fix(C-S/a11y): close out the WCAG contrast sweep — stone-500 → stone-… #974

	name: Quality Gate

	on:
	push:
	branches:
	- main
	pull_request:
	branches:
	- main

	concurrency:
	group: quality-gate-${{ github.workflow }}-${{ github.head_ref \|\| github.ref }}
	cancel-in-progress: true

	jobs:
	typecheck:
	runs-on: ubuntu-latest
	steps:
	- name: Checkout
	uses: actions/checkout@v7

	- name: Setup Node.js
	uses: actions/setup-node@v6
	with:
	node-version: 22
	cache: npm

	- name: Install dependencies
	run: npm ci

	- name: Run TypeScript typecheck
	run: npx tsc --noEmit

	lint:
	runs-on: ubuntu-latest
	steps:
	- name: Checkout
	uses: actions/checkout@v7

	- name: Setup Node.js
	uses: actions/setup-node@v6
	with:
	node-version: 22
	cache: npm

	- name: Install dependencies
	run: npm ci

	- name: Run ESLint
	run: npx eslint app/ components/ lib/ --max-warnings 0 --quiet

	brand-scan:
	runs-on: ubuntu-latest
	steps:
	- name: Checkout
	uses: actions/checkout@v7

	- name: Setup Node.js
	uses: actions/setup-node@v6
	with:
	node-version: 22
	cache: npm

	- name: Install dependencies
	run: npm ci

	- name: Run brand scan
	run: npm run brand:scan

	- name: Run PII leak scan
	shell: pwsh
	run: ./scripts/scan-pii-leaks.ps1

	security:
	runs-on: ubuntu-latest
	steps:
	- name: Checkout
	uses: actions/checkout@v7

	- name: Setup Node.js
	uses: actions/setup-node@v6
	with:
	node-version: 22
	cache: npm

	- name: Install dependencies
	run: npm ci

	- name: Run npm audit
	run: npm audit --audit-level=high

Provide feedback