Action v1.9.0: SARIF output + baseline ratchet

What's new

SARIF v2.1.0 output (sarif-output input)

The GitHub Action now emits a SARIF v2.1.0 file so design-contract findings appear in GitHub's native Code Scanning dashboard alongside CodeQL and Dependabot alerts.

• Each of the 40 checks becomes a SARIF rule (with id, name, shortDescription, defaultConfiguration.level, tags, precision, help/remediation)
• Each FAIL check becomes an error-level result; each WARN becomes a warning-level result
• The scored URL is the artifact location (design checks inspect live pages, not source files)
• Stable partialFingerprints prevent duplicate alerts across runs

Upload the SARIF file to GitHub code-scanning with github/codeql-action/upload-sarif@v4. Design-contract findings appear in the same Security > Code Scanning dashboard as CodeQL and Dependabot alerts — the first design system to integrate with GitHub's native alerting infrastructure.

- uses: LE-VAI/designesy-org@v1
  with:
    url: https://your-app.vercel.app
    sarif-output: designesy-results.sarif
- uses: github/codeql-action/upload-sarif@v4
  with:
    sarif-file: designesy-results.sarif
    category: designesy

Baseline ratchet (baseline input)

Commit a .designesy-baseline.json file to track your design score floor. The action fails when the score regresses below the baseline, and writes an updated baseline on improvement — so the floor only ratchets up.

- uses: LE-VAI/designesy-org@v1
  with:
    url: https://your-app.vercel.app
    baseline: .designesy-baseline.json

Also fixed

• Removed 6 phantom tools_exposed entries from server.json (registry advertised 17 tools, package ships 11)

Backward compatible

Both new inputs default to empty (disabled). Existing workflows are unaffected.

v1.0.1 — Marketplace badge icon update

Patch release: Marketplace badge icon updated from check-circle to radio (dot-in-ring) to match the Designesy favicon and Score Gate hero identity. No functional changes to the action itself.

v1.0.0 — Designesy Contract Check

v1.0.0 — Designesy Contract Check

First stable release of the Designesy GitHub Action — a design-contract quality gate for CI.

What it does

Scores any URL against the Designesy v0.4.0 design-system contract — 40 deterministic checks across 14 weighted categories (tokens, motion, accessibility, cadence, takt, poise, identity, interaction, performance, responsive, semantic, security, spec, copywriting) — and fails your workflow when the score or grade drops below your threshold.

No LLM. No heuristics. Every check is reproducible and grounded in the published contract.

Features

• 40-check engine — deterministic, cached ~24h per URL
• 4 emission formats — designesy (native), canonical (review-findings.json schema), review (jakubkrehel markdown), google (design.md-compatible)
• PR comments — posts a summary comment on pull requests with score, grade, and gate verdict (zero-dependency bare fetch to GitHub REST API)
• Quality gating — min-score and min-grade inputs; step fails on regression
• Job Summary — markdown summary on every run
• Zero dependencies — Node built-ins only, runs on node24

Usage

- uses: LE-VAI/designesy-org@v1
  with:
    url: https://your-app.vercel.app
    min-score: 70
    min-grade: B
    post-comment: true

Inputs

input	required	default	description
url	yes	—	URL to score
min-score	no	0	Minimum score (0–100). 0 disables.
min-grade	no	""	Minimum grade (A–F). Empty disables.
format	no	designesy	Emission format: designesy, canonical, review, google
api	no	https://www.designesy.org	Scoring engine base URL
fail-on-error	no	true	Fail on engine errors. Set false to warn.
post-comment	no	true	Post PR summary comment (pull_request events only)
github-token	no	${{ github.token }}	Token for PR comments

Contract

Designesy v0.4.0 — see designesy.org/contracts/design-system for the full contract and designesy.org/methodology for the scoring methodology.

---

v1.0.0 patch: Marketplace badge updated from check-circle to radio (dot-in-ring) to match the Designesy favicon and Score Gate hero identity. No functional changes.

Designesy Design System Contract v0.4.0

Designesy Design System Contract v0.4.0

The fourth tagged release of the Designesy design system contract — now with 40 verification checks across 14 weighted categories, including the new Copywriting adoption.

What's new in v0.4.0

Copywriting adoption (the big one)

16 UX copy principles + 4 verification checks:

• v38 — Button text is a verb phrase or recognized command (not a bare noun)
• v39 — No trailing period on button text, labels, or tab text
• v40 — Descriptive link text (no "click here")
• v41 — No ALL CAPS in body text

Grounded in NN/g guidance. Heuristic WARNs for manual review where deterministic checks can't fully cover intent.

Check count: 23 → 40

17 new checks across the existing categories plus the new Copywriting category. The verification engine now covers 14 weighted categories: tokens, motion, accessibility, cadence, takt, poise, identity, interaction, performance, responsive, semantic, security, spec, copywriting.

Originality + anti-slop signals

Positive craft signals panel in the score report — surface originality lift (+8 cap) that recognizes deliberate craft choices (glassmorphism done well, scoped gradients, intentional motion) rather than penalizing anything that looks like a pattern.

GitHub Action + CLI (adoption surfaces)

• GitHub Action — uses: LE-VAI/designesy-org@v1, node24, PR comments, 4 emission formats
• designesy-score CLI — npx designesy-score <url>, zero-dep, npm published
• MCP server — 11 tools, Streamable HTTP, no auth

Looping hero demo

The README and npm listing now include a looping Score Gate hero animation — a URL flows in, the 40-check contract grid fires, the score counts up to 99.2% grade A, and the gate passes. Built as a HyperFrames composition, rendered to mp4, encoded to a sub-1MB GIF with ffmpeg (24fps, 64-color palette, lanczos + bayer dithering). A static PNG fallback is served via <picture> art-direction when the OS has reduced-motion enabled.

