fix(vrt): add --no-sandbox to self-launching rich-text specs; pin Chrome 127

The rich-text-input and localized-rich-text-input visualspecs launch their OWN
puppeteer browser (not the jest-puppeteer global one) and did not pass
--no-sandbox. On ubuntu-24.04 (AppArmor restricts unprivileged user namespaces)
that crashes with 'No usable sandbox', failing those 2 suites and dropping a
Percy snapshot. They previously only passed because the removed aa-exec wrapper
covered them. Add --no-sandbox/--disable-setuid-sandbox to both launches, matching
jest-puppeteer.config.js used by the other 68 specs.

Also pin setup-chrome to 127.0.6533.88 (puppeteer 22.15.0's target build and the
Percy baseline's browser) instead of 'stable' — 'stable' pulled Chrome 149.

Author: misama-ct

.github/workflows/main.yml

@@ -73,12 +73,16 @@ jobs:
       # working in CI and yielded 0 snapshots, so we provision Chrome explicitly
       # here and point both tools at it. jest-puppeteer.config.js reads
       # PUPPETEER_EXECUTABLE_PATH and launches with --no-sandbox.
-      # TODO: pin `chrome-version` to a specific build for reproducible snapshots.
+      #
+      # Pinned to 127.0.6533.88 — the Chrome build puppeteer 22.15.0 targets and
+      # the one the Percy baseline was captured with. `chrome-version: stable`
+      # pulled Chrome 149 (~22 majors newer), which broke 2 visual test suites
+      # via CDP/runtime drift. Bump this in lockstep with puppeteer.
       - name: Set up Chrome
         id: setup-chrome
         uses: browser-actions/setup-chrome@2e1d749697dd1612b833dba4a722266286fbefcd # v2.1.2
         with:
-          chrome-version: stable
+          chrome-version: 127.0.6533.88
 
       - name: Running Visual Regression Tests for UI components
         run: |

packages/components/inputs/localized-rich-text-input/src/localized-rich-text-input.visualspec.js

@@ -9,6 +9,11 @@ jest.setTimeout(20000);
 beforeEach(async () => {
   browser = await puppeteer.launch({
     headless: 'new',
+    // This spec launches its own browser (not the jest-puppeteer global one), so
+    // it must opt out of the Chrome sandbox itself. CI runners (Ubuntu 24.04+)
+    // restrict unprivileged user namespaces via AppArmor, so the sandbox can't
+    // start otherwise. Matches jest-puppeteer.config.js used by other specs.
+    args: ['--no-sandbox', '--disable-setuid-sandbox'],
     slowMo: 10, // Launching the browser in slow motion is necessary due to race conditions. Otherwise browser closes prematurely and tests fail.
   });
   page = await browser.newPage();

packages/components/inputs/rich-text-input/src/rich-text-input.visualspec.js

@@ -9,6 +9,11 @@ jest.setTimeout(20000);
 beforeEach(async () => {
   browser = await puppeteer.launch({
     headless: 'new',
+    // This spec launches its own browser (not the jest-puppeteer global one), so
+    // it must opt out of the Chrome sandbox itself. CI runners (Ubuntu 24.04+)
+    // restrict unprivileged user namespaces via AppArmor, so the sandbox can't
+    // start otherwise. Matches jest-puppeteer.config.js used by other specs.
+    args: ['--no-sandbox', '--disable-setuid-sandbox'],
     slowMo: 10, // Launching the browser in slow motion is necessary due to race conditions. Otherwise browser closes prematurely and tests fail.
   });
   page = await browser.newPage();