pifydev · hypnguyen1209 · Aug 22, 2026 · Aug 22, 2026
diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
@@ -17,7 +17,6 @@ concurrency:
 jobs:
   lint:
     name: Lint (sync, frontmatter, mermaid)
-    if: github.event_name == "pull_request"
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
@@ -43,7 +42,7 @@ jobs:
 
   deploy:
     name: Deploy to GitHub Pages
-    if: github.event_name == "push" && github.ref == "refs/heads/main"
+    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
     needs: build
     runs-on: ubuntu-latest
     environment:

diff --git a/package.json b/package.json
@@ -12,7 +12,7 @@
     "lint:sync": "node scripts/sync-check.mjs",
     "lint:mermaid": "node scripts/validate-mermaid.mjs",
     "lint:gitbook": "node scripts/validate-gitbook-content.mjs",
-    "test:content": "node --test scripts/gitbook-content.test.mjs",
+    "test:content": "node --test scripts/gitbook-content.test.mjs scripts/ci-config.test.mjs",
     "quality:gitbook": "npm run test:content && npm run lint:gitbook && npm run lint:mermaid",
     "lint": "npm run lint:sync && npm run lint:frontmatter && npm run lint:mermaid"
   },

diff --git a/scripts/ci-config.test.mjs b/scripts/ci-config.test.mjs
@@ -0,0 +1,34 @@
+import assert from "node:assert/strict";
+import { readFile } from "node:fs/promises";
+import test from "node:test";
+
+const repositoryRoot = new URL("../", import.meta.url);
+
+test("deploy workflow uses valid expressions and runs its lint dependency on every event", async () => {
+  const workflow = await readFile(
+    new URL(".github/workflows/deploy.yml", repositoryRoot),
+    "utf8",
+  );
+  const normalizedWorkflow = workflow.replace(/\r\n/g, "\n");
+  const lintMatch = normalizedWorkflow.match(/  lint:\n(?<body>[\s\S]*?)\n  build:/);
+
+  assert.ok(lintMatch, "lint job block must be present");
+  assert.doesNotMatch(normalizedWorkflow, /^\s*if:\s+.*"/gm);
+  assert.doesNotMatch(lintMatch.groups.body, /^\s+if:/m);
+});
+
+test("Mermaid validation supplies the documented Chromium CI sandbox override", async () => {
+  const validator = await readFile(
+    new URL("scripts/validate-mermaid.mjs", repositoryRoot),
+    "utf8",
+  );
+  const configText = await readFile(
+    new URL("scripts/puppeteer-ci.json", repositoryRoot),
+    "utf8",
+  ).catch(() => null);
+
+  assert.match(validator, /process\.env\.CI/);
+  assert.match(validator, /puppeteer-ci\.json/);
+  assert.ok(configText, "scripts/puppeteer-ci.json must exist");
+  assert.deepEqual(JSON.parse(configText), { args: ["--no-sandbox"] });
+});
diff --git a/scripts/puppeteer-ci.json b/scripts/puppeteer-ci.json
@@ -0,0 +1,3 @@
+{
+  "args": ["--no-sandbox"]
+}
diff --git a/scripts/validate-mermaid.mjs b/scripts/validate-mermaid.mjs
@@ -11,6 +11,7 @@ let total = 0;
 
 const manifest = JSON.parse(await readFile("content/translation-manifest.json", "utf8"));
 const mmdc = join("node_modules", "@mermaid-js", "mermaid-cli", "src", "cli.js");
+const puppeteerConfig = join("scripts", "puppeteer-ci.json");
 
 const tmpDir = await mkdtemp(join(tmpdir(), "pi-docs-mermaid-"));
 
@@ -25,9 +26,12 @@ try {
         const svgFile = join(tmpDir, `block-${total}.svg`);
         await writeFile(mmdFile, block, "utf8");
         const result = await new Promise((resolve) => {
-          const proc = spawn(process.execPath, [mmdc, "-i", mmdFile, "-o", svgFile, "-q"], {
-            stdio: "inherit",
-          });
+          const browserArgs = process.env.CI ? ["-p", puppeteerConfig] : [];
+          const proc = spawn(
+            process.execPath,
+            [mmdc, ...browserArgs, "-i", mmdFile, "-o", svgFile, "-q"],
+            { stdio: "inherit" },
+          );
           proc.once("error", (error) => resolve({ code: null, error }));
           proc.once("close", (code) => resolve({ code, error: null }));
         });