# axe-core, vendored

`axe.min.js` is [axe-core](https://github.com/dequelabs/axe-core), Deque's
accessibility rules engine, vendored so the WCAG gate runs from the checkout
and not from the network.

    version   4.10.3
    file      axe.min.js
    sha256    880970c081707360e64f34cea25ff91892f5bc95675b0776925b9709dd8a68bb
    source    https://cdnjs.cloudflare.com/ajax/libs/axe-core/4.10.3/axe.min.js
    verified  byte-identical to https://cdn.jsdelivr.net/npm/axe-core@4.10.3/axe.min.js
    licence   MPL-2.0 (the header comment in the file is the notice)

## This is test data

It is read by `internal/axe`, whose `Scan` (build tag `browser`) injects it into a headless Chromium and runs it over the page a drive is on: every example state as its own document in `internal/gallery`, and the fixtures the drives in `check/` serve. Only this package embeds the engine. The root package embeds `css/`, `js/`, `icons/`, `examples/`, `i18n/` and `LICENSE`, so nothing a Go program imports from Fiesta carries it, and two untagged tests hold that on every `go test ./...`, not only when a browser is around: `TestTheShippedTreeCarriesNoAxe` beside this file walks the embedded tree for the engine's banner and checks that the public packages never import this one, and `TestVendoredAxeIsNotAShippedAsset` in `internal/build` walks the release.

## Upgrading

Fetch the new version from both CDNs above, check the two copies are identical, replace the file, and update the version and sha256 in this README. `TestVendoredAxeIsThePinnedVersion` reads both out of this file and fails if either stops describing what is on disk. Then run the scan: a new axe-core finds things the old one did not, and those findings are the point.

    make browser.internal.gallery~1of2 browser.internal.gallery~2of2