Deliver editable worksheets, accessible reading, and validated publications

.github/ISSUE_TEMPLATE/reader-field-note.yml

@@ -24,26 +24,62 @@ body:
       description: What did you actually do or make after reading? A small or unsuccessful attempt is useful evidence.
     validations:
       required: true
+  - type: input
+    id: time_to_first_action
+    attributes:
+      label: Time to first action / 到第一次行动的时间
+      description: Approximate minutes from opening the page to a first saved output; write "not recorded" if unknown.
+    validations:
+      required: true
+  - type: textarea
+    id: conditions
+    attributes:
+      label: Non-sensitive conditions / 非敏感条件
+      description: Record only useful context such as device type, available time, prior familiarity, or whether help was used. Do not include identity, location, employer, health, or private project details.
+    validations:
+      required: true
+  - type: textarea
+    id: immediate_result
+    attributes:
+      label: Immediate result / 即时结果
+      description: Record what you completed, what remained incomplete, direct feedback, the largest error or resistance, the conclusion you might exaggerate, and the next retest date. Include approximate minutes to the first saved output; write "not recorded" if unknown.
+    validations:
+      required: true
+  - type: textarea
+    id: retest
+    attributes:
+      label: Retest after 3–7 days / 三到七天后复测
+      description: Record the retest interval, prompts removed, related task, independent result, prompts still needed, what remained, and a private evidence location. Write "not retested yet" when applicable; do not include private paths or identifying details.
+    validations:
+      required: true
   - type: textarea
-    id: delayed_result
+    id: transfer
     attributes:
-      label: Delayed result / 延迟结果
-      description: What remained after several days, what transferred to a new situation, and what disappeared? Write "not retested yet" when applicable.
+      label: Changed condition and transfer / 改变条件与迁移
+      description: Change one condition (topic, audience, time, material, tool permission, or purpose), then record the new task, independent result, where it failed, and the next step. Write "not attempted" when applicable.
     validations:
       required: true
   - type: textarea
-    id: revision
+    id: editorial_feedback
     attributes:
-      label: What should change / 哪些内容需要改变
-      description: Name one unclear passage, missing boundary, weak example, unusable tool, or unnecessary section.
+      label: Editorial feedback / 对书稿的反馈
+      description: Address six items when possible: what most supported action; what remained abstract or unusable; a missing boundary, example, or prerequisite; what could be removed or shortened; what failed when tried; and what question the next edition should answer.
     validations:
       required: true
   - type: checkboxes
     id: privacy
     attributes:
       label: Privacy and claims / 隐私与事实
       options:
-        - label: This note contains no private customer data, credentials, medical records, or unnecessary third-party identity details.
+        - label: Passwords, keys, identity documents, exact addresses, and private contact details have been removed.
+          required: true
+        - label: Customer data, company secrets, medical records, and non-public financial information have been removed.
+          required: true
+        - label: Unnecessary third-party names, photos, relationships, and identifying details have been removed.
+          required: true
+        - label: Material involving other people is authorised or reduced to non-identifying minimum facts.
           required: true
         - label: I have separated what I observed from what I infer or hope.
           required: true
+        - label: I accept that this record may remain public and searchable for a long time.
+          required: true

.github/ISSUE_TEMPLATE/site.yml

@@ -6,25 +6,49 @@ body:
   - type: input
     id: url
     attributes:
-      label: URL
+      label: URL / 页面地址
     validations:
       required: true
   - type: dropdown
     id: type
     attributes:
-      label: Problem type
+      label: Problem type / 问题类型
       options:
-        - Route or redirect
-        - Search
-        - Mobile layout
-        - Keyboard or screen reader
-        - Image or media
-        - Build or other
+        - Route or redirect / 路由或跳转
+        - Search / 搜索
+        - Mobile layout / 移动端布局
+        - Keyboard or screen reader / 键盘或读屏
+        - Image or media / 图片或媒体
+        - Build or other / 构建或其他
+    validations:
+      required: true
+  - type: textarea
+    id: environment
+    attributes:
+      label: Environment / 环境
+      description: Browser and version, assistive technology, viewport or zoom, language edition, and device class. Do not include identity or private project details. / 请填写浏览器及版本、辅助技术、视口或缩放、语言版本和设备类别；不要填写身份或私人项目细节。
     validations:
       required: true
   - type: textarea
     id: reproduce
     attributes:
-      label: Reproduction and expected result
+      label: Reproduction steps / 复现步骤
+      description: List the smallest steps that trigger the problem. / 列出能够触发问题的最小步骤。
+    validations:
+      required: true
+  - type: textarea
+    id: observed
+    attributes:
+      label: Observed and expected behavior / 实际与预期行为
+      description: State what happened and what you expected separately. Include a short error message if useful; do not attach recordings or private data without permission. / 分开说明实际发生和预期发生的情况；必要时附简短错误信息，不要在未经授权时附录音或私人资料。
+    validations:
+      required: true
+  - type: checkboxes
+    id: privacy
+    attributes:
+      label: Privacy check / 隐私确认
+      options:
+        - label: I removed names, recordings, customer data, health information, credentials, and other private material from this public report. / 我已从公开报告中删除姓名、录音、客户资料、健康信息、凭据及其他私人内容。
+          required: true
     validations:
       required: true

