Wire E2E smoke + test-runners into CI pipeline

- Re-enable test-runners stage (was disabled since v0.7.2 pending
  Playwright headless fix from shell migration)
- Add e2e-smoke stage: boots server, runs Playwright navigation
  smoke test against every surface, uploads screenshots on failure
- Both stages gate build-and-deploy — failure blocks merge
- Add e2e-smoke service to docker-compose.ci.yml (same Playwright
  image as test-runner, mounts screenshot volume)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

.gitea/workflows/ci.yaml

@@ -380,10 +380,6 @@ jobs:
   # ── Stage 1d: Surface Test Runners ──────────
   # Boots the server in Docker, runs all installed test-runner packages
   # via Playwright, and asserts zero failures.
-  #
-  # DISABLED: Playwright driver can't find the Run All button in headless
-  # mode — likely a shell/SPA rendering issue.  Run manually from the
-  # test-runners surface after deploy until this is resolved.
   # See: docker-compose.ci.yml, ci/surface-test-driver.js
   #
   # Runs when: backend, frontend, or packages changed (runners test all tiers).
@@ -391,8 +387,11 @@ jobs:
   test-runners:
     runs-on: ubuntu-latest
     needs: [detect-changes]
-    if: false  # disabled — see comment above. Condition for v0.7.5:
+    if: |
-    # needs.detect-changes.outputs.backend == 'true' || needs.detect-changes.outputs.frontend == 'true' || needs.detect-changes.outputs.packages == 'true' || needs.detect-changes.outputs.infra == 'true'
+      needs.detect-changes.outputs.backend == 'true' ||
+      needs.detect-changes.outputs.frontend == 'true' ||
+      needs.detect-changes.outputs.packages == 'true' ||
+      needs.detect-changes.outputs.infra == 'true'
     steps:
       - name: Checkout
         uses: actions/checkout@v4
@@ -412,6 +411,46 @@ jobs:
         if: always()
         run: docker compose -f docker-compose.yml -f docker-compose.ci.yml down -v
 
+  # ── Stage 1e: E2E Smoke Test ───────────────
+  # Boots the server in Docker, runs Playwright navigation smoke
+  # test against every surface. Asserts topbar, no JS errors.
+  # Screenshots saved as artifacts on failure.
+  # See: docker-compose.ci.yml (e2e-smoke service), ci/e2e-smoke-driver.js
+  e2e-smoke:
+    runs-on: ubuntu-latest
+    needs: [detect-changes]
+    if: |
+      needs.detect-changes.outputs.backend == 'true' ||
+      needs.detect-changes.outputs.frontend == 'true' ||
+      needs.detect-changes.outputs.packages == 'true' ||
+      needs.detect-changes.outputs.infra == 'true'
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Run E2E smoke tests (compose)
+        env:
+          BUNDLED_PACKAGES: '*'
+          ARMATURE_ADMIN_USERNAME: admin
+          ARMATURE_ADMIN_PASSWORD: admin
+          ARMATURE_ADMIN_EMAIL: admin@test.local
+        run: |
+          docker compose -f docker-compose.yml -f docker-compose.ci.yml up --build \
+            --abort-on-container-exit \
+            --exit-code-from e2e-smoke
+
+      - name: Collect screenshots
+        if: failure()
+        uses: actions/upload-artifact@v4
+        with:
+          name: e2e-screenshots
+          path: /tmp/e2e-screenshots/
+          retention-days: 7
+
+      - name: Teardown
+        if: always()
+        run: docker compose -f docker-compose.yml -f docker-compose.ci.yml down -v
+
   # ── Stage 2: Build, Database, Deploy ─────────
   #
   # Depends on all test jobs. Skipped jobs (due to path gating)
@@ -420,7 +459,7 @@ jobs:
   # Always runs — docs are served in-app by the Docs surface.
   build-and-deploy:
     runs-on: ubuntu-latest
-    needs: [detect-changes, test-go-pg, test-frontend, test-sqlite, test-runners]
+    needs: [detect-changes, test-go-pg, test-frontend, test-sqlite, test-runners, e2e-smoke]
     # Run unless: a needed job failed or the workflow was cancelled.
     # Skipped test jobs (path-gated) are fine — they don't block.
     # Always deploys — docs are served in-app, VERSION needs a build.

docker-compose.ci.yml

@@ -1,15 +1,18 @@
 # docker-compose.ci.yml — CI test override
 #
-# Extends base docker-compose.yml. Adds a healthcheck to armature and a
+# Extends base docker-compose.yml. Adds a healthcheck to armature and
-# Playwright test-runner service.  All containers share the default compose
+# Playwright-based test services.  All containers share the default compose
-# bridge network, so the test-runner reaches armature via Docker DNS
+# bridge network, so services reach armature via Docker DNS (http://armature:80).
-# (http://armature:80).
 #
-# Usage:
+# Usage (test-runner):
 #   docker compose -f docker-compose.yml -f docker-compose.ci.yml up --build \
 #     --abort-on-container-exit --exit-code-from test-runner
 #
-# The workflow exits with the test-runner's exit code (0 = pass, 1 = fail).
+# Usage (e2e-smoke):
+#   docker compose -f docker-compose.yml -f docker-compose.ci.yml up --build \
+#     --abort-on-container-exit --exit-code-from e2e-smoke
+#
+# The workflow exits with the selected service's exit code (0 = pass, 1 = fail).
 #
 # NOTE: Do NOT use network_mode: host — the workflow container and compose
 # containers are in separate network namespaces inside DinD. Use the default
@@ -42,3 +45,25 @@ services:
       ADMIN_USER: admin
       ADMIN_PASS: admin
     command: ["bash", "-c", "./ci/run-surface-tests.sh"]
+
+  e2e-smoke:
+    build:
+      context: .
+      dockerfile_inline: |
+        FROM mcr.microsoft.com/playwright:v1.52.0-noble
+        WORKDIR /work
+        RUN npm init -y && npm install playwright@1.52.0
+        COPY ci/ /work/ci/
+        RUN chmod +x /work/ci/*.sh
+    depends_on:
+      armature:
+        condition: service_healthy
+    working_dir: /work
+    environment:
+      SERVER_URL: http://armature:80
+      ADMIN_USER: admin
+      ADMIN_PASS: admin
+      SCREENSHOT_DIR: /tmp/e2e-screenshots
+    volumes:
+      - /tmp/e2e-screenshots:/tmp/e2e-screenshots
+    command: ["bash", "-c", "./ci/e2e-smoke-test.sh"]