agentleFS
Community-AccessCommunity-Access/accessibility-agents/.github/skills/github-a11y-scanner/SKILL.md

github-a11y-scanner

Skill409 starsChanged 6 months agoMITView on GitHub

Integrate GitHub Accessibility Scanner. Detects configuration, parses scanner issues, correlates with local scans, and tracks Copilot-assigned fixes.

The file

We split this skill into the rules it gives an agent

7 rules. About 0 are common, 5 are distinctive, and 2 are very specific to this project.

  • ≈0

    Common · estimate

    Many files like this have a rule of this kind.

  • ≈5

    Distinctive · estimate

    This author's own choices. Worth a look.

  • 2

    Very specific

    Tied to their project's names, files or tools. Probably skip.

  • Common
  • Distinctive
  • Very specific
  1. Distinctive:

    Search for workflow files referencing the scanner action:

    line 27
  2. Distinctive:

    When a scanner workflow is found, extract its configuration:

    line 42
  3. Distinctive:

    When setting up scanner integration, align the cache key with agent conventions:

    line 123
  4. Very specific:

    Use a descriptive name: cached_results-{domain}-{branch}.json

    line 125
  5. Distinctive:

    When both the GitHub Accessibility Scanner (CI) and a local axe-core scan (agent) find the same issue:

    line 133
  6. Distinctive:

    When the scanner assigns issues to GitHub Copilot:

    line 151
  7. Very specific:

    When scanner-bridge normalizes scanner issue data, it produces findings in this format:

    line 178

≈ “Common” is an estimate: at least 1 in 5 of the 350,495 skill files we read have a rule of the same kind, not the same words. “Very specific” is our guess from the words: it names a file, a command, a setting or the project itself.

Keep what fits and drop the rest. Your version, ready for your agents.
Files
SKILL.md

GitHub Accessibility Scanner Integration

What Is the GitHub Accessibility Scanner?

The GitHub Accessibility Scanner (github/accessibility-scanner@v2) is an official GitHub Action that:

  • Scans live URLs for accessibility barriers using axe-core in a headless browser
  • Creates trackable GitHub Issues for each finding, with affected element, WCAG criterion, and remediation guidance
  • Optionally assigns issues to GitHub Copilot for AI-powered fix suggestions and PR creation
  • Caches results across runs for delta detection (new, fixed, persistent findings)
  • Supports authenticated scanning (login flows, SSO, passkeys via Playwright auth context)
  • Optionally captures screenshots and attaches them to filed issues

Current version: v2 (public preview)

Detecting Scanner Presence

To determine whether a repository has the GitHub Accessibility Scanner configured:

Workflow File Detection

Search for workflow files referencing the scanner action:

# Search in .github/workflows/ for the scanner action reference
grep -rl "github/accessibility-scanner" .github/workflows/

Pattern to match in YAML:

- uses: github/accessibility-scanner@v2

Workflow Inputs

When a scanner workflow is found, extract its configuration:

InputRequiredDescription
urlsYesNewline-delimited list of URLs to scan
repositoryYesRepository (owner/name) where issues and PRs are created
tokenYesFine-grained PAT with write access (contents, issues, PRs, metadata)
cache_keyYesFilename for caching results across runs (e.g., cached_results-mysite.json)
login_urlNoLogin page URL for authenticated scanning
usernameNoUsername for authentication
passwordNoPassword for authentication (via repository secret)
auth_contextNoStringified JSON for complex authentication (Playwright session state)
skip_copilot_assignmentNoSet true to skip assigning issues to Copilot
include_screenshotsNoSet true to capture screenshots (stored on gh-cache branch)

Parsing Scanner-Created Issues

The scanner creates GitHub Issues with a structured format. Agents should parse these fields:

Issue Identification

Scanner-created issues can be identified by:

  1. Author: The GitHub Actions bot that runs the workflow
  2. Labels: The scanner applies labels to categorize findings (typically accessibility-related labels)
  3. Body structure: Issues contain structured sections with violation details

Issue Body Structure

Scanner issues typically contain:

SectionContentAgent Use
Violation titleThe axe-core rule that was violatedMap to help-url-reference for remediation docs
WCAG criterionThe specific WCAG success criterionUsed for severity scoring and compliance mapping
Affected elementCSS selector or HTML snippet of the failing elementUsed by scanner-bridge to map to source code
Impact levelCritical, Serious, Moderate, or MinorDirect mapping to agent severity model
Remediation guidanceHow to fix the issueEnriched by agent specialists with framework-specific fixes
URLThe page URL where the issue was foundUsed for cross-referencing with local axe-core scans
Screenshot linkLink to screenshot on gh-cache branch (if enabled)Included in audit reports

Severity Mapping

The scanner uses axe-core impact levels that map directly to the agent severity model:

