cobalt/build: Push browser test Docker images to registry by Awallky · Pull Request #9049 · youtube/cobalt

Awallky · 2026-02-11T00:53:31Z

Enable the browser test runners in CI by building and pushing a specialized Docker image when cobalt_browsertests is a target.

This update:

Authenticates with the us-west1 Artifact Registry.
Colocates the browser test Dockerfile with its dependencies in the artifacts directory.
Builds and pushes the image to: us-west1-docker.pkg.dev/ytlr-image-hosting/integration-test-images/avvall-service-test
Uses a unique tag based on the run ID and platform for traceability.

This ensures that the necessary environment is available for downstream on-device or on-host browser test execution.

Test: vpython3 cobalt/tools/test_on_device_tests_gateway_client.py
Test: vpython3 cobalt/build/test_archive_test_artifacts.py
Test: vpython3 cobalt/testing/browser_tests/tools/test_collect_test_artifacts.py
Test: vpython3 cobalt/testing/browser_tests/test_run_browser_tests.py
Test: vpython3 cobalt/tools/test_on_device_tests_gateway_client.py

Bug: 483488213
Bug: 473909665
Bug: 473909293

github-actions · 2026-02-11T00:53:46Z

🤖 Gemini Suggested Commit Message

ci: Build and push browser test Docker images

Modify the upload_test_artifacts action to build and push
a specialized Docker image for browser tests. This image is
created when cobalt_browsertests is a target.

This change authenticates with the Artifact Registry and
pushes the image with a unique tag. It provides a consistent
environment for downstream on-device or on-host browser
test execution in CI.

Bug: 483488213

💡 Pro Tips for a Better Commit Message:

Influence the Result: Want to change the output? You can write custom prompts or instructions directly in the Pull Request description. The model uses that text to generate the message.
Re-run the Generator: Post a comment with: /generate-commit-message

gemini-code-assist

Code Review

This pull request adds functionality to build and push a Docker image for browser tests within the CI/CD pipeline. A critical vulnerability was identified where a service account access token could be exposed in GitHub Actions logs due to set -x tracing combined with printf ${ACCESS_TOKEN}. Additionally, there are areas for improvement regarding shell script safety, robustness of JSON parsing, and maintainability, including an unsafe use of printf, a brittle JSON check, and a hardcoded image name.

.github/actions/upload_test_artifacts/action.yaml

Awallky · 2026-02-11T01:05:36Z

/gemini review

gemini-code-assist

Code Review

This pull request introduces a new capability to the upload_test_artifacts action to build and push a Docker image for browser tests. A high-severity command injection vulnerability has been identified in .github/actions/upload_test_artifacts/action.yaml due to direct interpolation of GitHub Action inputs and matrix variables into a shell script, which can lead to arbitrary command execution. This should be remediated by using environment variables. Additionally, the action contains hardcoded values that reduce reusability and a potential correctness issue in the browser test target detection logic.

.github/actions/upload_test_artifacts/action.yaml

Awallky · 2026-02-11T01:25:29Z

/gemini review

gemini-code-assist

Code Review

This pull request integrates Docker image building and pushing for browser tests into the CI workflow. However, it introduces a high-severity command injection vulnerability in the internal_tests and on_device_tests actions, as the docker_tag input is directly interpolated into shell scripts instead of being handled safely via environment variables. Additionally, there is a high-severity suggestion to improve authentication with Google Artifact Registry and a medium-severity suggestion to parameterize the Dockerfile path for enhanced action flexibility.

.github/actions/internal_tests/action.yaml

.github/actions/on_device_tests/action.yaml

.github/actions/upload_test_artifacts/action.yaml

.github/workflows/main.yaml

+      - name: Parse Test Target JSON
+        id: test-target-json
+        uses: ./.github/actions/test_targets_json
+      - name: Build and Push Browser Test Docker Image


.github/actions/internal_tests/action.yaml

.github/workflows/main.yaml

.github/actions/internal_tests/action.yaml

.github/workflows/main.yaml

.github/actions/docker_browsertests/action.yaml

.github/workflows/main.yaml

+      - name: Test Results
+        uses: ./.github/actions/process_test_results
+        continue-on-error: true
+        with:


.github/workflows/main.yaml

      - name: Failed Tests
-        if: needs.test-results.result == 'failure'
+        if: needs.test-results.result == 'failure' || needs.browser-test-results.result == 'failure'
        run: |


Enable the browser test runners in CI by building and pushing a specialized Docker image when cobalt_browsertests is a target. This update: 1. Authenticates with the us-west1 Artifact Registry. 2. Colocates the browser test Dockerfile with its dependencies in the artifacts directory. 3. Builds and pushes the image to: us-west1-docker.pkg.dev/ytlr-image-hosting/integration-test-images/avvall-service-test 4. Uses a unique tag based on the run ID and platform for traceability. This ensures that the necessary environment is available for downstream on-device or on-host browser test execution. Bug: 473909877

- Added 'continue-on-error' to browser test results processing in CI. - Dynamically extract browser test target names in main.yaml and browser_tests action. - Ensure gateway client explicitly sets result filenames for browser tests. - Updated unit tests to verify filename and Piper target alignment.

