@js-recon/js-recon 1.3.2 → 1.4.1-alpha.9

package/.claude/settings.local.json

@@ -0,0 +1,10 @@
+{
+  "permissions": {
+    "allow": [
+      "Bash(npm view *)",
+      "Bash(python3 -c \"import json, sys; v=json.load\\(sys.stdin\\); stable=[x for x in v if all\\(c not in x for c in ['alpha','beta','rc','canary','next','experimental','-']\\)]; print\\('\\\\n'.join\\(stable[-30:]\\)\\)\")",
+      "Bash(npm install *)",
+      "Bash(npx vitest *)"
+    ]
+  }
+}

package/.github/workflows/build-and-prettify.yaml

@@ -12,7 +12,7 @@ jobs:
       !startsWith(github.event.head_commit.message, 'chore: prettify code')
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - name: Check version mismatch
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
@@ -42,8 +42,8 @@ jobs:
     runs-on: ubuntu-latest
     needs: version_check
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version: "22"
           cache: "npm"
@@ -55,16 +55,23 @@ jobs:
   prettier:
     runs-on: ubuntu-latest
     needs: audit
+    environment: commit-signing
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           # Make sure the action checks out the repository to the pull request branch
           ref: ${{ github.ref_name }}
-          ssh-key: ${{ secrets.DEPLOY_KEY }}
+
+      - name: Configure SSH commit signing
+        uses: shriyanss/verified-commit-action@v1
+        with:
+          ssh-private-key: ${{ secrets.JS_RECON_SIGNING_KEY }}
+          commit-name: "js-recon-bot"
+          commit-email: ${{ secrets.JS_RECON_SIGNING_EMAIL }}
 
       - name: Set up Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version: "22"
           cache: "npm"
@@ -77,30 +84,49 @@ jobs:
 
       - name: Run Prettier
         run: prettier --write . --config .prettierrc
-      
+
       - name: Remove node_modules
         run: rm -rf node_modules
 
       - name: Commit and push changes
         run: |
-          git config user.name "github-actions[bot]"
-          git config user.email "github-actions[bot]@users.noreply.github.com"
           git add .
           git commit -m "chore: prettify code" || echo "No changes to commit"
           git push
 
-  build:
+  test:
     needs: prettier
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          ref: ${{ github.ref_name }}
+
+      - name: Set up Node.js
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        with:
+          node-version: "22"
+          cache: "npm"
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Run unit tests
+        run: npm test
+
+  build:
+    needs: test
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           # Make sure the action checks out the repository to the pull request branch
           ref: ${{ github.ref_name }}
 
