[build] always use the latest Selenium Manager code when needed for tests

[titusfortner]

🔗 Related Issues

Update to #16736, which used --pin_browsers flag to determine whether to compile selenium manager

💥 What does this PR do?

• Reduces how often Selenium Manager is compiled in PR jobs (only when rust code has changed)
• Ensures Selenium Manager download pin is kept up to date with trunk instead of previous release

🔧 Implementation Notes

• Replaces --pin_browsers as the compilation flag with --//common:manager, a string flag with download (default) and host values; --pin_browsers=false on its own now downloads the pinned binary
• CI compiles the manager only in Python and Ruby jobs that test Selenium Manager and only when a PR or push touches rust/
• bazel:affected_targets reports whether rust/ changed alongside the target list, and the two jobs add --manager=host to their bazel test command from a workflow input
• SM pin is updated every time a new set of binaries is published to selenium_manager_artifacts from trunk branch. This ensures that tests are always run on the current Selenium Manager code.
• The bump lands through commit-changes.yml with the CI bot, like the release mirror, and only for trunk snapshots, so the release flow's call on a release branch keeps bumping the pin itself; a failure anywhere in the trunk snapshot chain posts to Slack, since a rejected push would otherwise go unnoticed

🤖 AI assistance

• AI assisted (complete below)
  • Tool(s): Claude Code (Claude Fable 5.1)
  • What was generated: analysis of the existing wiring, the flag and CI changes, the snapshot bump job, and this description
  • I reviewed all AI output and can explain the change

💡 Additional Considerations

• The first automated pin commit lands on trunk after the next rust/ merge
• --//common:manager=all is reserved for cross-compiled release builds once those exist

🔄 Types of changes

• Cleanup (build and CI wiring; published packages are unaffected)

[qodo-code-review]

PR Summary by Qodo

Compile Selenium Manager conditionally and refresh trunk pin

✨ Enhancement ⚙️ Configuration changes 📝 Documentation 🕐 20-40 Minutes

AI Description

• Decouples Selenium Manager source compilation from browser pinning with a dedicated Bazel flag.
• Compiles Manager in Python and Ruby CI only when rust/ files change.
• Refreshes trunk’s pinned Manager binary after snapshots and alerts on update failures.

Diagram

graph TD
  A["Changed Files"] --> B{"rust/ changed?"} -->|Yes| C["Python Ruby CI"] --> D["Manager Alias"] -->|Compile| E["Source Build"]
  B -->|No| C
  D -->|Default| F["Pinned Binary"]
  G["Snapshot Publish"] --> H["Trunk Pin Commit"] --> F

Loading

High-Level Assessment

The dedicated --compile_manager flag is the appropriate approach because Manager compilation and browser pinning are independent concerns. Keeping the old coupling would preserve unnecessary builds, while always compiling would defeat the CI optimization; propagating the existing affected-file result avoids duplicating path-filter logic across workflows.

Files changed (10) +109 / -11

Refactor (1) +8 / -8

BUILD.bazelDefault Manager aliases to pinned binaries +8/-8

Default Manager aliases to pinned binaries

• Changes each platform alias to select the Rust-built Manager only under 'manager_from_source'. All other builds now download the pinned binary independently of 'pin_browsers'.

common/manager/BUILD.bazel

Documentation (2) +3 / -2

README.mdDocument the Manager compilation flag +1/-0

Document the Manager compilation flag

• Adds '--compile_manager' to the documented Bazel testing arguments and explains that it replaces the pinned download with a source build.

README.md

BUILD.bazelClarify source-build selection guidance +2/-2

Clarify source-build selection guidance

• Updates comments to describe '--compile_manager' as the explicit switch for replacing prebuilt Manager binaries with local Rust builds.

rust/BUILD.bazel

Other (7) +98 / -1

.bazelrcAdd a shorthand alias for Manager compilation +1/-0

Add a shorthand alias for Manager compilation

• Exposes '//common:compile_manager' as the user-facing '--compile_manager' Bazel flag.

.bazelrc

ci-python.ymlConditionally compile Manager in Python integration tests +13/-0

Conditionally compile Manager in Python integration tests

• Adds reusable and manual workflow inputs for Manager compilation. The Selenium Manager test matrix passes '--compile_manager' only when requested.

.github/workflows/ci-python.yml

ci-ruby.ymlConditionally compile Manager in Ruby integration tests +11/-0

Conditionally compile Manager in Ruby integration tests

• Adds reusable and manual workflow inputs for Manager compilation. Ruby Manager tests conditionally enable the new Bazel flag while retaining pinned-binary behavior by default.

.github/workflows/ci-ruby.yml

ci.ymlPropagate Rust-change detection into binding workflows +11/-1

Propagate Rust-change detection into binding workflows

• Carries 'compile-manager.txt' through the affected-target artifact and exposes it as a job output. Python and Ruby reusable workflows receive the resulting boolean input.

.github/workflows/ci.yml

sm-snapshot.ymlCommit each trunk snapshot pin automatically +46/-0

Commit each trunk snapshot pin automatically

• After publishing trunk snapshots, runs the Manager pin updater and commits its patch to trunk through the CI bot. Adds Slack notification when the trunk pin update or commit fails, while leaving release-branch pinning unchanged.

