Public evidence shows automated quality gates wired into CI across the supported lifecycle: CircleCI's unconditional 'build' job runs lint, gulp test, an accessibility test suite (test:a11y, which builds Storybook and runs test-storybook against it), and a Snyk scan on every push, while a separate CodeQL workflow runs static analysis on push, pull request, and a weekly schedule. The Storybook test-runner injects axe-core accessibility checks on every story via preVisit/postVisit hooks.
Accessibility documentation states this is a blocking gate: automated tools scan every code change and 'If it doesn't pass, we don't merge the code.' The release-prep workflow adds a zero-tolerance vulnerability gate for production dependencies and a critical-vulnerability gate for devDependencies before release, with the 3.14.0 release notes disclosing the measured counts (0 regular-dependency vulnerabilities; 19 devDependency vulnerabilities, 11 moderate/3 high, disclosed but non-blocking).
For anchor 3's exceptions clause, two governed accepted-deviation paths are evidenced: the Storybook a11y test-runner supports an explicit, code-reviewed opt-out (a11y.disable, axe.mode 'off', axe.skip true) for stories that intentionally bypass automated a11y checks, subject to the same PR review criteria documented in GOVERNANCE.md; and the component lifecycle's 'Use with caution' status is a formally governed, core-team-managed state for components that fail accessibility/usability/development requirements, distinct from silent noncompliance.
Automated gates spanning development through release, plus these two governed exception mechanisms, satisfy anchor 3's lifecycle-and-exceptions clause.
Anchor 4 requires quality, adoption, exceptions, and regressions to all be measured and acted on; only a subset (per-release vulnerability counts, a one-time March 2025 ACR/VPAT assessment of 44 components) is measured, and no adoption or regression-rate metrics are evidenced, so anchor 4 is not met.
- Completeness
- Complete
- Sources
- 9 of 9
- Verification
- Automation wired
- Test definition
- Not observed
- Automation wiring
- Observed
- Current result
- Not observed
- Generalizability
- System wide
Scoring rule used: Quality gates cover the supported lifecycle and exceptions
What a higher score requires: Quality, adoption, exceptions, and regressions are measured and acted on
What is still needed: No public evidence shows adoption metrics or systematic regression measurement across releases, and only a one-time (March 2025) ACR/VPAT assessment exists rather than continuous measurement, so anchor 4's requirement that quality, adoption, exceptions, and regressions all be measured and acted on is not fully met.
Scope: governance; system-wide.
Subjects: CI pipeline (CircleCI, CodeQL), Storybook accessibility test-runner (axe-core) with governed opt-out, release vulnerability gates (release-prep.yml, release.yml), component lifecycle 'Use with caution' status.
Limitation: Actual invocation frequency of accessibility test exceptions, adoption metrics, and regression-rate measurement across releases are not evidenced in the declared public scope.
- What broke
- No confirmed break: automated gates cover the CI/release lifecycle and two governed exception paths are evidenced, but full quality/adoption/regression measurement is not.
- Impact
- Consumers can trust that most changes pass automated accessibility, lint, and vulnerability checks before merge and release, but cannot verify from public evidence how often exceptions are invoked, whether version adoption is tracked, or whether regressions are systematically measured across releases.
- Why
- CircleCI, CodeQL, and the Storybook a11y test-runner wire automated checks into the CI pipeline, and release-prep.yml/release.yml gate publishing on vulnerability scans; the a11y opt-out flags and the lifecycle's 'Use with caution' status provide governed exception paths; but adoption and regression metrics are not published.
- What to change
- Publish aggregate data on how often accessibility test exceptions are invoked, and track/report adoption and regression metrics across releases to support a fully measured quality-enforcement claim.
Supporting evidence, 7 citation(s)