Add custom HTTP header support to Playwright tests for firewall bypass

[Copilot]

Playwright tests are blocked by firewall. This adds configurable custom HTTP headers to requests for bypass authentication.

Changes

• Environment variables: PLAYWRIGHT_CUSTOM_HEADER_NAME and PLAYWRIGHT_CUSTOM_HEADER_VALUE in .env.example
• Playwright config: Conditionally injects extraHTTPHeaders when both vars present, validates header name format (alphanumeric, hyphens, underscores only)
• GitHub Actions workflow: Passes header name via Variables, value via Secrets

Usage

Local development via .env:

PLAYWRIGHT_CUSTOM_HEADER_NAME=X-Firewall-Bypass
PLAYWRIGHT_CUSTOM_HEADER_VALUE=secret-value

CI/CD: Set PLAYWRIGHT_CUSTOM_HEADER_NAME as Repository Variable and PLAYWRIGHT_CUSTOM_HEADER_VALUE as Repository Secret.

---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
sam	Ignored	Preview	Jan 31, 2026 7:42am

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[Copilot]

Pull request overview

This PR adds support for custom HTTP headers in Playwright tests to bypass firewall restrictions. The implementation uses environment variables to configure optional header name-value pairs that are injected into all test requests.

Changes:

• Added environment variable configuration for custom HTTP header name and value
• Implemented header validation and conditional injection in Playwright config
• Updated GitHub Actions workflow to pass header credentials from repository variables and secrets

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.

File	Description
pnpm-monorepo/apps/playwright/playwright.config.ts	Adds header validation logic and conditional extraHTTPHeaders injection
pnpm-monorepo/apps/playwright/.env.example	Documents new environment variables for header configuration
.github/workflows/playwright-tests.yml	Passes header name from Variables and value from Secrets to test execution

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

The header name validation regex allows underscores, but RFC 7230 specifies that HTTP header field names should only contain alphanumeric characters and hyphens. Underscores in header names can cause compatibility issues with some HTTP servers and proxies. Consider removing _ from the regex pattern or documenting this deviation from the standard.

Suggested change

	// Basic validation: HTTP header names should be alphanumeric with hyphens/underscores
	if (!/^[a-zA-Z0-9_-]+$/.test(headerName)) {
	throw new Error(`Invalid HTTP header name: ${headerName}. Header names must contain only alphanumeric characters, hyphens, and underscores.`);
	// Basic validation: HTTP header names should be alphanumeric with optional hyphens
	if (!/^[A-Za-z0-9-]+$/.test(headerName)) {
	throw new Error(`Invalid HTTP header name: ${headerName}. Header names must contain only alphanumeric characters and hyphens.`);