@suffolklitlab/alkiln 5.16.0 → 5.16.1-always-html-1

package/.github/workflows/da_image_v_sha_7d13853.yml

@@ -65,3 +65,4 @@ jobs:
           DOCASSEMBLE_DEVELOPER_API_KEY: "${{ steps.github_server.outputs.DOCASSEMBLE_DEVELOPER_API_KEY }}"
           INSTALL_METHOD: "server"
           ALKILN_TAG_EXPRESSION: "@e3"  # One very simple test
+          # ALKILN_VERSION: 

package/.github/workflows/github_server.yml

@@ -160,7 +160,7 @@ jobs:
           #### Developer note: You can probably leave the rest out
           #### To learn more, see https://assemblyline.suffolklitlab.org/docs/alkiln/writing/#optional-inputs
           ALKILN_TAG_EXPRESSION: "${{ env.ALKILN_TAG_EXPRESSION }}"
-          # ALKILN_VERSION: 
+          ALKILN_VERSION: "screenshot"
 
       #### Developer note: Example of making an issue when tests fail
       #### that includes the text of the failure output file

package/.github/workflows/playground.yml

@@ -1,7 +1,6 @@
 name: Playground installation
 
 on:
-  push:
   pull_request:
   workflow_dispatch:
     inputs:
@@ -9,6 +8,8 @@ on:
         required: False
         description: 'Optional. Use a "tag expression" specify which tagged tests to run (https://cucumber.io/docs/cucumber/api/#tag-expressions)'
         default: ''
+  schedule:
+    - cron: "0 1 * * SUN"
 
 jobs:
 
@@ -82,4 +83,4 @@ jobs:
           # want to check up on this.
           ALKILN_TAG_EXPRESSION: "${{ env.ALKILN_TAG_EXPRESSION }}"
           #### Developer note: You can probably leave this out
-          # ALKILN_VERSION: 
+          ALKILN_VERSION: "screenshot"

package/CHANGELOG.md

@@ -43,6 +43,39 @@ Format:
 - 
 -->
 
+## [Unreleased]
+
+### Changed
+
+- On pages with sensitive answers, store the HTML of the page. The HTML excludes field values, so those sensitive answers will not be in the saved file. Still avoid taking a pic of the screen, which would reveal sensitive answers. NEVER USE REAL USERS' ANSWERS IN ALKILN TESTS. This HTML can still reveal information about a user's answers. For example, some answers will reveal new questions. That will change the code of the revealed fields and that code will be in the HTML.
+
+- GitHub action release: Restored our GitHub action's default for ALKiln version to the latest version 5 again. Released first on GitHub actions. NPM release will come in time, but npm has no impact on GitHub action releases.
+
+### Fixed
+
+- Fixed GitHub+You action outdated docassemble cli version causing Scenario timeouts.
+
+### Internal
+
+- Break out the function in `Before()` to attempt better error tracing. Goal: try to repeat this for other functions in that file.
+
+- Updated both of our actions' dependencies (the checkout, setup-node, setup-python, upload-artifacts, download-artifacts actions). Closes [#1095](https://github.com/suffolkLITLab/aLKiln/issues/1095). Once again, action related.
+
+## [5.16.1] - 2026-06-01
+
+### Fixed
+
+- In action.yml, replaced `npm rebuild` with an explicit search for existing puppeteer chrome executables. There is no fallback if all of those are missing. Addresses [#1088](https://github.com/suffolkLITLab/aLKiln/issues/1088). We hope to address the core issue when we can.
+- Restore custom artifacts path argument to allow environments like action.yml to make and reuse their own artifacts path value in environments where it's hard to pass around return values. Closes [#1055](https://github.com/suffolkLITLab/aLKiln/issues/1055).
+
+### Security
+
+- Moved responsibility for security measures to ALKiln internal development by automating internal security measures with `.npmrc`. Closes [#1088](https://github.com/suffolkLITLab/aLKiln/issues/1088).
+
+### Internal
+
+- Avoid testing on our dev server with every push, uses cron job instead.
+
 ## [5.16.0] - 2026-05-14
 
 ### Added

package/action.yml

@@ -32,7 +32,7 @@ inputs:
   DOCASSEMBLECLI_VERSION:
     description: "The version of docassemblecli to install."
     required: false
-    default: "0.0.17"
+    default: "0.0.25"
   ALKILN_MAX_RANDOM_TESTS_PER_SCENARIO:
     description: "The maximum number of tests ALKiln will generate for every Scenario that can generate tests."
     required: false
@@ -59,7 +59,7 @@ runs:
   using: "composite"
   steps:
     # Place the root directory in this branch
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v7
 
