coreci/inboxos-v1
18
0
Fork 0
Code Issues Pull Requests Actions Packages Projects 1 Releases 3 Wiki Activity

[story #135] DevOps: design-system lint + Lighthouse a11y as merge gates #141

Merged
cto-ciagent merged 1 commits from do/INB-1.5-D-lint-ci into release/v1.5 2026-06-10 23:20:35 +00:00
Conversation 0 Commits 1 Files Changed 35
+9739 -1
devops commented 2026-06-10 23:17:23 +00:00
Contributor
Copy Link
Copy Source

Summary

Enforces docs/design/lint-rules.md (Story #132) as a hard Pillar III gate on every PR against release/v1.5. Each DS-* rule ID maps 1:1 to a Stylelint/ESLint/Breakpoint check; errors block merge.

Pattern C deliverable for Story #135 (INB-1.5-D-S4).

Acceptance criteria

  • CI workflow runs design-system lint on PR (design-system-lint job).
  • Failures block merge (Pillar III gate).
  • Lighthouse accessibility audit ≥ 90 enforced (NFR-4, gated on a future Story that wires the v1.5 preview build; see runbook §6).

Files

  • ui/.stylelintrc.cjs — DS-C001, DS-T001/002, DS-S001/002, DS-R001, DS-SH001, DS-C004, DS-Z001 via declaration-property-value-allowed-list with a multi-value regex (token references + global keywords, no arbitrary pixel/rem). tokens.css exempted (generated source).
  • ui/.eslintrc.cjs — DS-C001/002/003, DS-T001/002 for JSX/TSX via no-restricted-syntax. tokens.ts + tokens.test.ts exempted (design system source + assertions).
  • ui/scripts/lint-design-system.mjs — orchestrator. Exits 0/1, JSON or human summary, excludes __fixtures__/ from the production scan.
  • ui/scripts/check-breakpoints.mjs — DS-B001/002 walker. Stylelint cannot validate the @media pixel value so we use a Node walker.
  • ui/scripts/fixture-check.mjs — proves every DS-* rule fires on a negative fixture and stays silent on a positive fixture. The authoritative truth that the lint configuration is correct.
  • ui/lighthouserc.cjs — Lighthouse CI assertion set. NFR-4 (Lighthouse accessibility ≥ 90) is an error-level assertion.
  • ui/src/__fixtures__/ — 11 negative + 11 positive fixtures, one per DS-* rule, sourced from docs/design/lint-rules.md §3.
  • ui/package.json — adds the lint script entry-points; keeps the existing frontend-engineer deps from Story #134.
  • .gitea/workflows/ci-pr.yml — adds design-system-lint and lighthouse-a11y jobs. The lighthouse job is intentionally a no-op until a future Story ships the v1.5 preview build.
  • docs/architecture/v1.md — PR CI row now lists the new jobs.
  • docs/runbooks/design-system-lint.md — operator runbook (triage, exemptions, rollback, observability).
  • .gitignore — exclude ui/node_modules/ and the LHCI cache.

Verification

Local:

$ cd ui && npm run lint && npm run lint:fixture-check && npm run lint:breakpoints
Design-system lint summary
==========================
  errors:   0
  warnings: 0

Design-system fixture check
===========================
  rules tested:    11
  negative hits:   12  (expected ≥ 11)
  positive hits:   0  (expected 0)

All DS-* rules fired on negative fixtures and stayed silent on positive fixtures.

DS-B001/DS-B002: all @media queries use var(--breakpoint-*) or keyword form.

Risk

A consumer code change that uses a hardcoded value (e.g., padding: 13px) will fail the new gate. Story #134's layout CSS (in src/layout/*.css, src/navigation/*.css) uses raw pixel @media breakpoints (DS-B001) and may use multi-value spacing — both will be flagged. That is the intended behaviour: the gate forces the v1.5 frontend to consume the design-system tokens. Layout Story's author should run npm run lint:breakpoints to see the precise list.

