jekyll-theme-zer0 1.23.0 → 1.25.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 73435219bd711a7e8485d895f8e07156804569313c0213be215495e994a72c6b
-  data.tar.gz: ff65b97cd663f7cacd18757aad849725c18c9e036563e72bff8185e894dd8c47
+  metadata.gz: 2ffe866835e858107f670f29086f904914d21bf1159d8c6eb3cbd138f79caf64
+  data.tar.gz: d26f27d6460136cc9f2da67da26523721b52b0e7525e0811498910215e2f29e2
 SHA512:
-  metadata.gz: 94a2e3468724372bbf8478f3615b3195a6182a0775dd4ab45be19d9b0a57cdb0af7e85d7d990faa2456cbdc66b23e58b71af7a3fa487fd9e021ffb6175f4edd3
-  data.tar.gz: 1bbacd96a15484f01b193394addcc354afb9b35364d9eedf388b0dfce1dd24dafefdc9b7fee46fb1862e5212a50bddb325e3fbe0c8c0808bc254527b2a2e86b7
+  metadata.gz: 50038606f12260b1382fceee13299e6f8a9ca0b08b00ba18e285ed88ee762fd425e853d6fde39e8c9f72f8b345f841b04b29a3e4b095a89c36f01dc4d267d036
+  data.tar.gz: e2e2764ca02d2d10250c768beb66ca7b7ba44c60b22e1852f3993f245080b5b2d3ad532245b33e394a078ae912cc60b28b33ee9fb23403194a1e75183841d925