     # Set environment variables
     - name: "💡 ALK0023 INFO: Set environment variables"
@@ -111,18 +111,36 @@ runs:
 
     # Install ALKiln during GitHub workflow
     - name: "💡 ALK0025 INFO: Set up node"
-      uses: actions/setup-node@v5
+      uses: actions/setup-node@v6
       with:
         node-version: "24.x"
         package-manager-cache: false
+
     - name: "💡 ALK0026 INFO: Install ALKiln directly from npm"
       shell: bash
       run: |
         log="💡 ALK0026 INFO: Install ALKiln directly from npm"
         echo -e "\n$log" >> "${{ env.DEBUG_PATH }}"
-        npm install --ignore-scripts --min-release-age=7 -g "@suffolklitlab/alkiln@$ALKILN_VERSION"
-        npm rebuild -g puppeteer --update-binary
+        npm install -g --ignore-scripts "@suffolklitlab/alkiln@$ALKILN_VERSION"
 
+        BROWSER="$(
+          command -v google-chrome-stable ||
+          command -v google-chrome ||
+          command -v chrome ||
+          command -v chromium-browser ||
+          command -v chromium ||
+          true
+        )"
+        if [[ -n "$BROWSER" ]]; then
+          log_result="💡 ALK0279 INFO: Found puppeteer browser executable at '$BROWSER'"
+          echo -e "\n$log_result" >> "${{ env.DEBUG_PATH }}" && echo -e "$log_result"
+          echo "PUPPETEER_EXECUTABLE_PATH=$BROWSER" >> "$GITHUB_ENV"
+        else
+          log_result="🤕 ALK0280 INFO: Unable to find puppeteer browser executable"
+          echo -e "\n$log_result" >> "${{ env.DEBUG_PATH }}" && echo -e "$log_result"
+          # Our project uses bash error codes in the 50's. This may change.
+          exit 51
+        fi
 
     # Files prep
     - shell: bash
@@ -137,7 +155,7 @@ runs:
 
     # Install package on playground
     # Don't rely on the environment's version of python
-    - uses: actions/setup-python@v5
+    - uses: actions/setup-python@v6
       if: ${{ inputs.INSTALL_METHOD == 'playground' }}
       with:
         python-version: '3.10'
@@ -195,7 +213,7 @@ runs:
     # Upload artifacts that subscribers can download on the Actions summary page
     - name: "💡 ALK0033 INFO: Upload artifacts folder"
       if: ${{ always() }}
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@v7
       with:
         name: ${{ env.ARTIFACT_FOLDER }}
         path: ./alkiln-*
@@ -203,7 +221,7 @@ runs:
     # Download artifacts folder internally to create action output
     - name: "💡 ALK0183 INFO: Get uploaded artifacts folder"
       if: ${{ always() }}
-      uses: actions/download-artifact@v4
+      uses: actions/download-artifact@v8
       with:
         name: ${{ env.ARTIFACT_FOLDER }}
 

package/action_for_github_server/action.yml

@@ -49,7 +49,7 @@ runs:
   using: "composite"
   steps:
       # Place the root directory in this branch
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - shell: bash
         run: |
@@ -253,7 +253,7 @@ runs:
           done
 
       # Don't rely on the environment's version of python
-      - uses: actions/setup-python@v5
+      - uses: actions/setup-python@v6
         with:
           python-version: '3.10'
       # No output
@@ -285,7 +285,7 @@ runs:
           echo "$(docker output docassemble_container)" >> "${{ env.DEBUG_LOGS_PATH }}"
       - name: "💡 ALK0020 INFO: Upload artifacts folder"
         if: ${{ always() && env.OUTPUT_DOCKER == 'true' }}
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: ${{ env.GITHUB_SERVER_ARTIFACT_NAME }}
           path: ${{ env.DEBUG_LOGS_PATH }}

package/lib/scope.js

@@ -2711,8 +2711,23 @@ module.exports = {
     return scope;
   },  // Ends scope.throwPageError()
 