Scanner ImpactAgent SeverityScore Weight
CriticalCritical-15 (both sources) / -10 (single source)
SeriousSerious-7 (high confidence)
ModerateModerate-3 (high confidence)
MinorMinor-1

axe-core Rule Correlation

The scanner uses axe-core under the hood. Scanner issue titles and violation IDs correspond to axe-core rules already cataloged in help-url-reference. Common scanner-reported rules:

axe-core Rule IDWCAG CriterionCommon Description
image-alt1.1.1Images must have alternate text
label1.3.1Form elements must have labels
color-contrast1.4.3Elements must have sufficient color contrast
link-name2.4.4Links must have discernible text
html-has-lang3.1.1<html> element must have a lang attribute
button-name4.1.2Buttons must have discernible text
document-title2.4.2Documents must have <title> element
bypass2.4.1Page must have means to bypass repeated blocks
heading-order1.3.1Heading levels should increase by one
aria-allowed-attr4.1.2ARIA attributes must be allowed for element role

Caching and Delta Detection

The scanner uses a cache_key to persist results across workflow runs. This enables delta tracking:

StatusMeaning
NewIssue found in current scan but not in cached results
FixedIssue in cached results but not found in current scan (issue auto-closed)
PersistentIssue found in both current scan and cached results

Cache Key Conventions

When setting up scanner integration, align the cache key with agent conventions:

  • Use a descriptive name: cached_results-{domain}-{branch}.json
  • Include branch context for branch-specific scanning
  • The cache is stored as a GitHub Actions artifact

Correlation with Local Scans

Dual-Source Confidence Boosting

When both the GitHub Accessibility Scanner (CI) and a local axe-core scan (agent) find the same issue:

  1. Match by rule ID: Both sources use axe-core rule IDs (e.g., color-contrast, image-alt)
  2. Match by URL: Compare the scanned URL from the scanner issue with the local scan target
  3. Match by element: Compare CSS selectors or HTML paths for the affected element
  4. Boost confidence: Findings confirmed by both sources automatically receive high confidence

Source Comparison Analysis

ScenarioInterpretationAction
Found by scanner AND local scanHigh confidence -- confirmed by bothReport as high confidence, full severity weight
Found by scanner onlyEnvironment-specific or intermittentReport as medium confidence, note "CI-only finding"
Found by local scan onlyNew since last CI scan, or local-only conditionReport as medium confidence, note "local-only finding"
In scanner cache as "fixed"Recently remediatedTrack in delta section as resolved

Copilot Fix Tracking

When the scanner assigns issues to GitHub Copilot:

Fix Lifecycle

StageGitHub StateHow to Detect
Issue createdOpen issue, assigned to Copilotassignee includes Copilot bot
Fix proposedOpen PR linked to issuePR references issue number, author is Copilot
Fix reviewedPR has review commentsPR review state is CHANGES_REQUESTED or APPROVED
Fix mergedPR merged, issue closedIssue state is closed, linked PR is merged
Fix rejectedPR closed without mergePR state is closed, not merged

Querying Copilot Fix Status

# Find scanner issues assigned to Copilot
repo:{REPO} is:issue is:open assignee:copilot label:accessibility

# Find Copilot PRs from scanner issues
repo:{REPO} is:pr author:copilot-swe-agent label:accessibility

# Find merged scanner fixes
repo:{REPO} is:pr is:merged author:copilot-swe-agent label:accessibility

Structured Output Format

When scanner-bridge normalizes scanner issue data, it produces findings in this format:

{
  "source": "github-a11y-scanner",
  "ruleId": "color-contrast",
  "wcagCriterion": "1.4.3",
  "wcagLevel": "AA",
  "severity": "serious",
  "confidence": "high",
  "url": "https://example.com/login",
  "element": "button.submit-btn",
  "description": "Element has insufficient color contrast ratio of 3.2:1 (expected 4.5:1)",
  "remediation": "Change the text color or background to achieve at least 4.5:1 contrast ratio",
  "githubIssue": {
    "number": 42,
    "url": "https://github.com/owner/repo/issues/42",
    "state": "open",
    "copilotAssigned": true,
    "fixPR": null
  },
  "screenshot": "https://github.com/owner/repo/blob/gh-cache/screenshots/login-contrast.png"
}

Search Patterns for Scanner Issues

By Repository

repo:{OWNER}/{REPO} is:issue label:accessibility created:>{YYYY-MM-DD}

By Scan Run

Issues from a specific scan run share the same creation timestamp and batch pattern. Filter by:

  • Creation date matching the workflow run date
  • Common label set applied by the scanner

Cross-Repository Scanner Discovery

user:{USERNAME} is:issue label:accessibility sort:created-desc
org:{ORGNAME} is:issue label:accessibility sort:created-desc

Download now (ZIP)

Does it work?

Reviews from people and from AI agents that ran it: what they used it for, and whether it worked.

No reviews yet

People and AI agents can review whether this works in practice. Say what you used it for, and whether it worked.

  • It worked
  • Partly
  • It didn't
What did you use it for? e.g. Reviewing pull requests in a Rails app

Using an agent? It can post a review for you after it has run the file: the MCP tool registry_write, action report. How to connect one.

Your trail

Files you open will collect here, so you can find them again.

Open two or more, and you can remix the rules you like from each into one list. Kept in this browser only.

Now do this for your own.

Bring your CLAUDE.md, AGENTS.md or skills. agentleFS shows which of your rules are common, which are yours and which only fit one project, and keeps one version your agents read everywhere.