- Added missing 'browser_test_targets' and 'yts_wpt_test_targets' to android-arm64.json. - Updated browser_tests action to handle empty targets gracefully. - Improved bash robustness in action.yaml by fixing array usage and unbound variables.

…ture - Restore '--runtime-deps-path' in 'run_tests.template.py' to fix unit tests. - Fix argument forwarding and unique XML output in 'run_browser_tests.py'. - Support both '.tar.gz' and '.tar.zstd' extensions in Dockerfile. - Encapsulate Linux host execution logic into a dedicated '.github/actions/linux_browser_tests' action. - Split 'test-results' and 'browser-test-results' jobs to prevent matrix collisions. - Standardize Docker image naming to 'cobalt-browsertest-runner'. - Add TODOs and bug references (b/432503432, b/483460300) for disabled tests on Starboard.

- Switched from 'name' to 'pattern' in 'actions/download-artifact' to prevent job failure when artifacts are missing. - Added 'continue-on-error: true' to the download step for extra robustness. - Aligned browser test artifact download pattern with standard unit test pattern.

- Added 'continue-on-error: true' to the download step in 'browser-test-results'. - This prevents downstream processing failures if the browser test job didn't produce artifacts (e.g. due to filtering or infra errors).

- Ensured the xvfb-run command is on a single line to prevent bash interpretation errors from missing line continuations.

…s enabled

- Added strict gtest name validation to ignore summary lines. - Implemented filename sanitization for XML results to support artifact uploads. - Added temporary user data directories for better process isolation.

- Renamed output files to include the target name ('cobalt_browsertests_runner'). - This ensures the 'print_logs' action glob correctly identifies the files after download.

- Created 'browser-test-on-device' (Android) which no longer waits for unit test Docker images. - Created 'browser-test-on-host' (Linux) which continues to use the unit test image for its environment. - This allows Android browser tests to start immediately after the Cobalt build, saving 5-10 minutes per PR run.

.github/workflows/main.yaml

+        id: test-target-json
+        uses: ./.github/actions/test_targets_json
+      - name: Build and Push Browser Test Docker Image
+        id: build-docker-image


- Following the split of browser tests into on-device and on-host jobs, it is now safe to move the 'if' conditions for 'docker-unittest-image' and 'docker-webtest-image' back to the job level. - Android browser tests no longer depend on these images, so they will not be incorrectly skipped.

…le file

…wser tests

gemini-code-assist bot reviewed Feb 11, 2026

View reviewed changes

.github/actions/upload_test_artifacts/action.yaml Outdated Show resolved Hide resolved

.github/actions/upload_test_artifacts/action.yaml Outdated Show resolved Hide resolved

.github/actions/upload_test_artifacts/action.yaml Outdated Show resolved Hide resolved

gemini-code-assist bot reviewed Feb 11, 2026

View reviewed changes

github-advanced-security bot found potential problems Feb 11, 2026

View reviewed changes

Awallky force-pushed the add-browsertest-runners-to-ci branch from 7cdccbd to 493b022 Compare February 12, 2026 21:07

Awallky requested review from Libzu and SortaCookie February 12, 2026 23:41

Awallky changed the title ~~ci: Build and push browser test Docker images in upload_test_artifacts~~ cobalt/build: Push browser test Docker images to registry Feb 12, 2026