-  take_a_screenshot: async ( scope,{ path }) => {
-    /* Takes a jpeg screenshot. Avoids destroying signatures. */
+  take_a_screenshot: async ( scope, {
+    path, disable_pic=false, disable_html=false
+  }) => {
+    /** 
+     * Saves a jpeg screenshot and page HTML to `path`. Avoids destroying
+     *     signatures.
+     * 
+     * @param {obj} scope - State and internal functions
+     * @param {obj} obj - Named arguments
+     * @param  {str} obj.path - name of path where to save the files
+     * @param  {bool} [obj.disable_pic=false] - Optional. Whether to disable a
+     *     puppeteer screenshot
+     * @param  {bool} [obj.disable_html=false] - Optional. Whether to disable
+     *     saving the HTML of the page
+     * 
+     * @returns undefined
+     * */
 
     let fullPage = true;
     let signature_elem = await scope.page.$(scope.signature_selector);
@@ -2721,28 +2736,32 @@ module.exports = {
       fullPage = false;
     }
 
-    await scope.page.screenshot({
-      path: path,
-      type: 'jpeg',
-      fullPage: fullPage,
-    });
-
-    let html_path = path;
-    if (path.endsWith(".jpg")) {
-      html_path = html_path.substring(0, html_path.length - 4) + ".html";
-    } else {
-      html_path = html_path + ".html";
+    if ( !disable_pic ){
+      await scope.page.screenshot({
+        path: path,
+        type: 'jpeg',
+        fullPage: fullPage,
+      });
     }
 
-    // Also save the HTML of the page
-    await scope.page.content().then(content => {
-      let server_url = session_vars.get_da_server_url();
-      content = content.replaceAll(/"(\/static\/.*\.css\?v=[^"]+")/g, server_url + "$1");
-      content = content.replaceAll(/"(\/static\/.*\.js\?v=[^"]+")/g, server_url + "$1");
-      content = content.replaceAll(/"(\/packagestatic\/.*\.css\?v=[^"]+")/g, server_url + "$1");
-      content = content.replaceAll(/"(\/packagestatic\/.*\.js\?v=[^"]+")/g, server_url + "$1");
-      fs.writeFileSync(html_path, content)
-    });
+    if ( !disable_html ) {
+      let html_path = path;
+      if (path.endsWith(".jpg")) {
+        html_path = html_path.substring(0, html_path.length - 4) + ".html";
+      } else {
+        html_path = html_path + ".html";
+      }
+
+      // Also save the HTML of the page
+      await scope.page.content().then(content => {
+        let server_url = session_vars.get_da_server_url();
+        content = content.replaceAll(/"(\/static\/.*\.css\?v=[^"]+")/g, server_url + "$1");
+        content = content.replaceAll(/"(\/static\/.*\.js\?v=[^"]+")/g, server_url + "$1");
+        content = content.replaceAll(/"(\/packagestatic\/.*\.css\?v=[^"]+")/g, server_url + "$1");
+        content = content.replaceAll(/"(\/packagestatic\/.*\.js\?v=[^"]+")/g, server_url + "$1");
+        fs.writeFileSync(html_path, content)
+      });
+    }
   },  // Ends scope.take_a_screenshot()
 
 

package/lib/setup/artifacts.js

@@ -11,7 +11,12 @@ const Log = require(`../utils/Log.js`);
 
 session_vars.delete_artifacts_path_name();
 
-const artifacts_path = files.make_artifacts_folder();
+// process.argv is a list of strings of commands and args.
+// If using `npm run artifacts` (as opposed to the bin commands),
+// use `--` before, for example, `--sources=./foo`
+// Envs like action.yml reuse their own .path when return vals are hard to get
+const forced_path = require(`minimist`)( process.argv.slice(2) )?.path;
+const artifacts_path = files.make_artifacts_folder( forced_path );
 session_vars.save_artifacts_path_name( artifacts_path );
 
 const log = new Log({ path: artifacts_path, context: `artifacts` });

package/lib/steps.js

@@ -114,8 +114,9 @@ BeforeAll(async function() {
   reports.create( scope );
 });
 
-Before(async (scenario) => {
-
+Before( beforeScenario );
+async function beforeScenario( scenario ) {
+  console.log('👁️ 111 start beforeScenario');
   // Start the running "progress bar" for the Scenario
   log.stdout({}, `\nScenario: ${ scenario.pickle.name }: `);
 
@@ -125,15 +126,20 @@ Before(async (scenario) => {
       // Will only run in the Playground outside of a sandbox. TODO: There's a
       // better way to do this, though it's more complicated. See comments in
       // https://github.com/SuffolkLITLab/ALKiln/issues/661
+      console.log('👁️ 112 no browser, await new local browser');
       scope.browser = await scope.driver.launch({ args: ['--no-sandbox'] });
     } else {
+      console.log('👁️ 113 no browser, await new remote browser');
       scope.browser = await scope.driver.launch({ headless: !session_vars.get_debug(), devtools: session_vars.get_debug() });
     }
   }
+  console.log('👁️ 114 we have ensured browser exists, awaiting pages');
   // Clean up all previously existing pages
   for (const page of await scope.browser.pages()) {
+    console.log('👁️ 115 awaiting closing page');
     await page.close();
   }
+  console.log('👁️ 116 awaiting opening a new page');
   // Make a new page
   scope.page = await scope.browser.newPage()
 
