Make sponsors, people, projects and forms data-driven

[ramereth]

PR 4 of the site refresh. Moves the last hand-maintained pages onto data files, so editing content means editing YAML instead of raw HTML. No visual redesign here — that landed in #92.

This also delivers two fixes that came out of the #92 review: staging form submissions no longer escape to production, and required checkbox groups actually block submission.

Forms

The five request forms were ~800 lines of copy-pasted Drupal-era HTML. They're now data/forms/*.yml plus a request-form shortcode; each page is down to its intro text and one line.

The formsender contract is unchanged. A parity script compares every control the browser will POST — field names, select option values, defaults, hidden envelope, action/method/enctype — between this branch and main, and they match. Two intentional exceptions:

• the aarch64 distribution option value CentOS Steam → CentOS Stream (typo)
• the redirect value (below)

Also fixed along the way:

• Staging escape: the formsender redirect pointed at production, so submitting a form on a staging deploy bounced you to the live site. request-form.js rebases it onto the current origin. No Jenkins change needed.
• Checkbox groups: required can't express "at least one of these", so the OS Platform(s) groups on the two CI forms accepted empty submissions. Now enforced via the constraint-validation API, starting at the first submit attempt.
• Accessibility, generated uniformly rather than per-form: programmatic labels, help text via aria-describedby, autocomplete on name/email, fieldset/legend groups.

Projects, people, sponsors

• Eight project YAML files → data/projects/{hosted,aarch64,powerdev}.yml with status/category keys; one project_table shortcode replaces three. The hosted list's abused comma-separated description field becomes a real services array. Every table renders the same captions, counts and project sets as before; the homepage stat stays at 307.
• data/people.yml + data/sponsors.yml drive the staff and sponsors pages. Heading anchors like #lance-albertson are preserved. Retires the line_break shortcode.
• Tag1's link now points at tag1.com on both the homepage and the sponsors page — main had it pointing two different places. @ArtofBugs / @ramereth: worth a sanity check that this is the right domain.

Adversarial review

Everything above passed CI, so before opening this I ran a multi-agent adversarial review over the diff — independent finders per dimension, each finding then attacked by skeptics that had to refute it. 18 candidates, 15 refuted, 3 real. All three are fixed in 934802e, and two of them were mine, made while writing accessibility code:

1. Phantom screen-reader error — my checkbox validation set the custom validity at page load, so Chrome exposed the first checkbox as invalid before you touched anything. A screen reader announced "Debian, checkbox, not checked, invalid entry" on a box nobody chose (WCAG 4.1.2). Someone could plausibly check Debian just to clear it and file a wrong ticket. pa11y reported 0 errors on this — no scanner catches it. Now enforced only after a submit attempt, with a visually-hidden "(required)" in the legend so the requirement is knowable up front.

2. Search lost its deep links — putting the anchor id on <section> instead of <h2> made Pagefind record an anchor with empty text, which its sub-result filter discards. Searching "Tiffany" returned a bare "Staff" result instead of a link to #tiffany-chang. /about/people/ was the only page affected: 7 sub-results → 0. Now back to 7/7, verified by running the real indexer.

3. My pa11y exemption was worse than the problem — in Madrone theme: Bootstrap 5.3, OSU design system, dark mode, WCAG AA #92 I added hideElements: ".form-select" to silence a contrast warning. But hideElements removes the element from the DOM both runners see, for all rules: I'd deleted 100% of select accessibility coverage from a gate documented as "no ignored rules". Proof — on a page where I broke a select's label association, the old config reports 0 errors, the new one catches 4.

   The right mechanism is levelCapWhenNeedsReview: "warning". axe's "needs review" means couldn't measure (an image behind the text), not found a failure. Capping those at warning keeps every rule running on every element while proven violations still fail the build. That let me drop the hero exemption too, so the config now matches its own claim. hideElements is left only for reCAPTCHA, which we genuinely can't fix.

Verification

• Form POST parity vs main: identical
• htmltest 222 documents; 50/50 alias stubs; markdownlint clean
• pa11y-ci 15/15, now with less hidden from the scanners than before
• 49/49 browser checks (redirect rebasing, checkbox groups, required selects, labels, error page)
• All three fixes confirmed to survive --minify, which is what CI and production build with

Reviewer notes

• Best read commit by commit; the data-file diffs are bulk moves.
• The one thing worth real scrutiny is data/forms/*.yml — a wrong name: key silently breaks ticket routing, and the parity script only proves this branch matches main, not that main was right.

🤖 Generated with Claude Code