data/CHANGELOG.md

@@ -5,6 +5,113 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [1.25.0](https://github.com/bamr87/zer0-mistakes/compare/v1.24.0...v1.25.0) (2026-07-03)
+
+
+### Features
+
+* **features:** reverse-traceability source tags — applied and enforced ([#270](https://github.com/bamr87/zer0-mistakes/issues/270)) ([f2c0c07](https://github.com/bamr87/zer0-mistakes/commit/f2c0c073c08bce62956a56b4b3e77d48a00ba309))
+* **includes:** rebuild settings offcanvas into 3 coherent tabs ([#276](https://github.com/bamr87/zer0-mistakes/issues/276)) ([6d7fa5e](https://github.com/bamr87/zer0-mistakes/commit/6d7fa5e028a540576205462cb37797f6ee11c98a))
+* **navigation:** collection-aware sidebar modes with shared resolver ([#273](https://github.com/bamr87/zer0-mistakes/issues/273)) ([104285f](https://github.com/bamr87/zer0-mistakes/commit/104285fbed2d27646549c9aa956dea5108d91f77))
+
+
+### Bug Fixes
+
+* **features:** stop ZER0-061 card from swallowing every following card ([#268](https://github.com/bamr87/zer0-mistakes/issues/268)) ([46a604d](https://github.com/bamr87/zer0-mistakes/commit/46a604d1bf4331422b382bf895aeecae928fda70))
+* **navigation:** remove redundant entries from navigation menus ([916eca2](https://github.com/bamr87/zer0-mistakes/commit/916eca269726c984c5c0c9dc9533c83d9975f906))
+* **sass:** mobile audit — contain author card, restore consent z-order, grow tap targets ([#275](https://github.com/bamr87/zer0-mistakes/issues/275)) ([8ec9867](https://github.com/bamr87/zer0-mistakes/commit/8ec9867858ff87e9b8a6fcd4a68ec7e50582c3c1))
+
+## [Unreleased]
+
+### Changed
+
+- **Settings panel rebuilt** — the navbar Settings offcanvas (`#info-section`)
+  is reorganized from four overlapping tabs (Settings / Environment /
+  Developer / Background) into three with one purpose each, guarded by the
+  new `test/visual/settings-panel.spec.js` smoke suite
+  (evidence: [`test/visual/evidence/settings-panel/`](test/visual/evidence/settings-panel/README.md)
+  — 4 tabs → 3, duplicate color-mode controls 6 → 3, dead search box
+  removed, admin links 0 → 4):
+  - **Appearance** consolidates every look-and-feel control exactly once:
+    color mode (one-click segmented control replacing the two-click
+    dropdown), theme skin, background toggle + layer opacity with inline
+    values, and the primary-color picker — now mounted *inside* the tab
+    instead of appended below the tab content where it duplicated the
+    color-mode buttons under every tab.
+  - **Site** stacks the environment card (copyable page URL via a delegated
+    `data-zer0-copy` handler — inline `onclick` handlers removed),
+    quick links, deduplicated theme & build info, and Admin quick links.
+  - **Developer** keeps page location (rendered only where breadcrumbs
+    render — no more empty heading on the homepage), page metadata, and
+    source shortcuts (dead never-initialized tooltip attributes dropped).
+  - The dead Settings-tab search box (an empty `#searchbox` no JS ever
+    bound to) is removed; the search modal remains the one search surface.
+  - Mobile tabs keep their text labels (their accessible names) at every
+    width and drop the decorative icons instead of the reverse.
+
+### Fixed
+
+- **Settings panel admin links never rendered** — the
+  `_plugins/admin_page_urls.rb` lookup powering them never ran: the
+  `github-pages` gem forces safe mode and randomizes `plugins_dir`, so local
+  `_plugins` are disabled on GitHub Pages, in CI, and in the Docker dev
+  server alike. The plugin is replaced with a pure-Liquid scan in the cached
+  `_includes/components/admin-links.html` (jekyll-include-cache is
+  whitelisted), so the Admin section now renders its existence-gated links
+  (0 → 4 on the demo site).
+
+- **Mobile responsive audit** — four defects found by driving every key route
+  and component under phone emulation (320–414px), each guarded by the new
+  `test/visual/mobile-responsive.spec.js` smoke suite
+  (evidence: [`test/visual/evidence/mobile-responsive/`](test/visual/evidence/mobile-responsive/README.md) —
+  author-card page overflow 19px → 0 on small phones; consent buttons 0
+  tap-blocked; all footer/copy tap targets ≥24px):
+  - **Author card**: a long nowrap expertise badge propagated through flexbox
+    `min-width: auto` and pushed the whole page past the viewport on ≤340px
+    phones, widening the layout viewport so the fixed navbar rendered "cut
+    off" and the page panned sideways.
+  - **Cookie consent banner**: the `.zer0-bg-body` child-elevation rule
+    flattened the banner (and the TOC FAB) to `z-index: 1`, letting the chat
+    and local-graph FABs paint over — and steal taps from — the banner's
+    Reject All / Accept All buttons on mobile. The rule now excludes
+    `.position-fixed`, restoring the `--zer0-layer-*` token order.
+  - **Footer tap targets**: text links (~19px) and icon-only social links
+    (~16px) now meet the WCAG 2.5.8 24px minimum via block padding and
+    minimum boxes — text size and visual design unchanged.
+  - **Breadcrumb tap targets**: breadcrumb links (~19px bare text) gain a
+    ≥24px tap box via block padding + matching negative margin, without
+    shifting the visual baseline.
+  - **Code-copy buttons**: grown from ~22px to ≥24px tall (32px on
+    coarse/touch pointers).
+  - **ToC / chat FAB collision**: on mobile, the table-of-contents FAB and
+    the AI-chat toggle both claimed the right-edge slot above back-to-top
+    and overlapped (ToC painting over the chat button). The chat toggle and
+    its panel now step one slot higher on pages that render the ToC FAB,
+    and the chat panel is capped to the viewport so it can't poke above
+    short tablet/landscape screens.
+
+### Added
+
+- **Mobile test tier**: `test/visual/mobile-responsive.spec.js` runs the above
+  guards plus offcanvas-menu, search-modal, and settings-panel fit/tap checks
+  under real Pixel-class emulation in the `smoke` tier; `npm run test:mobile`
+  runs just this suite. New `dismissCookieConsent` fixture pre-seeds the
+  consent choice for tests that interact with lower-screen chrome.
+
+## [1.24.0](https://github.com/bamr87/zer0-mistakes/compare/v1.23.0...v1.24.0) (2026-07-01)
+
+
+### Features
+
+* **features:** backfill PR/commit/issue provenance + render it ([#264](https://github.com/bamr87/zer0-mistakes/issues/264)) ([03b584a](https://github.com/bamr87/zer0-mistakes/commit/03b584aab91332fd0e91f48210a7455da5bc6d08))
+* **features:** document 16 reconciled features (ZER0-061..076) + governance ([#267](https://github.com/bamr87/zer0-mistakes/issues/267)) ([097e842](https://github.com/bamr87/zer0-mistakes/commit/097e842426d62189d527719d07ac609a970a3084))
+
+
+### Bug Fixes
+
+* **features:** reconcile registry with the real repo + add validation gate ([#262](https://github.com/bamr87/zer0-mistakes/issues/262)) ([786459c](https://github.com/bamr87/zer0-mistakes/commit/786459cc611bcc829cd81c971dc6cd1a4f3ba82d))
+* **security:** close two DOM-XSS sinks (CodeQL js/xss-through-dom) ([#266](https://github.com/bamr87/zer0-mistakes/issues/266)) ([812f247](https://github.com/bamr87/zer0-mistakes/commit/812f2478e0cc1989f599e32ac2171a0da449567f))
+
 ## [1.23.0](https://github.com/bamr87/zer0-mistakes/compare/v1.22.0...v1.23.0) (2026-06-30)
 