@@ -147,8 +153,10 @@ Before(async (scenario) => {
   scope.server_reload_promise = null;
 
   reports.addReportHeading(scope, {scenario});
+  console.log('👁️ 117 awaiting getting safe scenario name');
   // Make folder for this Scenario in the all-tests artifacts folder
   scope.base_filename = await scope.getSafeScenarioBaseFilename(scope, {scenario});
+  console.log('👁️ 118 got safe scenario name');
   // Add a date for uniqueness in case dev has accidentally copied a Scenario description
   let date = Date.now();
   scope.paths.scenario = `${ scope.paths.artifacts }/${ scope.base_filename }-${ date }`;
@@ -171,7 +179,7 @@ Before(async (scenario) => {
 
   // Reset default timeout
   scope.timeout = default_timeout;
-});
+}
 
 // Add a check for an error page before each step? After each step?
 
@@ -1379,25 +1387,34 @@ After(async function(scenario) {
         reports.addToReport(scope, {
           type: `row info`,
           code: `ALK0095`,
-          value: `For security, ALKiln will avoid creating a picture of the page for this error. It's possible a secret is being used on this screen.`
+          // Discuss: Might people use secret variables to prevent any
+          // information about a screen from getting out? For example, they have
+          // proprietary info in the HTML itself.
+          value: `For security, ALKiln will avoid creating a picture of the page for this error. It's possible a secret is being used on this screen. ALKiln will save the HTML, which omits the values in the fields.`
         });
-      } else {
 
-        // Save/download a picture of the screen that's showing during the unexpected status
-        // Save one copy in the outer-most artifact folder
-        let scenario_filename = await scope.getSafeScenarioFilename( scope, { prefix: `error_on` });
-        let path_outer = `${ scope.paths.artifacts }/${ scenario_filename }.jpg`;
-        await scope.take_a_screenshot( scope, { path: path_outer });
-
-        // Save another copy in the artifact's Scenario folder
-        let screenshot_name = `error_on`;
-        let { id } = await scope.examinePageID( scope, 'none to match' );
-        let short_id = `${ id }`.substring(0, 20);
-        screenshot_name += `-${ short_id }`;
-        let path_scenario = `${ scope.paths.scenario }/${ screenshot_name }.jpg`;
-        await scope.take_a_screenshot( scope, { path: path_scenario });
-
-      }  // ends if scope.disable_error_screenshot
+      // Save/download a picture of the screen that's showing during the unexpected status
+      // Save one copy in the outer-most artifact folder
+      let scenario_filename = await scope.getSafeScenarioFilename( scope, { prefix: `error_on` });
+      let path_outer = `${ scope.paths.artifacts }/${ scenario_filename }.jpg`;
+      await scope.take_a_screenshot( scope, {
+        path: path_outer,
+        disable_pic: scope.disable_error_screenshot,
+        disable_html: false,
+      });
+
+      // Save another copy in the artifact's Scenario folder
+      let screenshot_name = `error_on`;
+      let { id } = await scope.examinePageID( scope, 'none to match' );
+      let short_id = `${ id }`.substring(0, 20);
+      screenshot_name += `-${ short_id }`;
+      let path_scenario = `${ scope.paths.scenario }/${ screenshot_name }.jpg`;
+      await scope.take_a_screenshot( scope, {
+        path: path_scenario,
+        disable_pic: scope.disable_error_screenshot,
+        disable_html: false,
+      });
+
     }  // ends if scope.page exists
 
     // This has to come after the security message or security message doesn't print. Not sure why.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@suffolklitlab/alkiln",
-  "version": "5.16.0",
+  "version": "5.16.1-always-html-1",
   "description": "Integrated automated end-to-end testing with docassemble, puppeteer, and cucumber.",
   "main": "lib/index.js",
   "scripts": {

package/tests/log_codes/log_code_expected_instances.txt

@@ -288,4 +288,6 @@ ALK0273:1
 ALK0274:1
 ALK0275:1
 ALK0276:1
-ALK0277:1
+ALK0277:1
+ALK0278:1
+ALK0279:1