Skip to content

feat(routes): single typed inventory for quality checks (#191) - #210

Open
vicistar-star wants to merge 9 commits into
wraith-protocol:developfrom
vicistar-star:wave-10/route-inventory-191
Open

vicistar-star wants to merge 9 commits into
wraith-protocol:developfrom
vicistar-star:wave-10/route-inventory-191

Conversation

@vicistar-star

Copy link
Copy Markdown
Contributor

What

Closes #191. Introduces `src/routes/inventory.ts` as the single source of truth for every URL the site serves, replacing seven separate route lists maintained in isolation across the codebase.

Why

Before this PR, application routes and the lists used by smoke, a11y, and Lighthouse checks were maintained separately. A new route added to `App.tsx` could silently skip every quality check. Wave 9 route-matrix work did not land, so this is the first consolidation pass.

Done when criteria

  • One typed inventory for static, dynamic, and localized production routes
  • Smoke, a11y, and Lighthouse selection driven from it
  • Build fails when an application route lacks an explicit quality-check policy

Changes

File Change
`src/routes/inventory.ts` New. Typed `STATIC_ROUTES`, `DYNAMIC_ROUTE_FAMILIES`, `SPECIAL_ROUTES` with `RoutePolicy { smoke, a11y, lighthouse }` per entry. Exported views: `smokeRoutes()`, `a11yRoutes()`, `lighthouseRoutes()`, `allStaticPaths()`, `localizedBasePaths()`
`scripts/assert-route-coverage.ts` New. Build-time guard: parses `App.tsx` for route paths, fails if any are absent from the inventory
`scripts/gen-routes-snapshot.ts` New. Writes `scripts/routes-snapshot.json` so plain-JS scripts and CI can consume the inventory without `tsx`
`src/utils/localizedRoutes.ts` `LOCALIZED_BASE_PATHS` derived from inventory instead of a hardcoded `Set`
`scripts/sitemap.ts` `knownRoutes` replaced with `allStaticPaths()`
`scripts/gen-sitemap.mjs` Reads static paths and localized base paths from `routes-snapshot.json`
`src/tests/a11y.test.tsx` `pages` array replaced with `a11yRoutes()`
`tests/a11y/a11y.spec.ts` Page list loaded from `routes-snapshot.json` (inline fallback for runs without a build)
`tests/smoke/serverless.smoke.test.ts` `smokeRoutes()` drives the "still serves built site" loop
`scripts/validate-content.ts` Calls `assertAllAppRoutesHavePolicy()` as part of content validation
`package.json` `gen-routes-snapshot.ts` added to the build pipeline
`.github/workflows/ci.yml` Lighthouse reads `urlsFile` from snapshot; PR comment shows one row per audited route

Testing

The route coverage assertion is exercised on every `pnpm build` via `validate-content.ts`. A cross-check script confirmed all 28 `App.tsx` paths are present in the inventory and no consumer retains a hardcoded route list.

…col#191)

Introduce src/routes/inventory.ts as the one source of truth for every
URL the site serves, replacing the seven separate route lists that were
previously maintained in isolation.

Each route carries an explicit RoutePolicy { smoke, a11y, lighthouse }
so adding a route without an entry is a build error rather than a
silent omission from quality checks.

Changes
- src/routes/inventory.ts: typed STATIC_ROUTES, DYNAMIC_ROUTE_FAMILIES,
  SPECIAL_ROUTES; exported views smokeRoutes(), a11yRoutes(),
  lighthouseRoutes(), allStaticPaths(), localizedBasePaths()
- scripts/assert-route-coverage.ts: build-time guard that parses
  App.tsx and fails when any route lacks a policy entry
- scripts/gen-routes-snapshot.ts: writes scripts/routes-snapshot.json
  so plain-JS scripts and CI can consume the inventory without tsx
- src/utils/localizedRoutes.ts: derive LOCALIZED_BASE_PATHS from
  inventory instead of a hardcoded Set
- scripts/sitemap.ts: replace knownRoutes literal with allStaticPaths()
- scripts/gen-sitemap.mjs: read static paths and localized base paths
  from routes-snapshot.json
- src/__tests__/a11y.test.tsx: drive pages list from a11yRoutes()
- tests/a11y/a11y.spec.ts: load page list from routes-snapshot.json
- tests/smoke/serverless.smoke.test.ts: loop smokeRoutes() in the
  'still serves built site' assertion
- scripts/validate-content.ts: call assertAllAppRoutesHavePolicy()
- package.json: add gen-routes-snapshot.ts to the build pipeline
- .github/workflows/ci.yml: Lighthouse reads urlsFile from snapshot;
  PR comment now shows one row per audited route
@drips-wave

drips-wave Bot commented Oct 21, 2026

Copy link
Copy Markdown

@vicistar-star Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits

@vercel

vercel Bot commented Oct 21, 2026

Copy link
Copy Markdown

@vicistar-star is attempting to deploy a commit to the truthixify's projects Team on Vercel.