 
@@ -28,6 +135,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Bug Fixes
 
+* **features:** stop a feature card from swallowing every card after it on `/features/` — a raw `<key>` in the ZER0-061 description rendered as a stray HTML element. Fixed the description (`/authors/:key/`), escaped all `description` output on the features page and in `feature-card.html`, and added a registry-gate check that rejects raw `<`/`>` in titles/descriptions. (evidence: [`test/visual/evidence/features-card-escape/`](test/visual/evidence/features-card-escape/README.md))
 * **includes:** existence-guard component-showcase demo links — breadcrumb and list-group items now render as real links when the target page exists in the build (`/docs/`, `/docs/customization/`, `/categories/`, `/tags/`) and as plain text when absent; removes inert `href="#"` / `onclick="return false;"` workaround ([#219](https://github.com/bamr87/zer0-mistakes/issues/219)) (evidence: [`test/visual/evidence/component-showcase/`](test/visual/evidence/component-showcase/README.md))
 
 ### Tests
@@ -36,6 +144,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ### Features
 
 - **color_mode_default config knob** — new `color_mode_default` setting (`dark` | `light` | `auto`, default `auto`) in `_config.yml` controls Bootstrap's `data-bs-theme` both server-side (in `_layouts/root.html`) and client-side. An early inline script (`_includes/core/color-mode-init.html`, loaded before Bootstrap CSS) applies the correct theme before any `[data-bs-theme]` selector is evaluated, preventing FOUC. `localStorage["theme"]` (the Appearance panel override) always wins over the config default. `auto` follows `prefers-color-scheme` — backward-compatible with the previous behaviour. (evidence: [`test/visual/evidence/color-mode-default/`](test/visual/evidence/color-mode-default/README.md))
+- **feature provenance** — every entry in the feature registry (`_data/features.yml`) gained a `provenance:` block (`introduced_in` / `pr` / `commit` / `issue`) tracing the feature to the change that shipped it, surfaced on `/features/` as a `PR #N · <commit>` line on each card and a new **Provenance** column in the reference table. A registry-validation gate (`scripts/validate-features.rb`, the `features` test suite) now requires provenance on every active feature. (evidence: [`test/visual/evidence/features-provenance/`](test/visual/evidence/features-provenance/README.md))
+- **feature registry coverage** — reconciled the registry against the codebase: added 16 previously-undocumented features (ZER0-061…076 — author profiles, news/section/article layouts, theme-skins customizer, nanobar, setup wizard, table-CSV copy, share actions, archives, component showcase, and the AI-content-review / giscus-digest / evidence-gate / autonomous-pipeline / secret-scan workflows), each with provenance + a regression-test link. Every active feature now also declares a `tests:` block (`scripts/validate-features.rb` hard-enforces both provenance and tests), and the governance in [`features.instructions.md`](.github/instructions/features.instructions.md) requires them on every new entry.
 ### Bug Fixes
 
