gate-31 img-alt matches an <img> written inside a JSDoc comment in the <script> block — false RED (same family as #184 / #191)

[rubenvdlinde]

Measured on ConductionNL/launchpad @ development, hydra-gates at main (756fe89), full tree.

[gate-31] img-alt: FAIL — 1 <img> tag(s) without alt attribute
  src/components/OrgNavigationItem.vue: <img>

There is no <img> in that component. The file's only occurrence of the string is inside a JSDoc comment in the <script> block:

$ grep -n '<img' src/components/OrgNavigationItem.vue
83: * resolves any value the icon picker emits — a URL (→ `<img>`), an SVG

$ grep -n '^<template>\|^</template>\|^<script>\|^</script>' src/components/OrgNavigationItem.vue
6:<template>
62:</template>
64:<script>
216:</script>

Line 83 is inside <script> (64–216), in a docblock explaining that CnDashboardIcon resolves a URL to an <img>. It is prose about markup, in backticks, in a comment, in the wrong SFC block entirely. The template contains no <img> at all.

This is the third instance of the same family:

• gate-64 has_prelude() matched inside comments, and a commented-out prelude counted as a prelude — false GREEN (fix(hydra-gates): gate-64 read spelling, not code — 2 false REDs and 1 false GREEN #184)
• gate-48 matched a removed comment (gate-48 csrf-cochange matches a REMOVED COMMENT — nldesign is red for a docblock that only names the attribute #191)
• gate-31 matches an <img> written in a comment — false RED (this one)

The family is worth naming: a checker that greps raw file text for markup fails in both directions at once — it misses the real thing when it is written differently, and it fires on any mention of it in prose.

Suggested direction

gate-31 should scan the <template> block only, with comments stripped, the same way check_apphost_autoload_prelude.py now calls strip_comments() before matching. Two cheap guards, both testable:

1. Slice the SFC to its <template> region before matching — nothing in <script> or <style> can render an <img>.
2. Strip <!-- … -->, // and /* … */ comments, and inline-code spans, before matching.

A fixture that would have caught it: a .vue file whose <script> docblock contains `<img>` and whose template contains none — must report 0. Paired with the positive control (a real <img> with no alt in the template — must report 1), so the relaxation cannot be over-applied.

src/components/OrgNavigationItem.vue at launchpad development is a clean reproduction.

[rubenvdlinde]

Fixed and merged to main in #269 (cdfbd7a). Live fleet-wide now.

Your suggested direction was taken exactly: slice the SFC to its <template> region, strip comments, then match. Both now come from source_scope.markup_mask, shared with gates 12 and 32, so the three template gates agree on what "markup" means instead of each carrying its own answer.

Extraction also moved off [^>]*, which ends a tag at the first > — in Vue usually the arrow of :reduce="option => option.value" (#236).

Measured post-merge on openbuild (the other repro of this, #235), attribution-isolated between main@32fa23e and main@cdfbd7a, read from the runner's stdout:

A (before): [gate-31] img-alt: FAIL — 3 <img> tag(s) without alt attribute
B (after):  [gate-31] img-alt: PASS

launchpad@development OrgNavigationItem.vue is a unit fixture now (test_check_markup_a11y.py), together with the anti-widening control you asked for: the same component with one real <img src="/badge.png"> added must report exactly 1.

⚠️ One thing measurement caught before this landed. The first cut used a lazy <template…>(.*?)</template>, which ends the block at the first nested slot close — <template #default> is written inside the SFC's own template. That silently deleted a real finding at openconnector EditMapping.vue:376. A relaxation that removes true positives is the fix over-applied, which is the failure this whole change exists to prevent. Boundaries are found by depth now, with a test.

Also: a CodeQL py/bad-tag-filter (high) on the branch — </script\s*> does not match </script bar>, which an HTML parser does treat as the end of the element, so the script body would run past its close and blank shipping markup. Fixed, with a test. The first test written for it exercised a function that never touches that regex and survived the mutant; it now runs through the two functions that do.