       - name: Set up Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version: "22"
           cache: "npm"
@@ -113,9 +139,174 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           # Make sure the action checks out the repository to the pull request branch
           ref: ${{ github.ref_name }}
       - name: Build docker container
-        run: docker build -t shriyanss/js-recon .
+        run: docker build -t js-recon/js-recon .
+
+  integration-test-docker:
+    needs: build-docker
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    steps:
+      - name: Checkout js-recon
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          ref: ${{ github.ref_name }}
+
+      - name: Checkout js-recon-labs
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          repository: js-recon/js-recon-labs
+          path: js-recon-labs
+
+      - name: Checkout js-recon-rules
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          repository: js-recon/js-recon-rules
+          path: js-recon-rules
+
+      - name: Set up Node.js
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        with:
+          node-version: "22"
+          cache: "npm"
+
+      - name: Build js-recon Docker image
+        run: docker build -t js-recon/js-recon .
+
+      - name: Install vuln-all-rules app dependencies
+        working-directory: js-recon-labs/next_js/vuln-all-rules
+        run: npm ci
+
+      - name: Build vuln-all-rules app
+        working-directory: js-recon-labs/next_js/vuln-all-rules
+        run: npm run build
+
+      - name: Start vuln-all-rules app
+        working-directory: js-recon-labs/next_js/vuln-all-rules
+        run: npm start &
+
+      - name: Wait for lab app to be ready
+        run: |
+          echo "Waiting for lab app on port 3001..."
+          n=0
+          until curl -sf http://localhost:3001 > /dev/null; do
+            n=$((n+1))
+            [ $n -ge 30 ] && echo "Timed out waiting for lab app" && exit 1
+            sleep 2
+          done
+          echo "Lab app is ready."
+
+      - name: Run js-recon via Docker against lab app
+        run: |
+          docker run --name js-recon-run \
+            --network host \
+            -v "$(pwd)/js-recon-rules:/home/pptruser/js-recon-rules" \
+            --entrypoint /bin/bash \
+            js-recon/js-recon \
+            -c 'mkdir -p ~/.js-recon && ln -sf /home/pptruser/js-recon-rules ~/.js-recon/rules && printf "http://localhost:3001\n" > /tmp/urls.txt && node build/index.js run -u /tmp/urls.txt -r ./js-recon-rules --no-sandbox -y -k'
+          mkdir -p output
+          docker cp js-recon-run:/home/pptruser/output/. ./output/ 2>/dev/null || true
+          docker rm js-recon-run
+
+      - name: Verify all rules fired
+        run: node scripts/smoke-test.js
+
+      - name: Upload analyze.json on failure
+        if: failure()
+        uses: actions/upload-artifact@v4
+        with:
+          name: analyze-json-docker
+          path: output/localhost_3001/analyze.json
+          if-no-files-found: ignore
+
+  integration-test-macos:
+    needs: build
+    runs-on: macos-latest
+    timeout-minutes: 30
+    steps:
+      - name: Checkout js-recon
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          ref: ${{ github.ref_name }}
+
+      - name: Checkout js-recon-labs
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          repository: js-recon/js-recon-labs
+          path: js-recon-labs
+
+      - name: Checkout js-recon-rules
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          repository: js-recon/js-recon-rules
+          path: js-recon-rules
+
+      - name: Set up Node.js
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        with:
+          node-version: "22"
+          cache: "npm"
+
+      - name: Install Chrome
+        run: brew install --cask google-chrome
+
+      - name: Install js-recon dependencies
+        run: npm ci
+        env:
+          PUPPETEER_SKIP_DOWNLOAD: "true"
+
+      - name: Build js-recon
+        run: npm run build
+
+      - name: Install vuln-all-rules app dependencies
+        working-directory: js-recon-labs/next_js/vuln-all-rules
+        run: npm ci
+
+      - name: Build vuln-all-rules app
+        working-directory: js-recon-labs/next_js/vuln-all-rules
+        run: npm run build
+
+      - name: Start vuln-all-rules app
+        working-directory: js-recon-labs/next_js/vuln-all-rules
+        run: npm start &
+
+      - name: Wait for lab app to be ready
+        run: |
+          echo "Waiting for lab app on port 3001..."
+          n=0
+          until curl -sf http://localhost:3001 > /dev/null; do
+            n=$((n+1))
+            [ $n -ge 30 ] && echo "Timed out waiting for lab app" && exit 1
+            sleep 2
+          done
+          echo "Lab app is ready."
+
+      - name: Pre-populate js-recon rules cache
+        run: |
+          mkdir -p ~/.js-recon
+          ln -sf "$GITHUB_WORKSPACE/js-recon-rules" ~/.js-recon/rules
+
+      - name: Run js-recon natively against lab app
+        run: |
+          echo "http://localhost:3001" > /tmp/smoke-urls.txt
+          node --max-old-space-size=4096 build/index.js run \
+            -u /tmp/smoke-urls.txt \
+            -r ./js-recon-rules \
+            -y -k
+        env:
+          PUPPETEER_EXECUTABLE_PATH: /Applications/Google Chrome.app/Contents/MacOS/Google Chrome
+
+      - name: Verify all rules fired
+        run: node scripts/smoke-test.js
+
+      - name: Upload analyze.json on failure
+        if: failure()
+        uses: actions/upload-artifact@v4
+        with:
+          name: analyze-json-macos
+          path: output/localhost_3001/analyze.json
+          if-no-files-found: ignore

