Release v3.4.0 by taarikashenafi · Pull Request #250 · github/accessibility-scanner

taarikashenafi · 2026-07-24T18:55:36Z

Summary

Cuts the v3.4.0 minor release by merging the reviewed changes on main since immutable release v3.3.0 into the stable v3 action branch.

What's new

NPM scanner plugins — object entries in scans can install and load allowlisted first-party packages at runtime, including a pinned version (#242).
AccessLint engine — accesslint is available as a built-in alternative or complement to Axe, with comparison and selection guidance (#241).
Alt-text plugin documentation — documents @github/accessibility-scanner-alt-text-plugin and the object scans configuration (#247).

Maintenance

Update ruby/setup-ruby (#246, #248).
Update actions/setup-node and patched brace-expansion (#248, #249).

Upgrade notes

This is additive and backward-compatible. Existing workflows using github/accessibility-scanner@v3 need no configuration changes. Axe remains the default when scans is omitted.

To pin the currently published alt-text plugin:

scans: |
  ["axe", {"name": "alt-text-scan", "package": "@github/accessibility-scanner-alt-text-plugin", "version": "1.0.0"}]

Only allowlisted first-party NPM plugins are loaded. Package lifecycle scripts are disabled during installation.

Validation

npm run lint — passed on main at 096ac67
npm run format:check — passed
Action unit tests — 81 passed
.github/actions/find TypeScript build — passed
Repository Test workflow — passed: https://github.com/github/accessibility-scanner/actions/runs/30118540795
Manual local integration using @github/accessibility-scanner-alt-text-plugin@1.0.0 with object scans syntax — package installed and loaded through the scanner plugin manager; a local page with alt="image.jpg" produced the expected filename-alt-text finding
Root production dependency audit — 0 vulnerabilities

Release procedure after approval

Merge this PR using a merge commit, preserving the established main → v3 release history.
Validate the resulting v3 commit.
Publish immutable GitHub release/tag v3.4.0 from v3 and verify github/accessibility-scanner@v3 and v3.4.0 contain Npm plugin loading #242 and the intended release delta.

…nd pass UrlConfig in tests) Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

…totype

Accept object entries in the 'scans' input ({name, package, version}) and install/import them at runtime via npm install --ignore-scripts. Loading is gated to first-party allowlist. Includes unit tests.

…totype # Conflicts: # .github/actions/find/src/findForUrl.ts # README.md

Co-authored-by: Joyce Zhu <joycezhu@github.com>

…text

Co-authored-by: Joyce Zhu <joycezhu@github.com>

Scanner-side fixes for github/accessibility#10755. Consumers request a first-party NPM plugin by passing an object in the `scans` input: scans: | ["axe", {"name": "alt-text-scan", "package": "@github/accessibility-scanner-alt-text-plugin", "version": "1.0.0"}]

# Conflicts: # .github/actions/find/action.yml # .github/actions/find/src/scansContextProvider.ts

Closes github/accessibility#10666 Adds AccessLint as a built-in scan engine alongside Axe. Opt in via the `scans` input, e.g. `["axe", "accesslint"]`. With no `scans` input the default stays axe-only.

Bumps the github-actions group with 1 update in the / directory: [ruby/setup-ruby](https://github.com/ruby/setup-ruby). Updates `ruby/setup-ruby` from 1.314.0 to 1.316.0 - [Release notes](https://github.com/ruby/setup-ruby/releases) - [Changelog](https://github.com/ruby/setup-ruby/blob/master/release.rb) - [Commits](ruby/setup-ruby@9eb537c...d45b1a4) --- updated-dependencies: - dependency-name: ruby/setup-ruby dependency-version: 1.316.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions ... Signed-off-by: dependabot[bot] <support@github.com>

