everyhexcode 0.0.0-stage → 0.1.0

package/LICENSE.md

@@ -0,0 +1,135 @@
+# Functional Source License, Version 1.1, ALv2 Future License
+
+## Abbreviation
+
+FSL-1.1-ALv2
+
+## Notice
+
+Copyright 2026 Moltke Benjaminsen ApS
+
+## Terms and Conditions
+
+### Licensor ("We")
+
+The party offering the Software under these Terms and Conditions.
+
+### The Software
+
+The "Software" is each version of the software that we make available under
+these Terms and Conditions, as indicated by our inclusion of these Terms and
+Conditions with the Software.
+
+### License Grant
+
+Subject to your compliance with this License Grant and the Patents,
+Redistribution and Trademark clauses below, we hereby grant you the right to
+use, copy, modify, create derivative works, publicly perform, publicly display
+and redistribute the Software for any Permitted Purpose identified below.
+
+### Permitted Purpose
+
+A Permitted Purpose is any purpose other than a Competing Use. A Competing Use
+means making the Software available to others in a commercial product or
+service that:
+
+1. substitutes for the Software;
+
+2. substitutes for any other product or service we offer using the Software
+   that exists as of the date we make the Software available; or
+
+3. offers the same or substantially similar functionality as the Software.
+
+Permitted Purposes specifically include using the Software:
+
+1. for your internal use and access;
+
+2. for non-commercial education;
+
+3. for non-commercial research; and
+
+4. in connection with professional services that you provide to a licensee
+   using the Software in accordance with these Terms and Conditions.
+
+### Patents
+
+To the extent your use for a Permitted Purpose would necessarily infringe our
+patents, the license grant above includes a license under our patents. If you
+make a claim against any party that the Software infringes or contributes to
+the infringement of any patent, then your patent license to the Software ends
+immediately.
+
+### Redistribution
+
+The Terms and Conditions apply to all copies, modifications and derivatives of
+the Software.
+
+If you redistribute any copies, modifications or derivatives of the Software,
+you must include a copy of or a link to these Terms and Conditions and not
+remove any copyright notices provided in or with the Software.
+
+### Disclaimer
+
+THE SOFTWARE IS PROVIDED "AS IS" AND WITHOUT WARRANTIES OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING WITHOUT LIMITATION WARRANTIES OF FITNESS FOR A PARTICULAR
+PURPOSE, MERCHANTABILITY, TITLE OR NON-INFRINGEMENT.
+
+IN NO EVENT WILL WE HAVE ANY LIABILITY TO YOU ARISING OUT OF OR RELATED TO THE
+SOFTWARE, INCLUDING INDIRECT, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES,
+EVEN IF WE HAVE BEEN INFORMED OF THEIR POSSIBILITY IN ADVANCE.
+
+### Trademarks
+
+Except for displaying the License Details and identifying us as the origin of
+the Software, you have no right under these Terms and Conditions to use our
+trademarks, trade names, service marks or product names.
+
+## Grant of Future License
+
+We hereby irrevocably grant you an additional license to use the Software under
+the Apache License, Version 2.0 that is effective on the second anniversary of
+the date we make the Software available. On or after that date, you may use the
+Software under the Apache License, Version 2.0, in which case the following
+will apply:
+
+Licensed under the Apache License, Version 2.0 (the "License"); you may not use
+this file except in compliance with the License.
+
+You may obtain a copy of the License at
+
+http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software distributed
+under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR
+CONDITIONS OF ANY KIND, either express or implied. See the License for the
+specific language governing permissions and limitations under the License.
+
+---
+
+## Third-party notices
+
+The bundled `dist/everyhexcode.js` includes culori (https://culori.js.org), under the MIT License:
+
+```
+MIT License
+
+Copyright (c) 2018 Dan Burzo
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+```

