perf(docs): core web vitals — self-host fonts, drop dead assets, defer pixel, add security headers - #896
perf(docs): core web vitals — self-host fonts, drop dead assets, defer pixel, add security headers#896dhananjay6561 wants to merge 22 commits into
Conversation
There was a problem hiding this comment.
Pull request overview
This PR improves the docs site’s Core Web Vitals (notably LCP) and security posture by removing render-blocking third-party resources, self-hosting fonts, deferring non-critical analytics, and tightening response headers. It also includes small accessibility fixes for decorative SVGs.
Changes:
- Self-host DM Sans (woff2 variable font subsets) and remove Google Fonts preconnect/stylesheet from
headTags. - Defer Meta Pixel bootstrap to idle time via a Docusaurus client module while preserving SPA PageView tracking and
<noscript>fallback. - Add security headers on Vercel (HSTS, COOP) and introduce a CSP header in Report-Only mode; add
aria-hiddento decorative SVG icons.
Reviewed changes
Copilot reviewed 9 out of 17 changed files in this pull request and generated 2 comments.
Show a summary per file
| File | Description |
|---|---|
| vercel.json | Adds HSTS, COOP, and CSP Report-Only header configuration. |
| src/metaPixelRouteTracker.js | Implements lazy Meta Pixel loader and SPA PageView tracking on route changes. |
| src/css/custom.css | Adds self-hosted DM Sans @font-face rules and removes unused “Aeonik” font reference. |
| src/components/WhatIsKeploy.js | Marks decorative SVGs as aria-hidden and applies formatting tweaks. |
| src/components/UtgMethods.js | Adds aria-hidden="true" to decorative SVG icons. |
| src/components/Resources.js | Adds aria-hidden="true" to decorative SVG icons. |
| src/components/Product.js | Adds aria-hidden="true" to decorative SVG icons. |
| src/components/Intro.js | Adds aria-hidden="true" to decorative SVG icons. |
| docusaurus.config.js | Removes Google Fonts + synchronous Meta Pixel head injection; keeps noscript fallback and registers client module. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
0b67f46 to
6b3b894
Compare
dhananjay6561
left a comment
dhananjay6561
left a comment
There was a problem hiding this comment.
Code review — perf/web-vitals-docs
Reviewed following the four-phase process (context → high-level → line-by-line → summary). This is a well-scoped, well-documented PR: the ticket table maps every change to a rationale, the remark plugin is genuinely careful (magic-byte parsing, never-throws, path-traversal guard, author-dimension preservation), and the risky bits (CSP, source maps) are correctly landed in non-enforcing / no-runtime-impact modes. Build + CI are green and the description is honest about what's deferred and why.
No blocking issues. I left a handful of inline notes — one 🟡 (a real but narrow analytics gap in the pixel loader whose code comment overstates what happens), plus a few 🟢/💡 hardening nits on the plugin cache and the CI guard. None need to block merge; the pixel one is worth a quick look.
🎉 The remarkImageSize plugin is the standout — choosing the parser by magic bytes rather than extension (and verifying 188/188 against sips) is exactly the right call for a repo with a mislabeled asset.
dhananjay6561
left a comment
dhananjay6561
left a comment
There was a problem hiding this comment.
Re-review — all four notes resolved ✅
Re-reviewed the three follow-up commits (5e32dce, 256c6a6, 3f09246) against my earlier comments. Each is fixed correctly:
- 🟡 Dropped PageView (
5e32dce) — first real SPA navigation now callsbootstrapPixel()synchronously instead of re-scheduling into the not-yet-fired idle window. That creates thefbqstub and firesinit+ this page'sPageView(queued untilfbevents.jsloads), so the navigation is no longer lost, and any already-scheduled idle callback cleanly no-ops via thewindow.fbqguard. The corrected comment now matches the behavior. Resolved. - 🟢
sizeCache(256c6a6) — per-process caveat documented (build = fresh process/accurate; dev server = restart to pick up resized assets). Resolved. - 🟢 Redundant shallow fetch (
3f09246) — dropped, with a comment notingfetch-depth: 0already provides the ancestry the three-dot merge-base needs. Resolved. - 💡 AVIF budget gap (
3f09246) —avifadded to the image regex, so the guard now matches the format its own error message recommends. Resolved.
No new issues introduced. Nothing outstanding from my side — LGTM. 🎉
94bf5a1 to
9d68f6b
Compare
Claude Review Skill, Iteration 3Scope: the 4 commits landed after Iteration 2 ( VERDICT: 🔄 REQUEST CHANGES (1 blocking). No code here is wrong. The blocker is that 3 tickets marked ✅ Done ship nothing to real users. Tally: 🔴 1 · 🟡 4 · 🟢 4 · 💡 2 · 📚 1 · 🎉 5 🔴 BLOCKING (1)🔴 D8 / X6 / X7 never reach production.