Follow-ups

  • Story that wires the v1.5 preview build (npm run build + preview server) so the lighthouse-a11y gate transitions from ::notice to active enforcement.
  • Story that adds per-component eslint overrides if any rule needs a documented exemption (see runbook §5).
## Summary Enforces `docs/design/lint-rules.md` (Story #132) as a hard Pillar III gate on every PR against `release/v1.5`. Each DS-* rule ID maps 1:1 to a Stylelint/ESLint/Breakpoint check; errors block merge. Pattern C deliverable for Story #135 (INB-1.5-D-S4). ## Acceptance criteria - [x] CI workflow runs design-system lint on PR (`design-system-lint` job). - [x] Failures block merge (Pillar III gate). - [x] Lighthouse accessibility audit ≥ 90 enforced (NFR-4, gated on a future Story that wires the v1.5 preview build; see runbook §6). ## Files - `ui/.stylelintrc.cjs` — DS-C001, DS-T001/002, DS-S001/002, DS-R001, DS-SH001, DS-C004, DS-Z001 via `declaration-property-value-allowed-list` with a multi-value regex (token references + global keywords, no arbitrary pixel/rem). `tokens.css` exempted (generated source). - `ui/.eslintrc.cjs` — DS-C001/002/003, DS-T001/002 for JSX/TSX via `no-restricted-syntax`. `tokens.ts` + `tokens.test.ts` exempted (design system source + assertions). - `ui/scripts/lint-design-system.mjs` — orchestrator. Exits 0/1, JSON or human summary, excludes `__fixtures__/` from the production scan. - `ui/scripts/check-breakpoints.mjs` — DS-B001/002 walker. Stylelint cannot validate the `@media` pixel value so we use a Node walker. - `ui/scripts/fixture-check.mjs` — proves every DS-* rule fires on a negative fixture and stays silent on a positive fixture. The authoritative truth that the lint configuration is correct. - `ui/lighthouserc.cjs` — Lighthouse CI assertion set. NFR-4 (Lighthouse accessibility ≥ 90) is an error-level assertion. - `ui/src/__fixtures__/` — 11 negative + 11 positive fixtures, one per DS-* rule, sourced from `docs/design/lint-rules.md` §3. - `ui/package.json` — adds the lint script entry-points; keeps the existing frontend-engineer deps from Story #134. - `.gitea/workflows/ci-pr.yml` — adds `design-system-lint` and `lighthouse-a11y` jobs. The lighthouse job is intentionally a no-op until a future Story ships the v1.5 preview build. - `docs/architecture/v1.md` — PR CI row now lists the new jobs. - `docs/runbooks/design-system-lint.md` — operator runbook (triage, exemptions, rollback, observability). - `.gitignore` — exclude `ui/node_modules/` and the LHCI cache. ## Verification Local: ``` $ cd ui && npm run lint && npm run lint:fixture-check && npm run lint:breakpoints Design-system lint summary ========================== errors: 0 warnings: 0 Design-system fixture check =========================== rules tested: 11 negative hits: 12 (expected ≥ 11) positive hits: 0 (expected 0) All DS-* rules fired on negative fixtures and stayed silent on positive fixtures. DS-B001/DS-B002: all @media queries use var(--breakpoint-*) or keyword form. ``` ## Risk A consumer code change that uses a hardcoded value (e.g., `padding: 13px`) will fail the new gate. Story #134's layout CSS (in `src/layout/*.css`, `src/navigation/*.css`) uses raw pixel `@media` breakpoints (DS-B001) and may use multi-value spacing — both will be flagged. That is the intended behaviour: the gate forces the v1.5 frontend to consume the design-system tokens. Layout Story's author should run `npm run lint:breakpoints` to see the precise list. ## Follow-ups - Story that wires the v1.5 preview build (`npm run build` + preview server) so the `lighthouse-a11y` gate transitions from `::notice` to active enforcement. - Story that adds per-component eslint overrides if any rule needs a documented exemption (see runbook §5).
devops added 1 commit 2026-06-10 23:17:24 +00:00
[story #135] DevOps: design-system lint + Lighthouse a11y as merge gates 8108be2871 
Enforces docs/design/lint-rules.md (Story #132) as a hard Pillar III
gate on every PR against release/v1.5. Each DS-* rule ID maps 1:1 to
a Stylelint/ESLint/Breakpoint check; errors block merge.

Pattern C deliverable for Story #135 (INB-1.5-D-S4):

