From c079e961128282113258af69fba1c07c5c8fc786 Mon Sep 17 00:00:00 2001
From: Bindy-lbb <lbinbin1221@athom.ai>
Date: Mon, 7 Sep 2026 22:36:30 +0800
Subject: [PATCH] chore: document shipped tooling and move actions off Node 20

Two follow-ups from the tooling that merged with #3. No change to the page.

- CHANGELOG.md was missing every tooling entry. The commit that added the
  workflow, the two check scripts, the manifest and the PR template staged
  those files individually and left CHANGELOG.md out of the git add, so the
  entries never left the working tree and main documents none of what
  shipped. CONTRIBUTING.md requires changelog files to be updated alongside
  a change, so this closes that gap rather than being cosmetic.

- The workflow's actions targeted the deprecated Node 20 runtime, which
  annotated the first run and would annotate every future one. Bumped to
  the current majors: checkout v7, setup-node v7, cache v6,
  upload-artifact v7. Only inputs stable across those majors are used
  (node-version, cache, path, key, name, if-no-files-found,
  retention-days).

Verified locally before pushing: verify:contrast 44/0 exit 0,
verify:render RESULT=PASS exit 0 with 9/9 reveal blocks, verify:failclose
exit 1. CI re-verifies the action bump on this push.

Closes #4
---
 .github/workflows/verify.yml | 8 ++++----
 CHANGELOG.md                 | 6 ++++++
 2 files changed, 10 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/verify.yml b/.github/workflows/verify.yml
index bf663d7..c1d1b29 100644
--- a/.github/workflows/verify.yml
+++ b/.github/workflows/verify.yml
@@ -17,9 +17,9 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v7
         with:
           node-version: 22
           cache: npm
@@ -35,7 +35,7 @@ jobs:
           node -e "console.log('playwright-core', require('playwright-core/package.json').version)"
 
       - name: Cache browser
-        uses: actions/cache@v4
+        uses: actions/cache@v6
         with:
           path: ~/.cache/ms-playwright
           key: playwright-chromium-${{ hashFiles('package-lock.json') }}
@@ -64,7 +64,7 @@ jobs:
 
       - name: Upload section screenshots
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: section-screenshots
           path: |
diff --git a/CHANGELOG.md b/CHANGELOG.md
index a88c990..4a78d30 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -17,6 +17,12 @@
 
   带 `--self-test-failclose` 会在同一页面注入一条 console 错误和一个抛出的异常，用于证明失败路径确实以非零退出，而不只是打印。
 
+- CI（`.github/workflows/verify.yml`）：PR 与推送 main 时自动跑对比度审计与渲染检查，外加一道**守卫的守卫**——用注入错误的页面重跑渲染检查，若它居然通过则让构建失败，确保绿灯不是静默空转。三段截图作为 run artifact 上传，保留 14 天。
+- `scripts/contrast-check.js`：把对比度计算固化为脚本。token 直接从 `index.html` 解析而非在脚本里重述，因此不会与被检查的文件脱节；覆盖 22 对文字/背景 × 明暗两套共 44 项，任一项低于门槛即以非零退出。
+- `scripts/render-check.js`：渲染校验脚本，见上方 [Unreleased] 说明。
+- `package.json` + `package-lock.json`：固定验证工具链（`playwright-core` 1.62.1）。此前仓库没有 manifest，在仓库内跑 `npm install` 会装到外层目录树、`npx playwright install` 会拉到未固定的另一个包；现在 `npm ci` 从 lockfile 确定性安装。
+- `.github/PULL_REQUEST_TEMPLATE.md`：静态站点专用的轻量模板。组织级流程（issue → 分支 → PR → 独立评审 → squash）不变，但手写验证台账改为指向 CI，并保留两项 CI 判断不了的检查：事实准确性与人工过目（手机宽度、明暗两套）。
+
 ### Fixed
 
 - 手机宽度横向溢出：Runtime 轨道图的三个 Host 节点用 `left: 90%` 等绝对定位 + `white-space: nowrap`，390px 下容器仅约 334px 宽，把文档撑到比视口宽 71px（`docScrollW=461` vs `winW=390`），导致整页可以左右拖动。720px 以下改为纵向堆叠（隐藏轨道圆环、节点转为静态流式布局并允许换行），修复后 390 / 768 / 1440 三个宽度均无横向溢出。