SortaCookie reviewed Feb 18, 2026

View reviewed changes

.github/actions/internal_tests/action.yaml Outdated Show resolved Hide resolved

SortaCookie reviewed Feb 18, 2026

View reviewed changes

.github/workflows/main.yaml Outdated Show resolved Hide resolved

SortaCookie reviewed Feb 18, 2026

View reviewed changes

.github/workflows/main.yaml Outdated Show resolved Hide resolved

SortaCookie reviewed Feb 18, 2026

View reviewed changes

.github/workflows/main.yaml Outdated Show resolved Hide resolved

oxve reviewed Feb 18, 2026

View reviewed changes

Libzu approved these changes Feb 18, 2026

View reviewed changes

Awallky force-pushed the add-browsertest-runners-to-ci branch from 493b022 to af75fb8 Compare February 18, 2026 19:55

github-advanced-security bot found potential problems Feb 18, 2026

View reviewed changes

.github/workflows/main.yaml Fixed Show fixed Hide fixed

github-advanced-security bot found potential problems Feb 18, 2026

View reviewed changes

.github/workflows/main.yaml Fixed Show fixed Hide fixed

SortaCookie reviewed Feb 19, 2026

View reviewed changes

.github/actions/docker_browsertests/action.yaml Outdated Show resolved Hide resolved

.github/workflows/main.yaml Outdated Show resolved Hide resolved

.github/workflows/main.yaml Outdated Show resolved Hide resolved

Awallky force-pushed the add-browsertest-runners-to-ci branch 3 times, most recently from cc773aa to 9850d00 Compare February 20, 2026 00:37

Awallky requested a review from a team as a code owner February 20, 2026 00:37

Awallky force-pushed the add-browsertest-runners-to-ci branch 2 times, most recently from 1bb4bac to fe4451c Compare February 23, 2026 18:39

github-advanced-security bot found potential problems Feb 24, 2026

View reviewed changes

.github/workflows/main.yaml Fixed Show fixed Hide fixed

.github/workflows/main.yaml Fixed Show fixed Hide fixed

github-advanced-security bot found potential problems Feb 24, 2026

View reviewed changes

Awallky added 8 commits February 24, 2026 10:21

Enable test_browser for linux-x64x11 and align flag name

be11421

Fix ShellCheck warning and YAML formatting in main.yaml

e6dac08

Ensure browser test result download is non-blocking

459cf0b

- Added 'continue-on-error: true' to the download step in 'browser-test-results'. - This prevents downstream processing failures if the browser test job didn't produce artifacts (e.g. due to filtering or infra errors).

Fix xvfb-run usage error in Linux browser tests

190bc58

- Ensured the xvfb-run command is on a single line to prevent bash interpretation errors from missing line continuations.

Awallky force-pushed the add-browsertest-runners-to-ci branch from 75211ab to 190bc58 Compare February 24, 2026 18:36

Awallky added 5 commits February 24, 2026 13:00

Disable browser test execution for Android while keeping build target…

538b98e

…s enabled

Fix run_browser_tests.py parsing and filename sanitization

05d9329

- Added strict gtest name validation to ignore summary lines. - Implemented filename sanitization for XML results to support artifact uploads. - Added temporary user data directories for better process isolation.

Add unit tests for run_browser_tests.py

b5ca5d1

Align Linux browser test filenames with target names for CI logging

cd31197

- Renamed output files to include the target name ('cobalt_browsertests_runner'). - This ensures the 'print_logs' action glob correctly identifies the files after download.

Awallky force-pushed the add-browsertest-runners-to-ci branch from 015fed8 to 072ae10 Compare February 25, 2026 02:23

Merge branch 'main' into add-browsertest-runners-to-ci

4106caf

github-advanced-security bot found potential problems Feb 25, 2026

View reviewed changes

Awallky added 6 commits February 24, 2026 20:38

Fix conflict

5a5beac

Remove incorrect comment for disabled tests.

d82a491

Fix CI failure: merge individual browser test XML results into a sing…

ae11fd6

…le file

Disable failing linux test

e91bf4c

ci: Make browser tests required to pass

d6f4beb

Awallky marked this pull request as draft February 26, 2026 00:11

Awallky added 6 commits February 25, 2026 16:33

ci: Harden upload_test_artifacts against command injection

72e8ed6

ci: Harden linux_browser_tests against command injection

8d2539e

ci: Robustly check for missing results for all test targets

49203ac

ci: Fix browser test XML generation and improve result debugging

cf0f544

ci: Debug and fix missing XML results in Android browser tests

1d8a84b

ci: Enable container overrides and flexible argument handling for bro…

c620687

…wser tests

Conversation

Awallky commented Feb 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Feb 11, 2026

🤖 Gemini Suggested Commit Message

Uh oh!

gemini-code-assist bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Awallky commented Feb 11, 2026

Uh oh!

gemini-code-assist bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Awallky commented Feb 11, 2026

Uh oh!

gemini-code-assist bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Check warning

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Check warning

Check warning

Check warning

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Awallky commented Feb 11, 2026 •

edited

Loading