Migrate tests/browser to pnpm 11 devEngines.packageManager on rhoai-2.25

[jiridanek]

Background

On main, tests/browser was migrated to package.json5 with a devEngines.packageManager field, which makes pnpm 11 record the resolved pnpm version under packageManagerDependencies in pnpm-lock.yaml. scripts/get-pnpm-version.sh reads that field via yq.

On rhoai-2.25 (this branch), tests/browser was never migrated: it still ships a plain tests/browser/package.json with the old-style "packageManager": "pnpm@10.8.0" field, and its lockfile has no packageManagerDependencies.

.github/actions/playwright-test/action.yml's "Determine pnpm version" step already existed on this branch (from an earlier backport) with a legacy grep-based fallback for exactly this old-style field. That fallback stopped being reachable once scripts/get-pnpm-version.sh was ported to this branch for jupyter/utils/addons CI (f54647ca3), because the step picked the script whenever it was present + yq was available, with no fallback on failure. This broke tests/browser's Playwright CI job with:

::error::Failed to extract valid pnpm version from tests/browser/pnpm-lock.yaml (got 'null')

Seen in PR #2641, run 30656665554.

Immediate fix (already merged)

.github/actions/playwright-test/action.yml now falls back to the legacy grep-based lookup whenever get-pnpm-version.sh can't resolve a version, instead of an either/or on script presence. This restores CI without touching tests/browser's tooling.

Follow-up (this issue)

Migrate tests/browser on rhoai-2.25 to match main:

• Convert tests/browser/package.json → package.json5
• Add devEngines.packageManager (name: pnpm, a version range, onFail: download), drop the legacy packageManager field
• Regenerate pnpm-lock.yaml with pnpm 11 so packageManagerDependencies is populated
• Once done, the legacy fallback added in .github/actions/playwright-test/action.yml can be removed (or left as a harmless safety net for other future consumers)

Out of scope for the CVE-overrides PR that surfaced this, since it also implies dependency bumps (playwright, testcontainers, typescript, eslint) and lockfile regeneration that need their own review on a release branch.

[jiridanek]

@coderabbitai ❯ investigate and fix https://github.com/red-hat-data-services/notebooks/actions/runs/30656665554/job/91242804803?pr=2641#step:25:126

⏺ Bash(cd /Users/jdanek/IdeaProjects/notebooks && gh run view 30656665554 --repo red-hat-data-services/notebooks --job 91242804803 2>&1 | head -100)
⎿  X fix/rhoai-2.25-npm-cve-overrides Build Notebooks (pr) #2641 · 30656665554
Triggered via pull_request about 1 hour ago
… +62 lines (ctrl+o to expand)
⎿  Shell cwd was reset to /Users/jdanek/IdeaProjects/notebooks/.github/workflows
⎿  Allowed by auto mode classifier

⏺ Bash(cd /Users/jdanek/IdeaProjects/notebooks && gh run view 30656665554 --repo red-hat-data-services/notebooks --log --job 91242804803 2>&1 | grep -n "Run Playwright…)
⎿  10263:codeserver-ubi9-python-3.12 · linux/amd64 [rhoai] / build UNKNOWN STEP 2026-07-31T20:28:03.8510936Z ##[start-action display=Run Playwright tests;id=__self_5.playwright]
⎿  Shell cwd was reset to /Users/jdanek/IdeaProjects/notebooks/.github/workflows
⎿  Allowed by auto mode classifier

⏺ Bash(cd /Users/jdanek/IdeaProjects/notebooks && gh run view 30656665554 --repo red-hat-data-services/notebooks --log --job 91242804803 2>&1 | sed -n '10263,10400p')
⎿  codeserver-ubi9-python-3.12 · linux/amd64 [rhoai] / build UNKNOWN STEP 2026-07-31T20:28:03.8510936Z ##[start-action display=Run Playwright tests;id=__self_5.playwright]
codeserver-ubi9-python-3.12 · linux/amd64 [rhoai] / build UNKNOWN STEP 2026-07-31T20:28:03.8512972Z ##[end-action id=__self_5.playwright;outcome=skipped;conclusion=skipped;duration_ms=0]
codeserver-ubi9-python-3.12 · linux/amd64 [rhoai] / build UNKNOWN STEP 2026-07-31T20:28:03.8515216Z ##[start-action display=Stage Playwright JUnit XML;id=__self_5.stage-junit]
… +135 lines (ctrl+o to expand)
⎿  Shell cwd was reset to /Users/jdanek/IdeaProjects/notebooks/.github/workflows
⎿  Allowed by auto mode classifier

