@suffolklitlab/alkiln 5.15.4-ref-paths-1 → 5.16.0

package/.github/workflows/da_image_v_sha_7d13853.yml

@@ -0,0 +1,67 @@
+name: Use docassemble image version
+
+on:
+  push:
+  pull_request:
+  workflow_dispatch:
+    inputs:
+      show_docker_output:
+        required: false
+        default: false
+        type: boolean
+        description: 'Show the docker logs while building the GitHub server container. It will also save the docker log artifact. This might show sensitive config information.'
+      # Experimental
+      enable_tmate:
+        type: boolean
+        description: 'Run the build with tmate debugging enabled (https://github.com/marketplace/actions/debugging-with-tmate)'
+        required: false
+        default: false
+
+jobs:
+
+  github-server-tests:
+    # Avoids running double tests when someone on the team makes a pull request
+    # 1: Trigger job on push or dispatch from this repository
+    # 2: Trigger job on pull request from a fork
+    if: (
+          github.event_name != 'pull_request'
+          && ! github.event.pull_request.head.repo.fork
+        ) || (
+          github.event_name == 'pull_request'
+          && github.event.pull_request.head.repo.fork
+        )
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        node-version: [24.x]
+      
+    steps:
+      # Place the root directory in this branch to access relative paths to
+      # action files
+      - uses: actions/checkout@v4
+
+      - name: "ALKiln - Use a specific docassemble image version to start the isolated temporary docassemble server on GitHub"
+        id: github_server
+        uses: ./action_for_github_server
+        with:
+          SHOW_DOCKER_OUTPUT: "${{ github.event.inputs.show_docker_output }}"
+          DOCASSEMBLE_IMAGE: "ghcr.io/suffolklitlab/docassemble:sha-7d13853"
+      - run: echo "ALKiln finished starting the isolated GitHub docassemble server"
+        shell: bash
+
+      ## Optional debugging to explore things like docker issues
+      #- name: Docker debug tmate session
+      #  #if: ${{ failure() && github.event.inputs.enable_tmate == 'true' }}
+      #  uses: mxschmitt/action-tmate@v3
+
+      - name: "ALKiln - Confirm docassemble packages get installed correctly"
+        if: ${{ success() }}
+        id: alkiln
+        uses: ./
+        with:
+          # Required inputs. See
+          # https://assemblyline.suffolklitlab.org/docs/alkiln/writing/#sandbox-inputs
+          SERVER_URL: "${{ steps.github_server.outputs.SERVER_URL }}"
+          DOCASSEMBLE_DEVELOPER_API_KEY: "${{ steps.github_server.outputs.DOCASSEMBLE_DEVELOPER_API_KEY }}"
+          INSTALL_METHOD: "server"
+          ALKILN_TAG_EXPRESSION: "@e3"  # One very simple test

package/CHANGELOG.md

@@ -43,15 +43,26 @@ Format:
 - 
 -->
 
-## [Unreleased]
+## [5.16.0] - 2026-05-14
+
+### Added
+
+- Adds a new optional parameter to `action_for_github_server/action.yml`, the full name of the docassemble image. It defaults to `jhpyle/docassemble:latest`, what we previously used, but can also be changed to an earlier version (`jhpyle/docassemble:1.9.8`) or a different fork of docassemble (`ghcr.io/suffolklitlab/docassemble:latest`). Note that old docassemble versions may sometimes get removed.
 
 ### Changed
 
-- Use `cwd` as the base of file paths. Motivated by ALKiP's need to change the way it handles its own file paths.
+- Changed the default version of docassemblecli to 0.0.25
+- Use `cwd` as the base of file paths. Motivated by ALKiP's upcoming need to change the way it handles its own file paths.
+- Handle curl failures while waiting for docassemble server startup. Wrapped the curl call with set +e / set -e so GitHub Actions does not exit on curl failures. All non-zero curl exit codes are treated as "not ready yet" and retried - this covers transient errors like exit code 56 (connection dropped) and exit code 7 (connection refused) that may come up during startup. Added a comment explaining the permissive approach. Changed response value from "000" to "missing" for clarity in logs. See [#1044](https://github.com/SuffolkLITLab/ALKiln/issues/1044).
 
 ### Fixed
 
 - Print error correctly when missing sources paths
+- Changed the default version of docassemblecli to 0.0.25
+
+### Security
+
+- Security: Gave our main action's `npm install` call the arguments ` --ignore-scripts --min-release-age=7` to improve security against malicious `pre-install` and `post-install` scripts. See [#1053](https://github.com/SuffolkLITLab/ALKiln/issues/1053).
 
