Icon control - #713
Merged
Merged
Conversation
- Audits /, /pairs, /events, /docs using desktop preset - Starts production server via npm start (startServerReadyPattern: 'Ready on') - Hard-fails on: performance≥0.80, accessibility≥0.90, best-practices≥0.80, seo≥0.80, LCP≤2500ms, CLS≤0.1 - Advisory warnings for FCP≤2000ms, TBT≤300ms, TTI≤3800ms, SI≤3400ms - Writes HTML reports to .lighthouseci/ for artifact upload
- Adds 'lighthouse' job that runs after build-test (needs: build-test) - Installs @lhci/cli@0.14.0 with --no-save (not saved to package.json) - Builds production bundle then runs: npx lhci autorun --config=.lighthouserc.json - Passes LHCI_BUILD_CONTEXT env vars for commit metadata - Uploads .lighthouseci/ as artifact 'lighthouse-reports-<run-id>' with 30-day retention using if: always() so reports persist on failures
- Validates top-level schema: ci.collect, ci.assert, ci.upload all present - collect: exactly 4 routes on localhost:3000, npm start server command, ready pattern matches Next.js output, desktop preset, no mobile - assert: all 4 category error assertions with correct minScore bounds, LCP≤2500ms and CLS≤0.1 as error assertions, advisory metrics present with warn|error severity, tuple format and severity validity for all entries - upload: filesystem target, outputDir .lighthouseci - file integrity: exists, parses as JSON, no TODO/FIXME, no duplicate URLs - 48 tests across 8 describe groups
- Update Required CI checks table to include Lighthouse CI as third required job - Add full 'Lighthouse CI — performance budgets' section covering: - Audited routes table (/, /pairs, /events, /docs) - Performance thresholds table (error vs advisory) - Local run instructions (build + install @lhci/cli + lhci autorun) - How to view HTML reports locally and from CI artifacts - How to tighten or convert thresholds - Description of the lighthouseConfig.test.js test suite
…source-Policy Set both headers to 'same-origin' for all routes via the shared securityHeaders array in next.config.ts. - COOP: same-origin prevents cross-origin pages from retaining a browsing-context-group reference to the dashboard, closing opener-based side-channel attacks (e.g. Spectre variants). - CORP: same-origin prevents other origins from loading dashboard resources via no-cors fetch/XHR, a prerequisite for full cross-origin isolation (SharedArrayBuffer, performance.measureUserAgentSpecificMemory). frame-ancestors 'none' was already present in the CSP; no change needed.
…ctly once Extends nextConfigHeaders.test.ts with four new assertions: - Cross-Origin-Opener-Policy is 'same-origin' and appears exactly once - Cross-Origin-Resource-Policy is 'same-origin' and appears exactly once - CSP frame-ancestors directive contains 'none' and appears exactly once (duplicate directives would let a lenient parser use the weaker one) - Combined guard: both COOP and CORP keys appear exactly once in the flat header list, catching accidental duplicate entries
Adds an 'HTTP security headers' section explaining the purpose of each security header set in next.config.ts, with a focused sub-section on the cross-origin isolation family (COOP, CORP, CSP frame-ancestors). References the test file for traceability.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Files modified
Validation
closes #443