Merge branch 'main' into kh-add-webp-support

Author: jonrohan

.github/workflows/nodejs.yml

@@ -3,12 +3,19 @@ on: [push]
 jobs:
   build:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
-    - uses: actions/checkout@v2
+    - uses: actions/checkout@v4
     - name: Use Node.js
-      uses: actions/setup-node@v1
+      uses: actions/setup-node@v4
       with:
-        node-version: '14.x'
+        node-version: '20.x'
+    # Enable unprivileged user namespaces for Chrome sandbox
+    # This is required because Ubuntu 23.10+ disables them by default
+    # See: https://github.com/actions/runner-images/issues/9621
+    - name: Enable user namespaces
+      run: sudo sysctl -w kernel.unprivileged_userns_clone=1
     - run: npm install
     - run: npm run build --if-present
     - run: npm test

.github/workflows/publish.yml

@@ -7,6 +7,8 @@ on:
 jobs:
   publish-npm:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
       - uses: actions/checkout@v3
       - uses: actions/setup-node@v3

karma.config.js

@@ -1,4 +1,15 @@
-process.env.CHROME_BIN = require('chromium').path
+// Use system Chrome/Chromium if available, otherwise let Karma find it
+// In CI environments, CHROME_BIN should be set or the system Chrome should be in PATH
+if (!process.env.CHROME_BIN) {
+  try {
+    const chromiumPath = require('chromium').path
+    if (chromiumPath) {
+      process.env.CHROME_BIN = chromiumPath
+    }
+  } catch (e) {
+    // If chromium package doesn't work, let Karma use system Chrome
+  }
+}
 
 module.exports = function (config) {
   config.set({
@@ -11,7 +22,17 @@ module.exports = function (config) {
     port: 9876,
     colors: true,
     logLevel: config.LOG_INFO,
-    browsers: ['ChromeHeadless'],
+    browsers: ['ChromeHeadlessCI'],
+    customLaunchers: {
+      ChromeHeadlessCI: {
+        base: 'ChromeHeadless',
+        flags: [
+          '--no-sandbox',
+          '--disable-gpu',
+          '--disable-dev-shm-usage'
+        ]
+      }
+    },
     autoWatch: false,
     singleRun: true,
     concurrency: Infinity