package/.github/workflows/pr_checker.yml

@@ -13,10 +13,10 @@ jobs:
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: Redirect PR to dev
-        if: github.head_ref != 'dev' || github.event.pull_request.head.repo.full_name != 'shriyanss/js-recon'
+        if: github.head_ref != 'dev' || github.event.pull_request.head.repo.full_name != 'js-recon/js-recon'
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           PR_NUMBER: ${{ github.event.pull_request.number }}
         run: |
           gh pr edit $PR_NUMBER --base dev
-          gh pr comment $PR_NUMBER --body "This PR was targeting \`main\`, but only the \`dev\` branch of \`shriyanss/js-recon\` can merge directly into \`main\`. The target branch has been changed to \`dev\`."
+          gh pr comment $PR_NUMBER --body "This PR was targeting \`main\`, but only the \`dev\` branch of \`js-recon/js-recon\` can merge directly into \`main\`. The target branch has been changed to \`dev\`."

package/.github/workflows/promote-js-recon.yml

@@ -0,0 +1,104 @@
+# Manually-triggered second phase of a release, run after a staged npm publish
+# (see publish-js-recon.yml) has been approved by a human with 2FA on npmjs.com.
+# Installs js-recon from the published npm registry artifact rather than
+# building from git source, so the Homebrew/Docker/GHCR outputs are provably
+# the same bits that were reviewed and approved on npm.
+
+name: Promote JS Recon Release
+
+on:
+  workflow_dispatch:
+    inputs:
+      version:
+        description: "Published npm version to promote (e.g. 1.4.1-alpha.6, no leading v)"
+        required: true
+        type: string
+
+jobs:
+  update-homebrew-tap:
+    runs-on: ubuntu-latest
+    environment: homebrew-publish
+    steps:
+      - name: Fetch published tarball and compute SHA256
+        id: sha256
+        run: |
+          npm pack "@js-recon/js-recon@${VERSION}"
+          SHA=$(sha256sum "js-recon-js-recon-${VERSION}.tgz" | awk '{print $1}')
+          echo "sha256=${SHA}" >> "$GITHUB_OUTPUT"
+        env:
+          VERSION: ${{ inputs.version }}
+
+      - name: Determine target formula
+        id: formula
+        run: |
+          if [[ "$VERSION" == *"alpha"* ]]; then
+            FORMULA="Formula/js-recon-alpha.rb"
+          elif [[ "$VERSION" == *"beta"* ]]; then
+            FORMULA="Formula/js-recon-beta.rb"
+          else
+            FORMULA="Formula/js-recon.rb"
+          fi
+          echo "formula=${FORMULA}" >> "$GITHUB_OUTPUT"
+        env:
+          VERSION: ${{ inputs.version }}
+
+      - name: Check out homebrew-tap
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          repository: js-recon/homebrew-tap
+          token: ${{ secrets.HOMEBREW_TAP_GH_PAT }}
+          path: homebrew-tap
+
+      - name: Update formula fields
+        working-directory: homebrew-tap
+        run: |
+          sed -i "s|^  url \"https://registry\.npmjs\.org/@js-recon/js-recon/-/js-recon-[^\"]*\"|  url \"https://registry.npmjs.org/@js-recon/js-recon/-/js-recon-${VERSION}.tgz\"|" "${FORMULA}"
+          sed -i "s|^  sha256 \"[a-f0-9]*\"|  sha256 \"${SHA}\"|" "${FORMULA}"
+        env:
+          VERSION: ${{ inputs.version }}
+          SHA: ${{ steps.sha256.outputs.sha256 }}
+          FORMULA: ${{ steps.formula.outputs.formula }}
+
+      - name: Commit and push
+        working-directory: homebrew-tap
+        run: |
+          git config user.name "github-actions[bot]"
+          git config user.email "github-actions[bot]@users.noreply.github.com"
+          git add "${FORMULA}"
+          git commit -m "chore: update ${FORMULA} to ${VERSION}"
+          git push
+        env:
+          VERSION: ${{ inputs.version }}
+          FORMULA: ${{ steps.formula.outputs.formula }}
+
+  publish-ghcr:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+      - name: Build and push to github container registry
+        run: |
+          # build the image from the published npm artifact
+          docker build -f Dockerfile.release --build-arg JS_RECON_VERSION=$VERSION -t ghcr.io/js-recon/js-recon:$VERSION .
+
+          # check if it is alpha or beta. default to latest
+          TAG="latest"
+          [[ "$VERSION" == *"beta"* ]] && TAG="beta"
+          [[ "$VERSION" == *"alpha"* ]] && TAG="alpha"
+
+          # tag again with whatever has been set
+          docker tag ghcr.io/js-recon/js-recon:$VERSION ghcr.io/js-recon/js-recon:$TAG
+
+          # push images with both tags
+          docker push ghcr.io/js-recon/js-recon:$VERSION
+          docker push ghcr.io/js-recon/js-recon:$TAG
+
+        env:
+          VERSION: ${{ inputs.version }}

