browser-use ships to PyPI via OIDC trusted-publishing today, but the
publish job had no environment gate — anyone with workflow-dispatch
access (or any token with workflow scope) could trigger a publish
single-handedly. Adds:
- environment: release on publish_to_pypi
Reviewers configured separately on the env: gregpr07, MagMueller,
sauravpanda. prevent_self_review:true so the dispatcher cannot
self-approve.
- Fail-closed preflight that verifies the env still has required
reviewers and prevent_self_review enabled before publishing.
Same check the sdk pipeline uses. Guards against silent env
config drift.
- actions: read permission on the publish job for the env check.
Does NOT change the trigger model (release:published + workflow_dispatch),
does NOT touch tag_pre_release, does NOT touch the trusted-publishing
publish command itself. Minimal change, single security win:
two-person rule on every PyPI release.
Refs ENG-4762.
- add gemini-3-flash-preview-lite to VerifiedGeminiModels and token mappings
- list both gemini-3-flash-preview[-lite] alongside existing -latest aliases in CLOUD.md and api-v2.md SupportedLLMs
- swap example code and recommendations (examples/, AGENTS.md, quickstart.md, bug report placeholder) to gemini-3-flash-preview / -lite
- update Google CI test + evaluate_tasks judge LLM to gemini-3-flash-preview / -lite
- Add PYTHONIOENCODING=utf-8 env for Windows to handle Unicode
checkmarks and other special characters
- Remove "Source shell config" steps that fail on missing files
- Simplify to just "Add to PATH" since GITHUB_PATH is sufficient
Fixes: UnicodeEncodeError on Windows for checkmark character
Fixes: macOS failing on missing ~/.zshrc
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Use github.event.pull_request.head.repo.full_name for PRs to get
the fork's repo where the branch actually exists
- Remove cloudflared verification from uv pip/uvx tests since
browser-use install only installs Chromium, not cloudflared
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Add get_venv_bin_dir() and activate_venv() helpers for cross-platform
venv path handling (Scripts on Windows, bin on Unix)
- Replace all hardcoded venv activation calls with activate_venv
- Auto-install Python in non-interactive mode (CI) instead of prompting
from /dev/tty which doesn't exist in CI environments
- Update configure_path grep to match both Windows and Unix venv paths
- Add setup-python to Linux CI jobs for faster, more reliable installs
Fixes Windows test failures with:
install.sh: line 355: .../bin/activate: No such file or directory
Fixes Linux test failures with:
install.sh: line 650: /dev/tty: No such device or address
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Test install.sh across all platforms (Linux, macOS, Windows) with all
modes (--remote-only, --local-only, --full). Also test alternative
install methods (uv pip install, uvx).
Verifies:
- CLI works after install
- install-config.json has correct modes
- Chromium installed for local/full modes
- cloudflared installed for remote/full modes
- browser-use doctor passes
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Introduced a new HTML template for testing stacked DOM elements, including open and closed shadow DOMs, same-origin and cross-origin iframes, and a final button.
- Implemented a test case to validate click functionality through these stacked elements, ensuring that all interactive elements are clickable and that the click counter reflects the expected number of clicks.
- Enhanced the browser session configuration to accommodate a taller window size for better visibility of stacked elements.
This update aims to improve the robustness of DOM interaction tests and ensure comprehensive coverage of complex scenarios in the browser automation framework.
- Add branchName parameter to API call
- This allows the UI to show the actual PR branch instead of 'main'
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
Laith Weinberger