a11y.yml

# SPDX-License-Identifier: AGPL-3.0-or-later
name: a11y

# CICD-§11h: the axe gate installs Chromium and drives a browser — the most
# expensive job on the PR path — and its inputs are the app templates and
# site/**, never prose. Docs-only changes skip it; because the job is a
# REQUIRED status check, a11y-docs-only.yml provides the same-named
# always-green twin so docs-only PRs still report the context and stay
# mergeable. Keep both paths-ignore lists and the twin's paths in lockstep.
on:
  push:
    branches: [main]
    paths-ignore:
      - "**.md"
      - "docs/**"
      - "LICENSE"
  pull_request:
    paths-ignore:
      - "**.md"
      - "docs/**"
      - "LICENSE"
  workflow_dispatch:

permissions:
  contents: read

concurrency:
  group: a11y-${{ github.ref }}
  cancel-in-progress: true

jobs:
  axe:
    name: axe-core WCAG scan (merge gate)
    runs-on: ubuntu-latest
    steps:
      # P1-3 (SEC-04): audit-mode egress monitoring; see ci.yml's Harden Runner
      # step for the telemetry trade-off note.
      - name: Harden Runner (audit mode)
        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
        with:
          egress-policy: audit
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - name: Install uv (pinned)
        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
        with:
          version: "0.11.19"
          enable-cache: true
      - name: Lockfile drift (CQ-09)
        # Must precede `uv sync` and any `uv run`: a bare `uv run` silently relocks,
        # repairing the very drift a later check would look for. The sync below asks
        # for `--locked`, not `--frozen`; `--frozen` installs from uv.lock without
        # reading pyproject.toml, so it cannot see the two disagree and exits 0 on a
        # drifted lock.
        run: uv lock --check
      - name: Sync environment (Python 3.14, locked)
        run: uv sync --locked
      - name: Install Chromium for Playwright
        run: uv run playwright install --with-deps chromium
      - name: Run the axe-core accessibility gate
        # Gates the two conformant surfaces: the local app and packet.html — the
        # accessible rendering of an evidence packet (ADR 0004). A WCAG violation in
        # either fails the build. The PDF is a print convenience and makes no PDF/UA claim.
        run: uv run pytest -m a11y -q