⏺ Bash(cd /Users/jdanek/IdeaProjects/notebooks && gh run view 30656665554 --repo red-hat-data-services/notebooks --log --job 91242804803 2>&1 | grep -n "Failed to extr…)
⎿  10259:codeserver-ubi9-python-3.12 · linux/amd64 [rhoai] / build UNKNOWN STEP 2026-07-31T20:28:03.8496142Z ##[error]Failed to extract valid pnpm version from tests/browser/pnpm-lock.yaml (got
'null')
⎿  Shell cwd was reset to /Users/jdanek/IdeaProjects/notebooks/.github/workflows
⎿  Allowed by auto mode classifier

⏺ Bash(cd /Users/jdanek/IdeaProjects/notebooks && gh run view 30656665554 --repo red-hat-data-services/notebooks --log --job 91242804803 2>&1 | sed -n '10150,10263p')
⎿  codeserver-ubi9-python-3.12 · linux/amd64 [rhoai] / build UNKNOWN STEP 2026-07-31T20:28:03.7872271Z CACHE: ghcr.io/red-hat-data-services/notebooks/workbench-images/build-cache
codeserver-ubi9-python-3.12 · linux/amd64 [rhoai] / build UNKNOWN STEP 2026-07-31T20:28:03.7872683Z TRIVY_VERSION: 0.70.0
codeserver-ubi9-python-3.12 · linux/amd64 [rhoai] / build UNKNOWN STEP 2026-07-31T20:28:03.7872932Z TRIVY_SCAN_FS_JSON: {}
… +111 lines (ctrl+o to expand)
⎿  Shell cwd was reset to /Users/jdanek/IdeaProjects/notebooks/.github/workflows
⎿  Allowed by auto mode classifier

Read 1 file (ctrl+o to expand)

⏺ Bash(cd /Users/jdanek/IdeaProjects/notebooks && head -30 tests/browser/pnpm-lock.yaml; echo "---search packageManagerDependencies---"; grep -n "packageManagerDepende…)
⎿  lockfileVersion: '9.0'

 settings:
 … +29 lines (ctrl+o to expand)

⎿  Shell cwd was reset to /Users/jdanek/IdeaProjects/notebooks/.github/workflows
⎿  Allowed by auto mode classifier

⏺ Bash(cd /Users/jdanek/IdeaProjects/notebooks && head -5 jupyter/utils/addons/pnpm-lock.yaml; echo "---"; grep -n "packageManagerDependencies" -A3 jupyter/utils/addon…)
⎿  ---
lockfileVersion: '9.0'
… +7 lines (ctrl+o to expand)
⎿  Shell cwd was reset to /Users/jdanek/IdeaProjects/notebooks/.github/workflows
⎿  Allowed by auto mode classifier

⏺ Bash(cd /Users/jdanek/IdeaProjects/notebooks && ls tests/browser/package.json*; grep -n "devEngines|packageManager" tests/browser/package.json 2>/dev/null)
⎿  tests/browser/package.json
21: "packageManager": "pnpm@10.8.0"
⎿  Shell cwd was reset to /Users/jdanek/IdeaProjects/notebooks/.github/workflows
⎿  Allowed by auto mode classifier

Recalled 1 memory, searched memories (ctrl+o to expand)

⏺ Bash(cd /Users/jdanek/IdeaProjects/notebooks && git log --oneline -5 -- tests/browser/package.json tests/browser/pnpm-lock.yaml; echo "---branch info---"; git log --…)
⎿  4ffb45f2f NO-JIRA: add TypeScript utilities for browser automation and Snyk target setup (#1517)
0e95139 NO-JIRA: update development dependencies in pnpm-lock.yaml and package.json (#1201)
0866362 NO-JIRA: tests(browser/): update dependencies in pnpm-lock.yaml (#1046)
… +33 lines (ctrl+o to expand)
⎿  Shell cwd was reset to /Users/jdanek/IdeaProjects/notebooks/.github/workflows
⎿  Allowed by auto mode classifier

