From fca39344b15435ade5292df4609acd896ff6fe80 Mon Sep 17 00:00:00 2001
From: Dotta <bippadotta@protonmail.com>
Date: Fri, 4 Sep 2026 02:26:19 -0500
Subject: [PATCH] ci(runner): install only Chromium headless shell

---
 .github/workflows/runner-full-stack-e2e.yml | 6 +++---
 tests/runner-e2e/workflow-security.test.ts  | 6 ++++++
 2 files changed, 9 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/runner-full-stack-e2e.yml b/.github/workflows/runner-full-stack-e2e.yml
index 4a599b0a51..fb341726a5 100644
--- a/.github/workflows/runner-full-stack-e2e.yml
+++ b/.github/workflows/runner-full-stack-e2e.yml
@@ -910,15 +910,15 @@ jobs:
         if: matrix.profileId == 'legacy-claude'
         run: npm install --global --omit=dev @anthropic-ai/claude-code@2.1.19
 
-      - name: Install Chromium
+      - name: Install Chromium headless shell
         run: |
           set -euo pipefail
           for attempt in 1 2 3; do
-            if pnpm exec playwright install --with-deps chromium; then
+            if pnpm exec playwright install --with-deps --only-shell chromium; then
               exit 0
             fi
             if [ "$attempt" -eq 3 ]; then
-              echo "Chromium installation failed after $attempt attempts." >&2
+              echo "Chromium headless shell installation failed after $attempt attempts." >&2
               exit 1
             fi
             sleep "$((attempt * 10))"
diff --git a/tests/runner-e2e/workflow-security.test.ts b/tests/runner-e2e/workflow-security.test.ts
index d73194e5f4..2ee1ca60e2 100644
--- a/tests/runner-e2e/workflow-security.test.ts
+++ b/tests/runner-e2e/workflow-security.test.ts
@@ -238,6 +238,12 @@ describe("public repository paid workflow security", () => {
     expect(paidJob).toMatch(
       /Reauthorize paid execution before provider access[\s\S]*actions\/checkout@[0-9a-f]{40}[\s\S]*persist-credentials: false[\s\S]*Download resolved target lockfile/,
     );
+    expect(paidJob).toContain(
+      "pnpm exec playwright install --with-deps --only-shell chromium",
+    );
+    expect(paidJob).not.toContain(
+      "pnpm exec playwright install --with-deps chromium",
+    );
     const paidInstall = paidJob.indexOf(
       "pnpm install --frozen-lockfile --ignore-scripts",
     );