Run Playwright proxy tests in GitHub Actions

Separate the three network layers

A runner downloading dependencies, Playwright downloading a browser and the browser opening your test site are three separate activities. A proxy configured for one does not necessarily apply to the others.

For a regional website test, set Playwright's browser-context proxy. Do not route every CI operation through a mobile connection merely to change the website's observed country. GitHub's runner-proxy settings and Playwright's browser-install environment variables solve different deployment problems.

Keep credentials out of the workflow file

Create repository or environment secrets for the proxy endpoint, username and password. Keep your test base URL and expected country as explicit configuration. The distributed example contains only secret names and synthetic test settings.

Secrets are not normally available to workflows from untrusted forks. Do not bypass that boundary by checking out untrusted code in a privileged pull_request_target job. The starter uses a manual trigger so you choose the trusted revision that receives credentials.

name: Regional website checks
on:
  workflow_dispatch:
permissions:
  contents: read
jobs:
  country-check:
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
      - uses: actions/checkout@v6
      - uses: actions/setup-node@v6
        with:
          node-version: '24'
          cache: npm
      - run: npm ci
      - run: npx playwright install --with-deps chromium
      - run: npx playwright test
        env:
          MP_PROXY_SERVER: ${{ secrets.MP_PROXY_SERVER }}
          MP_PROXY_USERNAME: ${{ secrets.MP_PROXY_USERNAME }}
          MP_PROXY_PASSWORD: ${{ secrets.MP_PROXY_PASSWORD }}
          QA_BASE_URL: ${{ vars.QA_BASE_URL }}
          QA_EXPECTED_COUNTRY: ${{ vars.QA_EXPECTED_COUNTRY }}

Review artifacts before uploading them

A trace can contain network headers, URLs and page data. Screenshots can contain account details. Secret masking in a CI log does not make every binary artifact safe to publish.

Use an owned demonstration site or synthetic account, collect only the artifacts needed to explain a failure and choose a short retention period. The starter does not upload traces or screenshots automatically. Add that step only after reviewing what the files contain.

Keep the failure path bounded

Keep dependencies pinned through the lockfile and document the version used for the last validation. A passing local fixture verifies the example's control flow. It does not replace a test against your actual proxy and authorized website.

1. Fail clearly if required environment variables are absent.
2. Confirm one country before creating a larger matrix.
3. Use one worker for the first validation run.
4. Set both request/test timeouts and a job timeout.
5. Classify a connection failure separately from a failed storefront assertion.
6. Rerun only after inspecting the failure; do not rotate indefinitely to make the job green.