⏺ Bash(cd /Users/jdanek/IdeaProjects/notebooks && git log --oneline -5 -- scripts/get-pnpm-version.sh; echo "---find usages---"; grep -rln "get-pnpm-version.sh" .githu…)
⎿  f54647ca3 chore(jupyter/utils/addons): port main dependency refresh and drop dev server
---find usages---
.github/workflows/test-addons.yaml
… +3 lines (ctrl+o to expand)
⎿  Shell cwd was reset to /Users/jdanek/IdeaProjects/notebooks/.github/workflows
⎿  Allowed by auto mode classifier

⏺ Bash(cd /Users/jdanek/IdeaProjects/notebooks && git show main:tests/browser/package.json5 2>&1 | head -40)
⎿  {
type: 'module',
private: 'true',
… +37 lines (ctrl+o to expand)
⎿  Shell cwd was reset to /Users/jdanek/IdeaProjects/notebooks/.github/workflows
⎿  Allowed by auto mode classifier

Read 1 file (ctrl+o to expand)

⏺ Bash(cd /Users/jdanek/IdeaProjects/notebooks && git diff main -- .github/actions/playwright-test/action.yml | head -100)
⎿  diff --git c/.github/actions/playwright-test/action.yml w/.github/actions/playwright-test/action.yml
index d0b1cb588..8fa6ed095 100644
--- c/.github/actions/playwright-test/action.yml
… +97 lines (ctrl+o to expand)
⎿  Shell cwd was reset to /Users/jdanek/IdeaProjects/notebooks/.github/workflows
⎿  Allowed by auto mode classifier

⏺ Bash(cd /Users/jdanek/IdeaProjects/notebooks && git show --stat f54647c | head -60)
⎿  commit f54647c
Author: Jiri Daněk jdanek@redhat.com
Date: Thu Jul 30 10:11:28 2026 +0200
… +32 lines (ctrl+o to expand)
⎿  Shell cwd was reset to /Users/jdanek/IdeaProjects/notebooks/.github/workflows
⎿  Allowed by auto mode classifier

⏺ Bash(cd /Users/jdanek/IdeaProjects/notebooks && git log --oneline -8 -- .github/actions/playwright-test/action.yml)
⎿  da9540c47 Backport hermetic codeserver build to rhoai-2.25.
⎿  Shell cwd was reset to /Users/jdanek/IdeaProjects/notebooks/.github/workflows
⎿  Allowed by auto mode classifier

⏺ Found it. The failure is in .github/actions/playwright-test/action.yml's "Determine pnpm version" step, and it's a latent bug that got triggered by an unrelated change — not something this PR's actual
changes caused directly, but worth understanding and fixing here since it's blocking CI.

Root cause:

• scripts/get-pnpm-version.sh (added by the recent jupyter/utils/addons port commit, for test-addons.yaml) reads the pnpm version via yq from the lockfile's packageManagerDependencies field — a pnpm 11
  feature that only appears when package.json declares devEngines.packageManager.
• tests/browser/package.json on this branch still uses the old-style "packageManager": "pnpm@10.8.0" field (unlike main, where tests/browser was already migrated to package.json5 +
  devEngines.packageManager). Its lockfile has no packageManagerDependencies, so the yq query returns null.
• playwright-test/action.yml's "Determine pnpm version" step (already on this branch from an earlier backport) picks get-pnpm-version.sh whenever it exists + yq is available — a blanket check with no
  awareness of whether this project was migrated. Before this session's port added the script, that condition was always false, so it silently used its own grep-based legacy fallback and things worked.
  Adding the script for the addons use case broke the unrelated tests/browser path as a side effect.

Migrating tests/browser to the pnpm 11 format (like main) is a bigger, riskier change than this CVE-override PR should carry. The minimal, safe fix is to make the "Determine pnpm version" step fall back to
the legacy grep when the script can't resolve a version, instead of treating script-presence as a hard either/or:

⏺ Update(~/IdeaProjects/notebooks/.github/actions/playwright-test/action.yml)
⎿  Added 6 lines, removed 3 lines
104 if [[ ! -f "${pkg_file}" ]]; then
105 pkg_file="${WORKING_DIRECTORY}/package.json"
106 fi
107 + ver=""
108 if [[ -f scripts/get-pnpm-version.sh ]] && command -v yq >/dev/null 2>&1; then
108 - ver=$(scripts/get-pnpm-version.sh "${lockfile}")
109 - else
110 - ver=$(grep -oP '"packageManager"\s*:\s*"pnpm@\K[0-9.]+' "${pkg_file}")
109 + ver=$(scripts/get-pnpm-version.sh "${lockfile}") || true
110 fi
111 if [[ -z "${ver}" ]]; then
112 + # Fallback for lockfiles predating the pnpm 11 devEngines.packageManager migration.
113 + ver=$(grep -oP '"packageManager"\s*:\s*"pnpm@\K[0-9.]+' "${pkg_file}") || true
114 + fi
115 + if [[ -z "${ver}" ]]; then
116 echo "::error::Failed to resolve pnpm version from ${pkg_file} or ${lockfile}"
117 exit 1
118 fi
⎿  Allowed by auto mode classifier

