[devantler]

🤖 Generated by the Agentic Engineer

Why

GitHub's runner upgrade prevents the required Coroot browser checks from starting and has evicted validated work from the delivery queue.

What

Run the browser check on the supported Ubuntu version so its existing scenarios can complete and delivery can resume.

Fixes #5557

[devantler]

🤖 Generated by the Agentic Engineer

The failure is reproduced by native merge-group run 40827115612 (browser job 123292576321), before any browser scenario executes. The moving runner label selected Ubuntu 26.04, which the pinned Playwright 1.56.1 does not support. Its tagged platform selector recognizes Ubuntu 24.04; GitHub also documents pinning that image during the ongoing runner migration.

Signed head f43af02d3982472c46a4c7c45ae53645beb0cb93 changes only the native browser job's runner and its explanatory comment. Local actionlint and whitespace validation pass. Correctness and simplification review found no other change needed; every scenario, tool/image pin, permission, timeout and evidence requirement is retained.

The existing native browser run 40829342660 and CI run 40829342470 must settle at this exact head before an ordered independent review is requested. This remains a draft; there is no hosted success, merge or queue-recovery claim yet.

[devantler]

🤖 Generated by the Agentic Engineer

Blocker: none

Cleared 2026-10-29: Prerequisite PR 5565 merged at 2d60bc4; current main still uses ubuntu-latest in the browser job, so this runner fix remains required. Integrate current main and collect new-head CI and native browser proof.

Previous record (historical):

> 🤖 Generated by the Agentic Engineer

<!-- pr-blocker-record -->

**Blocker:** devantler-tech/platform#5565 | upstream | last-verified 2026-10-29: Native publication CI failed in the worker-counter probe before the browser-runner change could be cleared. Open repair #5565 at 65fc4187 contains the synchronized publication probe. Resume after it merges, integrate current main, and collect new-head CI, independent review and the browser proof.

[devantler]

🤖 Generated by the Agentic Engineer

Cleared the merged prerequisite and integrated actual main 2d60bc4f498f6a15fca1970aeff6db940d781405 through the expected-head update. GitHub verifies signed merge f93e92215c00a3ee72ce54f8d4aaffb198bacbba, with the previous head and that main revision as its exact parents. The remaining diff is only the supported Ubuntu browser-runner change.

The new native browser run 40856796709 passed. Existing CI 40856796603 and the associated Go/quality runs are still in progress. This remains draft pending settled current-head CI, an ordered substantive review and the final readiness gates.

[devantler]

🤖 Generated by the Agentic Engineer

@coderabbitai full review

[coderabbitai]

⚠️ Action not completed

Review rate limited.

---

Your included review limit is currently reached under our Fair Usage Limits Policy. This review may still proceed through usage-based billing if eligible. Your next included review will be available in 49 minutes.

[coderabbitai]

No actionable comments were generated in the recent review.

Recent review info

Run configuration

• Source mode: Auto
• Repository: devantler-tech/platform
• Branch: codex/coroot-browser-runner-5557-ce14
• File: .coderabbit.yaml
• Commit: 9a22899
• Layers: Repository YAML (base), Organization UI (inherited)
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: 0cb212a3-1f9b-4a93-9e14-b68a07834a75

Commits

Reviewing files that changed from the base of the PR and between 94f4a5c and 9a22899.

Files selected for processing: 1

• .github/workflows/validate-coroot-security-progress.yaml

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

Recent review details

Additional context used

Code guidelines: 1

AGENTS.md — auto-discovered

Path-based instructions: 1

Source excerpt: **Never commit plaintext secrets** — all secrets must be SOPS-encrypted with the `.enc.yaml` suffix.

CodeRabbit inference engine (AGENTS.md)

Files:

• .github/workflows/validate-coroot-security-progress.yaml

Additional comments: 1

.github/workflows/validate-coroot-security-progress.yaml: 1

143-144: LGTM!

Walkthrough

The native-coroot job now runs on ubuntu-24.04 instead of ubuntu-latest. Its name, timeout, permissions, environment, and steps remain unchanged.

Possibly related issues

• #5557: The issue reports that the native browser job cannot install Chromium on Ubuntu 26.04. This change pins the job to Ubuntu 24.04.

Possibly related PRs

• devantler-tech/platform#5262: This PR introduced the workflow and native-coroot job that this change updates.
• devantler-tech/platform#5268: This PR activates the Coroot dashboards that the native browser job exercises.

Priority: Normal

Severity of issue fixed: Medium

Merge Risk: Minimal · up to 9a228

No actionable merge-blocking risk is identified; normal current-head CI validation remains appropriate.

