[P0][0.2.x] Fix red main CI: Playwright wait_for_function violates strict CSP

Open Beginner friendly
  • Is something wrong?
#74 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
2/5
Estimated time
1-3 hours
Newbie friendliness
68/100
Issue type
Bug
Clarity
Clearly specified
Activity status
Active
Tech stack
playwright, python
Domain
security, testing

Research direction

Start in tests/test_browser.py at the failing wait near line 175, then search nearby Playwright tests for other string predicates that conflict with the strict CSP. Replace the wait with a locator based assertion and run the failing test on Linux Chromium through both response branches. Done means the exact new HEAD passes that test and full pytest, with error responses restoring controls and preserving edited Markdown.

Written by the indexing model from the issue text.

Description

bug

P0 blocker: red CI on merged main (2026-10-21)

Exact tested SHA: c30d213bf9fa2c889d00f1feabf637a689e5b9fd
Failing run: https://github.com/drevendev/PatchPitch/actions/runs/39588939745
Observed outcome: 245 passed, 1 failed, 15 dependency warnings.

Failure:
tests/test_browser.py::test_delayed_regeneration_locks_editor_and_restores_it[True]
At tests/test_browser.py:175, page.wait_for_function("!document.getElementById('generate').disabled") evaluates a JavaScript string through eval; the local application's strict Content-Security-Policy: script-src 'self' forbids unsafe-eval. The failing exception is Page.wait_for_function: EvalError: Evaluating a string as JavaScript violates ... script-src 'self'.

Smallest safe fix

  • Replace this wait with a Playwright locator-based assertion / wait, e.g. expect(page.locator("#generate")).to_be_enabled() with the appropriate timeout. If a JS predicate is necessary, use a proper non-string function expression supported by the Playwright API and strict CSP.
  • Search only nearby affected Playwright tests for other CSP-incompatible string predicates. Do not disable CSP, add unsafe-eval, weaken local-only protections or alter actual generation/editor code merely to make the test green.
  • Repeat exact failing test on a Linux Chromium runner with failure and success response branches, then full pytest on the new exact HEAD.
  • Verify a generation error still restores input/editor controls and preserves previous edited Markdown. Differentiate a flaky test harness from any actual UI bug; file a separate behavioral bug only if reproduced.

Acceptance

P0 before any release/tag/0.3 implementation: exact-HEAD CI green, zero new bypasses and clear linked PR/commit. Earlier local report of 246 passed is not evidence of green CI for c30d213.

Relates to #45 release gate and the full release-kit roadmap.

Dominant language
Python
Stars
1
Forks
0
Avg merge
1h 56m
Merged PRs (30d)
7

Getting set up

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from drevendev/PatchPitch

All issues in drevendev/PatchPitch

Similar issues

More Python issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.