Release v2.3.0: chrome by tag, upkeep heartbeat and lock

Andrew Dunnrequested to merge
upkeep-v2/chrome-and-lock into main

Added

  • The Phosphor duotone icon font is vendored into design/icons/phosphor/. Three files from the @phosphor-icons/web@2.1.1 npm tarball, 397 KB together, with the upstream MIT license verbatim beside the stylesheet and a refresh procedure in design/icons/README.md. The @font-face names the one woff2; every class rule is byte-identical to upstream.

  • The design bundle is published under each release tag, at design/<tag>/, alongside the unversioned latest. just sync-design-assets emits one snapshot per released tag at or after v1.3.0, the release that self-hosted the fonts. Publication and pruning policy sits beside the airgap recipe in standards/design/SKILL.md: at eight tags, pruning leaves the current major and the one before it.

  • --status-attention and --status-alert join the docs chrome tokens, light and dark. Attention is a check that could not tell, alert is a check that told us something is wrong, and anything rendering either used to hardcode its own amber and red. The dark variants hold the hue and lift the lightness into the band the three existing status tokens occupy.

  • upkeep requires the heartbeat be published and the citations pinned. Clause 3 now asks for both the when: always emission and a pipeline/freshness-heartbeat include in a stage before the deploy, and states the week-long lag a fresh heartbeat carries. A sixth clause names .gitlab/freshness.lock.json, written by check-freshness pin at the archive of the stamped release, so a released stamp drifts only when a release lands and the finding names the cited pages that changed in it.

  • design asserts that a page does not fetch from unpkg, jsdelivr or Google Fonts. Only the presence of the first-party link was ever asserted, so a page linking both passed. The assertion needed a tree-wide negative, so check_grep_absent joins the closed primitive set beside check_grep, forced by standards/design.

Changed

  • Design principle 7 is scoped to any published page, markup included, not to "any CSS rule". A <link> in a Layout's <head> is not a CSS rule, which is how every chrome family in the estate came to load its icon font from a host the principle names as its own forbidden example. The first-party carve-out for the reference's Pages origin is unchanged.

  • Both project templates link every design asset by tag, and just sync keeps them current. sync-versions.sh repins the versioned URLs from VERSION and validate-versions.sh reports a template left behind, so a newly-stamped project never starts a release out of date. The unversioned path stays supported and stays the documented default.

Fixed

  • Nothing in the repository fetches Phosphor from unpkg any more, the reference's own production site included. Both templates and site/src/layouts/Layout.astro carried the unpkg stylesheet, so a reader behind an egress filter got a page with no icons. sync-design-assets also publishes design/icons, without which the vendored font would not reach Pages at all.

Merge request reports