Aman-Mittal commented on issue #377:
URL:
https://github.com/apache/fineract-backoffice-ui/issues/377#issuecomment-5308035480
## Release scorecard — `0846def1`
| Area | Status | Evidence | Blocking? |
|---|---|---|---|
| Version / release metadata | **FAILED** | `0.0.0`, propagates to
`remoteEntry.json` and the SBOM; no release tags; no changelog | **Yes (V1)** |
| Build | VERIFIED | `npm run build` exit 0, 44 s | No |
| Lint | VERIFIED | `npm run lint:prune` exit 0 | No |
| Format | VERIFIED | `npm run format:check` exit 0 | No |
| i18n (mechanism) | VERIFIED | 1532 referenced keys, 0 missing | No |
| i18n (locale completeness) | PARTIAL | hi/ko at 20.9%; English fallback
confirmed | No |
| Unit tests | VERIFIED | 1093/1093 + 2/2 | No |
| Coverage | VERIFIED | 73.72% statements excl. generated client;
security-critical files ≥90% | No |
| E2E | VERIFIED | 325 passed; 8 failures attributed to contention, green
serially | No |
| E2E — two-factor | VERIFIED | 3 passed, dedicated stack | No |
| RBAC | VERIFIED | 223/223 codes real; drift checker passes; 50 RBAC e2e
cases incl. backend refusal | No |
| Navigation authorization | VERIFIED | 119 entries, 104 gated, static
equality with routes enforced in CI | No |
| Action authorization | PARTIAL | 163 gating sites; 62 of 74 write controls
gated; 7 ungated, all leading to a gated route | No |
| API surface | VERIFIED | 142 services / 564 operations; manifest matches;
spec identical to Fineract head | No |
| GA gates | VERIFIED | 8/9, 0 blocking | No |
| Dependency licensing (production) | VERIFIED | 26/26 Category A | No |
| Dependency licensing (dev) | **NEEDS A DECISION** |
`eslint-plugin-sonarjs` LGPL-3.0-only | **Yes (L1)** |
| Dependency vulnerabilities | VERIFIED | production 0; dev 11, none
shipped, all fixable | No |
| ASF / RAT | VERIFIED | 706 approved, 0 unapproved; gate proved to block |
No |
| SBOM | VERIFIED (with limits) | CycloneDX 1.6, 23/932 components; no
hashes — generator limitation, stated not fabricated | No |
| CI/CD security | VERIFIED | all actions SHA-pinned; no
`pull_request_target`; least privilege | No |
| Accessibility | PARTIAL / one AA failure | axe passes on 4 screens;
primary colour 3.15:1 vs 4.5:1 | No |
| Functional coverage | VERIFIED | 27 areas, 333 routes, 0 TODOs, no dead
routes | No |
| Documentation | **FAILED** | no release docs; threat-model config table
wrong; broken README link; stale copyright | **Yes (D1)** |
| Deployment artifacts | **FAILED** | image builds, but serves the SPA shell
for `/api/v1/*` | **Yes if a container ships** |
| Breaking changes | VERIFIED | one, intended, with an opt-out | No |
| Release hygiene | **FAILED** | no tags, no changelog, no RM process, no
KEYS | **Yes (D1)** |
## E2E attribution — why 8 failures are not 8 defects
The full suite was run on a **fresh database** against
`apache/fineract:latest`:
```
bash scripts/e2e-stack.sh --fresh → exit 0
npx playwright test --project=mocked --project=backend → 325 passed,
8 failed, 4 did not run (16.1 m)
```
This host has no `CI` env var, so Playwright used `fullyParallel` with
default workers and `retries: 0`. CI sets `workers: 1`, `retries: 2`, and
shards the mocked project four ways. Rather than assume, the failing specs were
re-run the way CI runs them:
```
npx playwright test --project=backend --workers=1 \
e2e/loan-lifecycle.spec.ts e2e/loan-schedule-type.spec.ts \
e2e/share-account-servicing.spec.ts e2e/teller-cash-management.spec.ts
→ 12 passed,
exit 0
npx playwright test --project=mocked --workers=1 e2e/accessibility.spec.ts
→ 3 passed,
exit 0 (3.3 s/test vs 32–34 s under load)
```
| Failure | Cause | Class |
|---|---|---|
| `loan-lifecycle` create/approve/disburse | select-popover option "outside
of the viewport", retried 104× to a 120 s timeout | environment |
| `loan-schedule-type` progressive round-trip | seeded product not visible
within 20 s | environment |
| `loan-schedule-type` badge | same popover signature, 150 retries |
environment |
| `share-account-servicing` full lifecycle | activate control never
appeared, 240 s | environment |
| `teller-cash-management` over-settlement | `ensureCashMappings` stayed on
`…/create`; another spec created the mapping concurrently | test isolation
under parallelism |
| `accessibility` × 3 | axe `color-contrast` on a page in a transitional
render state; all three also hit the 30 s test timeout | environment |
**None of the eight is a product defect.** Two follow-ups fall out of it:
`teller-cash-management.spec.ts` shares `ensureCashMappings` state and is not
parallel-safe, and the accessibility gate is load-sensitive enough that it
should not be the only AA check.
### But the contrast defect the noisy run named is real
Under contention axe reported `fgColor #ffffff`, `bgColor #3498db`,
`contrastRatio 3.15`, `expectedContrastRatio 4.5:1`. Those colours are not an
artefact — they are the committed theme:
```scss
/* src/styles/_ionic-theme.scss */
--ion-color-primary: #3498db;
--ion-color-primary-contrast: #ffffff;
```
Computing the WCAG ratio from those two values gives **3.15:1**. The *test
failures* were environmental and the *defect the test named* is real; both are
true and neither cancels the other.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
