From 03d57a17f2571014c03efa82bdf90ea82af837e4 Mon Sep 17 00:00:00 2001
From: martin veillette <martin.veillette@gmail.com>
Date: Sat, 15 Aug 2026 15:14:53 -0400
Subject: [PATCH] ci: allow manual Pages deploys, sync Dependabot, drop
 Playwright fuzz job

Match the fleet deploy.yml and dependabot.yml, and stop running the Playwright fuzz smoke as a CI job.
---
 .github/dependabot.yml       |  2 +-
 .github/workflows/ci.yml     | 31 -------------------------------
 .github/workflows/deploy.yml |  4 ++++
 CLAUDE.md                    |  3 +--
 4 files changed, 6 insertions(+), 34 deletions(-)

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 350b6e7..c374c25 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -18,7 +18,7 @@ updates:
     ignore:
       - dependency-name: "@types/node"
         update-types: ["version-update:semver-major"]
-      # Forced in package.json overrides (see CLAUDE.md → package.json overrides).
+      # Forced in package.json overrides (see each repo's CLAUDE.md → package.json overrides).
       # Dependabot PRs would fight the pin / reopen known-accepted risk.
       - dependency-name: "lodash"
       - dependency-name: "three"
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 1252291..865de67 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -35,34 +35,3 @@ jobs:
 
   codeql:
     uses: OpenPhysics/Baton/.github/workflows/shared-codeql.yml@main
-
-  # The Playwright fuzz smoke needs a browser, so it runs here rather than in the shared
-  # vitest job. It drives the built sim with the fuzz query parameters and fails on any
-  # console error or assertion.
-  fuzz:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v7
-
-      - uses: actions/setup-node@v7
-        with:
-          node-version: 24
-          cache: npm
-
-      - run: npm ci
-
-      - name: Install Chromium for Playwright
-        run: npx playwright install --with-deps chromium
-
-      - name: Fuzz the simulation
-        run: npm run test:fuzz
-        env:
-          FUZZ_DURATION: 30
-
-      - name: Upload fuzz report on failure
-        if: failure()
-        uses: actions/upload-artifact@v7
-        with:
-          name: fuzz-report
-          path: playwright-report/
-          retention-days: 7
diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index 910486b..e87506e 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -3,6 +3,10 @@ name: Deploy
 on:
   push:
     branches: [main]
+  # Manual dispatch, so the site can be published without waiting for a push and
+  # so a deploy that never fired can be recovered by hand. Matches Baton's own
+  # pages.yml, which carries the same pair of triggers.
+  workflow_dispatch:
 
 concurrency:
   group: pages-${{ github.ref }}
diff --git a/CLAUDE.md b/CLAUDE.md
index e69151c..0eaf726 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -94,8 +94,7 @@ Put unit tests only under root `tests/` (never co-locate or use `__tests__/`). R
 runs the suite when a `test` script is present. Use seeded RNG in engine tests for reproducibility.
 
 View nodes that build a `Dialog` need a `phet.joist.sim` global; call `installSimStub()` from
-`tests/view/simStub.ts` before constructing them. The Playwright fuzz smoke (`npm run test:fuzz`)
-runs as its own CI job, since it needs a browser.
+`tests/view/simStub.ts` before constructing them.
 
 ## Commands