From a57657ddf9e663b047ddeccbefe72deb31a35bb2 Mon Sep 17 00:00:00 2001
From: Tao Bojlén <git@btao.org>
Date: Sat, 20 Jun 2026 13:01:26 +0000
Subject: [PATCH] ci: e2e a11y gate — build docs release, run Playwright suite

---
 .tangled/workflows/e2e.yml | 76 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
 1 file(s) changed, 76 insertion(s)(+), 0 deletion(s)(-)

diff --git a/.tangled/workflows/e2e.yml b/.tangled/workflows/e2e.yml
new file mode 100644
--- /dev/null
+++ b/.tangled/workflows/e2e.yml
@@ -0,0 +1,76 @@
+# e2e a11y conformance gate + functional regression tests. Builds the production
+# shadix_docs release (NOT mix dev), boots it, and runs the Playwright suite
+# (axe + regression) against it. Browser recipe confirmed by the a11y-ci-spike.
+when:
+  - event: ["push"]
+    branch: ["main"]
+  - event: ["pull_request"]
+    branch: ["main"]
+
+engine: "nixery"
+
+dependencies:
+  nixpkgs/nixpkgs-unstable:
+    - erlang_27
+    - nodejs
+    - cacert
+    - curl
+    - unzip
+    - chromium
+    - fontconfig
+    - dejavu_fonts
+
+environment:
+  MIX_ENV: "docs"
+  ELIXIR_ERL_OPTIONS: "+fnu"
+  HEX_HTTP_TIMEOUT: "120"
+  PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD: "1"
+  PLAYWRIGHT_BASE_URL: "http://localhost:8080"
+  PORT: "8080"
+  PHX_HOST: "localhost"
+  SECRET_KEY_BASE: "ci-only-secret-key-base-not-used-for-anything-sensitive-000000000000"
+
+steps:
+  - name: "Build docs release"
+    command: |
+      set -eu
+      mkdir -p /etc/ssl/certs
+      ln -sf "$(ls /nix/store/*-nss-cacert-*/etc/ssl/certs/ca-bundle.crt | head -n1)" /etc/ssl/certs/ca-certificates.crt
+      export SSL_CERT_FILE=/etc/ssl/certs/ca-certificates.crt
+
+      OTP="$(erl -noshell -eval 'io:format("~s",[erlang:system_info(otp_release)]),halt().')"
+      curl -fsSL --cacert "$SSL_CERT_FILE" -o /tmp/elixir.zip \
+        "https://github.com/elixir-lang/elixir/releases/download/v1.20.1/elixir-otp-${OTP}.zip"
+      mkdir -p .elixir && unzip -q -o /tmp/elixir.zip -d .elixir
+      export PATH="$PWD/.elixir/bin:$PATH"
+      mix local.hex --force && mix local.rebar --force
+      mix deps.get --only docs
+      (cd assets && npm install --no-audit --no-fund)
+      mix assets.build
+      mix compile
+      mix release shadix_docs
+
+  - name: "Boot release + run Playwright e2e suite"
+    command: |
+      set -eu
+      # Fonts for headless Chromium (minimal image ships none -> zero-height text).
+      FONT_SRC="$(ls -d /nix/store/*-dejavu-fonts-*/share/fonts 2>/dev/null | head -n1)"
+      mkdir -p "$HOME/.fonts" "$HOME/.cache/fontconfig" "$HOME/.config/fontconfig"
+      [ -n "$FONT_SRC" ] && cp -Lr "$FONT_SRC"/. "$HOME/.fonts"/ 2>/dev/null || true
+      printf '<?xml version="1.0"?>\n<!DOCTYPE fontconfig SYSTEM "fonts.dtd">\n<fontconfig>\n<dir>%s/.fonts</dir>\n<cachedir>%s/.cache/fontconfig</cachedir>\n</fontconfig>\n' "$HOME" "$HOME" > "$HOME/.config/fontconfig/fonts.conf"
+      export FONTCONFIG_FILE="$HOME/.config/fontconfig/fonts.conf"
+      fc-cache -f || true
+
+      # Boot the production release in the background.
+      ./_build/docs/rel/shadix_docs/bin/shadix_docs start &
+      # Wait for the server to answer on :8080.
+      for i in $(seq 1 60); do
+        if curl -fsS "http://localhost:8080/" >/dev/null 2>&1; then echo "server up"; break; fi
+        [ "$i" = "60" ] && { echo "server did not start"; exit 1; }
+        sleep 1
+      done
+
+      export CHROMIUM_BIN="$(command -v chromium)"
+      cd test/e2e
+      npm ci --no-audit --no-fund
+      npm test

--
tangled.sh