package/.github/workflows/publish-js-recon.yml

@@ -11,7 +11,7 @@ jobs:
   version_check:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - name: Check version mismatch
         run: |
           echo "[i] Checking if the version in the CHANGELOG.md, package.json, and Github release version matches"
@@ -39,8 +39,8 @@ jobs:
     needs: version_check
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version: 22
       - run: npm ci
@@ -51,8 +51,8 @@ jobs:
     needs: audit
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version: 22
       - run: npm ci
@@ -63,103 +63,45 @@ jobs:
   publish-npm:
     needs: build
     runs-on: ubuntu-latest
+    permissions:
+      id-token: write
+      contents: read
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version: 22
           registry-url: https://registry.npmjs.org/
       - run: npm ci
       - run: npm run build
-      - name: Publish to npm
+      - name: Ensure npm CLI supports OIDC trusted publishing
+        run: npm install -g npm@latest
+      - name: Stage release to npm via OIDC
         run: |
           TAG="latest"
           [[ "$VERSION" == *"beta"* ]] && TAG="beta"
           [[ "$VERSION" == *"alpha"* ]] && TAG="alpha"
-          npm publish --tag $TAG
-        env:
-          NODE_AUTH_TOKEN: ${{secrets.npm_token}}
-          VERSION: ${{ github.event.release.tag_name }}
-
-
-  publish-docker:
-    needs: build
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Build and push to dockerhub
-        run: |
-          # login to docker
-          echo $DOCKER_SECRET | docker login -u shriyanss --password-stdin
-
-          # build the image
-          docker build -t shriyanss/js-recon:$VERSION .
-
-          # check if it is alpha or beta. default to latest
-          TAG="latest"
-          [[ "$VERSION" == *"beta"* ]] && TAG="beta"
-          [[ "$VERSION" == *"alpha"* ]] && TAG="alpha"
-
-          # tag again with whatever has been set
-          docker tag shriyanss/js-recon:$VERSION shriyanss/js-recon:$TAG
-
-          # push images with both tags
-          docker push shriyanss/js-recon:$VERSION
-          docker push shriyanss/js-recon:$TAG
-          
+          npm stage publish --tag $TAG
         env:
-          DOCKER_SECRET: ${{ secrets.DOCKER_SECRET }}
           VERSION: ${{ github.event.release.tag_name }}
 
