ci(site): test the pages in a real browser, check the live site, widen the em-dash check

.github/workflows/ci.yml

@@ -124,21 +124,27 @@ jobs:
                    --results results 2>&1)"
           set -e
           echo "$out" | grep -q "requires" || { echo "expected a named refusal, got:"; echo "$out"; exit 1; }
-          echo "$out" | grep -qv "Traceback" || { echo "traceback leaked"; exit 1; }
+          if echo "$out" | grep -q "Traceback"; then echo "traceback leaked"; echo "$out"; exit 1; fi
 
   # The house style has no em dashes, and the report's own strings are prose a
-  # reader sees. datasets/public/ is excluded because it holds vendored
-  # third-party rows that are reproduced as published.
+  # reader sees, as are the site's pages and the issue templates. Besides the
+  # character itself it catches the spellings that render as one in HTML or JS
+  # (the named and numeric HTML entities, and the JS unicode escape); each is
+  # written in the pattern with a bracketed character so this file does not
+  # match itself. datasets/public/ holds vendored third-party rows reproduced as
+  # published, and site/vendor/ a vendored library, so both are excluded.
   prose:
     name: no em dashes in the docs or the report strings
     runs-on: ubuntu-latest
 
     steps:
       - uses: actions/checkout@v5
 
-      - name: Tracked markdown and src/ contain no em dash
+      - name: Tracked prose, source, site, and templates contain no em dash
         run: |
-          if git grep -n -P '\x{2014}' -- '*.md' 'src/' ':!datasets/public/'; then
+          pattern='\x{2014}|&m[d]ash;|&#821[2];|&#x201[4];|\\u201[4]'
+          if git grep -n -i -P "$pattern" -- '*.md' 'src/' 'site/' 'scripts/' '.github/' \
+              ':!datasets/public/' ':!site/vendor/'; then
             echo "::error::em dash found above; use a comma, colon, parentheses, or a new sentence"
             exit 1
           fi

.github/workflows/site.yml

@@ -103,6 +103,13 @@ jobs:
           tar -xf artifact/artifact.tar -C site-as-published
           node scripts/check_site_links.mjs site-as-published
 
+      # The runner's own Chrome, driven over the DevTools protocol by the
+      # runner's own Node; nothing is installed. It fails on a broken flow (the
+      # calculator, a shared link, search) and on any console error or CSP
+      # violation, on every page.
+      - name: The pages work in a real browser
+        run: node scripts/smoke_site.mjs site-as-published
+
   deploy:
     name: deploy to GitHub Pages
     needs: [parity, docs]
@@ -123,3 +130,21 @@ jobs:
       - name: Publish the checked site
         id: deployment
         uses: actions/deploy-pages@v5
+
+  live:
+    name: the live site resolves as the checked one did
+    needs: deploy
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v5
+
+      # What Pages actually serves, including a real 404 for a missing path,
+      # which only a request to the live site can show. The CDN can take a
+      # moment to serve the new build, so a failure is retried once.
+      - name: Every link, anchor, meta tag, and policy resolves on the live site
+        run: |
+          node scripts/check_site_links.mjs https://tmhsdigital.github.io/plumbline/ || {
+            sleep 60
+            node scripts/check_site_links.mjs https://tmhsdigital.github.io/plumbline/
+          }

CHANGELOG.md

@@ -59,13 +59,21 @@ different event from one that moved because it was wrong.
 - Every page carries a Content-Security-Policy that allows nothing but the
   site's own files (no inline script or style), and `check_site_links.mjs`
   fails a page that lacks it or carries anything it would block.
+- The site is checked in a real browser before it deploys.
+  `scripts/smoke_site.mjs` drives the runner's own Chrome over the DevTools
+  protocol with Node's standard library (nothing is installed), runs the
+  calculator, a shared link, and search, and fails on any console error or CSP
+  violation on any page. After a deploy, a new job checks the live site's
+  links, anchors, meta tags, policy, and 404.
 
 ### Changed
 
 - Report bullets separate the label from the figure with a colon instead of an
   em dash (`- **Cost**: not reported.`), and the docs no longer use em dashes.
   A CI job now fails on an em dash in tracked markdown or `src/`. **This
-  changes report text, not any number.**
+  changes report text, not any number.** The job also covers `site/`,
+  `scripts/`, and `.github/`, and the HTML entity and JavaScript escape
+  spellings of the character.
 
 ### Fixed
 
@@ -94,6 +102,9 @@ different event from one that moved because it was wrong.
   `FileNotFoundError` traceback instead of refusing with a reason.
 - An adapter built without a required setting raised a bare `TypeError` from
   `__init__` instead of naming the setting.
+- CI's guard against a traceback leaking from the quickstart refusal could
+  never fail: `grep -qv Traceback` succeeds on any output with one line
+  without the word (#49).
 - CI ran every pull request twice, because both the `push` and `pull_request`
   triggers fired on a branch pushed to origin.