[slayerjain]

What

keploy-ci-playwright installed Chromium's ~200 OS-level dependencies but deliberately not the browser binary — the header comment said so explicitly: "Node modules and the Playwright browser binary are cached via MinIO at pipeline runtime."

This bakes the browser in.

Why

Every consuming lane fetched ~170 MB at pipeline time. In enterprise-ui that is paid up to 16 times concurrently, all against the same MinIO host that is simultaneously serving the build artifact and the docker image cache.

Measured on that repo:

Pulled from MinIO per pipeline	39.6 GiB
Of which static content that never changes	~27.7 GiB (70%)
MinIO aggregate ceiling	~200–250 MiB/s
Per-lane throughput, 1 transfer	~100 MiB/s
Per-lane throughput, fan-out in flight	~22 MiB/s

The browsers are the textbook case for baking: identical bytes, every run, every lane. Downloading once at image build time removes the pipeline-time cost entirely — the bytes ship in a layer the agents already cache.

How it works on the consumer side — no changes needed there

Installed to the default location for this image's user (root, HOME unset → /root/.cache/ms-playwright). That path is deliberate: it is exactly what enterprise-ui's .ci/scripts/restore-playwright-cache.sh and the install guard in .ci/scripts/playwright-setup.sh already probe. A baked image therefore short-circuits both the MinIO restore and npx playwright install with no consumer change.

PLAYWRIGHT_BROWSERS_PATH is intentionally left unset — setting it would move the browsers away from those probes and silently reintroduce the download.

Version coupling

PLAYWRIGHT_VERSION is a build arg pinned to 1.57.0, matching @playwright/test in enterprise-ui's package-lock.json, because Playwright resolves a browser by revision. install-deps is pinned to the same version so the OS packages and the browser cannot drift apart.

If a consumer moves ahead of this pin the revision will not match and the runtime path falls back to the MinIO cache, then to npx playwright install — a slow pipeline, not a broken one, and the signal to rebuild this image.

Safety

The build now asserts the browser directory exists and is non-empty. Without that an empty tree would ship silently: every consumer probe only checks for a non-empty path, so a half-installed tree reads as "baked" and the failure surfaces much later as a missing-executable error inside a test run.

Follow-up (not in this PR)

Once this ships as playwright-1.2.33, enterprise-ui repins its 22 playwright-* image references. Repinning before the image is verified would break CI, so it is deliberately separate.

Testing

• RUN block extracted and sh -n clean.
• Image user/HOME confirmed from the published registry config (User unset → root, HOME unset → /root).
• Install path corroborated by the consumer's own working code: save-playwright-cache.sh tars ~/.cache/ms-playwright after npx playwright install in this same image family.
• Not built locally — the machine I am on is at 100% disk. Please confirm the image build is green before tagging.