From 294cd5f51e71112cfa8cec81498fa0914ba9c968 Mon Sep 17 00:00:00 2001
From: Richard McDaniel <1130888+rmcdaniel@users.noreply.github.com>
Date: Thu, 5 Nov 2026 23:25:54 +0000
Subject: [PATCH 1/4] Reuse runner Chrome for documentation source checks

---
 .github/workflows/ci.yml           |  4 ++--
 .github/workflows/docs.yml         |  3 ++-
 scripts/check-docs-browser.mjs     |  1 +
 scripts/ci/use-installed-chrome.sh | 26 ++++++++++++++++++++++++++
 4 files changed, 31 insertions(+), 3 deletions(-)
 create mode 100644 scripts/ci/use-installed-chrome.sh

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 04796d4e..e2be2c09 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -595,8 +595,8 @@ jobs:
             --offline
             --root-dir build/site
             build/site
-      - name: Install the locked Chromium browser
-        run: '"$DOCS_TOOLING_DIRECTORY/node_modules/.bin/playwright" install --with-deps chromium'
+      - name: Select the runner-provided Chrome browser
+        run: bash "$DOCS_TOOLING_DIRECTORY/scripts/ci/use-installed-chrome.sh"
       - name: Verify missing-resource browser evidence
         run: npm --prefix "$DOCS_TOOLING_DIRECTORY" run test:docs-browser-failures
       - name: Check portal and API layouts in Chromium
diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml
index 464ff418..d7aed1bc 100644
--- a/.github/workflows/docs.yml
+++ b/.github/workflows/docs.yml
@@ -158,7 +158,8 @@ jobs:
             --offline
             --root-dir build/site
             build/site
-      - run: '"$DOCS_TOOLING_DIRECTORY/node_modules/.bin/playwright" install --with-deps chromium'
+      - name: Select the runner-provided Chrome browser
+        run: bash "$DOCS_TOOLING_DIRECTORY/scripts/ci/use-installed-chrome.sh"
       - name: Test missing-resource browser evidence
         run: npm --prefix "$DOCS_TOOLING_DIRECTORY" run test:docs-browser-failures
       - name: Check portal and API layouts in Chromium
diff --git a/scripts/check-docs-browser.mjs b/scripts/check-docs-browser.mjs
index 3a312e1e..831cb510 100644
--- a/scripts/check-docs-browser.mjs
+++ b/scripts/check-docs-browser.mjs
@@ -240,6 +240,7 @@ try {
   };
   if (process.env.PLAYWRIGHT_CHROMIUM_EXECUTABLE_PATH) launchOptions.executablePath = process.env.PLAYWRIGHT_CHROMIUM_EXECUTABLE_PATH;
   browser = await chromium.launch(launchOptions);
+  console.log(`Launched browser version: ${browser.version()}`);
 
   const surfaces = [
     {name: 'home', path: '/', kind: 'portal'},
diff --git a/scripts/ci/use-installed-chrome.sh b/scripts/ci/use-installed-chrome.sh
new file mode 100644
index 00000000..5174da7e
--- /dev/null
+++ b/scripts/ci/use-installed-chrome.sh
@@ -0,0 +1,26 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# Source checks use the browser already provided by the Ubuntu x64 runner.
+# Missing or changed stock prerequisites refuse without an installer fallback.
+chrome_binary=/opt/google/chrome/chrome
+if [[ $(/usr/bin/uname -m) != x86_64 || ! -f "$chrome_binary" || ! -x "$chrome_binary" || -L "$chrome_binary" \
+  || $(/usr/bin/readlink -f "$chrome_binary") != "$chrome_binary" \
+  || $(/usr/bin/stat -c '%u:%g:%a' "$chrome_binary") != 0:0:755 ]]; then
+  echo 'The runner must provide the root-owned Google Chrome executable.' >&2
+  exit 1
+fi
+
+package=$(/usr/bin/dpkg-query -W -f='${binary:Package}\t${Architecture}\t${Status}\t${Version}' google-chrome-stable)
+package_pattern=$'^google-chrome-stable\tamd64\tinstall ok installed\t[0-9][A-Za-z0-9.+:~_-]*$'
+if [[ ! "$package" =~ $package_pattern \
+  || $(/usr/bin/dpkg-query -S "$chrome_binary") != "google-chrome-stable: $chrome_binary" ]]; then
+  echo 'The browser must belong to the installed stock Chrome package.' >&2
+  exit 1
+fi
+
+printf 'Runner browser package: %s\n' "$package"
+/usr/bin/stat -c 'Browser file: %n owner=%u:%g mode=%a' "$chrome_binary"
+/usr/bin/sha256sum "$chrome_binary"
+"$chrome_binary" --version
+printf 'PLAYWRIGHT_CHROMIUM_EXECUTABLE_PATH=%s\n' "$chrome_binary" >> "${GITHUB_ENV:?GitHub Actions environment file is required}"