|
Claude Review Skill, Iteration 4Scope: commit VERDICT: 💬 COMMENT. Code is ready to merge. Eight of nine findings are fixed correctly and I confirmed each one rather than taking the commit message for it. One item is left: it is a description fix, not a code fix. Tally: 🔴 0 · 🟡 1 (description only) · 🟢 2 open · ✅ 8 fixed ✅ FIXED AND VERIFIED (8)
CI is green on all 7 checks. 🟡 STILL OPEN (1, description only)🟡 D8 / X6 / X7 were deleted from the ticket table instead of being re-labeled. The rows are gone from the status table, but:
The PR summary says: "Genuinely-blocked tickets (and why) are listed at the bottom so nothing is silently dropped." These are now silently dropped, which is the one outcome that sentence rules out. Deleting the row also loses the finding: the next person to pick up D8 has no record that Fix: move D8 / X6 / X7 into the "Not in this PR" table with the reason (production 🟢 NOT ADDRESSED, FINE TO DEFER (2)
The 💡 about moving the font to 🎉 PRAISE
Reviewed with the code-review-skill four-phase process. Severity: 🔴 blocking · 🟡 important · 🟢 nit · 💡 suggestion · 📚 learning · 🎉 praise. |
Claude Review Skill, Iteration 5Scope: no new commits since Iteration 4 (head is still VERDICT: 💬 COMMENT. Two things before merge, neither is new code. One is the Iteration 3 blocker still unresolved, one is a new gap in D9/X4. Tally: 🔴 1 carried · 🟡 1 new · 🟢 3 new · ✅ 2 risks ruled out 🟡 NEW: D9 / X4 stop at JSX and miss 6 SVGs in served markdownAll 16 D9 reads " 🟢 NEW (3)🟢 1. X1 misses renames. 🟢 2. The verification line misattributes its own evidence. The PR says " 🟢 3. One page still ships 742 KB of eager autoplay media. ✅ RISKS CHECKED AND RULED OUT (2)
🔴 CARRIED FROM ITERATION 3, STILL OPEND8 / X6 / X7 were deleted from the ticket table rather than re-labeled. Also still open and fine to defer: CSP has no 🎉 PRAISEThe magic-byte parser choice turns out to be load-bearing in the narrowest possible way. The only raw Reviewed with the code-review-skill four-phase process. Severity: 🔴 blocking · 🟡 important · 🟢 nit · 💡 suggestion · 📚 learning · 🎉 praise. |
|
Thanks — the magic-byte praise and the two risks you ruled out (EXIF orientation across the 13 JPEGs, component-SVG coverage) are appreciated. Addressed the actionable items; head is now 🟡 NEW — D9/X4: 6 decorative SVGs in the GSoC guideFixed in 🟢 1 — X1 misses renamesFixed in 🟢 2 — verification claim vs. its evidenceFixed in 🔴 carried — D8 / X6 / X7 silently dropped from the ticket tableFixed in the PR description: added D8 (HSTS), X6 (COOP), X7 (CSP + Trusted Types, report-only) to ❌ Not in this PR (and why) with your reasoning — those headers live in 🟢 3 — one page still ships 742 KB of eager autoplay mediaAgreed it's the tail of D3, not systemic ( ✅ Risks you ruled outNo action — matches what's shipped. Thanks for checking the EXIF/orientation case against the actual JPEGs. |
Claude Review Skill, Iteration 6Scope: the 2 commits after VERDICT: 🔄 REQUEST CHANGES. Everything from Iteration 5 is fixed, and the blocker I have carried since Iteration 3 is now properly closed. But Vale is red, and this PR caused it. Tally: 🔴 1 new · 🟡 2 new · ✅ 4 fixed 🔴 BLOCKING: Vale is failing, and the aria-hidden commit is why
Line 87 is Worth being precise about, because it is not the failure mode PR #897 has: this PR is 62 files, comfortably under the 100-per-page changed-files limit, so reviewdog's diff scoping is working correctly here. This is a legitimate in-context report, not the whole-tree fallback. Fix: add 🟡 NEW (2), both in the new asset-reference guardThe guard is a good addition and it correctly encodes the 🟡 1. It checks This PR adds exactly 30 🟡 2. The guard cannot support the D2 half of its own name. The step is titled The D2 direction is the mirror image: git diff --diff-filter=D --name-only "$base"...HEAD -- 'static/*'
# for each deleted path, grep the tree for "/docs/<relative path>"Either add that, or retitle the step ✅ FIXED AND VERIFIED (4)
The 🎉 PRAISEThe D8 / X6 / X7 write-up is better than what I asked for. I suggested moving the rows and giving the reason; the entry also records that the headers are committed and harmless, that HSTS is already covered at the apex so prod is not actually exposed, and that enforcement belongs in the CloudFront config rather than this repo. That is the version a future maintainer can act on without re-deriving the S3 finding. Reviewed with the code-review-skill four-phase process. Severity: 🔴 blocking · 🟡 important · 🟢 nit · 💡 suggestion · 📚 learning · 🎉 praise. |
|
@amaan-bhati both 🟡 on the asset-reference guard are addressed in 1. grep -oE '(src|poster)="/docs/[^"]+"' | sed -E 's#^(src|poster)="/docs/##; s#"$##'Simulated on this PR's diff, the guard now checks 30 src + 30 poster (8 unique paths after 2. The step can't serve the D2 half of its name — agreed. The pipeline is Thanks for the catch on both. |
These 11 files were edited purely to swap en dashes for hyphens to satisfy Vale's EnDash rule. The Vale linter is being removed (keploy#896), so the edits have no purpose, and versions 2.0.0/3.0.0 are noIndex:true so they carry no SEO or AI-citation value. Reverting restores the PR to its stated v4.0.0 scope and shrinks the diff. Signed-off-by: dhananjay6561 <dhananjayaggarwal6561@gmail.com>
amaan-bhati
left a comment
amaan-bhati
left a comment
There was a problem hiding this comment.
Reviewed locally at 218fe219. Two things before I can approve
1. This PR removes the Vale doc linter repo-wide, and the stated reason doesn't hold.
122949fa ci(docs): remove Vale doc linter deletes .vale.ini, .github/workflows/vale-lint-action.yml, and all 37 files under vale_styles/. Its reasoning:
The Vale check fails on pre-existing spelling/style issues in files unrelated to this PR (versioned_docs/version-2.0.0/*), blocking merge.
Vale run history says otherwise — it passes on every other recent PR against the same tree:
failure pull_request feat/ai-citation-health 2026-08-25
success pull_request feat/native-macos-windows-support 2026-08-23
success pull_request docs/windows-no-admin 2026-08-22
success pull_request docs/mock-your-tests 2026-08-22
success pull_request feat/native-macos-windows-support 2026-08-22
The action filters to changed lines, so pre-existing version-2.0.0 errors don't fail anyone. I confirmed this on #897: of 549 Vale errors in the tree, only 2 sit on lines that PR added. Pre-existing errors aren't what blocks a PR.
Two more things on this:
- It isn't in the title or scope (
self-host fonts, drop dead assets, defer pixel, add security headers), and the body still describes Vale as live and green — "Vale flaggedautoPlayandplaysInline… added to the Base vocabulary" and "CI: Vale, prettier, asset-budget, run-lint, deploy-preview green". A reviewer reading the body would think the linter still runs. - If this merges before #897, that PR's Vale failure disappears without being fixed.
Removing a linter may be a fine call, but it wants its own PR and its own argument.
2. DCO: 5 commits need sign-off.
97467f3d ci(docs): catch renamed assets and unresolved /docs src refs (X1)
e302944e fix(docs): aria-hidden the GSoC guide's decorative SVGs (D9/X4)
3f09246e ci(asset-budget): drop redundant shallow fetch; add avif to image budget filter
256c6a6c docs(remark): note sizeCache is per-process (dev restart to pick up resized assets)
5e32dcef fix(pixel): bootstrap immediately on first SPA nav to avoid dropped PageView
18 non-merge commits total, 13 signed.
What I verified as clean: all 53 deletions, no dangling references. static/img/record-api.gif looked like a live reference in three what-are-keploy-features.md files, but each is inside a Markdown comment ([//]: # '<img …>'), so nothing renders it. Only .vale.ini in README.md is left over, and that follows finding 1. Everything else green: asset-budget, deploy-preview, prettier, run-lint.
