp.sh @@ -5,7 +5,14 @@ set -euo pipefail versions_url="https://googlechromelabs.github.io/chrome-for-testing/last-known-good-versions.json" -major=$(curl -fsS "$versions_url" | jq -r '.channels.Stable.version | split(".")[0]') +major=$(curl -fsS --retry 3 --retry-delay 2 --max-time 30 "$versions_url" | + jq -r '.channels.Stable.version | split(".")[0]') + +# Guard the parse so an upstream schema change reads as itself rather than as a hunt for "vnull". +if ! [[ "$major" =~ ^[0-9]+$ ]]; then + echo "::error::Could not parse a stable Chrome major from ${versions_url} (got: '${major}')" >&2 + exit 1 +fi root=$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd) if [ ! -d "${root}/common/devtools/chromium/v${major}" ]; then