a11y-nightly.yml

name: Nightly Accessibility Scan

# Runs every day at 06:00 UTC (≈1:00 AM EST). Also runs on manual trigger.
on:
  schedule:
    - cron: "0 6 * * *"
  workflow_dispatch:

permissions:
  contents: read

jobs:
  a11y-scan:
    name: Axe DevTools AA scan (live pages)
    runs-on: ubuntu-latest
    timeout-minutes: 25
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: "20"
          cache: npm
          cache-dependency-path: frontend/package-lock.json

      - name: Install frontend dependencies
        working-directory: frontend
        run: npm ci

      - name: Install Playwright Chromium
        working-directory: frontend
        run: npx playwright install --with-deps chromium

      - name: Build Next.js production bundle
        working-directory: frontend
        run: npm run build
        env:
          NEXT_PUBLIC_STELLAR_NETWORK: testnet
          NEXT_PUBLIC_HORIZON_URL: https://horizon-testnet.stellar.org
          NEXT_PUBLIC_API_URL: http://localhost:4000

      - name: Start Next.js server in background
        working-directory: frontend
        run: |
          nohup npm run start > next-start.log 2>&1 &
          # Wait up to 60s for the server to respond.
          timeout 60 bash -c 'until curl -fs http://localhost:3000 > /dev/null; do sleep 2; done'
          echo "Next.js server is up."

      - name: Run axe-core scan
        working-directory: frontend
        run: npm run a11y:scan

      - name: Upload a11y report
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: a11y-report
          path: frontend/a11y-report.json
          if-no-files-found: warn

      - name: Upload server log
        if: failure()
        uses: actions/upload-artifact@v4
        with:
          name: next-start.log
          path: frontend/next-start.log
          if-no-files-found: ignore