package/README.md

@@ -1,3 +1,100 @@
-# Temporary Holding Version
+# everyhexcode
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+Check the colors in your code the way people will see them. `everyhexcode` reads your CSS, SCSS, Less, Tailwind config or design tokens, works out which colors are text and which are backgrounds, and checks every pair that meets against WCAG 2, in light and dark mode. It flags status and chart colors that look alike with color blindness, and gives you the nearest passing colors as a diff of your own files.
+
+It runs on your machine and in your own CI. Nothing is uploaded. The engine is the same one behind the [color checker on everyhexcode.com](https://everyhexcode.com/color-checker).
+
+```
+$ npx everyhexcode check src/styles
+src/styles/globals.css (css, 39 colors, light and dark)
+  ✗ --muted-foreground on --muted [light]: 2.7:1, needs 4.5:1 (text)  src/styles/globals.css:11
+      fix: --muted-foreground → #6f6f77
+  ✗ --muted-foreground on --background [light]: 2.97:1, needs 4.5:1 (text)  src/styles/globals.css:11
+      fix: --muted-foreground → #6f6f77
+  …
+  24 pass, 12 fail against WCAG 2 AA
+```
+
+## What it reads
+
+| Input | How pairs are found |
+|---|---|
+| CSS custom properties, including shadcn/ui's bare `hsl` numbers, `var()` chains, `.dark`, `[data-theme=dark]` and `prefers-color-scheme` blocks | By name: `--primary-foreground` on `--primary`, `--foreground` on `--background`, `--input` and `--ring` as input borders (3:1) |
+| CSS rules | A rule that sets `color` and `background` is checked as written; `color` alone is checked on the page background; `border-color` on inputs and buttons needs 3:1 |
+| SCSS `$vars`, Less `@vars` | By name, like custom properties |
+| `tailwind.config.js` / `.ts`, Tailwind v4 `@theme` | The colors under `colors`, by name |
+| Design tokens: W3C DTCG (`$value`, `{aliases}`), Style Dictionary, Figma variables exports | By name, aliases resolved, a `light` or `dark` level in the path read as the mode |
+| A rendered page (`scan`) | Every visible text and the color actually behind it, in your own headless Chrome |
+
+Stylesheets given together are read as one cascade, so a variable set in `tokens.css` resolves where `button.css` uses it.
+
+## Commands
+
+```
+everyhexcode check [files or folders...]   # default: the current folder
+everyhexcode fix [files...] --write        # write the nearest passing colors back, in the same format (hex stays hex, hsl stays hsl)
+everyhexcode scan http://localhost:3000    # load the page in headless Chrome, light and dark, and check what it draws
+```
+
+Options: `--target AA|AAA`, `--format text|json|sarif|markdown|github`, `--out <file>`, `--sarif <file>`, `--lock <names>` (colors the fix must not change, such as your brand color), `--fail-on fail|warn|none`, `--config <file>`, `--verbose`, `--chrome <path>`, `--width <px>`.
+
+Exit codes: `0` all pass, `1` a pair fails, `2` a usage or read error.
+
+### How fixes are chosen
+
+Each fix keeps the color's hue and chroma and moves only its lightness, in OKLCH. The checker picks the one color whose move fixes the most failing pairs with the smallest visible change (ΔE in OKLab), repeats until everything passes, and never breaks a pair that already passes. Text colors move before backgrounds, brand and accent colors last. `--lock` keeps any color where it is.
+
+### The rendered scan
+
+`scan` starts your installed Chrome, Chromium or Edge headless, with a temporary profile it deletes afterwards. For every visible text it takes the backgrounds under the text's own spot, composites translucent layers, and where an image or gradient is behind the text, it hides the text, photographs the box and takes the worst tenth of what is behind it. It uses chrome-headless-shell when one is installed (`npx @puppeteer/browsers install chrome-headless-shell@stable`, into the current folder or Puppeteer's cache), else your Chrome, Chromium or Edge; `CHROME_PATH` or `--chrome` picks one. Use the shell for heavy pages: in our tests full headless Chrome stalled on stripe.com, where the shell read 600 texts in 15 s. A page that stops answering gives a partial result with a note (`--timeout`, default 150 s), and a site that blocks automated browsers (nytimes.com) is reported as having nothing to read. The GitHub Action installs the shell by itself when you give it `url:`. It needs Node 22 or newer (Node 20 with `--experimental-websocket`).
+
+## Settings: `colorcheck.json`
+
+```json
+{
+  "files": ["src/styles", "tokens/*.json"],
+  "target": "AA",
+  "lock": ["--brand"],
+  "roles": { "--muted": "bg", "--highlight": "text" },
+  "pairs": [["--link", "--card", "text"]],
+  "ignore": ["--decorative-gradient-stop"],
+  "failOn": "fail"
+}
+```
+
+Roles are `bg`, `text`, `accent`, `border` (decoration, no minimum), `control` (input borders and focus rings, 3:1), `chart` (3:1) and `ignore`.
+
+## GitHub Action
+
+```yaml
+name: Colors
+on: [pull_request]
+jobs:
+  check:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      security-events: write   # only for the SARIF upload
+    steps:
+      - uses: actions/checkout@v4
+      - uses: Benjaminsen/everyhexcode-cli@v0
+        with:
+          files: src/styles tokens
+          sarif: colors.sarif
+      - if: always()
+        uses: github/codeql-action/upload-sarif@v3
+        with:
+          sarif_file: colors.sarif
+```
+
+Failing pairs show as annotations on the lines that set the color, and a summary table with the fixes lands on the job page. To check a running preview as drawn, pass `url:`. The job runs on your own runners; nothing is sent to a server.
+
+## What it does not do
+
+- APCA is not included in this package. Its licence covers web content under the W3C's agreement; the [APCA contrast checker](https://everyhexcode.com/apca-contrast-checker) on the site shows it as an advisory value.
+- It checks colors only, not other accessibility criteria such as alt text or keyboard use.
+- A static check cannot see colors set by scripts or text over images; use `scan` for those.
+
+## Licence
+
+[Functional Source License 1.1, ALv2 future licence](LICENSE.md) (FSL-1.1-ALv2): free to use, change and run for your own projects and your company's, including in CI. What it does not allow is offering it as a competing product or service. Each version becomes Apache 2.0 two years after its release. Copyright 2026 Moltke Benjaminsen ApS.