⏺ Now let's verify the fix locally, simulating both scenarios (legacy tests/browser format and the modern packageManagerDependencies format):

⏺ Bash(command -v yq || echo "no yq"; cd /Users/jdanek/IdeaProjects/notebooks && bash -c '
set -Eeuxo pipefail…)
⎿  Error: Exit code 1
/opt/homebrew/bin/yq
+ WORKING_DIRECTORY=tests/browser
+ lockfile=tests/browser/pnpm-lock.yaml
+ pkg_file=tests/browser/package.json5
+ [[ ! -f tests/browser/package.json5 ]]
+ pkg_file=tests/browser/package.json
+ ver=
+ [[ -f scripts/get-pnpm-version.sh ]]
+ command -v yq
… +17 lines (ctrl+o to expand)

⏺ Bash(command -v ggrep && cd /Users/jdanek/IdeaProjects/notebooks && bash -c '
set -Eeuxo pipefail…)
⎿  /opt/homebrew/bin/ggrep
+ WORKING_DIRECTORY=tests/browser
+ lockfile=tests/browser/pnpm-lock.yaml
… +16 lines (ctrl+o to expand)
⎿  Shell cwd was reset to /Users/jdanek/IdeaProjects/notebooks/.github/workflows
⎿  Allowed by auto mode classifier

⏺ The fallback correctly resolves 10.8.0 when get-pnpm-version.sh returns null. Now confirm the modern-format path (jupyter/utils/addons) still works unaffected:

⏺ Bash(cd /Users/jdanek/IdeaProjects/notebooks && bash -c '
set -Eeuxo pipefail…)
⎿  + WORKING_DIRECTORY=jupyter/utils/addons
+ lockfile=jupyter/utils/addons/pnpm-lock.yaml
+ pkg_file=jupyter/utils/addons/package.json5
… +10 lines (ctrl+o to expand)
⎿  Shell cwd was reset to /Users/jdanek/IdeaProjects/notebooks/.github/workflows
⎿  Allowed by auto mode classifier

⏺ Both paths resolve correctly — modern format (jupyter/utils/addons) uses the primary get-pnpm-version.sh path, legacy format (tests/browser) now falls back correctly instead of hard-failing. Let's run
shellcheck and diff:

⏺ Bash(cd /Users/jdanek/IdeaProjects/notebooks && python3 -c "import yaml; yaml.safe_load(open('.github/actions/playwright-test/action.yml'))" && echo "YAML OK" && git…)
⎿  YAML OK
diff --git i/.github/actions/playwright-test/action.yml w/.github/actions/playwright-test/action.yml
index 8fa6ed095..ac1125612 100644
… +19 lines (ctrl+o to expand)
⎿  Shell cwd was reset to /Users/jdanek/IdeaProjects/notebooks/.github/workflows
⏺ Bash(cd /Users/jdanek/IdeaProjects/notebooks && git add .github/actions/playwright-test/action.yml && git commit -m "$(cat <<'EOF'
fix(ci): fall back to legacy pnpm…)
⎿  [fix/rhoai-2.25-npm-cve-overrides 4f3716473] fix(ci): fall back to legacy pnpm version parsing in playwright-test
1 file changed, 6 insertions(+), 3 deletions(-)
⎿  Shell cwd was reset to /Users/jdanek/IdeaProjects/notebooks/.github/workflows

⏺ Root cause: .github/actions/playwright-test/action.yml's "Determine pnpm version" step picked scripts/get-pnpm-version.sh whenever it existed and yq was available — no fallback. That script reads
packageManagerDependencies from the lockfile, a pnpm 11 field that only appears when package.json declares devEngines.packageManager. tests/browser on this branch still uses the old "packageManager":
"pnpm@10.8.0" field (unlike main, where it's fully migrated), so the lookup returned null and the whole Playwright job failed before running a single test.

This wasn't caused by anything in this PR directly — get-pnpm-version.sh only exists because of the earlier jupyter/utils/addons port commit, and its mere presence silently broke the unrelated,
already-existing playwright-test action logic for tests/browser.