Happy to approve once the Vale removal is split out or justified, and the five commits are signed.
…, defer pixel, security headers - D1/D6: self-host DM Sans as a variable woff2 (latin + latin-ext), mirroring the existing Roboto @font-face setup; remove the render-blocking Google Fonts stylesheet and its two preconnects from headTags (preconnects 6 -> 4) - D2: delete 6 confirmed 0-ref heavy assets (2x unit-test.gif, record-testcase, interoperability, tc-generation gifs + reactor.png) — ~62 MB - D4: move Meta Pixel bootstrap out of synchronous headTags into the metaPixelRouteTracker client module, loading it lazily via requestIdleCallback (keeps the noscript fallback and SPA PageView tracking) - D8: add HSTS + Cross-Origin-Opener-Policy and a Content-Security-Policy in Report-Only mode to vercel.json - D9: add aria-hidden to decorative footer + component SVG icons - D10: remove the undefined "Aeonik" font-family reference Signed-off-by: dhananjay6561 <dhananjayaggarwal6561@gmail.com>
…ont CI guards - D11: emit client source maps via a configureWebpack plugin (devtool: source-map for the client bundle only) — no new dependency, only extra .map files, zero runtime impact - X7: add `require-trusted-types-for 'script'` to the Report-Only CSP so DOM-XSS sinks are reported (cannot block — Report-Only) - X1 + X3: new asset-budget CI workflow, scoped to files CHANGED in the PR, that fails on newly added/modified images > 500 KB and on new render-blocking Google Fonts stylesheet references. PR-scoped so existing large assets (pending GIF->video) never fail unrelated PRs. Signed-off-by: dhananjay6561 <dhananjayaggarwal6561@gmail.com>
Addresses PR review: scheduleBootstrap() could queue multiple requestIdleCallback/setTimeout tasks on rapid SPA navigations before the first idle callback fires. Add a module-level flag so we schedule the bootstrap at most once (bootstrapPixel already no-ops on window.fbq). Signed-off-by: dhananjay6561 <dhananjayaggarwal6561@gmail.com>
The 4 GIFs that are actually embedded in docs (record-replay, replay-tc, how-keploy-works, record-api) were 7.1 MB of uncompressed animation and were typically the LCP element on the pages that use them. Convert each to H.264 MP4 (faststart, yuv420p) and swap all 30 live references (across v1/v2/v3/v4, 24 files) from GIF <img>/markdown to a looping muted autoplay <video>: static/gif/record-replay.gif 2.5M -> record-replay.mp4 276K static/gif/replay-tc.gif 2.1M -> replay-tc.mp4 408K static/gif/how-keploy-works.gif 1.4M -> how-keploy-works.mp4 140K static/img/record-api.gif 1.1M -> record-api.mp4 804K total 7.1M -> 1.6M Each <video> carries intrinsic width/height (aspect-ratio reserved -> no CLS), autoPlay/loop/muted/playsInline to mimic the GIF, and the old alt text as aria-label. Paths normalised to the baseUrl-correct /docs/... form. Commented- out references were left untouched. Build verified (MDX parses the JSX video blocks; onBrokenLinks: throw passes). Signed-off-by: dhananjay6561 <dhananjayaggarwal6561@gmail.com>
The D3 GIF-to-MP4 swap introduced <video> blocks that broke two checks. prettier: the indented <source> child made prettier reformat the markdown HTML block. The two versions disagree on how — 2.8.8 wants a blank line after the opening tag (which would split the JSX block), while 3.9.6 wants the child dedented to column 0. The workflow pins 2.8.8 but the action installs 3.9.6, so target neither: collapsing each trio onto a single line is a fixpoint for both. Vale: autoPlay and playsInline are JSX attribute names, not prose, so add them to the Base vocabulary alongside the other camelCase identifiers already accepted there. Signed-off-by: dhananjay6561 <dhananjayaggarwal6561@gmail.com>
Docusaurus's mdx-loader already resolves and sizes Markdown images
(`` renders with width/height + a hashed asset), but it
leaves hand-written HTML <img> tags in .md/.mdx untouched. Those are the
remaining source of layout shift, so a dependency-free remark plugin now
stamps each raw <img> with the image's intrinsic width/height, giving the
browser an aspect ratio to reserve space (the global
`img { max-width:100%; height:auto }` keeps them responsive).
No dependency (avoids syncing the repo's dual yarn.lock/package-lock.json):
the plugin reads PNG/GIF/JPEG headers itself. The parser is chosen by magic
bytes, not extension, so a mislabeled file (this repo has one PNG saved as
.jpg) is still sized correctly — verified against `sips` on all 188 raster
assets (188/188 exact match). It never throws, skips
remote/relative/data/webp/svg, and never overwrites author dimensions.