 ## [5.15.4] - 2025-11-29
 
@@ -1243,4 +1254,4 @@ Note: published on incorrect commit
 - `example.feature` - an example test to get a project started
 - `github/workflows/run_form_tests.yml` - Automated github workflow to run tests when code is pushed and a manual trigger for testing without needing to push
 - `.gitignore` - ignores files that are generated by the tests and shouldn't be added to the repo
-- `package.json` - keep up-to-date version of this test repository and hold scripts that the automated tests run
+- `package.json` - keep up-to-date version of this test repository and hold scripts that the automated tests run

package/action.yml

@@ -120,7 +120,9 @@ runs:
       run: |
         log="💡 ALK0026 INFO: Install ALKiln directly from npm"
         echo -e "\n$log" >> "${{ env.DEBUG_PATH }}"
-        npm install -g "@suffolklitlab/alkiln@$ALKILN_VERSION"
+        npm install --ignore-scripts --min-release-age=7 -g "@suffolklitlab/alkiln@$ALKILN_VERSION"
+        npm rebuild -g puppeteer --update-binary
+
 
     # Files prep
     - shell: bash

package/action_for_github_server/action.yml

@@ -23,10 +23,14 @@ inputs:
     description: "Default is 600 seconds. Maximum amount of seconds to give the docassemble docker container to serve the site."
     required: false
     default: 600  # 10 min
+  DOCASSEMBLE_IMAGE:
+    description: "The specific docassemble image to use."
+    required: false
+    default: jhpyle/docassemble
   DOCASSEMBLECLI_VERSION:
     description: "The version of docassemblecli to install."
     required: false
-    default: "0.0.17"
+    default: "0.0.25"
 
 outputs:
   DOCASSEMBLE_DEVELOPER_API_KEY:
@@ -155,35 +159,37 @@ runs:
         if: ${{ env.OUTPUT_DOCKER == 'false' }}
         env:
           CONFIG_ARGS: ${{ env.CONFIG_ARGS }}
+          DOCASSEMBLE_IMAGE: "${{ inputs.DOCASSEMBLE_IMAGE }}"
         shell: bash
         run: |
           log="💡 ALK0009 INFO: Download and start docker silently"
           echo -e "\n$log" >> "${{ env.DEBUG_LOGS_PATH }}"
-          docker pull jhpyle/docassemble > /dev/null 2>&1
+          docker pull "$DOCASSEMBLE_IMAGE" > /dev/null 2>&1
           docker run --name docassemble_container \
                      --env DA_ADMIN_EMAIL="$DA_ADMIN_EMAIL" \
                      --env DA_ADMIN_PASSWORD="$DA_ADMIN_PASSWORD" \
                      --env DA_ADMIN_API_KEY="$DA_ADMIN_API_KEY" \
                      $CONFIG_ARGS \
                      --cap-add SYS_PTRACE \
-                     --memory="4gb" -d -p 80:80 jhpyle/docassemble > /dev/null 2>&1
+                     --memory="4gb" -d -p 80:80 "$DOCASSEMBLE_IMAGE" > /dev/null 2>&1
       # With output
       - name: "💡 ALK0010 INFO: Download and start docker"
         if: ${{ env.OUTPUT_DOCKER == 'true' }}
         env:
           CONFIG_ARGS: ${{ env.CONFIG_ARGS }}
+          DOCASSEMBLE_IMAGE: "${{ inputs.DOCASSEMBLE_IMAGE }}"
         shell: bash
         run: |
           log="💡 ALK0010 INFO: Download and start docker"
           echo -e "\n$log" >> "${{ env.DEBUG_LOGS_PATH }}"
-          docker pull jhpyle/docassemble
+          docker pull "$DOCASSEMBLE_IMAGE"
           docker run --name docassemble_container \
                      --env DA_ADMIN_EMAIL="$DA_ADMIN_EMAIL" \
                      --env DA_ADMIN_PASSWORD="$DA_ADMIN_PASSWORD" \
                      --env DA_ADMIN_API_KEY="$DA_ADMIN_API_KEY" \
                      $CONFIG_ARGS \
                      --cap-add SYS_PTRACE \
-                     --memory="4gb" -d -p 80:80 jhpyle/docassemble
+                     --memory="4gb" -d -p 80:80 "$DOCASSEMBLE_IMAGE"
 
       # Section for showing the time it takes to start the server.
 
@@ -213,14 +219,25 @@ runs:
 
             # Check if max seconds till loading has passed
             if [[ $SECONDS -ge $MAX_SECONDS_FOR_DOCKER ]]; then
-              log3="🤕 ALK0014 ERROR: Timed out waiting for docker container to serve the site. If you want to give your docker container more timem to install, set the MAX_SECONDS_FOR_DOCKER input for this action."
+              log3="🤕 ALK0014 ERROR: Timed out waiting for docker container to serve the site. If you want to give your docker container more time to install, set the MAX_SECONDS_FOR_DOCKER input for this action."
               echo -e "\n$log3" >> "${{ env.DEBUG_LOGS_PATH }}" && echo -e "$log3"
               exit 1
             fi
 
             # Set the variable to a new string value in each iteration
-            response=$(curl -o /dev/null -s -w "%{http_code}\n" http://localhost:80/health_check?ready=1)
-            log4="💡 ALK0015 INFO: Response is $response"
+            # We intentionally skip all non-zero curl exit codes here instead of handling specific ones.
+            # During server startup there are several transient errors that can come up and since we already log  the exit code and have a timeout,
+            # retrying on all of them is safer than trying to maintain a list of specific codes to handle.
+            set +e
+            response=$(curl -o /dev/null -s -w "%{http_code}" http://localhost:80/health_check?ready=1)
+            status=$?
+            set -e
+            
+            if [[ $status -ne 0 ]]; then
+              response="missing"
+            fi
+
+            log4="💡 ALK0015 INFO: Response is $response (curl exit code: $status)"
             echo -e "\n$log4" >> "${{ env.DEBUG_LOGS_PATH }}" && echo -e "$log4"
 