…ub-actions group across 1 directory (#246) Bumps the github-actions group with 1 update in the / directory: [ruby/setup-ruby](https://github.com/ruby/setup-ruby). Updates `ruby/setup-ruby` from 1.314.0 to 1.316.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/ruby/setup-ruby/releases">ruby/setup-ruby's releases</a>.</em></p> <blockquote> <h2>v1.316.0</h2> <h2>What's Changed</h2> <ul> <li>Update CRuby releases on Windows by <a href="https://github.com/ruby-builder-bot"><code>@ruby-builder-bot</code></a> in <a href="https://redirect.github.com/ruby/setup-ruby/pull/926">ruby/setup-ruby#926</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/ruby/setup-ruby/compare/v1.315.0...v1.316.0">https://github.com/ruby/setup-ruby/compare/v1.315.0...v1.316.0</a></p> <h2>v1.315.0</h2> <h2>What's Changed</h2> <ul> <li>Bump actions/checkout from 6 to 7 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/ruby/setup-ruby/pull/924">ruby/setup-ruby#924</a></li> <li>Add ruby-3.4.10 by <a href="https://github.com/ruby-builder-bot"><code>@ruby-builder-bot</code></a> in <a href="https://redirect.github.com/ruby/setup-ruby/pull/925">ruby/setup-ruby#925</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/ruby/setup-ruby/compare/v1.314.0...v1.315.0">https://github.com/ruby/setup-ruby/compare/v1.314.0...v1.315.0</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/ruby/setup-ruby/commit/d45b1a4e94b71acab930e56e79c6aa188764e7f9"><code>d45b1a4</code></a> Update CRuby releases on Windows</li> <li><a href="https://github.com/ruby/setup-ruby/commit/0dafeac902942906541bc140009cdbf32665b601"><code>0dafeac</code></a> Add ruby-3.4.10</li> <li><a href="https://github.com/ruby/setup-ruby/commit/bf35c27edc951760db12f3d7956eefe8f8bff334"><code>bf35c27</code></a> Bump actions/checkout from 6 to 7</li> <li>See full diff in <a href="https://github.com/ruby/setup-ruby/compare/9eb537ca036ebaed86729dcb9309076e4c5c3b74...d45b1a4e94b71acab930e56e79c6aa188764e7f9">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=ruby/setup-ruby&package-manager=github_actions&previous-version=1.314.0&new-version=1.316.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions </details>

Co-authored-by: Joyce Zhu <joycezhu@github.com>

…updates Bumps the github-actions group with 2 updates in the / directory: [actions/setup-node](https://github.com/actions/setup-node) and [ruby/setup-ruby](https://github.com/ruby/setup-ruby). Updates `actions/setup-node` from 6 to 7 - [Release notes](https://github.com/actions/setup-node/releases) - [Commits](actions/setup-node@v6...v7) Updates `ruby/setup-ruby` from 1.316.0 to 1.319.0 - [Release notes](https://github.com/ruby/setup-ruby/releases) - [Changelog](https://github.com/ruby/setup-ruby/blob/master/release.rb) - [Commits](ruby/setup-ruby@d45b1a4...003a5c4) --- updated-dependencies: - dependency-name: actions/setup-node dependency-version: '7' dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: ruby/setup-ruby dependency-version: 1.319.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions ... Signed-off-by: dependabot[bot] <support@github.com>

Bumps [brace-expansion](https://github.com/juliangruber/brace-expansion) from 5.0.3 to 5.0.7. - [Release notes](https://github.com/juliangruber/brace-expansion/releases) - [Commits](juliangruber/brace-expansion@v5.0.3...v5.0.7) --- updated-dependencies: - dependency-name: brace-expansion dependency-version: 5.0.7 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>

github-advanced-security · 2026-07-24T18:55:38Z

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.

Copilot

Pull request overview

Releases v3.4.0 with AccessLint support, runtime NPM plugins, documentation, tests, and dependency maintenance.

Changes:

Adds the AccessLint scan engine and guidance.
Adds allowlisted NPM plugin loading and alt-text plugin documentation.
Updates CI actions and dependencies.

Show a summary per file

File	Description
`README.md`	Documents new scanning options.
`PLUGINS.md`	Documents NPM plugins.
`AXE_VS_ACCESSLINT.md`	Compares scan engines.
`package-lock.json`	Updates `brace-expansion`.
`.github/workflows/test.yml`	Updates Ruby setup.
`.github/workflows/lint.yml`	Updates Node setup.
`.github/actions/find/action.yml`	Expands `scans` input documentation.
`.github/actions/find/package.json`	Adds AccessLint dependencies.
`.github/actions/find/package-lock.json`	Locks new dependencies.
`.github/actions/find/src/findForUrl.ts`	Runs AccessLint scans.
`.github/actions/find/src/scansContextProvider.ts`	Parses engines and NPM plugins.
`.github/actions/find/src/pluginManager/index.ts`	Loads allowlisted NPM plugins.
`.github/actions/find/src/pluginManager/pluginNpmLoader.ts`	Installs and imports packages.
`.github/actions/find/src/pluginManager/types.ts`	Defines NPM plugin requests.
`.github/actions/find/tests/findForUrl.test.ts`	Tests scan selection.
`.github/actions/find/tests/pluginNpmLoader.test.ts`	Tests NPM plugin loading.