From 373bca75b90d5ecf7fea82f5b1fa205e27ec2441 Mon Sep 17 00:00:00 2001
From: Richard McDaniel <1130888+rmcdaniel@users.noreply.github.com>
Date: Thu, 5 Nov 2026 23:29:25 +0000
Subject: [PATCH 2/4] Record runner browser facts before prerequisite refusal

---
 scripts/ci/use-installed-chrome.sh | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/scripts/ci/use-installed-chrome.sh b/scripts/ci/use-installed-chrome.sh
index 5174da7e..58ea86f5 100644
--- a/scripts/ci/use-installed-chrome.sh
+++ b/scripts/ci/use-installed-chrome.sh
@@ -4,6 +4,13 @@ set -euo pipefail
 # Source checks use the browser already provided by the Ubuntu x64 runner.
 # Missing or changed stock prerequisites refuse without an installer fallback.
 chrome_binary=/opt/google/chrome/chrome
+printf 'Runner browser architecture: %s\n' "$(/usr/bin/uname -m)"
+if [[ -e "$chrome_binary" || -L "$chrome_binary" ]]; then
+  /usr/bin/stat -c 'Browser file: %n type=%F owner=%u:%g mode=%a' "$chrome_binary"
+  printf 'Canonical browser path: %s\n' "$(/usr/bin/readlink -f "$chrome_binary")"
+else
+  echo 'The fixed Chrome executable is absent.'
+fi
 if [[ $(/usr/bin/uname -m) != x86_64 || ! -f "$chrome_binary" || ! -x "$chrome_binary" || -L "$chrome_binary" \
   || $(/usr/bin/readlink -f "$chrome_binary") != "$chrome_binary" \
   || $(/usr/bin/stat -c '%u:%g:%a' "$chrome_binary") != 0:0:755 ]]; then
@@ -20,7 +27,6 @@ if [[ ! "$package" =~ $package_pattern \
 fi
 
 printf 'Runner browser package: %s\n' "$package"
-/usr/bin/stat -c 'Browser file: %n owner=%u:%g mode=%a' "$chrome_binary"
 /usr/bin/sha256sum "$chrome_binary"
 "$chrome_binary" --version
 printf 'PLAYWRIGHT_CHROMIUM_EXECUTABLE_PATH=%s\n' "$chrome_binary" >> "${GITHUB_ENV:?GitHub Actions environment file is required}"

From c1eccb1d70e3d7db4582f4e4d7426e45104bc5d3 Mon Sep 17 00:00:00 2001
From: Richard McDaniel <1130888+rmcdaniel@users.noreply.github.com>
Date: Fri, 6 Nov 2026 00:47:51 +0000
Subject: [PATCH 3/4] Keep locked Chromium source checks without APT dependency
 installation