MCP tool descriptions rewritten for agent selection (TDQS Tier-A)

All 11 MCP tool descriptions restructured against the Glama TDQS (Tool Definition Quality Score) six-dimension rubric. Research (arXiv 2602.18914) found smell-free descriptions win 72% of head-to-head agent selections vs a 20% random baseline — a 260% relative lift. Every tool now has: verb+object purpose lead, "When NOT to use" sibling disambiguation (89% of MCP tools omit this), behavioral transparency (read-only/executable/cache/SKIP disclosure), parameter intent, and return JSON shapes. Server-level TDQS = 0.6×mean + 0.4×min — all 11 must pass Tier A (≥3.5) or the worst sinks the server.

Leaderboard

30 sites scored, with an open submission form at /leaderboard — submit a URL, get scored on-the-fly, curated into the next weekly batch.

Full adoption history

Version	Date	Summary
0.1.0	2026-07-12	First public contract — tokens, motion, components, verification
0.1.1	2026-07-12	Poise interaction rules — wordmark breath, press settle, sound preference, reduced motion
0.1.2	2026-07-13	Takt interface-feel rules — concentric radii, press scale, image outlines, hit area floor
0.1.3	2026-07-13	Cadence typography rules — font smoothing, rem scale, line-height by role, text-wrap, tabular nums
0.1.4	2026-07-13	Duration scale, Core Web Vitals + contrast verification, anti-rationalization methodology
0.3.0	2026-07-15	Spring physics, full acoustic enumeration, 10 Motion Standards, motion anti-patterns, entrance scale tokens
0.4.0	2026-07-31	Copywriting adoption (16 principles + 4 checks), 40-check engine, originality signals, GitHub Action v1, CLI, leaderboard, looping hero demo, TDQS Tier-A tool descriptions

Machine export

• Contract: designesy.org/contracts/design-system.json (W3C DTCG 2025.10 + custom $type: spring, $type: sound)
• Methodology: designesy.org/methodology

Live score

The designesy.org site is verified against this contract: 99.2% (Grade A) — 35 pass, 0 fail, 1 warn, 4 skip (browser-only checks).

Designesy Design System Contract v0.3.0

Designesy Design System Contract v0.3.0

The first tagged release of the Designesy design system contract — a public, machine-readable design system with 23 verification checks, 10 non-negotiable motion standards, 10 acoustic cues, and 9 documented open tensions.

What's in this release

• Tokens: colors, surfaces, lines, shadows, radius, spacing, layout, motion (duration + easing + springs), typography, acoustic cues
• Motion: 10 Non-Negotiable Motion Standards (§16), 6 block-on-sight anti-patterns, 4 caution anti-patterns, entrance scale tokens, stagger interval
• Acoustic: 10 cue tokens via custom $type: sound (net-new vs W3C DTCG 2025.10), Cuelume v0.1.0 engine, interaction-only mapping rules
• Labs adopted: Poise (v0.1.1), Takt (v0.1.2), Cadence (v0.1.3)
• Verification: 23 automated checks with provenance back to contract tokens
• Machine export: designesy.org/contracts/design-system.json (W3C DTCG 2025.10 format + custom $type: spring and $type: sound)

Adoption history

Version	Date	Summary
0.1.0	2026-07-12	First public contract — tokens, motion, components, verification
0.1.1	2026-07-12	Poise interaction rules — wordmark breath, press settle, sound preference, reduced motion
0.1.2	2026-07-13	Takt interface-feel rules — concentric radii, press scale, image outlines, hit area floor
0.1.3	2026-07-13	Cadence typography rules — font smoothing, rem scale, line-height by role, text-wrap, tabular nums
0.1.4	2026-07-13	Duration scale (transitions.dev cross-ref), Core Web Vitals + contrast verification, anti-rationalization methodology
0.3.0	2026-07-15	Spring physics, full acoustic enumeration, 10 Motion Standards, motion anti-patterns, entrance scale tokens, font-synthesis/underline fixes

Open tensions (9)

1. Light theme is not contracted — dark technical foundation is provisional
2. --activation exists but has limited public surface usage
3. Inter is named in the stack but not self-hosted; system fallback is intentional
4. Shadow tokens exist; elevation language is still light-touch (borders lead)
5. Human contract page and machine export remain dual sources until a single generator owns both
6. Keyboard-path verification packets are published for Poise only — not every public route
7. Inline-axis logical properties applied — block-axis and border-inline remain physical (Cadence partial migration)
8. Block-axis logical properties (margin-block-start/end) not yet migrated — only inline-axis done
9. border-left decorative accents not yet migrated to border-inline-start — visual regression risk needs testing

External ingests (provenance)

• Amicro (Kiyotaka / @SubhanHQ) — micro-transitions library, informed Takt stagger and press rules
• better-ui skill (Jakub Krehel / @jakubkrehel, MIT) — 13 interface polish principles
• better-typography skill (Jakub Krehel / @jakubkrehel, MIT) — 18 typography principles
• agent-skills (Addy Osmani / @addyosmani, MIT) — anti-rationalization table pattern + verification checklist methodology
• Taste Skill (Leon / @Leonxlnx) — pre-flight checklist methodology, Core Web Vitals and button contrast checks
• transitions.dev (Jakub Antalik / @Jakubantalik) — motion token library, duration scale cross-reference

Links

• Live contract: https://www.designesy.org/contracts/design-system
• Machine export: https://www.designesy.org/contracts/design-system.json
• SKILL.md export: https://www.designesy.org/contracts/skill
• Labs: https://www.designesy.org/labs/poise · /takt · /cadence · /acoustics

---

Designesy is design intelligence infrastructure. This contract is public, machine-readable, and verified against the live site. We build against it.