Add a Lighthouse script with budgets, for CI

[NullVoxPopuli-ai-agent]

pnpm build:prod && pnpm lighthouse in apps/repl runs Lighthouse on the production build and exits with code 1 on new accessibility, best practices, SEO, or agentic browsing findings, on layout shift, and on transfer size. It takes about 70 seconds.

The CI job is not in this PR

My GitHub token has no workflow scope, so I cannot push a change to .github/workflows/ci.yml. Add this job to ci.yml, before the lints job. It uses the artifact of the build_prod job, and the action pins are the ones that the repo already uses:

  lighthouse:
    name: "Lighthouse"
    runs-on: ubuntu-latest
    timeout-minutes: 10
    needs: [build_prod]

    steps:
      - uses: wyvox/action@d463e4fd48f0863f09cadf66203c1780b694620c # v2.0.0
        with:
          repo-token: ${{ secrets.GITHUB_TOKEN }}
      - name: Download the production build
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: deploy-prep-dist
          path: ./deploy-prep-dist
      # Budgets and known failures are in apps/repl/scripts/lighthouse.mjs.
      # The result table is in the job summary.
      - run: pnpm lighthouse
        working-directory: ./apps/repl
        env:
          LIGHTHOUSE_DIST: ../../deploy-prep-dist/repl/dist
      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        if: always()
        with:
          name: lighthouse-reports
          if-no-files-found: ignore
          path: ./apps/repl/lighthouse-reports

I did not run this job, so it is not verified. The script reads GITHUB_STEP_SUMMARY and writes the result table there.

How the script works

apps/repl/scripts/lighthouse.mjs:

• Serves dist with brotli and an index.html fallback, close to Cloudflare Pages.
• Runs Lighthouse 13.4 on three pages: /edit with the welcome document, /edit with a gjs document (this loads Babel and content-tag), and /docs.
• Three runs for each page, with a fresh Chrome for each run. The median run counts.
• Writes the HTML reports to lighthouse-reports/ (ignored by git).

Page	Perf	A11y	BP	SEO	Agentic	FCP	LCP	TBT	CLS	Transfer
edit (welcome document)	76	96	100	100	67	3.7 s	4.4 s	100 ms	0.013	624 kB
edit (gjs document)	76	96	100	100	67	3.7 s	4.4 s	70 ms	0	1632 kB
docs	77	91	100	100	67	3.5 s	4.4 s	50 ms	0	521 kB

What fails

• Each scored audit (weight above 0) in the accessibility, best practices, SEO, and agentic browsing categories. These depend on what we ship, not on the speed of the machine.
• CLS above 0.1.
• Transfer size above 1800 kB for a page.

KNOWN_FAILURES excuses two audits, both from the tabster elements that #2264 describes: aria-hidden-focus and agent-accessibility-tree. I checked that the gate can fail: without that list, the script exits with code 1 and names both audits for each page.

What only warns

The performance score (below 70) and TBT (above 300 ms). They change with the speed of the machine, and a flaky gate gets ignored.

Why not @lhci/cli

Its newest release (0.15.1) has Lighthouse 12.6. PageSpeed uses 13.4, which has the agentic browsing category.

Limits

• The timings are simulated from a local server. Compare them with other CI runs, not with pagespeed.web.dev.
• agent-accessibility-tree is one audit for the whole tree, so the known failure also hides other findings of that audit. The accessibility category still reports those by their own audit ids.

🤖 Generated with Claude Code

[bolt-new-by-stackblitz]

Run & review this pull request in StackBlitz Codeflow.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	lighthouse@​13.4.1
	chrome-launcher@​1.2.1

View full report

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Warn		Obfuscated code: npm csp_evaluator is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: pnpm-lock.yaml → npm/lighthouse@13.4.1 → npm/csp_evaluator@1.1.8 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/csp_evaluator@1.1.8. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

[github-actions]

Project	Preview URL1	Manage
Limber	https://nvp-lighthouse-ci.limber-glimdown.pages.dev	on Cloudflare
Tutorial	https://nvp-lighthouse-ci.limber-glimmer-tutorial.pages.dev	on Cloudflare

Logs

Footnotes

1. if these branch preview links are not working, please check the logs for the commit-based preview link. There is a character limit of 28 for the branch subdomain, as well as some other heuristics, described here for the sake of implementation ease in deploy-preview.yml, that algo has been omitted. The URLs are logged in the wrangler output, but it's hard to get outputs from a matrix job. ↩