contextsafe/.github/workflows/ci.yml at roadmap/b-043-accessibility-gates · ghzhost/contextsafe · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
name: CI

on:
  pull_request:
    paths-ignore:
      - "**.md"
      - "docs/**"
      - "LICENSE"
  push:
    branches:
      - main
    paths-ignore:
      - "**.md"
      - "docs/**"
      - "LICENSE"

permissions:
  contents: read

concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: true

jobs:
  verify:
    name: verify
    runs-on: ubuntu-24.04
    timeout-minutes: 15
    permissions:
      contents: read
    env:
      UV_PYTHON: "3.12"
      UV_PYTHON_DOWNLOADS: never
    steps:
      - name: Check out repository
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false

      - name: Set up Python
        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
        with:
          python-version: "3.12"
          check-latest: false

      - name: Set up uv
        uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2
        with:
          version: "0.11.28"
          enable-cache: true

      - name: Run the local verification gate
        run: make verify

  determinism:
    # RG-15 and R-10 ask for identical deterministic JSON across three runs and
    # every supported operating system. `verify` proves that on one runner; this
    # job is the cross-platform half, running only tests/test_determinism.py so a
    # platform-dependent line ending, encoding, or path leak fails here instead
    # of in a partner's release evidence. These are GitHub's server SKUs, not the
    # Windows 11 and macOS desktop fresh installs RG-15 requires, and packaged
    # artifacts remain B-045; this job is byte-reproducibility evidence only.
    name: determinism (${{ matrix.os }})
    runs-on: ${{ matrix.os }}
    timeout-minutes: 15
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-24.04, macos-15, windows-2025]
    permissions:
      contents: read
    env:
      UV_PYTHON: "3.12"
      UV_PYTHON_DOWNLOADS: never
    steps:
      - name: Check out repository
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false

      - name: Set up Python
        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
        with:
          python-version: "3.12"
          check-latest: false

      - name: Set up uv
        uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2
        with:
          version: "0.11.28"
          enable-cache: true

      # --locked fails on lockfile drift; --frozen exits 0 and cannot gate it.
      - name: Install the locked dependency graph, failing on drift
        run: uv sync --locked

      - name: Three-run determinism suite
        run: uv run pytest tests/test_determinism.py

  accessibility:
    # `make verify` runs the stdlib half of B-043 on every push. This job adds
    # axe-core in a headless DOM, which needs the node harness a clean clone does
    # not carry. It is a separate job rather than part of `verify` for that
    # reason — and `make a11y-full` fails with `engine-unavailable` if the
    # harness is missing, so this job cannot silently degrade into the checks
    # `verify` already ran and report the same green.
    name: accessibility (axe-core + built-in checks)
    runs-on: ubuntu-24.04
    timeout-minutes: 15
    permissions:
      contents: read
    env:
      UV_PYTHON: "3.12"
      UV_PYTHON_DOWNLOADS: never
    steps:
      - name: Check out repository
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false

      - name: Set up Python
        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
        with:
          python-version: "3.12"
          check-latest: false

      - name: Set up uv
        uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2
        with:
          version: "0.11.28"
          enable-cache: true

      - name: Set up Node
        uses: actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903 # v6.0.0
        with:
          node-version: "22"
          cache: npm
          cache-dependency-path: tools/a11y/package-lock.json

      - name: Install the pinned accessibility harness
        run: make a11y-install

      # --locked fails on lockfile drift; --frozen exits 0 and cannot gate it.
      - name: Install the locked dependency graph, failing on drift
        run: uv sync --locked

      - name: Accessibility gate (built-in checks plus axe-core)
        run: make a11y-full

      - name: Upload the accessibility report
        if: always()
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
        with:
          name: a11y-report
          path: .a11y/report.json
          if-no-files-found: error