A member of the Team first needs to authorize it.

…iming on threat-model

- Security.tsx: wrap audits grid in <dl> to fix dlitem violation
- Security.tsx: darken bounty active badge text (#22c55e -> #166534)
- Vitals.tsx: darken rating badge and DNT badge green text (#22c55e -> #166534)
- Vitals.tsx: darken Blocked label text (#ee7d77 -> #9b1c1c)
- a11y.spec.ts: wait for document.title before running axe to fix
  flaky document-title violation on lazy-loaded pages

@truthixify truthixify left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Reviewed exact head f8a9ca5. The inventory covers every current literal App route, its derived views feed smoke/a11y/Lighthouse/sitemap consumers, and validation runs in the build. All required checks are green. Local verification passed: content validation, production build, and 21 serverless smoke tests.

@truthixify truthixify left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The rebased head has a required Lighthouse failure before any audit runs: .github/workflows/ci.yml:145 reads scripts/routes-snapshot.json, but that file is absent on this head, producing ENOENT. Restore/generate the tracked route snapshot as part of this PR or derive the URL list directly from the canonical route inventory, then rerun required CI.

The Lighthouse job read scripts/routes-snapshot.json before it
existed, causing ENOENT before any audit ran.

- Wire tsx scripts/gen-routes-snapshot.ts into the pnpm build
  script so the snapshot is always regenerated from the typed
  inventory on every build.
- Commit the generated snapshot so the file is present on checkout
  without needing to run the full build first in CI.

Also bring the Lighthouse job up to date with the fixes landed on
wave-10/lighthouse-budgets:
- Start pnpm preview --host explicitly; gate on tcp:localhost:4173
  with wait-on instead of the unsupported startServerCommand input.
- Remove continue-on-error, uploadArtifacts, temporaryPublicStorage.
- Add lhci-mobile.json; update lhci-desktop.json with assert block
  gating accessibility, best-practices, seo at >= 0.95.
- Upload .lighthouseci-mobile/ and .lighthouseci-desktop/ as the
  lighthouse-reports artifact (if: always(), 14-day retention).
- Add issues: write permission; add continue-on-error to the PR
  comment step to survive fork permission restrictions.
- Expand PR comment table to show all four categories per route.
treosh/lighthouse-ci-action@v12 does not accept urlsFile as an
input. Move the URL list into collect.url in both lhci config files
(lhci-mobile.json, lhci-desktop.json) — the same pattern that
works on wave-10/lighthouse-budgets.

Remove the 'Generate Lighthouse URL list' step and drop urlsFile
from both action steps; configPath alone is sufficient since the
configs now carry the full URL list.
axe flags <th> without scope as a serious violation. Add scope="col"
to all three header cells in StellarDeploymentTable.

The 'View ↗' link text is not descriptive for screen readers. Add
aria-label="View {name} on explorer (opens in new tab)" to each
explorer link so assistive technology announces the contract name.

@truthixify truthixify left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The route snapshot is restored, but the required Playwright A11y Gate is still red on this exact head. The newly enrolled threat-model route has a persistent serious failure; contributors and blog-post detail are flaky with serious contrast/title violations. Since this PR expands the canonical inventory and drives the required a11y suite from it, it cannot merge while that suite fails. Fix the enrolled routes or correct invalid representative samples/policies, then rerun the required gate successfully.

@truthixify truthixify left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Changes requested on exact head 724cb90. The route-inventory/a11y work is no longer the blocker, but the required build now fails at pnpm audit --prod --audit-level=high: the branch pins toml 5.0.0 or earlier and hits GHSA-4qx8-w7c3-pj3p, GHSA-9j65-hcg3-gc64, and GHSA-9qmh-m7c6-f92p. Update the @stellar/stellar-sdk>toml override and lockfile to patched 5.0.1 (as the current repository security fix does), then rerun the required gates.

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[Wave 10][Carryover] Use one production route inventory for quality checks

2 participants