 * **search:** existence-gate search modal form action to `/sitemap/` only when that page is present in the build; falls back to `#` (safe no-op) for remote-theme Pages consumers without a `/sitemap/` stub (closes [#202](https://github.com/bamr87/zer0-mistakes/issues/202))

data/README.md

@@ -757,11 +757,11 @@ All workflows live under [`.github/workflows/`](.github/workflows/).
 
 | # | Workflow | File | Trigger | Purpose |
 |---|----------|------|---------|---------|
-| 1 | **Comprehensive CI Pipeline** | [`ci.yml`](.github/workflows/ci.yml) | push / PR / dispatch | Detect changes → fast checks → quality control → matrix test suite → integration tests → build & validate |
-| 2 | **TEST (Latest Dependencies)** | [`test-latest.yml`](.github/workflows/test-latest.yml) | daily schedule / push / PR / dispatch | Zero-pin Docker build with bleeding-edge gems; tests then promotes passing images to Docker Hub |
+| 1 | **Comprehensive CI Pipeline** | [`ci.yml`](.github/workflows/ci.yml) | push / PR / dispatch | Detect changes → quality control (incl. quick preflight) → matrix test suite → integration tests → build & validate |
+| 2 | **TEST (Latest Dependencies)** | [`test-latest.yml`](.github/workflows/test-latest.yml) | daily schedule / push / dispatch | Zero-pin Docker build with bleeding-edge gems; tests then promotes passing images to Docker Hub |
 | 3 | **Release** | [`release.yml`](.github/workflows/release.yml) | push to `main` | release-please opens a release PR from Conventional Commits; merging it tags `vX.Y.Z` and publishes the gem to [RubyGems](https://rubygems.org/gems/jekyll-theme-zer0) |
 | 4 | **Update Dependencies** | [`update-dependencies.yml`](.github/workflows/update-dependencies.yml) | weekly schedule | Refreshes `Gemfile.lock` to latest compatible versions and opens an automated PR |
-| 5 | **CodeQL Security Scanning** | [`codeql.yml`](.github/workflows/codeql.yml) | push / PR on code paths + weekly | Static security analysis across Ruby, JavaScript/TypeScript, Python, Actions, and YAML |
+| 5 | **CodeQL Security Scanning** | [`codeql.yml`](.github/workflows/codeql.yml) | push / PR on code paths + weekly | Static security analysis across Ruby, JavaScript/TypeScript, Python, and Actions |
 | 6 | **Content & Docs Review** | [`ai-content-review.yml`](.github/workflows/ai-content-review.yml) | PR on docs/content | Deterministic SEO/quality review + optional Claude agent + docs front matter, internal-link, and markdownlint checks |
 | 7 | **Convert Jupyter Notebooks** | [`convert-notebooks.yml`](.github/workflows/convert-notebooks.yml) | push to `pages/_notebooks/**.ipynb` | Auto-converts `.ipynb` → Jekyll-friendly Markdown with extracted images |
 | 8 | **Sync** | [`sync.yml`](.github/workflows/sync.yml) | push affecting `_data/backlog.yml` or `_data/roadmap.yml` | Mirrors the backlog to GitHub Issues and regenerates the README roadmap section |

data/_data/authors.yml

@@ -1,3 +1,4 @@
+# Feature: ZER0-061
 # Authors Data File
 # =================
 # Define author profiles for blog posts