cora-baseline

A project’s baseline, cora.baseline.json in the project root beside its config: the violations the project accepts for now, so the gate fails only on new ones. cora baseline update writes it, and cora scan and cora report merge compare each run with it. A project without one has accepted nothing, so every violation is new.

Each version lists its fields, then a section for each object they hold, headed by its path, in which [] stands for each entry of a list. Where objects of several kinds share a path, each kind has a section, named by the field that tells them apart. A field marked required is in every object of its kind, and the description of any other says when it is absent.

Version 1

The version this release writes. Its JSON Schema is schemas/cora-baseline/v1.json in the @vispero/cora package and at https://cora.vispero.com/docs/0.10/schemas/cora-baseline/v1.json.

format (“cora-baseline”, required): The file’s format, always cora-baseline.
version (1, required): The format’s version. A cora that meets a version newer than it reads fails with contract.unsupported-version.
fingerprintVersion (integer, required): The version of the algorithm that computed the entries’ fingerprints. A cora that computes an older version fails with contract.unsupported-version, since it could match none of them.
entries (array of objects, required): The violations the project accepts, each entry one rule’s issue: a page entry for an issue scans in a browser found, and a source entry for one a static engine found.

entries[] where kind is “page”

kind (“page”, required): What found the violation: page for a scan in a browser, source for a static engine.
rule (string, required): The rule the violation is of, such as axe/image-alt.
source (object): Where the violation is in the project’s source. A page entry holds it when its violations were found with a source location, from source stamps, and its resolution says whose opening tag that is. A source entry always holds it.
pages (array of objects, required): Each page the violation was seen on, in a browser at a viewport, at least one.

entries[] where kind is “source”

kind (“source”, required): What found the violation: page for a scan in a browser, source for a static engine.
rule (string, required): The rule the violation is of, such as axe/image-alt.
source (object, required): Where the violation is in the project’s source. A page entry holds it when its violations were found with a source location, from source stamps, and its resolution says whose opening tag that is. A source entry always holds it.

entries[].source where resolution is “element”

resolution (“element”, required): Whose opening tag the source names. element is the element’s own, when it has a source stamp of its own, and such an entry accepts the violation on every page the element appears on. call-site is its nearest stamped ancestor’s, when it has none, such as for an element a component from node_modules renders, and such an entry accepts the violation only on the elements its pages record.
fingerprint (string, required): The source fingerprint: a hash of the rule, the file and the opening tag, as 32 lowercase hexadecimal characters.
file (string, required): The file, from the repository’s root, with forward slashes, such as src/App.tsx.
openingTag (string, required): The opening tag as the fingerprint hashes it: its source text from < to >, each run of whitespace written as one space.
occurrences (integer, required): How many places in the file with this fingerprint the baseline accepts, at least one. One more such place makes them all new, since the baseline cannot tell which one was added. A call-site source never holds it.

entries[].source where resolution is “call-site”

resolution (“call-site”, required): Whose opening tag the source names. element is the element’s own, when it has a source stamp of its own, and such an entry accepts the violation on every page the element appears on. call-site is its nearest stamped ancestor’s, when it has none, such as for an element a component from node_modules renders, and such an entry accepts the violation only on the elements its pages record.
fingerprint (string, required): The source fingerprint: a hash of the rule, the file and the opening tag, as 32 lowercase hexadecimal characters.
file (string, required): The file, from the repository’s root, with forward slashes, such as src/App.tsx.
openingTag (string, required): The opening tag as the fingerprint hashes it: its source text from < to >, each run of whitespace written as one space.
occurrences (not allowed): How many places in the file with this fingerprint the baseline accepts, at least one. One more such place makes them all new, since the baseline cannot tell which one was added. A call-site source never holds it.

entries[].source where entries[].kind is “source”

fingerprint (string, required): The source fingerprint: a hash of the rule, the file and the opening tag, as 32 lowercase hexadecimal characters.
file (string, required): The file, from the repository’s root, with forward slashes, such as src/App.tsx.
openingTag (string, required): The opening tag as the fingerprint hashes it: its source text from < to >, each run of whitespace written as one space.
occurrences (integer, required): How many places in the file with this fingerprint the baseline accepts, at least one. One more such place makes them all new, since the baseline cannot tell which one was added. A call-site source never holds it.

entries[].pages[]

host (string): The page’s host, its hostname and any port its URL names, such as example.com or localhost:5173, where the issue’s identity keeps it: a page outside its run’s base URL, and every page of a run without one. Absent for a page the base URL claims.
route (string, required): The page’s route key: its URL’s path, query and fragment, without the scheme, host or port, so under the base URL the app’s preview host and production share it, such as /pricing?plan=team.
browser (string, required): The name of the browser the page ran in, such as chrome. An open set: a cora that does not know a name, such as one a newer cora writes, keeps and compares it as it is.
viewport (object, required): The size of the browser’s viewport the page was shown at.
state (string): The name of the page state, reached by interaction, that the violation was seen in; absent for a page as it loads.
element (object, required): The element the violation was seen on, on this page.

entries[].pages[].viewport

width (integer, required): Its width, in CSS pixels.
height (integer, required): Its height, in CSS pixels.

entries[].pages[].element

fingerprint (string, required): The element fingerprint: a hash of the rule, the page’s host where it keeps one, its route key and the element’s path and selector, as 32 lowercase hexadecimal characters.
path (array of objects, required): The iframes and shadow roots the element is inside, outermost first; empty for an element in the page’s own document.
selector (string, required): The element’s CSS selector, in the document or shadow root the last hop leads into.

entries[].pages[].element.path[]

selector (string, required): The CSS selector of the iframe or the shadow host, in the document or shadow root the hop before leads into.
into (“frame” or “shadow”, required): What the hop leads into: frame for the iframe’s document, shadow for the host’s shadow root.