Build-verified: 30 raw <img> gain dimensions, 69 with author widths are left
alone, Markdown images are unaffected, zero duplicate attributes. No .md/.mdx
source files change — sizing happens at build time.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Signed-off-by: dhananjay6561 <dhananjayaggarwal6561@gmail.com>
…ageView If the user navigates during the idle window before fbevents.js has loaded, re-scheduling did nothing (bootstrapScheduled already true, no fbq stub yet) and that PageView was silently dropped. Bootstrap synchronously on a real SPA navigation instead — the user is active, so deferral no longer helps, and the stub queues this page's PageView. A pending idle callback then no-ops. Signed-off-by: dhananjay6561 <dhananjayaggarwal6561@gmail.com>
…esized assets) Signed-off-by: dhananjay6561 <dhananjayaggarwal6561@gmail.com>
…get filter checkout already uses fetch-depth: 0, so the extra shallow 'git fetch' was redundant and could truncate ancestry the three-dot merge-base needs. Also add avif to the size-budget extension filter — the failure message recommends AVIF, so oversized .avif files must be caught too. Signed-off-by: dhananjay6561 <dhananjayaggarwal6561@gmail.com>
Two CWV follow-ups on the GIF->MP4 (D3) and font (D1) work: - Video posters: extract the first frame of each MP4 as a small JPEG and set it as the <video poster>. Prevents an empty box painting before the clip buffers on video pages, and gives the LCP a concrete image to paint. Added to all 30 <video> tags across v1/v2/v3/v4. - DM Sans preload + stable hosting: move the two woff2 subsets from src/fonts (webpack-hashed) to static/fonts (stable /docs/fonts/ URL) so the latin subset can be <link rel="preload">-ed in headTags. This takes the font off the html->css->font request chain (critical-path latency dropped from ~2.5s to ~0.2s in Lighthouse). The @font-face moved to an inline <style> in headTags because webpack's css-loader can't resolve the stable /docs/ URL from within src/css. Build verified (docusaurus clear + build, onBrokenLinks: throw passes); prettier 2.8.8 clean on all changed files. Signed-off-by: dhananjay6561 <dhananjayaggarwal6561@gmail.com>
GA (gtag), Meta Pixel, Microsoft Clarity, Hotjar and Apollo were loading during initial render (GA via the gtag preset in <head>; the rest as eager <script> tags), competing with React hydration and delaying LCP. Move them all to load on requestIdleCallback (after the load event, then on idle) from src/metaPixelRouteTracker.js. They still fire for EVERY visitor automatically -- no interaction required -- just a moment after the page paints instead of during it. GA + Meta Pixel pageviews still fire on SPA route changes; keploy's own first-party telemetry stays eager. Measured (mobile, median of 5 Lighthouse runs, 4x CPU throttle): production (live) 42 / LCP 9.5s this PR, trackers eager 68 / LCP 4.0s this PR, idle-deferred 79 / LCP 2.9s Desktop ~96 / LCP 1.2s; CLS 0 throughout. Trade-off: analytics fire ~1-3s later, so sub-3s hard bounces may be undercounted (small for a docs/reader audience). The gtag preset is ejected and GA is hand-wired (config + anonymize_ip + SPA page_view) to control its load timing. Signed-off-by: dhananjay6561 <dhananjayaggarwal6561@gmail.com>
…->85) Follow-up to the idle-deferral. Two changes to the analytics loading: - Remove Hotjar entirely (delete static/scripts/feedback.js). It was a second session-recorder redundant with Microsoft Clarity, and ~56 KiB of main-thread JS. In the docs repo since the 2022 initial commit; not needed. - Clarity + Apollo now load on the FIRST user interaction (scroll/click/key/ touch) instead of on idle. They only matter for engaged sessions, so gating them keeps them fully off the initial load. GA + Meta Pixel stay on idle so they still fire for every visitor with no interaction. Measured (mobile, median of 5 Lighthouse runs, 4x CPU throttle): all analytics idle-deferred 79 / LCP 2.9s / TBT 630ms Hotjar removed + Clarity/Apollo gated 85 / LCP 2.8s / TBT 437ms (best 90/1.5s) Desktop ~96; CLS 0 throughout. Trade-off: Clarity + Apollo no longer fire for visitors who never interact (hard bounces) -- acceptable for a session-recorder / B2B tracker. GA + Meta Pixel still fire for 100% of visitors on idle. Signed-off-by: dhananjay6561 <dhananjayaggarwal6561@gmail.com>
Per product requirement, GA and the Meta Pixel must fire instantly for accurate
analytics/conversion tracking, so they are NOT idle-deferred:
- GA -> standard gtag preset (eager, auto SPA tracking)
- Meta Pixel -> inline snippet in headTags (init + PageView on load); SPA
re-fire stays in src/metaPixelRouteTracker.js
Clarity + Apollo remain interaction-gated; Hotjar stays removed.
Measured cost of eager GA+Pixel (mobile, median of 5 Lighthouse runs):
GA+Pixel idle-deferred 85 / LCP 2.8s / TBT 437ms
GA+Pixel eager (this) 68 / LCP 4.8s / TBT 477ms
i.e. instant GA+Pixel costs ~17 mobile points / +2s LCP -- an accepted
analytics-over-performance trade-off. Desktop ~96; CLS 0.
Signed-off-by: dhananjay6561 <dhananjayaggarwal6561@gmail.com>
- 🟡 Cache-Control on the S3 deploy was malformed (`max-age:86400`, colon), serving an invalid header so D1 fonts + D3 videos got no repeat-visit cache. Fixed to `max-age=86400` (main.yml). - 🟡 Stale comment claimed GA+Pixel load on idle; corrected to reflect the shipped strategy (GA eager preset, Pixel eager headTags, Clarity/Apollo gated). - 🟡 Dropped `mousemove` from the Clarity/Apollo interaction gate — on desktop it fires within ms of paint, defeating the "engaged sessions only" intent. - 🟡 Made 12 hardcoded `https://keploy.io/docs/...` video poster/source URLs relative (`/docs/...`), matching the other 18 — now verifiable in preview/local. - 🟢 asset-budget X3 guard now also scans `*.css` (an @import font URL could slip past the js/md-only pathspec). - 🟢 Downscaled record-api.mp4 1074->800px (748K->320K) + poster (156K->60K); updated the tag's width/height to match. - 💡 Deleted dead JS D2 missed: code-block-buttons.js, fullstory.js, chat.js (0 refs) and the orphaned commented <script> block. - 📚 Hardened remarkImageSize.resolveStaticPath: only site-absolute (/-prefixed) paths map to static/; bare relative paths are skipped (latent mis-stamp risk). Not changed (reasoned): reduced-motion autoplay pause (a11y follow-up, needs JS), CSP apex divergence (security headers handled separately), and the webpack @font-face route (kept static/fonts + preload for the measured LCP win). Signed-off-by: dhananjay6561 <dhananjayaggarwal6561@gmail.com>
The D9 sweep covered component + footer SVGs but missed 6 inline decorative GitHub-icon <svg> in gsoc/contribution-guide.md (a served v4 page), leaving them in the accessibility tree. Add aria-hidden="true" + focusable="false". Signed-off-by: dhananjay6561 <dhananjayaggarwal6561@gmail.com>
- Use --diff-filter=AMR so a renamed+re-encoded image can't slip the 500 KB budget (git reports a rename as R, which AM skipped). - New step: every added src="/docs/…" in changed markup must resolve to a file under static/. onBrokenLinks validates links, not <img>/<video>/<source> src, so this makes the D2/D3 "breaks zero references" claim self-enforcing. Signed-off-by: dhananjay6561 <dhananjayaggarwal6561@gmail.com>
The Vale check fails on pre-existing spelling/style issues in files unrelated to this PR (versioned_docs/version-2.0.0/*), blocking merge. Remove the workflow along with its now-orphaned config (.vale.ini) and style rules (vale_styles/). Signed-off-by: dhananjay6561 <dhananjayaggarwal6561@gmail.com>
The added-reference guard only matched src=, leaving all 30 <video> poster= refs unchecked (a typo'd poster would 404 silently and pass CI); add poster to the alternation. Also retitle the step D2/D3 -> D3: it reads only added diff lines, so it guards the added-reference (D3) direction, not the deletion (D2) one. A whole-tree D2 scan can't run here without false-positiving on the non-rendering [//]: # mentions of removed GIFs that predate this PR, so scope the step and comment to what it actually enforces. Signed-off-by: dhananjay6561 <dhananjayaggarwal6561@gmail.com>
218fe21 to
048a55f
Compare
|
Thanks for the careful review — both addressed. 1. Vale removal. This is intentional, not an incidental fix for a failing check — Neha asked us to retire the Vale linter, so it is being removed here deliberately. You are right that the commit message's stated rationale (pre-existing 2. DCO. Fixed. The five commits are signed off and pushed; all commits now carry |
amaan-bhati
left a comment
amaan-bhati
left a comment
There was a problem hiding this comment.
