Add scheduled workflow to bump bundled Playwright (fixes #9362)

[Evangelink]

Why

Microsoft.Playwright.MSTest.v4 (bundled by MSTest.Sdk when <EnablePlaywright> is set) has been stuck at an old version because Dependabot never opens a PR for it, despite #9365 / #9422 / #9452 / #9508 all reworking the anchor.

Root cause (confirmed by running the real Dependabot engine)

The prior PRs all fixed the discovery step — which already works. I ran the actual ghcr.io/dependabot/dependabot-updater-nuget container (via dependabot-cli) against this repo at HEAD. The logs show Dependabot:

1. discovers Microsoft.Playwright.MSTest.v4 via the Fix Dependabot discovery of bundled Playwright; bump to 1.61.0 #9508 anchor ✅
2. computes the bump: Updated Microsoft.Playwright.MSTest.v4 from 1.60.0 to 1.61.0 in /Directory.Packages.props ✅
3. …then emits an empty create_pull_request (no dependencies, no file diff) right after fetching the package's release notes → no PR.

Aspire.Hosting.Testing uses a byte-for-byte identical anchor + SDK-target pattern and updates fine, and production Dependabot is otherwise healthy (it opened #9559, #9561, …). So this is a Playwright-specific edge-case bug at Dependabot's PR-assembly step that no in-repo anchor change can fix.

What this does

Replaces that one Dependabot flow with a small scheduled workflow + script:

• .github/scripts/update_bundled_playwright.py — looks up the latest stable Microsoft.Playwright.MSTest.v4 on nuget.org and, when newer, rewrites both coupled values in Directory.Packages.props (the MicrosoftPlaywrightVersion property and the literal PackageVersion) so _ValidateBundledSdkFeatureVersions stays green. Has a check mode used as a PR self-test.
• .github/workflows/update-bundled-playwright.yml — weekly (+ manual dispatch) run that applies the update and opens a PR via peter-evans/create-pull-request (same action/pin as copilot-curate-update.yml). On pull_request it only runs the script self-test.

This PR intentionally does not change the bundled version itself (that's #9578's job); it only adds the automation, whose first run will reconcile whatever is on main.

Notes

• Requires the repo setting Allow GitHub Actions to create and approve pull requests (already used by copilot-curate-update.yml).
• Playwright ships ~monthly, so this is low-noise.

Fixes #9362.

[Copilot]

Pull request overview

This PR works around a Dependabot limitation where the MSTest.Sdk-bundled Microsoft.Playwright.MSTest.v4 package is discovered and computed but never actually turned into a PR at Dependabot's PR-assembly step (issue #9362, after prior anchor reworks in #9365/#9422/#9452/#9508). It replaces that broken flow with a self-contained scheduled workflow plus a Python helper that bumps the bundled Playwright version and opens a PR. It intentionally does not change the bundled version (still 1.60.0), only adds the automation.

Changes:

• Adds .github/scripts/update_bundled_playwright.py that queries nuget.org for the latest stable release and rewrites both the MicrosoftPlaywrightVersion property and the coupled literal PackageVersion in Directory.Packages.props (keeping _ValidateBundledSdkFeatureVersions green), with an update mode and a network-free check self-test mode.
• Adds .github/workflows/update-bundled-playwright.yml: weekly + manual runs apply the update and open a PR via a pinned peter-evans/create-pull-request; pull_request runs only self-test the script.

Show a summary per file

File	Description
.github/scripts/update_bundled_playwright.py	New script to look up the latest stable Playwright package and rewrite the two coupled version values in Directory.Packages.props; also validates they stay in sync.
.github/workflows/update-bundled-playwright.yml	New scheduled/manual workflow that applies the bump and opens a PR, and self-tests the script on relevant pull_request changes.

Review details

• Files reviewed: 2/2 changed files
• Comments generated: 1
• Review effort level: Medium

[github-actions]

Note

🤖 Automated review by GitHub Copilot. Posted via a maintainer's GitHub token, so it appears under their account — the account owner did not write or approve this content personally. Generated by the Expert Code Review workflow. To request a follow-up action, reply by tagging @copilot directly.

✅ 22/22 dimensions clean — no findings.

Applicable dimensions reviewed (9/22):

Dimension	Notes
Algorithmic Correctness	Regex patterns verified against actual Directory.Packages.props — both match and substitute correctly. Version tuple comparison is lexicographic and handles variable segment counts properly.
Security & IPC	Actions pinned to SHA, top-level permissions: contents: read with least-privilege elevation only in the update job, no injection vectors in output handling.
Defensive Coding	Pre-flight sync check rejects updates when property/PackageVersion already disagree; RuntimeError on missing regex matches; nuget.org timeout set.
Test Completeness	self-test job validates check mode on every PR touching the script/workflow.
Build Infrastructure	Workflow well-structured: concurrency group prevents races, peter-evans/create-pull-request pinned to SHA, labels applied.
Scope & PR Discipline	Single concern, references #9362, clear rationale in description.
Code Structure	Clean, idiomatic Python; good separation of check/update modes.
Naming & Conventions	Descriptive names, clear docstring with mode descriptions.
Documentation Accuracy	Excellent module docstring explaining the Dependabot limitation and the dual-value coupling.

Remaining 13 dimensions (Threading, Public API, Performance, Cross-TFM, Resource Management, Localization, Test Isolation, Assertion Quality, Flakiness, Data-Driven, Analyzer Quality, IPC Wire, PowerShell Hygiene) are N/A — this is a Python CI script with no C# code, no public API, and no test files.