🚀 Feature Request
👋 Hi guys!
I love playwright and recently created a pretty cool feature package which creates an artifact for release pipelines of branded design assets which supports also one-way signatures such as PKI keys which you can sign and creates a unique and easy to verify fingerprint that is simple to understand the published source you are about to install or execute is trusted from its official source.
I’d like to implement this with playwright.dev branding which I don’t think would take too long and would be a hell of an achievement for me to have as a contributor- like seriously.
The package which i write is called rock-hardened and can be found on npmjs here: https://www.npmjs.com/package/@h4shed/rock-hardened
I of course will take the time to professionally design your branding and colors for the repo using high fidelity SVGs which can be rasterized through actions and reduces the size of the release art to nearly zero.
See it in action @fused-gaming/underworld-writer
Cheers 🍻
Example
PLAYWRIGHT RELEASE ART PROPOSAL
WHAT
MAKE OFFICIAL PLAYWRIGHT RELEASE ART WITH @h4shed/rock-hardened, PROFESSIONAL CONCEPT:
ONE TEMPLATE.
ONE RELEASE VERSION.
ONE VERIFIED OUTPUT.
ART LOOK PLAYWRIGHT.
ART COME FROM PLAYWRIGHT REPO.
ART CAN PROVE WHAT RELEASE AND COMMIT MADE IT.
HOW
PLAYWRIGHT KEEP RELEASE ART TEMPLATE IN REPO.
.github/
release-artwork/
playwright-release.svg
WHEN PLAYWRIGHT MAKE RELEASE:
npx @h4shed/rock-hardened release-artwork \
--version "$PLAYWRIGHT_VERSION" \
--commit "$GITHUB_SHA"
TOOL MAKE:
playwright-v1.63.0.svg
playwright-v1.63.0.png
playwright-v1.63.0.attestation.json
USE ART FOR:
- GitHub Releases
- release notes
- docs
- social posts
- blog posts
- announcements
BRAND
TEMPLATE CONTROL PLAYWRIGHT LOOK.
- Playwright masks
- Playwright green
- Playwright coral
- dark background
- version number
- spacing
- layout
- export size
NO RANDOM DESIGN EACH RELEASE.
SAME BRAND.
NEW VERSION NUMBER.
SECURITY
LOOKING OFFICIAL NOT SAME AS BEING OFFICIAL.
ROCK-HARDENED RECORD:
- repository
- release version
- commit SHA
- template hash
- artifact hash
- generator version
EXAMPLE:
{
"repository": "microsoft/playwright",
"release": "v1.63.0",
"commit": "abc123def456",
"generator": "@h4shed/rock-hardened",
"sha256": "91c67fdc0f..."
}IF SOMEBODY CHANGE ART AFTER BUILD:
HASH CHANGE
VERIFY FAIL
VERIFY
PERSON OR CI RUN:
npx @h4shed/rock-hardened verify playwright-v1.63.0.svg
GOOD RESULT:
✓ VERIFIED
Repository: microsoft/playwright
Release: v1.63.0
Commit: abc123def456
SHA-256: 91c67fdc0f...
BAD RESULT:
✗ UNVERIFIED
Artifact digest does not match.
WHY
CURRENT RELEASE ART CAN LOOK OFFICIAL.
THIS RELEASE ART CAN ALSO PROVE WHERE IT CAME FROM.
- BRANDED
- REPRODUCIBLE
- HASHED
- TRACEABLE
- QUICK TO VERIFY
PLAYWRIGHT CONTROL TEMPLATE.
GIT CONTROL HISTORY.
CI CONTROL BUILD.
ROCK-HARDENED CONTROL VERIFICATION.
PROPOSED CONTRIBUTION
ADD SMALL RELEASE ART PIPELINE TO PLAYWRIGHT.
DO NOT TOUCH PLAYWRIGHT RUNTIME.
DO NOT TOUCH TEST RUNNER.
DO NOT TOUCH BROWSER AUTOMATION.