             # Check if the string includes the desired text
@@ -228,7 +245,7 @@ runs:
               log5="💡 ALK0016 SUCCESS: Success! The docker container is ready!"
               echo -e "\n$log5" >> "${{ env.DEBUG_LOGS_PATH }}" && echo -e "$log5"
             else
-              log6="💡 ALK0017 INFO: The docker container is not ready yet. Will check again in 30 seconds."
+              log6="💡 ALK0017 INFO: The docker container is not ready yet (HTTP=$response, curl exit code=$status). Will check again in 30 seconds."
               echo -e "\n$log6" >> "${{ env.DEBUG_LOGS_PATH }}" && echo -e "$log6"
               sleep 30
             fi

package/docs/016_root_path_2026_04_09.md

@@ -1,6 +1,6 @@
 # Root path
 
-This code assumes the current root directory will contain the necessary files and folders to get files like `.feature` files and the test run runtime config file.
+This code assumes the current working directory (cwd) will contain the necessary files and folders to get files like `.feature` files and the test run runtime config file.
 
 When you run ALKiln on the command line, run the tests in the root directory of the docassemble package with the tests. There are other ways to tell processes where the root directory is. For example, ALKiP, a docassemble package that uses ALKiln inside an author's server, runs `subprocess.run()` or `subprocess.Popen()` with `cwd=`. In ALKiP the `cwd` is most likely `/tmp`.
 

package/npm-shrinkwrap.json

@@ -1,12 +1,12 @@
 {
   "name": "@suffolklitlab/alkiln",
-  "version": "5.15.4-ref-paths-1",
+  "version": "5.15.1-update-deps2",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@suffolklitlab/alkiln",
-      "version": "5.15.4-ref-paths-1",
+      "version": "5.15.1-update-deps2",
       "license": "MIT",
       "dependencies": {
         "@axe-core/puppeteer": "4.7.3",
@@ -380,6 +380,7 @@
       "version": "4.0.1",
       "resolved": "https://registry.npmjs.org/@cucumber/message-streams/-/message-streams-4.0.1.tgz",
       "integrity": "sha512-Kxap9uP5jD8tHUZVjTWgzxemi/0uOsbGjd4LBOSxcJoOCRbESFwemUzilJuzNTB8pcTQUh8D5oudUyxfkJOKmA==",
+      "peer": true,
       "peerDependencies": {
         "@cucumber/messages": ">=17.1.1"
       }
@@ -388,6 +389,7 @@
       "version": "19.1.4",
       "resolved": "https://registry.npmjs.org/@cucumber/messages/-/messages-19.1.4.tgz",
       "integrity": "sha512-Pksl0pnDz2l1+L5Ug85NlG6LWrrklN9qkMxN5Mv+1XZ3T6u580dnE6mVaxjJRdcOq4tR17Pc0RqIDZMyVY1FlA==",
+      "peer": true,
       "dependencies": {
         "@types/uuid": "8.3.4",
         "class-transformer": "0.5.1",
@@ -1482,7 +1484,8 @@
     "node_modules/devtools-protocol": {
       "version": "0.0.1312386",
       "resolved": "https://registry.npmjs.org/devtools-protocol/-/devtools-protocol-0.0.1312386.tgz",
-      "integrity": "sha512-DPnhUXvmvKT2dFA/j7B+riVLUt9Q6RKJlcppojL5CoRywJJKLDYnRlw0gTFKfgDPHP5E04UoB71SxoJlVZy8FA=="
+      "integrity": "sha512-DPnhUXvmvKT2dFA/j7B+riVLUt9Q6RKJlcppojL5CoRywJJKLDYnRlw0gTFKfgDPHP5E04UoB71SxoJlVZy8FA==",
+      "peer": true
     },
     "node_modules/diff": {
       "version": "5.0.0",
@@ -3008,6 +3011,7 @@
       "resolved": "https://registry.npmjs.org/puppeteer/-/puppeteer-22.15.0.tgz",
       "integrity": "sha512-XjCY1SiSEi1T7iSYuxS82ft85kwDJUS7wj1Z0eGVXKdtr5g4xnVcbjwxhq5xBnpK/E7x1VZZoJDxpjAOasHT4Q==",
       "hasInstallScript": true,
+      "peer": true,
       "dependencies": {
         "@puppeteer/browsers": "2.3.0",
         "cosmiconfig": "^9.0.0",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@suffolklitlab/alkiln",
-  "version": "5.15.4-ref-paths-1",
+  "version": "5.16.0",
   "description": "Integrated automated end-to-end testing with docassemble, puppeteer, and cucumber.",
   "main": "lib/index.js",
   "scripts": {