From 8719fe5930930478bd3dccf93f5a9ff5dc31f297 Mon Sep 17 00:00:00 2001 From: Aric Camarata Date: Thu, 25 Jun 2026 14:10:36 -0400 Subject: [PATCH 1/2] ci(chatislam): match chromedriver to runner Chrome in a11y-axe The @axe-core/cli bundled chromedriver tracks latest Chrome stable and mismatched the runner's pre-installed Chrome (exit 2). Install the matching driver via nanasess/setup-chromedriver and point axe at it; also pin the bundled chromedriver package via CHROMEDRIVER_FILEPATH as a fallback. Fix the two WCAG AA color-contrast violations this now surfaces: - disclaimer link mid-green (3.6:1) -> light-green (6.1:1) - footer copyright opacity 0.4 (3.1:1) -> 0.7 (6.4:1) Drop the homepage --include scope so the footer is actually audited. --- .github/workflows/a11y-axe.yml | 28 +++++++++++++++++++---- web/src/components/DisclaimerBanner.astro | 2 +- web/src/pages/index.astro | 2 +- 3 files changed, 25 insertions(+), 7 deletions(-) diff --git a/.github/workflows/a11y-axe.yml b/.github/workflows/a11y-axe.yml index cd1244b..3f4b6f2 100644 --- a/.github/workflows/a11y-axe.yml +++ b/.github/workflows/a11y-axe.yml @@ -64,20 +64,38 @@ jobs: - name: Wait for server run: npx wait-on http://localhost:3042 --timeout 120000 + # @axe-core/cli bundles a `chromedriver` whose version tracks the latest + # Chrome stable. The runner's pre-installed Google Chrome is often a major + # behind, so the bundled driver aborts with a version mismatch (exit 2): + # "This version of ChromeDriver only supports Chrome version N". + # Install the ChromeDriver that matches THIS runner's Chrome and point axe + # at it. nanasess/setup-chromedriver auto-detects the installed Chrome and + # drops the matching driver at /usr/local/bin/chromedriver. + - name: Setup matching ChromeDriver + uses: nanasess/setup-chromedriver@v3 + - name: Install axe-cli run: npm install -g @axe-core/cli + # Belt-and-suspenders: make the bundled `chromedriver` npm package reuse + # the matched binary instead of downloading a mismatched one, in case + # --chromedriver-path is not honored (dequelabs/axe-core-npm#370). + env: + CHROMEDRIVER_FILEPATH: /usr/local/bin/chromedriver - name: Run axe-core (critical + serious) - # Tags: wcag2a, wcag2aa, wcag21a, wcag21aa, wcag22aa - # --exit: exit non-zero on violation - # --tags: enforce up to WCAG 2.2 AA + # --chromedriver-path: use the runner-matched driver, not axe's bundled one. + # --chrome-options: CI-stable headless Chrome flags (no-sandbox + small /dev/shm). + # --tags: enforce up to WCAG 2.2 AA · --exit: exit non-zero on violation. # @axe-core/cli prints results to stdout by default; there is no # --reporter flag (it errors "unknown option '--reporter'"). run: | axe http://localhost:3042 \ --tags wcag2a,wcag2aa,wcag21a,wcag21aa,wcag22aa \ - --exit \ - --include "main, nav, [role='main']" + --chromedriver-path /usr/local/bin/chromedriver \ + --chrome-options="no-sandbox,disable-setuid-sandbox,disable-dev-shm-usage" \ + --exit axe http://localhost:3042/chat \ --tags wcag2a,wcag2aa,wcag21a,wcag21aa,wcag22aa \ + --chromedriver-path /usr/local/bin/chromedriver \ + --chrome-options="no-sandbox,disable-setuid-sandbox,disable-dev-shm-usage" \ --exit diff --git a/web/src/components/DisclaimerBanner.astro b/web/src/components/DisclaimerBanner.astro index 54bd83f..47f06cc 100644 --- a/web/src/components/DisclaimerBanner.astro +++ b/web/src/components/DisclaimerBanner.astro @@ -28,7 +28,7 @@ or authoritative religious rulings. Always consult a qualified Islamic scholar. Read our Sharia content guidelines

diff --git a/web/src/pages/index.astro b/web/src/pages/index.astro index 0234f79..8009734 100644 --- a/web/src/pages/index.astro +++ b/web/src/pages/index.astro @@ -104,7 +104,7 @@ export const prerender = true -