tenseleyflow/shithub / a6cb1fd

Browse files

S39: Makefile — audit-a11y + load-test targets

Authored by espadonne
SHA
a6cb1fd7ccc309a411cd5c591eebaff61a16026c
Parents
bd63968
Tree
c6d7a00

1 changed file

StatusFile+-
M Makefile 17 1
Makefilemodified
@@ -2,7 +2,7 @@
22
 # Targets mirror what CI runs. The Makefile is the source of truth.
33
44
 .DEFAULT_GOAL := help
5
-.PHONY: help dev build test test-race lint lint-policy lint-markdown lint-secret-logs lint-spdx verify-api-docs fmt tidy clean ci assets install-tools version deploy deploy-check restore-drill bench-staging docs docs-serve docs-verify gen-third-party-notices
5
+.PHONY: help dev build test test-race lint lint-policy lint-markdown lint-secret-logs lint-spdx verify-api-docs fmt tidy clean ci assets install-tools version deploy deploy-check restore-drill bench-staging docs docs-serve docs-verify gen-third-party-notices audit-a11y audit-a11y-pa11y audit-a11y-axe load-test
66
77
 # Build metadata embedded into the binary via -ldflags.
88
 VERSION := $(shell git describe --tags --always --dirty 2>/dev/null || echo dev)
@@ -200,3 +200,19 @@ docs-verify: verify-api-docs ## Verify docs are in sync (API routes documented +
200200
 gen-third-party-notices: ## Regenerate THIRD_PARTY_NOTICES.md from the active go.mod.
201201
 	@scripts/gen-third-party-notices.sh > THIRD_PARTY_NOTICES.md
202202
 	@echo "gen-third-party-notices: wrote THIRD_PARTY_NOTICES.md"
203
+
204
+# --- S39 hardening ---
205
+audit-a11y-pa11y: ## pa11y-ci scan of anonymous routes (needs running shithub on 127.0.0.1:8080).
206
+	@command -v pa11y-ci >/dev/null 2>&1 || { echo "pa11y-ci not installed; npm i -g pa11y-ci"; exit 2; }
207
+	pa11y-ci --config tests/a11y/pa11y-config.json
208
+
209
+audit-a11y-axe: ## axe-core scan of authenticated routes (needs SHITHUB_USER + SHITHUB_PASS).
210
+	@command -v node >/dev/null 2>&1 || { echo "node not installed"; exit 2; }
211
+	node tests/a11y/axe-runner.js
212
+
213
+audit-a11y: audit-a11y-pa11y audit-a11y-axe ## Run both accessibility scans.
214
+
215
+load-test: ## Run a k6 scenario (set K6_SCENARIO=mixed-read|auth-mix|issue-comment-storm|search-load; default mixed-read).
216
+	@command -v k6 >/dev/null 2>&1 || { echo "k6 not installed; see https://k6.io/docs/getting-started/installation/"; exit 2; }
217
+	@if [ -z "$$BASE" ] && [ -z "$$BENCH_TARGET" ]; then echo "set BASE or BENCH_TARGET (e.g. https://staging.shithub.example)"; exit 2; fi
218
+	BASE="$${BASE:-$$BENCH_TARGET}" k6 run tests/load/k6/scenarios/$${K6_SCENARIO:-mixed-read}.js