ONLY ADD:
- release artwork template
- generation command
- PNG/SVG output
- release metadata
- SHA-256 verification
- attestation file
- CI verification
GOAL
MAKE PLAYWRIGHT RELEASE ART PROFESSIONAL AND EASY TO TRUST.
OFFICIAL-LOOKING = BRAND
OFFICIAL + VERIFIABLE = BRAND + PROVENANCE
@h4shed/rock-hardened PROVIDE THE PROOF.
Motivation
Professional recognition and contribution to a cool project that I want to have looking great with a layer of security baked into it.
🚀 Feature Request
👋 Hi guys!
I love playwright and recently created a pretty cool feature package which creates an artifact for release pipelines of branded design assets which supports also one-way signatures such as PKI keys which you can sign and creates a unique and easy to verify fingerprint that is simple to understand the published source you are about to install or execute is trusted from its official source.
I’d like to implement this with playwright.dev branding which I don’t think would take too long and would be a hell of an achievement for me to have as a contributor- like seriously.
The package which i write is called rock-hardened and can be found on npmjs here: https://www.npmjs.com/package/@h4shed/rock-hardened
I of course will take the time to professionally design your branding and colors for the repo using high fidelity SVGs which can be rasterized through actions and reduces the size of the release art to nearly zero.
See it in action @fused-gaming/underworld-writer
Cheers 🍻
Example
PLAYWRIGHT RELEASE ART PROPOSAL
WHAT
MAKE OFFICIAL PLAYWRIGHT RELEASE ART WITH
@h4shed/rock-hardened, PROFESSIONAL CONCEPT:ONE TEMPLATE.
ONE RELEASE VERSION.
ONE VERIFIED OUTPUT.
ART LOOK PLAYWRIGHT.
ART COME FROM PLAYWRIGHT REPO.
ART CAN PROVE WHAT RELEASE AND COMMIT MADE IT.
HOW
PLAYWRIGHT KEEP RELEASE ART TEMPLATE IN REPO.
WHEN PLAYWRIGHT MAKE RELEASE:
TOOL MAKE:
USE ART FOR:
BRAND
TEMPLATE CONTROL PLAYWRIGHT LOOK.
NO RANDOM DESIGN EACH RELEASE.
SAME BRAND.
NEW VERSION NUMBER.
SECURITY
LOOKING OFFICIAL NOT SAME AS BEING OFFICIAL.
ROCK-HARDENED RECORD:
EXAMPLE:
{ "repository": "microsoft/playwright", "release": "v1.63.0", "commit": "abc123def456", "generator": "@h4shed/rock-hardened", "sha256": "91c67fdc0f..." }IF SOMEBODY CHANGE ART AFTER BUILD:
HASH CHANGE
VERIFY FAIL
VERIFY
PERSON OR CI RUN:
GOOD RESULT:
BAD RESULT:
WHY
CURRENT RELEASE ART CAN LOOK OFFICIAL.
THIS RELEASE ART CAN ALSO PROVE WHERE IT CAME FROM.
PLAYWRIGHT CONTROL TEMPLATE.
GIT CONTROL HISTORY.
CI CONTROL BUILD.
ROCK-HARDENED CONTROL VERIFICATION.
PROPOSED CONTRIBUTION
ADD SMALL RELEASE ART PIPELINE TO PLAYWRIGHT.
DO NOT TOUCH PLAYWRIGHT RUNTIME.
DO NOT TOUCH TEST RUNNER.
DO NOT TOUCH BROWSER AUTOMATION.
ONLY ADD:
GOAL
MAKE PLAYWRIGHT RELEASE ART PROFESSIONAL AND EASY TO TRUST.
OFFICIAL-LOOKING = BRAND
OFFICIAL + VERIFIABLE = BRAND + PROVENANCE
@h4shed/rock-hardenedPROVIDE THE PROOF.Motivation
Professional recognition and contribution to a cool project that I want to have looking great with a layer of security baked into it.