.github/workflows/sm-snapshot.yml

BUILD.bazelDefine the independent Manager compilation setting +12/-0

Define the independent Manager compilation setting

• Introduces a default-false 'compile_manager' boolean build setting and a matching 'manager_from_source' configuration selector.

common/BUILD.bazel

bazel.rakeReport whether Manager sources changed +4/-0

Report whether Manager sources changed

• Extends affected-target analysis to detect files under 'rust/' and writes the result to 'compile-manager.txt' for downstream CI jobs.

rake_tasks/bazel.rake

[qodo-code-review]

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 📜 Skill insights (0)

1. Rust changes can bypass manager tests ✓ Resolved 🐞 Bug ≡ Correctness

Description

read-targets enables compilation only when compile-manager.txt contains true, but the run-all
branch writes only bazel-targets.txt and never invokes the rake code that creates the new flag
file. Release-preparation pull requests, reusable CI calls, and manually dispatched runs take that
branch, so Rust changes in those runs reach the Python and Ruby manager tests using the downloaded
binary instead of the changed source.

Code

.github/workflows/ci.yml[R90-92]

+          if [ "$(cat compile-manager.txt 2>/dev/null)" = "true" ]; then
+            echo "compile-manager=true" >> "$GITHUB_OUTPUT"
+          fi

Evidence

The run-all branch bypasses bazel:affected_targets, while that rake task is the only producer of
compile-manager.txt; the newly added reader therefore defaults compilation off on those paths.

.github/workflows/ci.yml[38-58]
.github/workflows/ci.yml[89-92]
rake_tasks/bazel.rake[66-68]
.github/workflows/ci.yml[141-153]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
Run-all CI paths do not create `compile-manager.txt`, so Rust changes can be tested against the downloaded Selenium Manager rather than the changed source.

## Fix Focus Areas
- .github/workflows/ci.yml[38-63]
- .github/workflows/ci.yml[89-92]
- rake_tasks/bazel.rake[66-68]

## Recommended Fix
Ensure every check-targets path writes `compile-manager.txt`. For run-all pull-request or reusable-workflow paths, compute whether the relevant commit range changes `rust/`; write `true` when it does and `false` otherwise before uploading the artifact.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

2. Manual pin updates use another branch ✓ Resolved 📘 Rule violation ☼ Reliability

Description

update-pin calls bazel.yml without passing its ref input, and no focused workflow test covers
the newly added manual-dispatch path. When a dispatch requests inputs.branch == 'trunk' from a
different selected ref, the snapshot jobs publish trunk binaries while this job creates a patch from
that other checkout and commit-pin then applies it to trunk.

Code

.github/workflows/sm-snapshot.yml[R332-335]

+    uses: ./.github/workflows/bazel.yml
+    with:
+      name: "Update Bazel Pin"
+      run: ./go update_manager

Evidence

Compliance rule 5 requires focused coverage for changed behavior. The snapshot build checks out
inputs.branch, but the added update-pin call omits the reusable Bazel workflow's ref, whose
checkout consequently defaults to github.ref; the resulting patch is then explicitly committed to
trunk.

AGENTS.md: Add Focused Tests and Avoid Contract-Distorting Mocks
.github/workflows/sm-snapshot.yml[47-50]
.github/workflows/sm-snapshot.yml[327-350]
.github/workflows/bazel.yml[137-141]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
The new manual pin-update path does not forward the requested branch to the reusable Bazel workflow, so a dispatch initiated from another ref can generate a patch from the wrong checkout. This path also lacks focused regression coverage.

## Fix Focus Areas
- .github/workflows/sm-snapshot.yml[327-350]

## Recommended Fix
Pass `ref: trunk` to the `update-pin` invocation, matching the condition that restricts this job to trunk snapshots and the branch used by `commit-pin`. Add a focused workflow validation that confirms manual trunk snapshots generate and apply the pin patch from the trunk checkout regardless of the dispatch ref.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

3. Failed pin generation can reach trunk ✗ Dismissed 🐞 Bug ☼ Reliability

Description

update-pin runs ./go update_manager through a reusable step that pipes the command to tee
without pipefail, making the step successful when the generator exits nonzero. If the generator
leaves any changed pin content before failing, the unconditional artifact capture passes that patch
to commit-pin, which applies and pushes it to trunk instead of activating the failure path.

Code

.github/workflows/sm-snapshot.yml[R332-336]

+    uses: ./.github/workflows/bazel.yml
+    with:
+      name: "Update Bazel Pin"
+      run: ./go update_manager
+      artifact-name: selenium-manager-pin

Evidence

The new update job depends directly on a runner whose pipeline masks the invoked command's status,
while later steps always save the working-tree diff and the commit workflow pushes any nonempty
patch.

.github/workflows/sm-snapshot.yml[327-350]
.github/workflows/bazel.yml[264-272]
.github/workflows/bazel.yml[308-321]
.github/workflows/commit-changes.yml[46-62]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
The reusable Bazel runner masks `update_manager` failures because its pipeline returns `tee`'s status, allowing output from a failed pin generation to be committed.

## Fix Focus Areas
- .github/workflows/sm-snapshot.yml[327-350]
- .github/workflows/bazel.yml[264-272]

## Recommended Fix
Enable `set -o pipefail` before executing the reusable runner's command and ensure mutation artifacts are uploaded for committing only after the command succeeds. Preserve any separate failed-log collection behavior without allowing a failed generator's patch to enter `commit-pin`.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

Context sources

✅ Web pages:

  🌐 github actions Job status check functions - failure includes skipped

  🌐 Job-level "if" condition not evaluated correctly if job in "needs" property is skipped

  🌐 How to fail job if any dependent job fails

  +2 more

Review mode: ⚖️ Balanced: Downgraded extended -> standard: change is below the extended eligibility bar (hunks 26/18, lines 186/200; both must reach the floor). Router rationale: This push changes multiple independent CI workflow paths, Bazel selection logic, test-suite composition, and automated pin-update/commit handling, creating several plausible easy-to-miss defects.

Tip of the day

💡 Did you know, you can hide the parts of a finding you never read, like the evidence or the agent prompt

More tips ↗ | Customize Qodo ↗ | Qodo docs ↗

[qodo-code-review]

Code review by qodo was updated up to the latest commit d01f708