package/action.yml

@@ -0,0 +1,91 @@
+name: Every Hex Code color check
+description: Check the colors in your CSS, Tailwind config and design tokens against WCAG 2 contrast and color blindness, with the nearest passing colors.
+author: Moltke Benjaminsen ApS
+branding:
+  icon: droplet
+  color: blue
+inputs:
+  files:
+    description: Files, folders or globs to check, separated by spaces. Default the "files" in colorcheck.json, else the whole repository.
+    required: false
+    default: ''
+  target:
+    description: WCAG 2 level, AA or AAA. Default the "target" in colorcheck.json, else AA.
+    required: false
+    default: ''
+  url:
+    description: Optional. A page to load in headless Chrome and check as it is drawn, such as a preview deployment or a local server started earlier in the job.
+    required: false
+    default: ''
+  fail-on:
+    description: fail (failing pairs fail the step), warn (look-alike colors too) or none. Default the "failOn" in colorcheck.json, else fail.
+    required: false
+    default: ''
+  config:
+    description: Settings file. Default colorcheck.json when it exists.
+    required: false
+    default: ''
+  lock:
+    description: Comma-separated names or hex codes the suggested fixes must not change.
+    required: false
+    default: ''
+  sarif:
+    description: Also write SARIF to this file, for github/codeql-action/upload-sarif.
+    required: false
+    default: ''
+outputs:
+  exit-code:
+    description: 0 when everything passes, 1 when a pair fails, 2 on a usage or read error.
+    value: ${{ steps.check.outputs.exit-code }}
+runs:
+  using: composite
+  steps:
+    - id: node
+      shell: bash
+      run: echo "major=$(node -p 'process.versions.node.split(".")[0]' 2>/dev/null || echo 0)" >> "$GITHUB_OUTPUT"
+    - if: steps.node.outputs.major < 20
+      uses: actions/setup-node@v4
+      with:
+        node-version: 22
+    - id: check
+      shell: bash
+      env:
+        INPUT_FILES: ${{ inputs.files }}
+        INPUT_TARGET: ${{ inputs.target }}
+        INPUT_URL: ${{ inputs.url }}
+        INPUT_FAIL_ON: ${{ inputs.fail-on }}
+        INPUT_CONFIG: ${{ inputs.config }}
+        INPUT_LOCK: ${{ inputs.lock }}
+        INPUT_SARIF: ${{ inputs.sarif }}
+      run: |
+        set +e
+        CLI="$GITHUB_ACTION_PATH/dist/everyhexcode.js"
+        FLAGS=""
+        [ "$(node -p 'process.versions.node.split(".")[0]')" -lt 22 ] && FLAGS="--experimental-websocket"
+        # an input left empty leaves the setting to colorcheck.json (and the CLI's own default)
+        COMMON=()
+        [ -n "$INPUT_TARGET" ] && COMMON+=(--target "$INPUT_TARGET")
+        [ -n "$INPUT_FAIL_ON" ] && COMMON+=(--fail-on "$INPUT_FAIL_ON")
+        ARGS=("${COMMON[@]}" --format github)
+        [ -n "$INPUT_CONFIG" ] && ARGS+=(--config "$INPUT_CONFIG")
+        [ -n "$INPUT_LOCK" ] && ARGS+=(--lock "$INPUT_LOCK")
+        [ -n "$INPUT_SARIF" ] && ARGS+=(--sarif "$INPUT_SARIF")
+        read -r -a FILES <<< "$INPUT_FILES"
+        node $FLAGS "$CLI" check "${FILES[@]}" "${ARGS[@]}"
+        code=$?
+        if [ -n "$INPUT_URL" ] && [ -z "$CHROME_PATH" ]; then
+          # chrome-headless-shell scans heavy pages that full headless Chrome can stall on
+          SHELL_OUT=$(npx -y @puppeteer/browsers install chrome-headless-shell@stable --path "$RUNNER_TEMP/ehc-chrome" 2>/dev/null | tail -1)
+          CHROME_PATH="${SHELL_OUT##* }"; export CHROME_PATH
+          [ -x "$CHROME_PATH" ] || unset CHROME_PATH
+        fi
+        if [ -n "$INPUT_URL" ]; then
+          SCAN=("${COMMON[@]}" --format github)
+          [ -n "$INPUT_CONFIG" ] && SCAN+=(--config "$INPUT_CONFIG")
+          [ -n "$INPUT_SARIF" ] && SCAN+=(--sarif "${INPUT_SARIF%.sarif}-page.sarif")
+          node $FLAGS "$CLI" scan "$INPUT_URL" "${SCAN[@]}"
+          c2=$?
+          [ "$c2" -gt "$code" ] && code=$c2
+        fi
+        echo "exit-code=$code" >> "$GITHUB_OUTPUT"
+        exit $code