Important

Pre-merge checks failed

Please resolve all errors before merging. Addressing warnings is optional.

Failed checks: 1 inconclusive

Check name	Status	Explanation	Resolution
Linked Issues check		For [#5557], the workflow pins only native-coroot to ubuntu-24.04. The existing browser scenarios, Playwright version, images, permissions, timeout, and artifact upload remain present in the revie…	Provide current repair-head hosted-job evidence showing Chromium installation and all existing native browser scenarios passed.

Passed checks: 3 passed

Check name	Status	Explanation
Title check		The title clearly and concisely identifies the CI fix: keeping Coroot browser checks on a supported Ubuntu runner.
Description check		The description explains the runner compatibility problem and the intended fix. It directly relates to the changeset.
Out of Scope Changes check		The reviewed change is limited to the native-coroot runner pin and its explanatory comment. The runtime-tools job remains unchanged on ubuntu-latest, and no unrelated product or validation chang…

Full details: Out of Scope Changes check

Explanation

The reviewed change is limited to the native-coroot runner pin and its explanatory comment. The runtime-tools job remains unchanged on ubuntu-latest, and no unrelated product or validation changes are shown.

Full details: Linked Issues check

Explanation

For [#5557], the workflow pins only native-coroot to ubuntu-24.04. The existing browser scenarios, Playwright version, images, permissions, timeout, and artifact upload remain present in the reviewed workflow. The available evidence does not establish that the hosted native job on the current repair head installed Chromium and passed all scenarios; the PR summary reports only an earlier-head pass and later validation as pending.

Resolution

Provide current repair-head hosted-job evidence showing Chromium installation and all existing native browser scenarios passed.

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[devantler]

🤖 Generated by the Agentic Engineer

cr:no-gate@f93e922. The authenticated current-PR reply, updated 2026-10-29T10:36:42Z, says the included review is rate limited for another 49 minutes (about 11:25 UTC). A fresh no-gate guard found no substantive CodeRabbit review at this head. Continue to Codex under the ordered review contract; no paid review is enabled and no source change is needed.

[devantler]

🤖 Generated by the Agentic Engineer

@codex review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Chef's kiss.

Reviewed commit: f93e92215c

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-29T10:50:16.942675Z	f93e922	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[devantler]

🤖 Generated by the Agentic Engineer

The latest native merge-group run 40869263703 reproduced the Ubuntu 26.04 Chromium installation failure before any browser scenario ran. After the prior activity window expired and a fresh holder check found nobody working on this PR, I integrated actual main 94f4a5c18863c93583c51882bd5f48577597e45d through an update bound to the observed old head. GitHub verifies signed head 9a22899a7041c27c3e420f92c260bfa4a4baa43d, whose exact parents are the prior head and that main revision. The net change remains only the supported Ubuntu runner and its explanatory comment.

I inspected the prior-head native run 40856796709, its successful Chromium and real-browser steps, and all three preserved dashboard screenshots. The 12/8/13-panel synthetic dashboards render; absent one-day fixture history is explicit. This proves that earlier integration path, not production health or the new head.

New-head CI 40872773049 and native browser validation 40872772974 are pending. This stays draft until current-head validation and independent review are complete. No queue admission, merge or post-merge recovery is claimed.

[devantler]

🤖 Generated by the Agentic Engineer

@coderabbitai full review

[coderabbitai]

✅ Action performed

Full review finished.

[devantler]

🤖 Generated by the Agentic Engineer

Current-head validation and evaluation are complete at 9a22899a7041c27c3e420f92c260bfa4a4baa43d.

The native browser run 40872772974 is successful at this exact head. Its browser job installed the pinned Chromium, exercised the released binary and persisted dashboards, passed the existing browser scenarios, and preserved artifact coroot-security-native-40872772974-1. I downloaded that run's artifact and inspected all three screenshots: the synthetic 12-, 8- and 13-panel dashboards render their expected series and explicitly show the missing one-day fixture history. The helper validation job passed too. This supplies the current-head hosted evidence requested by the review summary's inconclusive linked-issue note; the earlier comment describing validation as pending is historical.

CI 40872773049 also passed at this head. The CodeRabbit recent-review summary names this head and reports no actionable comments; its author/freshness binding and the summary-verdict helper both pass. The complete conversation, review and thread read has no unresolved finding. The net diff still changes only the browser job's runner and explanatory comment; scenarios, tool/image pins, permissions, timeout and artifact requirements remain intact.

The runner repair is ready for protected queue validation. This synthetic browser acceptance proves the repaired check can run; production health and downstream adoption remain separate verification obligations.