From 3ce209d9fbf9c720a58b405fe0a3ab8faeb9fa4d Mon Sep 17 00:00:00 2001
From: sripwoud <me@sripwoud.xyz>
Date: Thu, 17 Sep 2026 10:59:12 +0200
Subject: [PATCH 1/2] ci: run the contrast tests on pull requests

The 14 assertions in src/styles/contrast.test.mjs had nothing running
them, so #8 merged on a local npm test rather than on a recorded check.

theme.css and tokens.css reach five sites through a git-tag pin, so a
contrast regression surfaces on auberge, dublette, colporteur, tagwerk
and pi-memsearch whenever each one's Renovate bump merges - which is
precisely when nobody is watching this repo.

The check costs three steps: no dependencies to install, no lockfile,
no registry access after checkout. setup-node's npm cache is left off
because it hashes a lockfile this package deliberately does not ship.
---
 .github/workflows/test.yml | 29 +++++++++++++++++++++++++++++
 1 file changed, 29 insertions(+)
 create mode 100644 .github/workflows/test.yml

diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
new file mode 100644
index 0000000..862bbb1
--- /dev/null
+++ b/.github/workflows/test.yml
@@ -0,0 +1,29 @@
+name: test
+
+on:
+  push:
+    branches: [master]
+  pull_request:
+  workflow_dispatch:
+
+# supersede in-flight PR runs, but never cancel a master run mid-flight
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
+permissions:
+  contents: read
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: lts/*
+
+      - run: npm test

From 78126c1b6cde53e0540d7f915d5055642e052a9b Mon Sep 17 00:00:00 2001
From: sripwoud <me@sripwoud.xyz>
Date: Thu, 17 Sep 2026 11:05:29 +0200
Subject: [PATCH 2/2] fix: make the test script fail when it matches no files

`node --test` treats zero matched files as nothing to do and exits 0,
so the check just added would report green both when the assertions
pass and when they have stopped running. One `git mv` of
contrast.test.mjs out of the `**/*.test.mjs` pattern reintroduced the
defect this repo added CI to close, silently.

Naming the file makes node open that path, so a rename exits 1. Local
`npm test` had the same blind spot; this closes both.

Also inline why `cache: npm` is absent, following the precedent in
espadat.com verify-credits.yml. The commit message is not where the
next contributor looks before adding a cache that cannot work here.
---
 .github/workflows/test.yml | 2 ++
 package.json               | 2 +-
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 862bbb1..9bf2017 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -22,6 +22,8 @@ jobs:
         with:
           persist-credentials: false
 
+      # No `cache: npm`: the cache key hashes a lockfile this package
+      # deliberately does not ship, and the step errors out without one.
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: lts/*
diff --git a/package.json b/package.json
index ecb79a4..782dcdb 100644
--- a/package.json
+++ b/package.json
@@ -14,7 +14,7 @@
     "./styles/*": "./src/styles/*"
   },
   "scripts": {
-    "test": "node --test"
+    "test": "node --test src/styles/contrast.test.mjs"
   },
   "peerDependencies": {
     "@astrojs/starlight": "^0.42.0",