#!/usr/bin/env bash
#
# What the site actually serves, checked after it is built.
#
# Every other guard here reads an input: the content check reads the data, the
# secret scan reads the diff, the build reads the source. This one reads the
# OUTPUT, which is the only thing a visitor or a crawler ever sees. Two live
# defects made the case for it: every page preloaded the wrong image for months,
# and eleven pages shipped a description that read as one run-on sentence. Both
# are plain in the built HTML and invisible in the source.
#
# It sorts after 10-build on purpose: there is nothing to read until the build
# has run, and it refuses (exit 2) rather than pass when dist/ is missing or
# older than the sources.
#
# Exit 0 clean, 1 findings, 2 nothing was audited.
set -uo pipefail
cd "$(git rev-parse --show-toplevel)" || exit 1

[ -f scripts/audit-html.js ] || { echo "audit: scripts/audit-html.js is missing, so nothing was audited." >&2; exit 2; }
node scripts/audit-html.js