.github/dependabot.yml

@@ -0,0 +1,46 @@
+version: 2
+updates:
+  - package-ecosystem: npm
+    directory: /
+    schedule:
+      interval: weekly
+      day: monday
+      time: "09:00"
+      timezone: Asia/Shanghai
+    open-pull-requests-limit: 3
+    groups:
+      npm-compatible:
+        patterns: ["*"]
+        update-types: [minor, patch]
+    commit-message:
+      prefix: "chore(deps)"
+
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+      day: monday
+      time: "09:00"
+      timezone: Asia/Shanghai
+    open-pull-requests-limit: 3
+    groups:
+      actions-compatible:
+        patterns: ["*"]
+        update-types: [minor, patch]
+    commit-message:
+      prefix: "chore(ci)"
+
+  - package-ecosystem: pip
+    directory: /
+    schedule:
+      interval: weekly
+      day: monday
+      time: "09:00"
+      timezone: Asia/Shanghai
+    open-pull-requests-limit: 3
+    groups:
+      publication-compatible:
+        patterns: ["*"]
+        update-types: [minor, patch]
+    commit-message:
+      prefix: "chore(pdf)"

.github/workflows/ci.yml

@@ -8,9 +8,14 @@ on:
 permissions:
   contents: read
 
+concurrency:
+  group: ci-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   validate:
     runs-on: ubuntu-latest
+    timeout-minutes: 20
     steps:
       - uses: actions/checkout@v7
       - uses: actions/setup-node@v7
@@ -20,32 +25,69 @@ jobs:
       - uses: actions/setup-python@v6
         with:
           python-version: "3.12"
+          cache: pip
+          cache-dependency-path: |
+            requirements-pdf.txt
+            requirements-audit.txt
+      - uses: actions/setup-java@v5
+        with:
+          distribution: temurin
+          java-version: "21"
       - run: npm ci
       - run: python -m pip install -r requirements-pdf.txt
+      - run: python -m pip install -r requirements-audit.txt
       - run: npm audit --audit-level=high
+      - run: python -m pip_audit -r requirements-pdf.txt
       - run: npm run check
-      - run: npm run docs:build
+      - run: npm run book:validate -- --reports-dir outputs/epubcheck
       - uses: actions/upload-artifact@v7
+        if: always()
         with:
-          name: site-preview
-          path: docs/.vitepress/dist/
+          name: epubcheck-report
+          path: outputs/epubcheck/
+          if-no-files-found: ignore
           retention-days: 14
       - name: Generated files are committed
         run: |
           npm run sync:content
           git diff --exit-code
+          if [[ -n "$(git ls-files --others --exclude-standard)" ]]; then
+            git status --short
+            echo 'Generated files must be committed.' >&2
+            exit 1
+          fi
+      - run: npm run docs:build
+      - uses: actions/upload-artifact@v7
+        with:
+          name: site-preview
+          path: docs/.vitepress/dist/
+          if-no-files-found: error
+          retention-days: 14
 
   smoke:
     runs-on: ubuntu-latest
+    needs: validate
+    timeout-minutes: 20
     steps:
       - uses: actions/checkout@v7
       - uses: actions/setup-node@v7
         with:
           node-version: 24
           cache: npm
       - run: npm ci
+      - uses: actions/download-artifact@v8
+        with:
+          name: site-preview
+          path: docs/.vitepress/dist/
+      - name: Remove stale runner Chrome apt source
+        run: |
+          while IFS= read -r source; do
+            sudo rm -f "$source"
+          done < <(sudo grep -ril 'dl\.google\.com/linux/chrome' /etc/apt/sources.list.d || true)
       - run: npx playwright install --with-deps chromium
       - run: npm run test:smoke
+        env:
+          PLAYWRIGHT_SKIP_BUILD: "1"
       - uses: actions/upload-artifact@v7
         if: failure()
         with:

.github/workflows/deploy.yml

@@ -7,16 +7,18 @@ on:
 
 permissions:
   contents: read
-  pages: write
-  id-token: write
 
 concurrency:
   group: pages
   cancel-in-progress: true
 
 jobs:
   build:
+    permissions:
+      contents: read
+      pages: read
     runs-on: ubuntu-latest
+    timeout-minutes: 30
     steps:
       - uses: actions/checkout@v7
       - uses: actions/setup-node@v7
@@ -26,20 +28,57 @@ jobs:
       - uses: actions/setup-python@v6
         with:
           python-version: "3.12"
+          cache: pip
+          cache-dependency-path: |
+            requirements-pdf.txt
+            requirements-audit.txt
+      - uses: actions/setup-java@v5
+        with:
+          distribution: temurin
+          java-version: "21"
       - uses: actions/configure-pages@v6
       - run: npm ci
       - run: python -m pip install -r requirements-pdf.txt
+      - run: python -m pip install -r requirements-audit.txt
       - run: npm run check
+      - run: python -m pip_audit -r requirements-pdf.txt
+      - run: npm run book:validate -- --reports-dir outputs/epubcheck
+      - uses: actions/upload-artifact@v7
+        if: always()
+        with:
+          name: deployment-epubcheck-report
+          path: outputs/epubcheck/
+          if-no-files-found: ignore
+          retention-days: 14
       - run: npm run docs:build
+      - name: Remove stale runner Chrome apt source
+        run: |
+          while IFS= read -r source; do
+            sudo rm -f "$source"
+          done < <(sudo grep -ril 'dl\.google\.com/linux/chrome' /etc/apt/sources.list.d || true)
+      - run: npx playwright install --with-deps chromium
+      - run: npm run test:smoke
+        env:
+          PLAYWRIGHT_SKIP_BUILD: "1"
+      - uses: actions/upload-artifact@v7
+        if: failure()
+        with:
+          name: deployment-playwright-report
+          path: playwright-report/
+          retention-days: 7
       - uses: actions/upload-pages-artifact@v5
         with:
           path: docs/.vitepress/dist
 
   deploy:
+    permissions:
+      pages: write
+      id-token: write
     environment:
       name: github-pages
       url: ${{ steps.deployment.outputs.page_url }}
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     needs: build
     steps:
       - name: Deploy to GitHub Pages