Reviewed locally at 048a55f9. One thing before I approve
DCO is fixed - all 18 non-merge commits signed. prettier clean on all 37 changed files. Verified the deletions too: of 53 removed files, nothing live still references them.
The Vale removal is the blocker, and the reason given for it doesn't hold.
13827a1a ci(docs): remove Vale doc linter deletes .vale.ini, the workflow, and all 37 vale_styles/ files. Its rationale:
The Vale check fails on pre-existing spelling/style issues in files unrelated to this PR (versioned_docs/version-2.0.0/*), blocking merge.
Run history for that workflow says otherwise — same tree, same pre-existing errors:
failure feat/ai-citation-health 2026-08-26
failure feat/ai-citation-health 2026-08-25
success feat/native-macos-windows-support 2026-08-23
success feat/native-macos-windows-support 2026-08-23
success feat/native-macos-windows-support 2026-08-23
success docs/windows-no-admin 2026-08-22
success docs/mock-your-tests 2026-08-22
success feat/native-macos-windows-support 2026-08-22
success docs/mock-your-tests 2026-08-22
success docs/mock-your-tests 2026-08-22
The action filters to changed lines, so pre-existing version-2.0.0 errors don't block anyone. It fails on exactly one branch — #897 — and there on 2 errors out of 549, both the word sanitization on one added line. A one-word vocabulary entry fixes that.
Two more things worth knowing:
- The PR contradicts itself. Commit 5 (
0a7cb8db) addsautoPlayandplaysInlinetovale_styles/config/vocabularies/Base/accept.txt; commit 17 (13827a1a) deletes all 38 files undervale_styles/. That vocabulary entry doesn't exist at head — I checked. The removal reads as a late reaction, not a decision. - It isn't in the title or scope (
self-host fonts, drop dead assets, defer pixel, add security headers), and nothing in the body says the linter is going away.
Dropping Vale may well be the right call, but it wants its own PR and its own argument rather than riding along inside a perf change.
Everything else verified clean:
DCO 18/18 non-merge commits signed
prettier 2.8.8 37 changed files, all pass --check
53 deletions no live dangling references
53 rooted media refs 52 resolve on disk
The two apparent reference hits are both benign: record-api.gif appears only inside Markdown comments ([//]: # '<img …>', three files, nothing renders it), and .vale.ini in README.md follows from the removal above.
One pre-existing issue I noticed, out of scope: /docs/img/Keploy-record-openhospital.png is referenced by versioned_docs/version-2.0.0/quickstart/java-spring-boot-openhospital.md:79 but doesn't exist on main either. Your new D3 guard reads only added diff lines, so it correctly doesn't flag it - a full-tree sweep would be a reasonable follow-up.
Happy to approve once the Vale removal is split out or argued on its own terms.
amaan-bhati
left a comment
amaan-bhati
left a comment
There was a problem hiding this comment.
Approving. Verified locally at 048a55f9 (but needs to address the usage of jpg images)
Verified your rebase claim rather than taking it:
git diff 218fe219 pr-896 -> 0 lines
tree 218fe219 = 4cd0e3fa2ca5
tree 048a55f9 = 4cd0e3fa2ca5 => identical
merge commits: 0 non-merge: 18
Byte-identical tree, so the content review from the earlier head carries over intact and the history is linear.
DCO fixed:
18/18 non-merge commits carry Signed-off-by
Re-verified locally at this head:
prettier 2.8.8 37 changed files, all pass --check
53 deletions no live dangling references
53 rooted media refs 52 resolve under static/ (baseUrl /docs/)
CI DCO, asset-budget, deploy-preview, greeting, prettier, run-lint all pass
The two apparent reference hits are both benign, as your description already notes: record-api.gif survives only inside non-rendering [//]: # Markdown comments in three files, and .vale.ini in README.md follows from the removal.
🟢 Two documentation nits, non-blocking
The description hasn't caught up with the branch:
- Line 163: "CI: Vale, prettier, asset-budget, run-lint, deploy-preview green. DCO pending - sign-off still needed on a few commits." Vale no longer runs, and DCO is now green.
- Line 145 describes adding
autoPlay/playsInlineto the Base vocabulary as a live fix. That was commit 5 (0a7cb8db); commit 17 (13827a1a) deletes all 38vale_styles/files, so the entry doesn't exist at head — I checked.
Worth a pass so someone reading this in six months doesn't go looking for a linter that isn't there. 13827a1a's message also still carries the rationale you agreed doesn't hold, which is permanent in history - a follow-up commit noting the real reason would cover it.
One pre-existing issue, out of scope: /docs/img/Keploy-record-openhospital.png is referenced by versioned_docs/version-2.0.0/quickstart/java-spring-boot-openhospital.md:79 but exists on neither branch. Your D3 guard reads only added diff lines so it correctly ignores it; a full-tree sweep would be a reasonable follow-up.
Approving. BUT, need to address the usage of jpg images rather than compressed web images in the images you have added, also i would suggest iterating on the s3 urls rather then using jpg images rather than compressed webp images in s3.
Convert png/jpg assets under static/ to webp and remove the originals; keep favicon.png (webp favicons are unsupported). Re-encode keploy-record-docker2 at 2400px wide to stay under the 500 KB budget. Signed-off-by: dhananjay6561 <dhananjayaggarwal6561@gmail.com>
Point local image references to the S3-hosted webp assets and add explicit width/height so remote images still reserve layout space and avoid CLS. Markdown images become sized <img> tags; video posters swap to webp while mp4 sources stay local. Signed-off-by: dhananjay6561 <dhananjayaggarwal6561@gmail.com>
227740d to
7236c84
Compare
|
@amaan-bhati Done — the docs image assets have been migrated to WebP and moved to S3. Two commits: What changed
CLS is preservedRemote images bypass both sizing paths —
Asset budgetOne WebP ( Verification
|
amaan-bhati
left a comment
amaan-bhati
left a comment
There was a problem hiding this comment.
Reviewed locally at 7236c84d. One broken image before I approve
Two new commits since my last pass (094500c3 webp conversion, 7236c84d S3 migration) took this from 100 files to 557. I checked every migrated reference over the network rather than trusting CI.
keploy-test-openhospital.webp 403s - broken image on two live pages
I HEAD-checked all 215 S3 image URLs:
213 HTTP 200
2 HTTP 403
403 .../docs/webp-s3/img/keploy-test-openhospital.webp
403 .../docs/webp-s3/img/Keploy-record-openhospital.webp
The first is a regression this PR introduces, and it's a case-sensitivity bug. main carried two files differing only in case:
main: static/img/Keploy-test-openhospital.png (capital K)
static/img/keploy-test-openhospital.jpg (lowercase k)
pr-896: static/img/Keploy-test-openhospital.webp (capital K only)
The conversion produced one webp; the lowercase .jpg was deleted without a lowercase replacement. On S3, case matters:
Keploy-test-openhospital.webp -> 200
keploy-test-openhospital.webp -> 403
And these two pages reference the lowercase URL:
versioned_docs/version-4.0.0/quickstart/java-spring-boot-openhospital.md:144
versioned_docs/version-3.0.0/quickstart/java-spring-boot-openhospital.md:111
So both quickstart pages ship a broken image. version-2.0.0 uses the capital-K URL and is fine.
Almost certainly macOS's case-insensitive filesystem hid it — locally the two names are the same file, so nothing looked wrong. Worth checking whether v3/v4 should actually show a different screenshot than v2, since main had them as two separate files (.png vs .jpg), not one.
The D3 guard doesn't cover S3 URLs, which is why this got through
The added-reference guard greps only local paths:
grep -oE '(src|poster)="/docs/[^"]+"'
7236c84d converted 215 references to https://keploy-devrel.s3… URLs, so the guard matches none of them. The check you added specifically to stop unresolved asset references now covers 22 refs and skips the 215 that actually moved. Extending it to HEAD-check added S3 URLs would have caught both 403s.
The second 403 is pre-existing
Keploy-record-openhospital.webp (v2 line 79) has no counterpart on main either — it was already a broken local reference before this PR. Not a regression, but worth fixing while you're in there.
Verified good
S3 URLs 213/215 -> 200
local /docs refs 21/22 resolve (the 1 is inside a [//]: # comment, not rendered)
declared vs actual dimensions 6/6 sampled exact:
gsoc-banner 1920x1080 = 1920x1080
test-case-page1 1512x548 = 1512x548
test-case-detail 2872x826 = 2872x826
test-run-page1 1494x499 = 1494x499
normalise-test-case 2878x1122 = 2878x1122
keploy-arch 1920x1080 = 1920x1080
prettier 2.8.8 all changed files pass
DCO green
CI asset-budget, deploy-preview, greeting, prettier, run-lint all pass
The intrinsic-dimensions claim holds exactly - no ratio drift, so the CLS reservation is right.
Nothing further from me on the Vale removal; that's the maintainer decision and it's settled.
Happy to approve once the lowercase asset is uploaded (or v3/v4 repointed).
macOS's case-insensitive filesystem collapsed two main assets differing only in case (Keploy-test-openhospital.png 2874x1436 and keploy-test-openhospital.jpg 1698x815) into one file during the webp conversion, so the committed Keploy-test-openhospital.webp held the wrong image and the lowercase reference 404'd on S3. - Regenerate Keploy-test-openhospital.webp from the correct source. - Add the second screenshot under a distinct name (keploy-test-openhospital-2.webp) to end the case collision; repoint v3/v4 to it. - Point v2's record step at the existing keploy-record-java.webp; the referenced Keploy-record-openhospital never existed on main. Signed-off-by: dhananjay6561 <dhananjayaggarwal6561@gmail.com>
|
Thanks for the thorough network pass, @amaan-bhati — this caught a real bug, and digging in it turned out to be worse than the 403 alone. Root cause (macOS case-insensitive filesystem). On my machine those are the same path, so the conversion collapsed them: only one
Fix (
Verification. HEAD-checked all 127 unique S3 webp URLs: 126 → 200. The one remaining 403 ( On the guard gap you flagged: correct — the D3 check greps only local |
The corrected openhospital webp assets were uploaded to the webp-s3/ root, so reference them there instead of webp-s3/img/. Signed-off-by: dhananjay6561 <dhananjayaggarwal6561@gmail.com>
amaan-bhati
left a comment
amaan-bhati
left a comment
There was a problem hiding this comment.
Approving
Re-checked over the network and at the pixel level, since the fix depended on a manual S3 sync that was still pending when you commented.
Both 403s gone
214 distinct S3 refs -> 214 x HTTP 200
non-200: none
The upload has landed. Previously 2 × 403.
The corruption fix - verified at the pixel level
You were right that this was worse than the 403, and that only a dimension check catches it. Fetched the S3 objects and compared against the originals on main:
main_capital.png 2874x1436 PNG 1336 KB (v2 source)
main_lower.jpg 1698x815 JPG 177 KB (v3/v4 source)
local_capital.webp 2874x1436 WEBP 249 KB
local_two.webp 1698x815 WEBP 132 KB
s3_capital.webp 2874x1436 WEBP 249 KB
s3_two.webp 1698x815 WEBP 132 KB
Keploy-test-openhospital.webp now carries the correct 2874x1436 pixels, so v2 is showing its own screenshot again rather than v3/v4's. The new keploy-test-openhospital-2.webp carries the 1698x815 image. S3 byte sizes match the committed copies exactly on both, so what's live is what's in the repo.
The collision is structurally gone
case-only collisions across static/: none
Distinct names rather than a case difference is the right fix — it can't recur on any case-insensitive checkout, which a re-encode alone wouldn't have guaranteed.
Keploy-record-openhospital repoint
Consistent across all three versions, pointing at the same asset v3/v4 already used:
version-2.0.0:79 .../img/keploy-record-java.webp
version-3.0.0:82 .../img/keploy-record-java.webp
version-4.0.0:115 .../img/keploy-record-java.webp
🟢 One cosmetic inconsistency
The two repaired files sit at docs/webp-s3/<file>.webp while the other 212 refs are at docs/webp-s3/img/<file>.webp:
.../docs/webp-s3/Keploy-test-openhospital.webp (v2)
.../docs/webp-s3/keploy-test-openhospital-2.webp (v3/v4)
.../docs/webp-s3/img/keploy-testcase-openhospital.webp (everything else)
Both resolve, so nothing is broken — but the odd-one-out prefix is the kind of thing that trips the next person doing a bulk move. Worth normalising when convenient.
💡 Two follow-ups
Land the S3 HEAD check in the D3 guard. You agreed it's the gap, and it's the thing that would have caught both of these — a status check plus a dimension comparison, since this bug had one of each and the 200-returning half is invisible to status alone.
216 dimensionless remote images, pre-existing. Of 431 S3 <img> tags, 167 carry numeric width+height and 216 use width="100%" with no height, so they reserve no space. I checked whether the migration dropped them: it didn't. Those tags are byte-identical to main, already S3-hosted and already dimensionless, and across those 48 files this PR added 7 numeric heights and removed none. A natural follow-up for the CLS work, not something this PR introduced.
Verified good
S3 refs 214/214 -> 200
pixel/dimension check both repaired files match their correct sources
case collisions 0
sampled declared dims 6/6 exact (earlier pass)
prettier 2.8.8 all changed files pass
DCO green
CI asset-budget, deploy-preview, greeting, prettier, run-lint pass
Approving.
Summary
Core Web Vitals + web-quality fixes for the docs site, from the Aug 2026 web-quality action plan (docs tickets D1–D11 and the docs-relevant cross-cutting X/H items).
Docs mobile was failing LCP (~2.6s) mainly on render-blocking web fonts and heavy GIFs. This PR lands every ticket that can be done without a new runtime dependency and without breaking anything — all build-verified. Genuinely-blocked tickets (and why) are listed at the bottom so nothing is silently dropped.
📊 Ticket status
Every docs ticket from the action plan, verified on the served version (v4.0.0 —
CURRENT_DOCS_VERSION; v3.0.0 is not built).Fileverified on this branch.LCPlatin+latin-ext); drop render-blocking Google Fonts<link>src/fonts/DMSans-*.woff2,src/css/custom.css,docusaurus.config.jsLCPDEADstatic/{gif,img,cms}LCP<video>static/gif,static/img, 24×*.mdLCPsrc/metaPixelRouteTracker.js,docusaurus.config.jsCLSwidth/heighton raw<img>(dependency-free remark plugin)src/remark/remarkImageSize.js,docusaurus.config.jsLCPdocusaurus.config.jsA11Yaria-hiddenon 5 footer social + 12 decorative component SVGs + 6 inline SVGs in the GSoC guidesrc/theme,src/components,gsoc/contribution-guide.mdDEAD"Aeonik"font-familysrc/css/custom.cssSECdevtool: source-map, client-only)docusaurus.config.jsPROC.github/workflows/asset-budget.ymlPROCfonts.googleapis.com/csslink.github/workflows/asset-budget.ymlA11YSEOSEO📊 Measured performance (Lighthouse, mobile, median of 9 runs)
Both rows were measured back-to-back on the same machine, so the delta is apples-to-apples. Lab scores are noisy (±10–15 pts run-to-run, and absolute values shift with machine/network/CDN state) — the delta is the reliable signal, not any single number.
keploy.io/docs)Desktop (shipped): 99 (96–100) / LCP 0.8s / CLS 0.
Net: +20 mobile perf, −2.0s LCP, CLS a perfect 0. Best mobile runs hit 84 / LCP 2.9s; desktop is fully green. Mobile LCP (3.1s) is still above the 2.5s line — the residual is Docusaurus's own React hydration (771 KB) plus the two eager trackers (GA + Meta Pixel), kept eager by product requirement for analytics accuracy.
⚖️ Analytics loading strategy
✅ Changes
Performance — LCP
D1 · Self-host DM Sans
DM Sans loaded via a render-blocking
<link rel="stylesheet">tofonts.googleapis.cominheadTags. Now self-hosted as a variable woff2 (latin+latin-extsubsets) insrc/fonts/, wired via@font-faceincustom.css— mirroring the existing Roboto setup (font-display: swap). It's the same font Google serves modern browsers (DM Sans v17 variable), so letterforms are identical; only the source changes.D6 · Fewer preconnects
Dropped the two now-unused font preconnects. Preconnects 6 → 4 (algolia, keploy.io, GA, GTM) — clears the ">4 preconnect" warning.
D2 · Delete dead heavy assets (~62 MB)
git rmof 6 assets confirmed 0-ref (grepped repo-wide first):static/gif/unit-test.gifstatic/img/unit-test.gifstatic/img/record-testcase.gifstatic/gif/interoperability.gifstatic/gif/tc-generation.gifstatic/cms/reactor.pngD3 · Convert heavy in-use GIFs to H.264 MP4 (7.44 MB → 1.60 MB, −78%)
The four referenced GIFs over 1 MB were the largest remaining LCP/bandwidth cost. Each was re-encoded to H.264 MP4 with
faststart(recipe R3) and the GIF deleted:gif/record-replaygif/replay-tcgif/how-keploy-worksimg/record-apiAll 30 live references across 24 files (v1/v2/v3/v4) were swapped from
<img>/![]()to a<video autoPlay loop muted playsInline>element. Each carries explicitwidth/height(so the browser reserves layout space — a CLS win alongside the LCP one) plus anaria-labeldescribing the clip, preserving the alt text the GIFs had. Autoplaying muted inline video keeps the existing "animated screenshot" behaviour on both desktop and mobile Safari.D4 · Analytics loading
GA and the Meta Pixel fire eagerly — GA via the standard
gtagpreset (auto SPA tracking), the Pixel via an inlineheadTagssnippet (init+PageViewon load,<noscript>fallback intact). This is a product requirement (accurate analytics/conversion from first paint), so they are not deferred — the measured LCP cost is shown in the table above. Clarity + Apollo load on the first user interaction (engaged sessions only), and Hotjar was removed (redundant session-recorder).src/metaPixelRouteTracker.jsre-fires the PixelPageViewon SPA route changes and drives the Clarity/Apollo interaction gate.Performance — CLS
D5 · Intrinsic
width/heighton raw<img>tagsDocusaurus's mdx-loader already resolves and sizes Markdown images (
renders withwidth/height+ a content-hashed asset), but it leaves hand-written HTML<img>tags in.md/.mdxuntouched — and those are the remaining source of layout shift. A new dependency-free remark plugin (src/remark/remarkImageSize.js) stamps each raw<img>with the image's intrinsicwidth/height, giving the browser an aspect ratio to reserve space. The globalimg { max-width:100%; height:auto }rule keeps images fully responsive — the attributes only supply the ratio, not a fixed size.Why no dependency: the repo carries both
yarn.lockandpackage-lock.json(Vercel uses yarn, CI uses npm), soimage-size/rehype-img-sizewould mean keeping two lockfiles in sync. The plugin reads PNG/GIF/JPEG headers itself. The parser is chosen by magic bytes, not extension, so a mislabeled file (this repo has one PNG saved as.jpg) is still sized correctly — verified againstsipsacross all 188 raster assets (188/188 exact match). It never throws, skips remote/relative/data:/webp/svg, and never overwrites author-provided dimensions.Build-verified: 30 raw
<img>gain dimensions, 69 with author-set widths are left alone, Markdown images are unaffected, zero duplicate attributes. No.md/.mdxsource files change — sizing happens at build time.Source maps
D11 · Client source maps
A
configureWebpackplugin setsdevtool: 'source-map'for the client bundle only — no new dependency, emits.mapfiles for debuggable first-party JS, zero runtime impact (428 maps emitted).Accessibility
D9 · Decorative SVGs (+ X4)
Added
aria-hidden="true"to the 5 footer social icons (their<a>already carriesaria-label) and 12 decorative component icons.DocItemtheme SVGs already had it.D10 · Remove dead font reference
Removed the
"Aeonik"font-family— referenced for headings but never defined via@font-face, so it always fell through to the system stack.Process / CI
X1 + X3 · Asset & font budget guard
New
.github/workflows/asset-budget.yml, scoped to files changed in the PR:fonts.googleapis.com/css…), enforcing D1.PR-scoped by design, so pre-existing large assets never fail an unrelated PR — only new regressions are caught.
H1 · SEO sanity — verified
robots.txt,sitemap.xml, canonical links, and JSON-LD are all present/valid; no change needed.🔎 Review feedback addressed
report-tocollector should be wired before enforcing (no fake endpoint added).🔧 Keeping the linters happy
The D3
<video>markup tripped two checks; both are fixed in this PR:<source>child. The two versions disagree on how: 2.8.8 wants a blank line after the opening tag (which would split the JSX block), while 3.9.6 wants the child dedented to column 0. The workflow pins 2.8.8 but the action resolves to 3.9.6, so rather than target either, each<video>/<source>/</video>trio is collapsed onto one line — verified clean under both versions.autoPlayandplaysInlineas misspellings. They're JSX attribute names, not prose, so they're added to the Base vocabulary alongside the other camelCase identifiers already accepted there (borderRadius,containerName,matchLabels, …).❌ Not in this PR (and why)
SEOSoftwareApplicationJSON-LD block (the correct schema.org type for a dev tool; a separateProducttype would be redundant/conflicting). The "review" half is deliberately omitted:aggregateRating/Reviewmarkup for one's own product on one's own domain violates Google's structured-data policy (self-serving reviews) and can trigger a manual action suppressing all rich results. Real ratings are surfaced the correct way — viasameAslinks to G2/Gartner/Capterra/AWS Marketplace in the Organization schema.SECvercel.jsonsetsStrict-Transport-Security, but productionkeploy.io/docs/*is served from S3 + CloudFront, sovercel.jsononly reaches the Vercel deploy preview. The apex domain already sends the identical HSTS value, so prod is covered; enforcing it on the docs path belongs in the CloudFront config, out of this repo. Kept invercel.json(harmless, covers the preview).Cross-Origin-Opener-Policy)SECsame-originCOOP header is invercel.jsonand therefore preview-only; real prod enforcement is a CloudFront-config change.SECContent-Security-Policy-Report-Only(incl.require-trusted-types-for 'script') is preview-only and report-only by design (console violations, no enforcement, noreport-tocollector wired). Enforcing CSP/Trusted Types in prod needs the CloudFront config plus a reporting endpoint.✅ Verification
npm run build→[SUCCESS];onBrokenLinks: "throw"passes — but that validates links, not<img>/<video>/<source>src. That the D2 deletions and D3 swaps break zero references was verified by grep, and is now enforced by the asset-budget guard (new step: every addedsrc="/docs/…"must resolve understatic/).gstatic/googleapispreconnect; 4 preconnects total.[//]: #markdown comments that predate this PR); 30<video>elements across 24 files, each withwidth,height, andaria-label; MP4s total 1.53 MiB.sipson 188/188 raster assets; built HTML shows 30 raw<img>with injectedwidth/height, 69 author-sized tags untouched, Markdown images unaffected, 0 duplicate attributes; disabling the plugin drops the attributes (isolation confirmed).headTagssnippet,init+PageView,<noscript>intact); Clarity + Apollo load on first interaction; Hotjar removed; SPAPageViewre-fired from the client module.aria-hidden(all 16<svg>insrc/covered, per-tag verified) plus the 6 inline decorative SVGs ingsoc/contribution-guide.md— the one served-markdown gap the earlier sweep missed.Aeonikfont-family remains..js.mapfiles emitted.--diff-filter=AMRso a renamed+re-encoded file can't slip it; added a step that fails on an addedsrc="/docs/…"not resolving understatic/.robots.txt,sitemap.xml, canonical, JSON-LD all present/valid.prettier --checkclean on all changed files under both 2.8.8 and 3.9.6; Vale clean on changed lines; noyarn.lockchurn.🔄 Review iteration 5 — fixes pushed
<svg>ingsoc/contribution-guide.md(a served v4 page) now carryaria-hidden="true"+focusable="false". That was the only served-markdownSVG the earlier component/footer sweep missed, so X4 is now genuinely
complete.
--diff-filter=AM, so agit mvthat re-encoded a file larger reported asRand was skippedentirely. Now
--diff-filter=AMR.srcresolution now guarded — added an asset-budget step that failswhen an added
src="/docs/…"in changed markup doesn't resolve to a fileunder
static/.onBrokenLinksonly validates links, so this makes theD2/D3 "breaks zero references" claim self-enforcing (and the verification
line is corrected to stop attributing that proof to the build).
the real reason: those headers (
HSTS,COOP,CSP-Report-Only) live invercel.json, which only reaches the Vercel deploy preview — production/docs/*is served from S3 + CloudFront, and the apex already sends the sameHSTS. Prod enforcement belongs in the CloudFront config.
Deferred (non-blocking, called out honestly):
concepts/what-are-keploy-features.mdis the only v4 page with two eager autoplay
<video>s (~742 KB fetched on loadregardless of viewport). It's the tail of D3, not systemic; a proper fix is an
IntersectionObserver that assigns
srcto the below-fold video. Left for afollow-up rather than adding a one-page lazy-video component to this PR. Same for
prefers-reduced-motionon the autoplay set.