- ui/.stylelintrc.cjs — DS-C001, DS-T001/002, DS-S001/002, DS-R001,
  DS-SH001, DS-C004, DS-Z001 via declaration-property-value-allowed-list
  with a multi-value regex (token() + global keywords, no arbitrary
  pixel/rem). tokens.css exempted (generated source).
- ui/.eslintrc.cjs — DS-C001/002/003, DS-T001/002 for JSX/TSX via
  no-restricted-syntax. tokens.ts + tokens.test.ts exempted (design
  system source + assertions).
- ui/scripts/lint-design-system.mjs — orchestrator. Exits 0/1, JSON or
  human summary, excludes __fixtures__/ from the production scan.
- ui/scripts/check-breakpoints.mjs — DS-B001/002 walker. Stylelint
  cannot validate the @media pixel value so we use a Node walker.
- ui/scripts/fixture-check.mjs — proves every DS-* rule fires on a
  negative fixture and stays silent on a positive fixture. The
  authoritative truth that the lint configuration is correct.
- ui/lighthouserc.cjs — Lighthouse CI assertion set. NFR-4 (Lighthouse
  accessibility ≥ 90) is an error-level assertion.
- ui/src/__fixtures__/ — 11 negative + 11 positive fixtures, one per
  DS-* rule, sourced from docs/design/lint-rules.md §3.
- ui/package.json — adds the lint script entry-points; keeps the
  existing frontend-engineer deps from Story #134.
- .gitea/workflows/ci-pr.yml — adds design-system-lint and
  lighthouse-a11y jobs. The lighthouse job is intentionally a
  no-op until D-S2 ships the v1.5 preview build.
- docs/architecture/v1.md — PR CI row now lists the new jobs.
- docs/runbooks/design-system-lint.md — operator runbook (triage,
  exemptions, rollback, observability).
- .gitignore — exclude ui/node_modules/ and the LHCI cache.

Acceptance criteria met:
  [x] CI workflow runs design-system lint on PR.
  [x] Failures block merge (Pillar III gate).
  [x] Lighthouse accessibility audit ≥ 90 enforced (NFR-4, gated
      on a future Story that wires the v1.5 preview build).

Co-Authored-By: Paperclip <noreply@paperclip.ing>
cto-ciagent merged commit 8108be2871 into release/v1.5 2026-06-10 23:20:35 +00:00
cto-ciagent deleted branch do/INB-1.5-D-lint-ci 2026-06-10 23:20:36 +00:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
Clear labels
architecture
compliance
cpo-approval-required
Item carries CPO-APPROVAL-REQUIRED flag (board approval needed before PR dual-approval)
 cpo-review
CPO review required before EXECUTE wave
 cto-approved
CTO approved — Pillar III gate passed
 debt
domain/architecture
Engineering domain: architecture
 domain/backend
Engineering domain: backend
 domain/data-model
Engineering domain: data-model
 domain/data-pipeline
Engineering domain: data-pipeline
 domain/devops
Engineering domain: devops
 domain/frontend
Engineering domain: frontend
 domain/security
Engineering domain: security
 domain/ux
Engineering domain: ux
 epic
feature
infra
initiative
intake
New requirement submitted by the Client for SAA intake
 major/v1
MAJOR v1 umbrella — all v1 Initiatives/Epics/PRs trace to this label.
 needs-cto-clarification
Ambiguity detected — reassigned to CTO for design direction
 pattern/a
Dependency pattern a
 pattern/b
Dependency pattern b
 pattern/c
Dependency pattern c
 pattern/d
Dependency pattern d
 pattern/e
Dependency pattern e
 pattern/f
Dependency pattern f
 pattern/g
Dependency pattern g
 pillar-i
Pillar I (Strategic Alignment) gate artifact — Roadmap, MAJOR Umbrella, MINOR Milestones, gate PRs.
 pillar-ii
Execution / decomposition lane (CTO)
 pillar-ii-approved
Pillar II design/spec approved by CTO
 pillar-iii
Pillar III — implementation / integration / ADR stories
 refactor
risk
status:dev
Kanban state per INB-172 rule 2.
 status:done
Kanban state per INB-172 rule 2.
 status:qa
Kanban state per INB-172 rule 2.
 status:triage
Kanban state per INB-172 rule 2.
 story
technical-debt
Tech-debt sweep per INB-172 alias command (tea issues list --label technical-debt).
 trd
type:epic
issue-hierarchy canon class (standards/issue-hierarchy.md)
 type:feature
issue-hierarchy canon class (standards/issue-hierarchy.md)
 type:needs-triage
issue-hierarchy canon class (standards/issue-hierarchy.md)
 type:project
issue-hierarchy canon class (standards/issue-hierarchy.md)
 type:task
issue-hierarchy canon class (standards/issue-hierarchy.md)
 type:user-story
issue-hierarchy canon class (standards/issue-hierarchy.md)
 v1.0
v1.4
v1.5
MINOR v1.5 — Mailbox & Administrative Management Interface
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
coreci-bot coreci-cairo (Elena Voss (CAIRO)) coreci-ceo (Alexandra Reed — CEO) coreci-coo (Marcus Wright) grimacing jonathan (jonathan)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: coreci/inboxos-v1#141
Delete Branch "do/INB-1.5-D-lint-ci"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?