Skip to content

a11y: test the PR's own CSS, scan every page, underline prose links - #107

Merged
rivassec merged 2 commits into
mainfrom
fix/a11y-pa11y
Oct 24, 2026
Merged

rivassec merged 2 commits into
mainfrom
fix/a11y-pa11y

Conversation

@rivassec

Copy link
Copy Markdown
Owner

The pa11y "color contrast" errors on post headers were axe needs-review results, not measured failures: the hero's ::after glow overlay hides the background from axe, and pa11y 6 reported every incomplete result as an error (processIncomplete sets warning, processIssue overwrites it from the impact). Measured worst case (lightest stop + both glows at full strength): h1 6.95:1, meta 5.89:1, links 5.50:1, all above AA.

  • pa11y-ci 3.1.0 → 5.0.0 (pa11y 10, axe 4.13, needs Node 22) with levelCapWhenNeedsReview: "warning".
  • Test the PR's CSS: build with SITEURL=http://127.0.0.1:8000. With publishconf's absolute URLs, pa11y loaded the live stylesheet, so CSS changes in a PR were never tested.
  • Scan every page from the sitemap (txt/md/xml excluded) instead of 6 hand-picked URLs.
  • Underline links in running text (main p/li/td a, footer p a): axe 4.13 found 234 links marked by color alone (#6cb4ff vs body text, 1.78:1, WCAG 1.4.1). Nav, cards and pills keep their styles.

Local run (pa11y-ci 5.0.0, Chrome): 35/36 pages pass. Remaining: nested-interactive in prompt-injection-supply-chain-evasion (a scrollable <pre> inside <figure role="img">; Chrome makes scrollers focusable). That needs a content/markup decision, so it is not in this PR. The job stays continue-on-error; flipping it to blocking is a separate PR once the run is clean.

🤖 Generated with Claude Code

rivassec and others added 2 commits October 23, 2026 22:58
The 30 pa11y contrast "errors" on post headers were axe needs-review
results, not measured failures: the hero's ::after glow overlay hides the
background from axe, and pa11y 6 reported every incomplete result as an
error. Worst-case measured contrast is 5.5:1 (links), above AA.

- pa11y-ci 3.1.0 -> 5.0.0 (pa11y 10, axe 4.13; needs Node 22) with
  levelCapWhenNeedsReview: warning.
- Build with SITEURL=http://127.0.0.1:8000: publishconf's absolute URLs
  made pa11y load the live stylesheet, so CSS changes in a PR were never
  tested.
- Scan every page from the sitemap instead of 6 hand-picked URLs.
- Underline links in running text: the newer axe found 234 links marked
  by color alone (#6cb4ff vs body text, 1.78:1; WCAG 1.4.1).

Locally (pa11y-ci 5.0.0, Chrome): 35/36 pages pass. The remaining error is
a nested-interactive figure in prompt-injection-supply-chain-evasion (a
scrollable <pre> inside role="img"), left for a content decision. The job
stays non-blocking; making it blocking is a separate PR.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The button injected into the ASCII trust-boundary diagram in
prompt-injection-supply-chain-evasion sat inside <figure role="img">: a
nested interactive control (axe nested-interactive), and a diagram is not
code to copy. With this, pa11y passes 36/36 pages locally.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@rivassec
rivassec merged commit b09b97b into main Oct 24, 2026
19 checks passed
@rivassec
rivassec deleted the fix/a11y-pa11y branch October 24, 2026 06:25
@rivassec rivassec mentioned this pull request Oct 24, 2026
rivassec added a commit that referenced this pull request Oct 24, 2026
All 36 pages pass since #107 (main run on f5ecf97). Drop continue-on-error
so a new accessibility error turns the check red.

Co-authored-by: rivassec <rivassec@rivassec.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant