[lihbr]

• res.ok is a method on Playwright's APIResponse, so assert(res.ok) never failed. Now res.ok().
• Traces leaked the test account's credentials (from the sign-in request) into CI artifacts. Tests that log in are no longer traced. Rotate the password of angelo.ashmore+test@prismic.io, then update the E2E_PRISMIC_PASSWORD secret.

Also updates the toolbar test selector: the toolbar now loads shell.html instead of iframe.html.

Created with Claude Opus 5.5 in Claude Code.

---

Note

Medium Risk
Changes fix silent test passes on failed API calls and reduce credential leakage in CI, but alter e2e auth assertions and CI debugging artifacts.

Overview
E2E infrastructure now fails when Prismic API calls return non-OK responses by calling Playwright’s APIResponse.ok() (and status() where needed) instead of asserting the truthy ok property, which never triggered failures. Wroom login also asserts a prismic-auth session cookie after sign-in, and repository teardown tolerates a 404 on the retry delete path when the first attempt returns 500.

Credential and CI artifact exposure is reduced by dropping the global trace: on-first-retry setting from playwright.config.ts and removing the workflow step that uploaded playwright-report/ artifacts. Toolbar coverage is aligned with the current embed by targeting shell.html instead of iframe.html in the iframe locator.

Operators should rotate the E2E Prismic account password and refresh E2E_PRISMIC_PASSWORD if traces may have captured sign-in payloads.

^{Reviewed by Cursor Bugbot for commit 2bcbd37. Bugbot is set up for automated code reviews on this repo. Configure here.}

[angeloashmore]

Let's just disable traces on CI altogether. We don't look at them, and if something fails, we can check it locally.

---

Generated by Claude Code