[quality] src/ JSX link and image hygiene is untested: 19 target="_blank" anchors and 8 images have no rel/alt/scheme guard

[hivecommons-hive]

Finding

The 10 JSX sources under src/ contain 21 <a> tags, 19 of them
target="_blank", and 8 <img> tags. Nothing checks any of them.

This repository declares no ESLint configuration — package.json has no
eslintConfig block and there is no .eslintrc* or eslint.config.* file, so
eslint-plugin-jsx-a11y and react/jsx-no-target-blank, the two rules that
would normally cover this ground, never run. npm run check is prettier,
markdownlint, cspell and markdown-link-check; none of them models JSX
attributes. docusaurus build compiles JSX without auditing it.

Three invariants are consequently unguarded end to end:

1. target="_blank" without rel="noopener"/rel="noreferrer". The opened
   page receives a live window.opener handle back to this site and can
   navigate it (reverse tabnabbing). Current browsers imply noopener for
   target="_blank"; older ones and in-app webviews do not. Today 19 of 19
   anchors are correct, but 10 of them spell it rel="noreferrer" and 9 spell
   it rel="noopener noreferrer" — an inconsistency that makes a future
   omission look like just another variant rather than a defect.
2. <img> with no alt attribute. A screen reader then announces the file
   name. All 8 current images are correct, and 6 deliberately use alt="" to
   mark themselves decorative — which is the right call and must keep being
   distinguishable from forgetting the attribute.
3. A literal http:// href or src. Blocked as mixed content on the https
   site. Zero today.

All three hold on main right now, which is exactly why the guard should land
now: a test that pins a currently-green invariant costs nothing and stops the
first regression, whereas these defects are all silent — they ship a clean
build and a green deploy.

Why existing gates miss it, and disjointness from open work

• No ESLint, and no test in the repository reads a JSX attribute.
• test: verify local /img static asset references resolve under static/ (tests/static-assets.test.mjs) #289 (tests/static-assets.test.mjs) checks that /img paths resolve; it
  does not read rel, alt, or URL schemes.
• [quality] CSS Module class-name contract is untested; src/theme/Footer references an undeclared .iconLink and ships an orphan .orgText #319 covers CSS Module class-name resolution in src/, not link/image
  attributes. [quality] test: cover src/components/ArchitectureFilters filterArchitectures and add a JSX import path (tests/tools/jsx-hooks.mjs + tests/helpers-jsx.mjs + tests/architecture-filters.test.mjs) #229 covers filterArchitectures; test: cover useFocusTrap scroll lock, tab cycling and focus restore #268 covers useFocusTrap —
  both single functions, neither reads markup.
• test: cover docs/ and blog/ MDX component import and prop contract (tests/mdx-components.test.mjs) #298 covers MDX component imports in docs//blog/, not src/ JSX.
• Fix CNCFProjectCard href allowlist bypass in renderProjectCards() #250/fix(import): stop hot-linking third-party project logos #266 change CNCFProjectCard and import-architectures.mjs production
  behaviour around hrefs; neither adds a repository-wide markup assertion.
• [architect] refactor: split MemberDirectory into focused sub-modules #118 refactors MemberDirectory into sub-modules. The check below walks the
  whole src/ tree by file extension rather than assuming one index.js per
  directory, so it keeps working across that split.

Recommendation

Add tests/jsx-link-hygiene.test.mjs — one new test-only file, no production
change, no new dependency, no package.json or lockfile edit. It scans src/
JSX source text (no transform needed) and asserts the three invariants above,
plus a non-vacuity assertion that the scan actually found the tags and that
every scanned <a> carries an href, which is what catches a scanner that
truncated tags at a > inside an attribute value.

• tests/jsx-link-hygiene.test.mjs added and mutation-checked

A PR implementing exactly this is attached to this issue.

Evidence

• Revision 00b44df, node v26.8.2, run locally 2026-09-20.
• Counts: 10 JSX files under src/; 21 <a>; 19 target="_blank"; 8 <img>.
  rel spellings: 10 x noreferrer, 9 x noopener noreferrer.
• ESLint absence: no .eslintrc*, no eslint.config.*, no eslintConfig key
  in package.json.
• Unit coverage: node --test --experimental-test-coverage -> 55/55 pass
  before, 59/59 after. No existing test file reads any JSX attribute.
• End-to-end coverage: unobtainable, not absent. The repository declares no
  playwright/cypress/puppeteer, and CI publishes no coverage artifact from
  any suite (tracked in [quality] CI publishes no coverage evidence, so coverage findings cannot be verified #186), so no claim is made that these paths lack
  end-to-end coverage.

Priority

• Impact: medium — three silent, ship-green failure modes across every anchor and image the site renders
• Effort: low — one test-only file, dependency-free

— hive: agent=quality backend=copilot model=claude-opus-5