test: generalize the Playwright guard into CI dependency compatibility

Also assert the exact vitest/vite couplings CI depends on:
@vitest/browser-playwright and @vitest/coverage-v8 peer on the vitest
version that vite-plus bundles, and vite must resolve to the
vite-plus-core build that vite-plus ships.

Author: setchy

.github/workflows/test.yml

@@ -49,8 +49,9 @@ jobs:
     # font stack, which a bare runner does not provide.
     #
     # This tag must match the `playwright` devDependency, which ships the
-    # matching browser build. Renovate groups the two so they always move
-    # together; `scripts/visual.sh` reads the version straight from package.json.
+    # matching browser build. `scripts/visual.sh` derives the image from it for
+    # local runs, and `src/main/ciDependencyCompatibility.test.ts` asserts the
+    # two stay in sync so the version cannot drift unnoticed.
     container: mcr.microsoft.com/playwright:v1.63.0-noble@sha256:eff16c30e6f3f4af0a03fa4b706120d5e9b0891c344a27d64559aff5900a4a27
 
     steps:

renovate.json

@@ -13,7 +13,7 @@
       "allowedVersions": "<12"
     },
     {
-      "description": "Leave the visual-regression Playwright container image to a deliberate bump rather than Renovate. It must match the playwright devDependency exactly (both ship the same browser build), but the npm package and the MCR image are separate datasources and MCR exposes no release timestamp for minimumReleaseAge to compare, so grouping them still drifts the versions and opens image-only PRs that strand the screenshot baselines. package.json is the source of truth; src/main/visualRegressionImage.test.ts enforces the match and scripts/visual.sh derives the same image locally. The digest stays pinned for zizmor.",
+      "description": "Leave the visual-regression Playwright container image to a deliberate bump rather than Renovate. It must match the playwright devDependency exactly (both ship the same browser build), but the npm package and the MCR image are separate datasources and MCR exposes no release timestamp for minimumReleaseAge to compare, so grouping them still drifts the versions and opens image-only PRs that strand the screenshot baselines. package.json is the source of truth; src/main/ciDependencyCompatibility.test.ts enforces the match and scripts/visual.sh derives the same image locally. The digest stays pinned for zizmor.",
       "matchDatasources": ["docker"],
       "matchPackageNames": ["mcr.microsoft.com/playwright"],
       "enabled": false

src/main/ciDependencyCompatibility.test.ts

@@ -0,0 +1,79 @@
+import { readFileSync } from 'node:fs';
+
+/**
+ * Guards version couplings that CI depends on but that no single manifest
+ * expresses. Renovate (or a manual edit) can move one half of a pair and leave
+ * the other behind, which otherwise only surfaces as a confusing failure deep in
+ * the test or visual-regression run. Asserting the couplings here — against the
+ * versions actually installed — turns that into a fast, explicit failure.
+ *
+ * The vitest couplings are exact peer dependencies: `@vitest/browser-playwright`
+ * and `@vitest/coverage-v8` peer on the same `vitest` version that `vite-plus`
+ * bundles, and `vite` must resolve to the `@voidzero-dev/vite-plus-core` build
+ * that `vite-plus` ships.
+ */
+const repoRoot = new URL('../../', import.meta.url);
+
+function readJson<T>(path: string): T {
+  return JSON.parse(readFileSync(new URL(path, repoRoot), 'utf8')) as T;
+}
+
+type PackageJson = {
+  name?: string;
+  version: string;
+  dependencies?: Record<string, string>;
+};
+
+const workflow = readFileSync(new URL('.github/workflows/test.yml', repoRoot), 'utf8');
+
+const playwright = readJson<PackageJson>('node_modules/playwright/package.json');
+const vitest = readJson<PackageJson>('node_modules/vitest/package.json');
+const browserPlaywright = readJson<PackageJson>(
+  'node_modules/@vitest/browser-playwright/package.json',
+);
+const coverageV8 = readJson<PackageJson>('node_modules/@vitest/coverage-v8/package.json');
+const vitePlus = readJson<PackageJson>('node_modules/vite-plus/package.json');
+const vite = readJson<PackageJson>('node_modules/vite/package.json');
+
+const PINNED_PLAYWRIGHT_IMAGE =
+  /container:\s+mcr\.microsoft\.com\/playwright:v([^@\s]+)-noble@(sha256:[0-9a-f]{64})/;
+
+describe('CI dependency compatibility', () => {
+  describe('playwright', () => {
+    it('pins the visual-regression image to the installed playwright version', () => {
+      const pinned = workflow.match(PINNED_PLAYWRIGHT_IMAGE);
+
+      expect(
+        pinned,
+        'Expected a digest-pinned mcr.microsoft.com/playwright container in the visual-regression job of .github/workflows/test.yml.',
+      ).not.toBeNull();
+
+      expect(
+        pinned?.[1],
+        [
+          `The visual-regression container must run mcr.microsoft.com/playwright:v${playwright.version}-noble to match the installed playwright (driven by the package.json devDependency).`,
+          'Update the tag and refresh the pinned digest with:',
+          `  docker buildx imagetools inspect mcr.microsoft.com/playwright:v${playwright.version}-noble --format '{{.Manifest.Digest}}'`,
+        ].join('\n'),
+      ).toBe(playwright.version);
+    });
+  });
+
+  describe('vitest family', () => {
+    it('installs the browser provider and coverage reporter at the vitest version', () => {
+      expect(browserPlaywright.version).toBe(vitest.version);
+      expect(coverageV8.version).toBe(vitest.version);
+    });
+
+    it('installs vitest at the version bundled by vite-plus', () => {
+      expect(vitest.version).toBe(vitePlus.dependencies?.vitest);
+    });
+  });
+
+  describe('vite family', () => {
+    it('resolves vite to the vite-plus-core build that vite-plus ships', () => {
+      expect(vite.name).toBe('@voidzero-dev/vite-plus-core');
+      expect(vitePlus.dependencies?.vite).toBe(`npm:${vite.name}@${vite.version}`);
+    });
+  });
+});