ci(smoke): add comment explaining why --with-deps is omitted

OS deps are pre-installed on the self-hosted peptide-vps runner host.
--with-deps invokes apt-get which fails under the runner's NoNewPrivileges
sandbox hardening. Flag was already dropped in e00f777; this adds an
inline comment so the intent is self-documenting for future maintainers.

Agent-Session: smoke-no-withdeps-20260617

.github/workflows/ci.yml

@@ -5,7 +5,7 @@
 #
 #   jobs:
 #     ci:
-#       uses: peptiderepo/peptide-e2e/.github/workflows/ci.yml@main
+#       uses: peptide-repo/peptide-e2e/.github/workflows/ci.yml@main
 #       with:
 #         tests: stubs       # or wp-framework | brain-monkey | none
 #         has_js: false

.github/workflows/deploy-app.yml

@@ -35,7 +35,7 @@ permissions:
 jobs:
   deploy-staging:
     name: Deploy to Staging
-    runs-on: ubuntu-latest
+    runs-on: [self-hosted, peptide-vps]
     environment: staging
     steps:
       - uses: actions/checkout@v4
@@ -72,7 +72,7 @@ jobs:
     name: Smoke tests (staging)
     needs: deploy-staging
     if: ${{ inputs.run_smoke }}
-    uses: peptiderepo/peptide-e2e/.github/workflows/smoke.yml@main
+    uses: peptide-repo/peptide-e2e/.github/workflows/smoke.yml@main
     secrets:
       STAGING_WP_ADMIN_USER: ${{ secrets.STAGING_WP_ADMIN_USER }}
       STAGING_WP_ADMIN_PASSWORD: ${{ secrets.STAGING_WP_ADMIN_PASSWORD }}
@@ -83,7 +83,7 @@ jobs:
     # skipped smoke (run_smoke: false) still allows prod via the if-condition.
     needs: [deploy-staging, smoke]
     if: ${{ !cancelled() && needs.deploy-staging.result == 'success' && needs.smoke.result != 'failure' }}
-    runs-on: ubuntu-latest
+    runs-on: [self-hosted, peptide-vps]
     environment: production
     steps:
       - uses: actions/checkout@v4

.github/workflows/smoke.yml

@@ -32,14 +32,14 @@ on:
 jobs:
   smoke:
     name: Playwright smoke suite
-    runs-on: ubuntu-latest
+    runs-on: [self-hosted, peptide-vps]
     timeout-minutes: 15
 
     steps:
       - name: Checkout peptide-e2e (explicit — workflow_call defaults to caller repo)
         uses: actions/checkout@v4
         with:
-          repository: peptiderepo/peptide-e2e
+          repository: peptide-repo/peptide-e2e
           ref: main
 
       - name: Set up Node.js
@@ -53,7 +53,8 @@ jobs:
         run: npm ci
 
       - name: Install Playwright browsers
-        run: npx playwright install chromium --with-deps
+        # OS deps pre-installed on the self-hosted runner host; --with-deps needs sudo which the sandbox blocks
+        run: npx playwright install chromium
 
       - name: Run smoke tests
         env:

CHANGELOG.md

@@ -1,5 +1,21 @@
 # Changelog
 
+## [1.7.2] - 2026-06-17
+
+### Fixed
+- **CI**: Drop `--with-deps` from `npx playwright install chromium` in `smoke.yml`.
+  The `peptide-vps` self-hosted runner has OS-level Playwright deps pre-installed by
+  root; `--with-deps` invokes `apt-get` which requires `sudo`, blocked by the runner's
+  `NoNewPrivileges=true` systemd hardening. Binary-only install works without
+  elevated privileges.## [1.7.1] - 2026-06-17
+
+### Changed
+- **CI/CD**: Switch `deploy-staging`, `deploy-production`, and `smoke` jobs from
+  `ubuntu-latest` (GitHub-hosted) to `[self-hosted, peptide-vps]` (org runner on
+  KVM8 VPS). This routes all Hostinger SSH/rsync traffic through our stable VPS IP,
+  fixing the Azure-region throttle that caused intermittent deploy failures.
+  Callers' CI/validate jobs are unaffected (remain on `ubuntu-latest`).
+
 ## [1.7.0] - 2026-06-17
 
 ### Added

package.json

@@ -1,6 +1,6 @@
 {
   "name": "peptide-e2e",
-  "version": "1.7.0",
+  "version": "1.7.2",
   "description": "Playwright smoke tests for peptiderepo.com (staging + production)",
   "private": true,
   "scripts": {