web-testing

The workflow does not itself show malicious behavior. It contains significant CI security and reliability concerns: credential-like values are hardcoded and exposed to test processes, the Playwright cache key is overly broad and can explain stale or missing browser executables, startup is validated only by a fixed sleep, and report upload is not configured to run after failed tests and uses a non-unique artifact name. Use GitHub Actions secrets, versioned cache keys based on the lockfile and Playwright revision, a health check, explicit log capture, unique shard artifact names, and if: always() for report upload.