Storybook: move smoke-test deps into the storybook workspace

[manzoorwanijk]

What?

Moves the Storybook smoke-test dependencies (@storybook/test-runner, playwright, http-server, concurrently, wait-on) into the @wordpress/storybook workspace so the storybook-check workflow no longer needs ad-hoc npm install or npx at CI time.

Why?

Dependencies installed ad hoc at CI time (npm install --no-save, npx) are invisible to the tooling that governs the repo's dependency tree: they are not in package-lock.json, so they are not covered by security audits, Dependabot, syncpack version policies, or lockfile validation. They also offer no protection against supply-chain attacks — the workflow fetches whatever the registry serves at run time, without the lockfile's integrity pinning or the repo's min-release-age safeguard, and a compromised package would execute inside CI with access to its secrets. Declaring them in the workspace that owns the smoke test puts them under the same lockfile, audit, and update process as every other dependency.

As a bonus, this also fixes the workflow under install-strategy=linked (isolated dependencies - #75814), where npx no longer resolves hoisted binaries from the repo root: the workflow becomes a pair of plain npm run --workspace calls that work under both isolated and hoisted strategies.

Recommendation: for the reasons above, we should ideally ban installing dependencies from within CI workflows (npm install <pkg>, npx <pkg>, etc.) across the repo — every dependency a workflow needs should be declared in a workspace package.json and installed through the lockfile via the regular npm ci step. CC: @desrosj

How?

• Adds @storybook/test-runner@0.24.2 (its storybook peer is already a devDependency of the workspace), playwright, http-server, concurrently, and wait-on to storybook/package.json devDependencies.
• Adds test:smoke (serve build + wait + test-storybook) and test:smoke:setup (Playwright browser install) scripts to the workspace.
• The workflow steps become npm run --workspace @wordpress/storybook test:smoke:setup and … test:smoke — npm run puts the workspace node_modules/.bin on PATH, so no npx is needed.

Testing Instructions

1. Verify the "Storybook build and Smoke Tests" CI job passes.
2. Locally: npm ci, npm run storybook:build, then npm run --workspace @wordpress/storybook test:smoke.

Note: this change was also validated with isolated dependencies (install-strategy=linked) by temporarily basing it on #75814 — the smoke-test job passed there too (run 1, run 2).

Use of AI Tools

Authored with the assistance of Claude Code; reviewed and tested by the PR author.

[github-actions]

Size Change: 0 B

Total Size: 7.76 MB

_{compressed-size-action}

[github-actions]

The following accounts have interacted with this PR and/or linked issues. I will continue to update these lists as activity occurs. You can also manually ask me to refresh this list by adding the props-bot label.

If you're merging code through a pull request on GitHub, copy and paste the following into the bottom of the merge commit message.

Co-authored-by: manzoorwanijk <manzoorwanijk@git.wordpress.org>
Co-authored-by: Mamaduka <mamaduka@git.wordpress.org>

To understand the WordPress project's expectations around crediting contributors, please review the Contributor Attribution page in the Core Handbook.

[Mamaduka]

Looks good.

I guess +1,743 lines to package lock isn't avoidable.

[manzoorwanijk]

I guess +1,743 lines to package lock isn't avoidable.

Yes, unavoidable due to a few new deps in the workspace.

[github-actions]

Flaky tests detected in 303c692.
Some tests passed with failed attempts. The failures may not be related to this commit but are still reported for visibility. See the documentation for more information.

🔍 Workflow run URL: https://github.com/WordPress/gutenberg/actions/runs/30631658542
📝 Reported issues:

• [Flaky Test] should open the inspector panel #41426 in /test/e2e/specs/widgets/customizing-widgets.spec.js