Fix (committed as 4f3716473): made the step fall back to the legacy grep-based parsing whenever the script can't resolve a version, instead of an either/or branch on script presence. Verified locally:
tests/browser (legacy format) now falls through and resolves 10.8.0; jupyter/utils/addons (pnpm 11 format) still resolves via the script directly (11.10.0), unaffected.

I deliberately didn't migrate tests/browser to the pnpm 11/devEngines format to match main — that's a bigger, separate change (new lockfile, dependency bumps, ESLint setup) out of scope for an
npm-CVE-overrides PR, and risks its own regressions on a release branch. This fix restores CI without touching that.

✻ Cogitated for 5m 9s

❯ create github issue for this, to do a followup

⏺ Bash(cd /Users/jdanek/IdeaProjects/notebooks && gh issue list --repo red-hat-data-services/notebooks --search "tests/browser pnpm 11" --state all --limit 20 2>&1)
⎿  2277 OPEN Dependency Dashboard 2026-06-09T12:32:51Z
2270 CLOSED Dependency Dashboard 2026-05-25T21:37:37Z
⎿  Shell cwd was reset to /Users/jdanek/IdeaProjects/notebooks/.github/workflows
⎿  Allowed by auto mode classifier

⏺ Bash(cd /Users/jdanek/IdeaProjects/notebooks && gh issue list --repo red-hat-data-services/notebooks --search "devEngines packageManager" --state all --limit 20 2>&1…)
⎿  ---
2277 OPEN Dependency Dashboard 2026-06-09T12:32:51Z
2292 OPEN Dependency Dashboard 2026-07-09T20:47:53Z
… +4 lines (ctrl+o to expand)
⎿  Shell cwd was reset to /Users/jdanek/IdeaProjects/notebooks/.github/workflows
⎿  Allowed by auto mode classifier

⏺ No duplicates found. Let's check for a PR template and repo issue-type conventions before creating.

[coderabbitai]

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

repo="red-hat-data-services/notebooks"
body="$(cat <<'EOF'
## Summary

Migrate `tests/browser` from the legacy pnpm package-manager declaration to the pnpm 11 format.

`tests/browser/package.json` currently declares pnpm with the top-level `"packageManager": "pnpm@10.8.0"` field. Its `pnpm-lock.yaml` therefore does not contain `packageManagerDependencies`.

## Rationale

The shared `scripts/get-pnpm-version.sh` script reads `packageManagerDependencies` from the lockfile. This is compatible with projects that use `devEngines.packageManager`, but not with the current `tests/browser` format.

Pull request `#2641` adds a compatibility fallback in `.github/actions/playwright-test/action.yml`. The fallback restores CI on the release branch. The migration should occur separately because it can require a lockfile refresh, dependency updates, and browser-test tooling validation.

## Affected areas

- `tests/browser/package.json`
- `tests/browser/pnpm-lock.yaml`
- `.github/actions/playwright-test/action.yml`
- `scripts/get-pnpm-version.sh`

## Required changes

1. Replace the legacy `packageManager` declaration in `tests/browser/package.json` with the supported `devEngines.packageManager` configuration.
2. Regenerate `tests/browser/pnpm-lock.yaml` so that it records the package-manager dependency metadata expected by `scripts/get-pnpm-version.sh`.
3. Review the browser-test dependency and ESLint configuration changes required to align this directory with the current main-branch format.
4. Remove the legacy parsing fallback from `.github/actions/playwright-test/action.yml` only when no supported caller requires it.

## Acceptance criteria

- `scripts/get-pnpm-version.sh tests/browser/pnpm-lock.yaml` returns the configured pnpm version.
- The Playwright composite action resolves the pnpm version for `tests/browser` without legacy parsing.
- Browser tests and the associated CI workflow pass.
- The change is reviewed independently from release-branch CVE override work.

## Backlinks

- CI-fix pull request: `#2641`
- Investigation context: `#2670`
- Requested by: `@jiridanek`
EOF
)"

gh issue create \
  --repo "$repo" \
  --title "Migrate tests/browser to pnpm 11 package-manager metadata" \
  --body "$body" \
  --assignee "jiridanek"

Length of output: 2483

---

@jiridanek, I created follow-up issue #2671: Migrate tests/browser to pnpm 11 package-manager metadata.

It links to #2641 and #2670, defines the migration work, and assigns the issue to you.