-
-  publish-ghcr:
-    needs: build
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-      packages: write
-    steps:
-      - uses: actions/checkout@v4
-      - uses: docker/login-action@v3
-        with:
-          registry: ghcr.io
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-      - name: Build and push to github container registry
-        run: |
-          # build the image
-          docker build -t ghcr.io/shriyanss/js-recon:$VERSION .
-
-          # check if it is alpha or beta. default to latest
-          TAG="latest"
-          [[ "$VERSION" == *"beta"* ]] && TAG="beta"
-          [[ "$VERSION" == *"alpha"* ]] && TAG="alpha"
-
-          # tag again with whatever has been set
-          docker tag ghcr.io/shriyanss/js-recon:$VERSION ghcr.io/shriyanss/js-recon:$TAG
-
-          # push images with both tags
-          docker push ghcr.io/shriyanss/js-recon:$VERSION
-          docker push ghcr.io/shriyanss/js-recon:$TAG
-          
-        env:
-          VERSION: ${{ github.event.release.tag_name }}
-  
   merge_main_and_dev:
     needs:
       - publish-npm
-      - publish-docker
-      - publish-ghcr
     runs-on: ubuntu-latest
+    environment: commit-signing
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
-          ssh-key: ${{ secrets.DEPLOY_KEY }}
           fetch-depth: 0
+      - name: Configure SSH commit signing
+        uses: shriyanss/verified-commit-action@v1
+        with:
+          ssh-private-key: ${{ secrets.JS_RECON_SIGNING_KEY }}
+          commit-name: "js-recon-bot"
+          commit-email: ${{ secrets.JS_RECON_SIGNING_EMAIL }}
       - name: Merge main and dev
         run: |
-          git config --global user.name 'github-actions[bot]'
-          git config --global user.email 'github-actions[bot]@users.noreply.github.com'
           git fetch origin main:main
           git fetch origin dev:dev
           git checkout dev

package/.github/workflows/rules-smoke-test.yaml

@@ -0,0 +1,79 @@
+name: Rules Smoke Test
+
+on:
+  push:
+    branches-ignore:
+      - main
+
+jobs:
+  rules-smoke-test:
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+
+    steps:
+      - name: Checkout js-recon
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+
+      - name: Checkout js-recon-labs
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          repository: js-recon/js-recon-labs
+          path: js-recon-labs
+
+      - name: Checkout js-recon-rules
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          repository: js-recon/js-recon-rules
+          path: js-recon-rules
+
+      - name: Set up Node.js
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        with:
+          node-version: "22"
+          cache: "npm"
+
+      - name: Install js-recon dependencies
+        run: npm ci
+
+      - name: Build js-recon
+        run: npm run build
+
+      - name: Install vulnerable app dependencies
+        working-directory: js-recon-labs/next_js/vuln-all-rules
+        run: npm ci
+
+      - name: Build vulnerable app
+        working-directory: js-recon-labs/next_js/vuln-all-rules
+        run: npm run build
+
+      - name: Start vulnerable app
+        working-directory: js-recon-labs/next_js/vuln-all-rules
+        run: npm start &
+
+      - name: Wait for app to be ready
+        run: |
+          echo "Waiting for app on port 3001..."
+          timeout 60 bash -c 'until curl -sf http://localhost:3001 > /dev/null; do sleep 2; done'
+          echo "App is ready."
+
+      - name: Run js-recon against vulnerable app
+        run: |
+          echo "http://localhost:3001" > /tmp/smoke-urls.txt
+          node --max-old-space-size=4096 build/index.js run \
+            -u /tmp/smoke-urls.txt \
+            -r ./js-recon-rules \
+            --no-sandbox \
+            -y -k
+        env:
+          PUPPETEER_EXECUTABLE_PATH: /usr/bin/google-chrome-stable
+
+      - name: Verify all rules fired
+        run: node scripts/smoke-test.js
+
+      - name: Upload analyze.json on failure
+        if: failure()
+        uses: actions/upload-artifact@v4
+        with:
+          name: analyze-json
+          path: output/localhost_3001/analyze.json
+          if-no-files-found: ignore