Force the image version from the release tag, and gate accessibility in CI - #23
Merged
Merged
Conversation
…in CI Two workflow changes that could not ride along in PR #22, because a push touching .github/workflows/ is rejected wholesale without a token carrying the workflow scope. docker.yml — v4.2.3 shipped with package.json still reading 4.2.2 and so reported itself as 4.2.2 at /api/version while being entirely correct and correctly deployed. The symptom is indistinguishable from a failed rollout. Two complementary guards: resolve the version from the tag and pass it to the build as APP_VERSION (empty on a branch push, so package.json remains the fallback), and fail a v* build outright when package.json disagrees with the tag. APP_VERSION also feeds APP_USER_AGENT, so a missed bump mislabels this service in other people's logs. a11y-audit.yml — /accessibility makes a public conformance claim under the Public Sector Bodies Accessibility Regulations 2018, and until now scripts/a11y-audit.mjs was a script someone had to remember to run. Builds, serves on 3210 with no working key (the audit only loads pages), runs the audit, keeps the JSON report for 90 days as the statement's evidence trail. GA variables are pinned empty so a CI run cannot pollute the usage counts the DPIA relies on. Every job summary states that a clean run is a floor, not a certificate: axe-core sees roughly a third to a half of WCAG issues. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This was referenced Aug 11, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Two workflow files that could not ride along in #22: a push touching
.github/workflows/is rejected wholesale unless the token carries theworkflowscope, so they were carried on their own branch.docker.yml— the image is told its own version. v4.2.3 shipped withpackage.jsonstill reading4.2.2, so/api/versionreported4.2.2while the release was entirely correct and correctly deployed — a symptom indistinguishable from a failed rollout. Two complementary guards:Resolve app versionpasses the resolved tag into the build asAPP_VERSION(empty on a branch push, wheremetadata-actionreports the branch name and "main" is not a version, sopackage.jsonstays the fallback and existing behaviour is unchanged); andRelease tag must match package.jsonfails av*build outright when the two disagree. The first alone would hide the symptom without fixing the cause — anything reading the repository would still get the wrong number.APP_VERSIONalso feedsAPP_USER_AGENT, so a missed bump mislabels this service in the MCP server's logs and in every fetched site's access log.a11y-audit.yml— the conformance claim gets a control behind it./accessibilitymakes a public claim under the Public Sector Bodies Accessibility Regulations 2018, and until nowscripts/a11y-audit.mjswas a script someone had to remember to run. Builds, serves on 3210, runs the audit, gates on any violation, retains the JSON report 90 days as the statement's evidence trail. No working API key is needed because the audit only loads pages. GA variables are pinned empty deliberately — a CI run must not emit telemetry that pollutes the usage counts the DPIA relies on. Every job summary states that a clean run is a floor and not a certificate: axe-core sees roughly a third to a half of WCAG issues, and focus order, error identification and most of the 2.2 additions still need a person.First run: WCAG audit green in 1m 59s. Checked against the pending v4.2.5 —
package.jsonon #22's branch already reads4.2.5, so the new assertion passes.