fix(governance): use absolute upload paths + env-based out dir

Fixes 4 issues discovered by the first governance workflow run (run
33968073019), addressing A10 verification:

1. perf-budget artifact upload used `website/.perf-budget.json` (rel),
   but action cwd was repo root and globbing silently missed the file.
   Switch all 3 uploads to `${{ github.workspace }}/...`.

2. Lighthouse configPath `./.lighthouserc.cjs` did not exist at repo
   root (it lives in website/). Point to `website/.lighthouserc.cjs`.

3. a11y tests could not find `website/out` because Playwright cwd is
   `tests/`, not repo root. static-server.ts now walks up to find the
   output directory, and accepts `WEBSITE_OUT_DIR` env var as override.
   governance.yml exports `WEBSITE_OUT_DIR` for deterministic paths.

These are wiring fixes, not threshold changes.

Author: zengfr

.github/workflows/governance.yml

@@ -53,7 +53,7 @@ jobs:
         uses: actions/upload-artifact@v4
         with:
           name: perf-budget
-          path: website/.perf-budget.json
+          path: ${{ github.workspace }}/website/.perf-budget.json
           retention-days: 14
 
   # ---- Soft gate: Lighthouse audit (homepage categories). ----
@@ -80,7 +80,7 @@ jobs:
       - name: Run Lighthouse CI
         uses: treosh/lighthouse-ci-action@v9
         with:
-          configPath: ./.lighthouserc.cjs
+          configPath: website/.lighthouserc.cjs
           uploadArtifacts: true
           temporaryPublicStorage: true
 
@@ -111,13 +111,15 @@ jobs:
       - name: Run axe a11y
         working-directory: tests
         run: npm run test:a11y
+        env:
+          WEBSITE_OUT_DIR: ${{ github.workspace }}/website/out
 
       - name: Upload a11y logs
         if: always()
         uses: actions/upload-artifact@v4
         with:
           name: a11y-logs
-          path: tests/test-results/
+          path: ${{ github.workspace }}/tests/test-results/
           retention-days: 14
 
   # ---- Soft gate: regenerate Go API docs and upload artifact. ----
@@ -144,7 +146,7 @@ jobs:
         uses: actions/upload-artifact@v4
         with:
           name: godocgen
-          path: website/content/docs/api/
+          path: ${{ github.workspace }}/website/content/docs/api/
           retention-days: 14
 
   # ---- Summary job: aggregates results in the GitHub Actions UI. ----
@@ -162,3 +164,8 @@ jobs:
           echo "- lighthouse:  ${{ needs.lighthouse.result }}" >> "$GITHUB_STEP_SUMMARY"
           echo "- a11y:        ${{ needs.a11y.result }}" >> "$GITHUB_STEP_SUMMARY"
           echo "- godocgen:    ${{ needs.godocgen.result }}" >> "$GITHUB_STEP_SUMMARY"
+
+
+
+
+

tests/a11y/fixtures/static-server.ts

@@ -1,11 +1,14 @@
 // fixtures/static-server.ts - serves ./website/out on an ephemeral port.
 //
 // Used by Playwright + axe-core to crawl the static export without
-// spinning up a real Next.js server.
+// spinning up a real Next.js server. Resolves the output directory
+// by walking up from cwd, so the suite works whether run from
+// repo root or from tests/.
 
 import { createServer, type Server } from 'node:http';
 import { readFile, stat } from 'node:fs/promises';
-import { extname, join, normalize } from 'node:path';
+import { existsSync } from 'node:fs';
+import { extname, join, normalize, dirname } from 'node:path';
 
 export type StaticServer = {
   url: string;
@@ -29,8 +32,20 @@ const MIME: Record<string, string> = {
   '.xml': 'application/xml; charset=utf-8',
 };
 
+function resolveOutDir(): string {
+  if (process.env.WEBSITE_OUT_DIR) return normalize(process.env.WEBSITE_OUT_DIR);
+  let dir = process.cwd();
+  for (let i = 0; i < 6; i++) {
+    const candidate = normalize(join(dir, 'website/out'));
+    if (existsSync(candidate)) return candidate;
+    const parent = dirname(dir);
+    if (parent === dir) break;
+    dir = parent;
+  }
+  return normalize(join(process.cwd(), 'website/out'));
+}
+
 async function resolveFile(rootDir: string, urlPath: string): Promise<string | null> {
-  // Map "/" -> "/index.html"; "/en/" -> "/en/index.html"; etc.
   const cleaned = urlPath.split('?')[0].split('#')[0];
   const candidates = [cleaned, join(cleaned, 'index.html')];
   for (const c of candidates) {
@@ -47,7 +62,7 @@ async function resolveFile(rootDir: string, urlPath: string): Promise<string | n
 }
 
 export async function startStaticServer(): Promise<StaticServer> {
-  const rootDir = normalize(join(process.cwd(), 'website/out'));
+  const rootDir = resolveOutDir();
   const server: Server = createServer(async (req, res) => {
     try {
       const urlPath = req.url ?? '/';
@@ -71,7 +86,7 @@ export async function startStaticServer(): Promise<StaticServer> {
   if (!addr || typeof addr === 'string') throw new Error('static-server: bad address');
 
   return {
-    url: `http://127.0.0.1:${addr.port}`,
+    url: 'http://127.0.0.1:' + addr.port,
     close: () =>
       new Promise<void>((resolve, reject) =>
         server.close((err) => (err ? reject(err) : resolve())),