feat(attachments): let automated tests attach logs, HAR files, videos, traces and HTML

[snevesbarros]

Summary

Automated tests can now attach files to their results and have them shown on the execution: console logs, network HAR files, videos, Playwright traces, page HTML snapshots and images.

A test only creates its execution when it finishes (or, in batch mode, when the whole run finishes), so files are uploaded against the build while the test runs, the same way screenshots are. The execution then lists the returned ids when it's saved, either for the whole test or on a step.

API

• POST /build/:buildId/attachment (multipart field attachment). The kind and the type the file is served with come from the file extension, never from the client's mime type:

  • .log / .txt: log
  • .json: json
  • .har: har
  • .webm / .mp4: video
  • .zip: trace when the name contains "trace", otherwise archive
  • .html / .htm: html
  • .png / .jpg / .jpeg / .gif / .webp: image

  Any other extension is rejected with a 400. The size limit is ANGLES_ATTACHMENT_MAX_SIZE_MB (default 100). The response never includes server paths.

• attachments on an execution, and on a step's attachments, for both POST /execution and PUT /build/:id/executions. Ids that weren't uploaded against the execution's own build are dropped. The rest are linked to the execution when it's saved, so an execution can never claim another build's (or team's) file. Malformed ids return a 422.

• GET /attachment?executionId= and ?buildId= list a test's or a build's attachments (metadata only).

• GET /attachment/:id/file serves files with X-Content-Type-Options: nosniff and Content-Security-Policy: sandbox. HTML snapshots, traces and archives are always served as downloads, so a snapshot's scripts never run on the API origin with the viewer's session. Range requests work, so videos can be seeked. Add ?download=true to force a download.

• Clean-up:

  • DELETE /attachment/:id also removes the file's references from executions and steps.
  • Deleting an execution deletes the files it claimed.
  • Deleting a build, by hand or through the nightly clean-up, deletes all of its files.

Also

• Documents the endpoints in swagger.json and adds docs/test-attachments.md.
• Adds the build and execution attachment indexes to setup/mongo-init.js and the Kubernetes init script.
• Exposes ANGLES_ATTACHMENT_MAX_SIZE_MB in docker-compose.yml and the Kubernetes ConfigMap.

Compatibility

Every execution response now includes an attachments array. Released clients are unaffected: the Java client's Gson ignores unknown fields, the Python client returns plain dicts, and in JavaScript an extra property is harmless.

Related PRs (merge this one first)

• UI: AnglesHQ/angles-ui (same branch name): attachment chips and a viewer for each kind
• Clients (same branch name): angles-javascript-client, angles-java-client, angles-python-client, which add attachFile / attach_file and friends
• Docs: angleshq.github.io

Testing

• New test/test-attachment.tests.js (24 tests) covers:
  • every kind, server-generated names and no server paths in responses
  • unsupported types, missing files, unknown builds and other teams
  • linking from POST /execution and from batches
  • dropping foreign ids, and ids posted with a new build
  • listing, and the file headers, downloads and range requests
  • reference clean-up on attachment delete, and file clean-up on execution and build delete
• Ran the full suite against a local MongoDB: 573 passing (549 before, plus 24 new). npx eslint app test is clean.
• Exercised end to end with the new UI and all three clients against a running instance, using a real video, trace and HAR that Playwright recorded.

🤖 Generated with Claude Code

https://claude.ai/code/session_01KgQXSUjuLVXmLWxobnMfSf

---

Generated by Claude Code