---
 scripts/ci/use-installed-chrome.sh | 32 ------------------------------
 1 file changed, 32 deletions(-)
 delete mode 100644 scripts/ci/use-installed-chrome.sh

diff --git a/scripts/ci/use-installed-chrome.sh b/scripts/ci/use-installed-chrome.sh
deleted file mode 100644
index 58ea86f5..00000000
--- a/scripts/ci/use-installed-chrome.sh
+++ /dev/null
@@ -1,32 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-# Source checks use the browser already provided by the Ubuntu x64 runner.
-# Missing or changed stock prerequisites refuse without an installer fallback.
-chrome_binary=/opt/google/chrome/chrome
-printf 'Runner browser architecture: %s\n' "$(/usr/bin/uname -m)"
-if [[ -e "$chrome_binary" || -L "$chrome_binary" ]]; then
-  /usr/bin/stat -c 'Browser file: %n type=%F owner=%u:%g mode=%a' "$chrome_binary"
-  printf 'Canonical browser path: %s\n' "$(/usr/bin/readlink -f "$chrome_binary")"
-else
-  echo 'The fixed Chrome executable is absent.'
-fi
-if [[ $(/usr/bin/uname -m) != x86_64 || ! -f "$chrome_binary" || ! -x "$chrome_binary" || -L "$chrome_binary" \
-  || $(/usr/bin/readlink -f "$chrome_binary") != "$chrome_binary" \
-  || $(/usr/bin/stat -c '%u:%g:%a' "$chrome_binary") != 0:0:755 ]]; then
-  echo 'The runner must provide the root-owned Google Chrome executable.' >&2
-  exit 1
-fi
-
-package=$(/usr/bin/dpkg-query -W -f='${binary:Package}\t${Architecture}\t${Status}\t${Version}' google-chrome-stable)
-package_pattern=$'^google-chrome-stable\tamd64\tinstall ok installed\t[0-9][A-Za-z0-9.+:~_-]*$'
-if [[ ! "$package" =~ $package_pattern \
-  || $(/usr/bin/dpkg-query -S "$chrome_binary") != "google-chrome-stable: $chrome_binary" ]]; then
-  echo 'The browser must belong to the installed stock Chrome package.' >&2
-  exit 1
-fi
-
-printf 'Runner browser package: %s\n' "$package"
-/usr/bin/sha256sum "$chrome_binary"
-"$chrome_binary" --version
-printf 'PLAYWRIGHT_CHROMIUM_EXECUTABLE_PATH=%s\n' "$chrome_binary" >> "${GITHUB_ENV:?GitHub Actions environment file is required}"

From d171d6b1e8454b5595618391d45d4f07b286c6a8 Mon Sep 17 00:00:00 2001
From: Richard McDaniel <1130888+rmcdaniel@users.noreply.github.com>
Date: Fri, 6 Nov 2026 00:48:13 +0000
Subject: [PATCH 4/4] Limit bundled-browser acquisition change to source CI

---
 .github/workflows/ci.yml   | 4 ++--
 .github/workflows/docs.yml | 3 +--
 2 files changed, 3 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 34eede57..fd94f475 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -595,8 +595,8 @@ jobs:
             --offline
             --root-dir build/site
             build/site
-      - name: Select the runner-provided Chrome browser
-        run: bash "$DOCS_TOOLING_DIRECTORY/scripts/ci/use-installed-chrome.sh"
+      - name: Install the locked Chromium browser
+        run: '"$DOCS_TOOLING_DIRECTORY/node_modules/.bin/playwright" install chromium'
       - name: Verify missing-resource browser evidence
         run: npm --prefix "$DOCS_TOOLING_DIRECTORY" run test:docs-browser-failures
       - name: Check portal and API layouts in Chromium
diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml
index d7aed1bc..464ff418 100644
--- a/.github/workflows/docs.yml
+++ b/.github/workflows/docs.yml
@@ -158,8 +158,7 @@ jobs:
             --offline
             --root-dir build/site
             build/site
-      - name: Select the runner-provided Chrome browser
-        run: bash "$DOCS_TOOLING_DIRECTORY/scripts/ci/use-installed-chrome.sh"
+      - run: '"$DOCS_TOOLING_DIRECTORY/node_modules/.bin/playwright" install --with-deps chromium'
       - name: Test missing-resource browser evidence
         run: npm --prefix "$DOCS_TOOLING_DIRECTORY" run test:docs-browser-failures
       - name: Check portal and API layouts in Chromium