Fix Playwright CLI provenance verification for tag format change

@playwright/cli 0.1.7 changed their git tag naming convention from
'v0.1.7' to '0.1.7' (dropped the 'v' prefix). This caused our
provenance verification to fail with WorkflowRefMismatch.

- Bump minimum version from >=0.1.3 to >=0.1.7
- Update tag validation to expect tags without the 'v' prefix
- Add test to verify the callback accepts the new tag format

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: mitchdenny

src/Aspire.Cli/Agents/Playwright/PlaywrightCliInstaller.cs

@@ -54,9 +54,9 @@ internal sealed class PlaywrightCliInstaller(
     internal const string PackageName = "@playwright/cli";
 
     /// <summary>
-    /// The version range to resolve. Accepts any version from 0.1.3 onwards.
+    /// The version range to resolve. Accepts any version from 0.1.7 onwards.
     /// </summary>
-    internal const string VersionRange = ">=0.1.3";
+    internal const string VersionRange = ">=0.1.7";
 
     /// <summary>
     /// The expected source repository for provenance verification.
@@ -185,7 +185,7 @@ internal sealed class PlaywrightCliInstaller(
                 ExpectedWorkflowPath,
                 ExpectedBuildType,
                 refInfo => string.Equals(refInfo.Kind, "tags", StringComparison.Ordinal) &&
-                           string.Equals(refInfo.Name, $"v{packageInfo.Version}", StringComparison.Ordinal),
+                           string.Equals(refInfo.Name, $"{packageInfo.Version}", StringComparison.Ordinal),
                 cancellationToken,
                 sriIntegrity: packageInfo.Integrity);
 

tests/Aspire.Cli.Tests/Agents/PlaywrightCliInstallerTests.cs

@@ -429,6 +429,41 @@ public void VerifyIntegrity_WithNonSha512Prefix_ReturnsFalse()
         }
     }
 
+    [Fact]
+    public async Task InstallAsync_WorkflowRefValidator_AcceptsTagWithoutVPrefix()
+    {
+        var tempDir = CreateTestRepoRoot();
+
+        try
+        {
+            var version = SemVersion.Parse("0.1.7", SemVersionStyles.Strict);
+            var npmRunner = new TestNpmRunner
+            {
+                ResolveResult = new NpmPackageInfo { Version = version, Integrity = "sha512-abc123" }
+            };
+            var provenanceChecker = new TestNpmProvenanceChecker();
+            var playwrightRunner = new TestPlaywrightCliRunner();
+            var installer = new PlaywrightCliInstaller(npmRunner, provenanceChecker, playwrightRunner, new TestInteractionService(), new ConfigurationBuilder().Build(), NullLogger<PlaywrightCliInstaller>.Instance);
+
+            await installer.InstallAsync(tempDir, s_emptySkillDirs, CancellationToken.None);
+
+            Assert.True(provenanceChecker.ProvenanceCalled);
+            Assert.NotNull(provenanceChecker.CapturedValidateWorkflowRef);
+
+            // The Playwright team dropped the 'v' prefix from tags starting with 0.1.7.
+            // Verify the callback accepts the new format (e.g., "0.1.7" not "v0.1.7").
+            Assert.True(WorkflowRefInfo.TryParse($"refs/tags/{version}", out var refInfo));
+            Assert.True(provenanceChecker.CapturedValidateWorkflowRef(refInfo!));
+        }
+        finally
+        {
+            if (Directory.Exists(tempDir))
+            {
+                Directory.Delete(tempDir, recursive: true);
+            }
+        }
+    }
+
     [Fact]
     public async Task InstallAsync_WhenProvenanceCheckFails_ReturnsErrorMessage()
     {
@@ -997,10 +1032,12 @@ private sealed class TestNpmProvenanceChecker : INpmProvenanceChecker
     {
         public ProvenanceVerificationOutcome ProvenanceOutcome { get; set; } = ProvenanceVerificationOutcome.Verified;
         public bool ProvenanceCalled { get; private set; }
+        public Func<WorkflowRefInfo, bool>? CapturedValidateWorkflowRef { get; private set; }
 
         public Task<ProvenanceVerificationResult> VerifyProvenanceAsync(string packageName, string version, string expectedSourceRepository, string expectedWorkflowPath, string expectedBuildType, Func<WorkflowRefInfo, bool>? validateWorkflowRef, CancellationToken cancellationToken, string? sriIntegrity = null)
         {
             ProvenanceCalled = true;
+            CapturedValidateWorkflowRef = validateWorkflowRef;
             return Task.FromResult(new ProvenanceVerificationResult
             {
                 Outcome = ProvenanceOutcome,