_{You are interacting with an AI system.}

[jiridanek]

Cross-linking a related follow-up: opendatahub-io/notebooks#4246 tracks porting the other fixes from PR #2641 (jupyter/utils/addons tsconfig/CI fixes) upstream to main. That issue explicitly notes the playwright-test pnpm-version fallback fix (the one this issue's immediate-fix section covers) does not need porting to main, since main's tests/browser is already migrated — which is exactly the migration this issue tracks for rhoai-2.25.

[jiridanek]

🎯 Functional Correctness | 🟠 Major | 🏗️ Heavy lift

🧩 Analysis chain

🏁 Script executed:

#!/usr/bin/env bash
set -euo pipefail

echo "Manifest pnpm declarations:"
rg -n -C 3 'packageManager|devEngines|version' \
  --glob 'package.json' --glob 'package.json5' .

echo
echo "Matches produced by the current fallback:"
while IFS= read -r file; do
  match="$(grep -oP '"packageManager"\s*:\s*"pnpm@\K[0-9.]+' "$file" || true)"
  printf '%s => %s\n' "$file" "${match:-<empty>}"
done < <(rg --files -g 'package.json' -g 'package.json5')

Repository: red-hat-data-services/notebooks

Length of output: 4256

---

🏁 Script executed:

#!/usr/bin/env bash
set -euo pipefail

echo 'Action logic:'
sed -n '75,130p' .github/actions/playwright-test/action.yml

echo
echo 'Version helper references and implementation:'
rg -n -C 5 'get-pnpm-version|pkg_file|lockfile|devEngines|packageManager' \
  .github/actions scripts jupyter/utils/addons 2>/dev/null || true

echo
echo 'Relevant manifest files:'
cat -n jupyter/utils/addons/package.json5 | sed -n '30,48p'
cat -n tests/browser/package.json | sed -n '15,24p'

echo
echo 'Deterministic fallback probe:'
python3 - <<'PY'
from pathlib import Path
import re

pattern = re.compile(r'"packageManager"\s*:\s*"pnpm@([0-9.]+)')
for path in [
    Path("jupyter/utils/addons/package.json5"),
    Path("tests/browser/package.json"),
]:
    text = path.read_text()
    matches = pattern.findall(text)
    print(f"{path}: {matches or '<empty>'}")
PY

Repository: red-hat-data-services/notebooks

Length of output: 50388

---

🏁 Script executed:

#!/usr/bin/env bash
set -euo pipefail

echo 'Exact fallback results:'
for file in jupyter/utils/addons/package.json5 tests/browser/package.json; do
  result="$(grep -oP '"packageManager"\s*:\s*"pnpm@\K[0-9.]+' "$file" || true)"
  printf '%s => %s\n' "$file" "${result:-<empty>}"
done

echo
echo 'Playwright action callers and working directories:'
rg -n -C 3 'playwright-test|working-directory:|jupyter/utils/addons|tests/browser' \
  .github --glob '*.yml' --glob '*.yaml' --glob '*.json' --glob '*.json5' || true

echo
echo 'All exact packageManager fallback matches, including comments:'
python3 - <<'PY'
from pathlib import Path
import re

pattern = re.compile(r'"packageManager"\s*:\s*"pnpm@([0-9.]+)')
for path in sorted(list(Path(".").rglob("package.json")) + list(Path(".").rglob("package.json5"))):
    text = path.read_text(errors="replace")
    for line_no, line in enumerate(text.splitlines(), 1):
        matches = pattern.findall(line)
        if matches:
            print(f"{path}:{line_no}: {matches} :: {line.strip()}")
PY

Repository: red-hat-data-services/notebooks

Length of output: 10855

---

Make the pnpm fallback parse JSON5 and ignore comments.

When the helper fails or yq is unavailable, the fallback reads the commented pnpm@10.8.1 declaration in jupyter/utils/addons/package.json5. The lockfile resolves pnpm 11.10.0, so the action can install the wrong pnpm version. Parse JSON5 without comments, or resolve the concrete version from the lockfile.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/actions/playwright-test/action.yml around lines 107 - 113, The
fallback around get-pnpm-version.sh must parse JSON5 package metadata without
comments and avoid selecting a stale commented pnpm declaration. Update the
grep-based logic following ver and pkg_file to use comment-aware JSON5 parsing,
or derive the concrete pnpm version from the lockfile, while preserving the
existing fallback behavior when no version is found.