Denozordec
7f81c304ae
Docker images / prepare-release (push) Successful in 5s
Docker images / backend-image (push) Failing after 2m40s
Docker images / frontend-image (push) Successful in 1m49s
Docker images / notify-webhook (push) Skipped
Docker images / updater-image (push) Successful in 42s
Docker images / publish-release (push) Skipped
23 lines
1.4 KiB
Markdown
23 lines
1.4 KiB
Markdown
# Quality gates (security, accessibility, scroll)
|
|
|
|
These are the **done gate**, not a nice-to-have: before you call any ReUI work finished, call the MCP `get_audit_checklist` tool and pass every item below (plus the craft bar in [craft.md](./craft.md)). Then typecheck and lint.
|
|
|
|
## Security
|
|
|
|
- Never `dangerouslySetInnerHTML`. Render data as text/components.
|
|
- External links (`target="_blank"`) must always pair `rel="noopener noreferrer"`.
|
|
- No real PII, secrets, or tokens in demo or committed code. Remote media only from sources the project already allows.
|
|
|
|
## Accessibility
|
|
|
|
- Implicit list/card items that navigate get real anchors with a standard hover affordance.
|
|
- Icon-only or numeric buttons need an `aria-label`; decorative icons get `aria-hidden`.
|
|
- Every non-submit button is `type="button"`.
|
|
- Keyboard + focus: everything interactive is reachable in a sensible Tab order with a visible focus ring; layers (dialogs/sheets/menus) trap focus and close on `Escape`. ReUI components ship standard keyboard behavior - read each component's inline `api` rather than re-implementing it.
|
|
- Announce async UI: loading and error messages use `role="status"` / `aria-live` so they're not silent to screen readers.
|
|
|
|
## Scroll mechanics
|
|
|
|
- Make scroll regions with a parent-owned height: a `min-h-0` + flex chain down to the scroll container. Never guess a `max-h`.
|
|
- The scroll container owns `overflow-auto`; ancestors stay `min-h-0` so the height resolves.
|