Add Lighthouse CI checks

[lwwmanning]

Summary

Adds a Lighthouse CI workflow that runs on every PR and posts a sticky comment with per-URL Performance / Accessibility / Best-Practices / SEO scores, and hard-gates each category at a measured floor.

URLs audited: /, /blog, /blog/<seed-slug> (newest published post, discovered at config-load time from src/content/blog/*.mdx).

Threshold calibration

Ran the suite locally against bun run start on 2026-05-04 to capture a real baseline:

URL	Perf	A11y	Best practices	SEO
/	1.00	1.00	0.96	1.00
/blog	1.00	1.00	0.96	1.00
/blog/<seed>	1.00	0.96	0.96	1.00

The WebGL hero on / doesn't drag perf down under desktop simulation — every category clears 0.9 with comfortable headroom across all three URLs, so a flat 0.9 floor for every category does the job (a per-URL matrix would be dead scaffolding at these numbers). spiraldb's permissive perf floor (0.5) is calibrated for its visualizer-heavy routes; vortex doesn't need that latitude.

The intent is "lock in today's quality"; bump thresholds via a separate PR if a category drifts up enough that 0.9 stops catching real regressions, and don't relax a threshold to mask a regression.

Files

• New .github/workflows/lighthouse.yml — PR-only workflow that builds, runs treosh/lighthouse-ci-action, and posts a sticky 🔦 Lighthouse audit comment. Uses the same SHA-pinned actions and bun + .next/cache caching as ci.yml. Concurrency group lighthouse-${{ github.workflow }}-${{ github.ref }}.
• New lighthouserc.cjs — JS rather than JSON because the seed slug for /blog/<slug> is discovered at run time from src/content/blog/*.mdx frontmatter (published: false filtered, then sorted by date). Hardcoding a slug would break Lighthouse the day that post is renamed or unpublished.
• PR comment jq — per-cell emoji follows Lighthouse's own scoring buckets: 🟢 ≥90, 🟡 50–89, 🔴 <50. Floor thresholds are below the 🟢 cutoff so a cell can pass assertions and still show 🟡 — the visual signals "we locked this in but it's improvable."

Audit advisories

Adding @lhci/cli@^0.15.1 as a dev dep introduces two upstream-blocked transitive advisories:

• tmp <=0.2.3 (GHSA-52f5-9888-hmc6, low symbolic-link path traversal in dir). Pulled exclusively by @lhci/cli@0.15.1. Dev-only; runs in CI on controlled inputs. Documented in CLAUDE.md and added to the bun audit --ignore list in .github/workflows/ci.yml.
• uuid <14.0.0 (GHSA-w5hq-g745-h8pq, already ignored from PR Hard-gate bun audit in CI; pin patched postcss + mdast-util-to-hast #59 via the resend → svix path). @lhci/cli adds a second parent path (@lhci/cli@0.15.1 → uuid@8.3.2) — same GHSA, same --ignore, no new flag needed. The CLAUDE.md entry was widened to mention both parents.

Removal triggers (both): when @lhci/cli ships a release with patched transitives.

Test plan

• CI green on this PR (Lint, build, verify + new Lighthouse audit job)
• PR receives a sticky 🔦 Lighthouse audit comment with the score table; cells render with 🟢 emoji given the baseline
• Reports are clickable (links to temporary-public-storage)
• bun audit --ignore=GHSA-w5hq-g745-h8pq --ignore=GHSA-52f5-9888-hmc6 exits 0 in the green CI run

🤖 Generated with Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
vortex	Ready	Preview, Comment	May 4, 2026 7:22pm

[github-actions]

🔦 Lighthouse audit

URL	Perf	A11y	Best practices	SEO	Report
/	🟢 100	🟢 100	🟢 96	🟢 100	report
/blog	🟢 100	🟢 100	🟢 96	🟢 100	report
/blog/btrblocks-compressor	🟢 100	🟢 96	🟢 96	🟢 100	report

Run 25338600010 · 2026-05-04 19:23 UTC