Review details

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Files not reviewed (1)

.github/actions/find/package-lock.json: Generated file

Files reviewed: 14/16 changed files
Comments generated: 4
Review effort level: Medium

+
+// Install the package at runtime.
+export function installNpmPackage(spec: string) {
+  execFileSync('npm', ['install', spec, '--no-save', '--no-package-lock', '--ignore-scripts'], {stdio: 'inherit'})


+
+// Install and import a single NPM-published plugin
+export async function loadPluginViaNpm(request: NpmPluginRequest): Promise<Plugin | undefined> {
+  const spec = request.version ? `${request.package}@${request.version}` : request.package


+        if (isDuplicatePlugin(plugin)) {
+          core.warning(`Skipping plugin '${pluginFolder}' because a plugin named '${plugin.name}' is already loaded`)
+          continue
+        }


+    await addFinding({
+      scannerType: 'accesslint',
+      url,


kzhou314 and others added 30 commits June 24, 2026 13:19

Add AccessLint scan engine

52e401a

Document AccessLint engine in README

d07f5eb

Apply suggestions from code review (escape AccessLint solutionShort a…

41f49ec

…nd pass UrlConfig in tests) Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

Fix formatting

0432b26

Merge remote-tracking branch 'origin/main' into accesslint-engine-pro…

2cdf7c1

…totype

Load first-party scanner plugins from NPM packages

671de5c

Accept object entries in the 'scans' input ({name, package, version}) and install/import them at runtime via npm install --ignore-scripts. Loading is gated to first-party allowlist. Includes unit tests.

Document loading scanner plugins from NPM packages

9a9e932

Merge remote-tracking branch 'origin/main' into accesslint-engine-pro…

61c5831

…totype # Conflicts: # .github/actions/find/src/findForUrl.ts # README.md

Merge branch 'main' into npm-plugin-loading

c451932

Validate scans input, skip lockfile writes, and warn on name mismatches

6aad92b

Merge branch 'main' into accesslint-engine-prototype

e1aed69

Merge branch 'main' into npm-plugin-loading

4488f96

Pin Playwright to 1.60.0 to keep the integration-test Chromium unchanged

ef9b812

Add axe vs. AccessLint comparison doc

d065c0c

Trim axe vs. AccessLint doc

296fa7e

List AccessLint-only checks and tighten wording in comparison doc

52cc0db

Rename npmPluginLoader to pluginNpmLoader for consistency

59a5adc

Extract isValidPlugin and isDuplicatePlugin helpers for plugin loading

fdafec3

Link first-party allowlist in docs and drop redundant scans comment

454be60

Merge branch 'main' into accesslint-engine-prototype

4853746

Merge branch 'main' into npm-plugin-loading

4cadf62

Update AXE_VS_ACCESSLINT.md

600734b

Co-authored-by: Joyce Zhu <joycezhu@github.com>

Guard object scans entries and read npm plugins from cached scans con…

2757b80

…text

Clarify axe and accesslint function

aee1d92

Co-authored-by: Joyce Zhu <joycezhu@github.com>

Use GitHub tip alert syntax for engine-selection callout

011eff9

Npm plugin loading (#242)

78b3876

Scanner-side fixes for github/accessibility#10755. Consumers request a first-party NPM plugin by passing an object in the `scans` input: scans: | ["axe", {"name": "alt-text-scan", "package": "@github/accessibility-scanner-alt-text-plugin", "version": "1.0.0"}]

Merge branch 'main' into accesslint-engine-prototype

99ad11e

# Conflicts: # .github/actions/find/action.yml # .github/actions/find/src/scansContextProvider.ts

Add AccessLint scan engine (#241)

c018ad2

Closes github/accessibility#10666 Adds AccessLint as a built-in scan engine alongside Axe. Opt in via the `scans` input, e.g. `["axe", "accesslint"]`. With no `scans` input the default stays axe-only.

kzhou314 and others added 10 commits July 7, 2026 13:47

Document alt-text plugin in Plugins section

2f157b4

Make section less dense/more readable

92e55ab

Merge branch 'main' into document-alt-text-plugin

40bcff5

Wording changes

752cdcb

Co-authored-by: Joyce Zhu <joycezhu@github.com>

Merge branch 'main' into document-alt-text-plugin

28456f9

Document alt-text plugin in Plugins section (#247)

096ac67

Copilot AI review requested due to automatic review settings July 24, 2026 18:55

taarikashenafi requested a review from a team as a code owner July 24, 2026 18:55

taarikashenafi requested a review from rickyzhangca July 24, 2026 18:55

Copilot started reviewing on behalf of taarikashenafi July 24, 2026 18:56 View session

taarikashenafi merged commit da2381e into v3 Jul 24, 2026
10 checks passed

Copilot AI reviewed Jul 24, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Release v3.4.0#250

Release v3.4.0#250
taarikashenafi merged 40 commits into
v3from
main

taarikashenafi commented Jul 24, 2026

Uh oh!

github-advanced-security AI commented Jul 24, 2026

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

Uh oh!

Conversation

taarikashenafi commented Jul 24, 2026

Summary

What's new

Maintenance

Upgrade notes

Validation

Release procedure after approval

Uh oh!

github-advanced-security AI commented Jul 24, 2026

What Enabling Code Scanning Means:

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Review details

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants