fix(tests): exempt hidden analytics beacons from the alt-text check - #488
Draft
g-despot wants to merge 1 commit into
Draft
fix(tests): exempt hidden analytics beacons from the alt-text check#488g-despot wants to merge 1 commit into
g-despot wants to merge 1 commit into
Conversation
The indexability suite already exempted the analytics beacon by hostname
("static.scarf.sh"). That predicate went stale when the pixel moved to our own
CNAME (pixel.weaviate.cloud), so test_images_have_alt_text started failing on
/weaviate/concepts/data-import, /cloud/quickstart and
/cloud/manage-clusters/create.
Repair the exemption structurally instead of by hostname: skip images hidden
from both rendering and the accessibility tree (inline display:none or
visibility:hidden, aria-hidden="true") and 1x1 tracking pixels. Alt text is
meaningless on an image no reader, screen reader or crawler can reach, and the
rule survives the next domain move. The scarf.sh case is kept. Content images
missing alt text are still caught.
Also mark the beacon itself as decorative in scarf.js with alt="" and
aria-hidden="true", which is the correct markup for a hidden pixel.
![orca-security-eu[bot]](https://avatars.githubusercontent.com/in/276244?s=60&v=4){kind=small}
There was a problem hiding this comment.
Orca Security Scan Summary
| Status | Check | Issues by priority | |
|---|---|---|---|
 Passed |
Infrastructure as Code |  0  0  0  0 |
View in Orca |
| Passed |
SAST | 0 0 0 0 |
View in Orca |
| Passed |
Secrets | 0 0 0 0 |
View in Orca |
| Passed |
Vulnerabilities | 0 0 0 0 |
View in Orca |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes 3
test_images_have_alt_textfailures on main: /weaviate/concepts/data-import, /cloud/quickstart, /cloud/manage-clusters/create.The suite already exempted analytics beacons, but by hostname (
static.scarf.sh). That check went stale when the beacon moved to our own CNAME (pixel.weaviate.cloud), so it began flagging a hidden 1x1 tracking pixel as a content image missing alt text.Replaces the hostname match with a structural check (display:none, visibility:hidden, aria-hidden, or 1px dimensions) so it will not go stale on the next domain change. Also sets
alt=""andaria-hiddenon the injected beacon in scarf.js, which is the WCAG-correct markup for a decorative hidden pixel.Local: the 3 target tests pass, full
-m indexabilityrun is 63 passed.Note: the scarf.js half only takes effect after deploy, since the suite reads the live site.
Draft pending the verifier gate.