v3.4.1 by taarikashenafi · Pull Request #253 · github/accessibility-scanner

taarikashenafi · 2026-07-29T21:52:46Z

Summary

Cuts the v3.4.1 patch release to fix NPM plugin module resolution introduced in v3.4.0.

Fix

NPM plugins are now installed beside the compiled Find action loader, allowing Node to resolve and import them correctly when the scanner runs from a consumer repository (#252).

This fixes the failure encountered when loading:

scans: |
  ["axe", {"name": "alt-text-scan", "package": "@github/accessibility-scanner-alt-text-plugin", "version": "1.1.0"}]

Bumps the github-actions group with 1 update in the / directory: [ruby/setup-ruby](https://github.com/ruby/setup-ruby). Updates `ruby/setup-ruby` from 1.319.0 to 1.321.0 - [Release notes](https://github.com/ruby/setup-ruby/releases) - [Changelog](https://github.com/ruby/setup-ruby/blob/master/release.rb) - [Commits](ruby/setup-ruby@003a5c4...95ef2b0) --- updated-dependencies: - dependency-name: ruby/setup-ruby dependency-version: 1.321.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions ... Signed-off-by: dependabot[bot] <support@github.com>

…ub-actions group across 1 directory (#251) Bumps the github-actions group with 1 update in the / directory: [ruby/setup-ruby](https://github.com/ruby/setup-ruby). Updates `ruby/setup-ruby` from 1.319.0 to 1.321.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/ruby/setup-ruby/releases">ruby/setup-ruby's releases</a>.</em></p> <blockquote> <h2>v1.321.0</h2> <h2>What's Changed</h2> <ul> <li>Add jruby-10.1.1.0 by <a href="https://github.com/ruby-builder-bot"><code>@ruby-builder-bot</code></a> in <a href="https://redirect.github.com/ruby/setup-ruby/pull/932">ruby/setup-ruby#932</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/ruby/setup-ruby/compare/v1.320.0...v1.321.0">https://github.com/ruby/setup-ruby/compare/v1.320.0...v1.321.0</a></p> <h2>v1.320.0</h2> <h2>What's Changed</h2> <ul> <li>Update CRuby releases on Windows by <a href="https://github.com/ruby-builder-bot"><code>@ruby-builder-bot</code></a> in <a href="https://redirect.github.com/ruby/setup-ruby/pull/931">ruby/setup-ruby#931</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/ruby/setup-ruby/compare/v1.319.0...v1.320.0">https://github.com/ruby/setup-ruby/compare/v1.319.0...v1.320.0</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/ruby/setup-ruby/commit/95ef2b042f9d7a56d8268cba8559e2842e2ad01b"><code>95ef2b0</code></a> Add jruby-10.1.1.0</li> <li><a href="https://github.com/ruby/setup-ruby/commit/a30dfa457ad68707b8b910ac3a244714b61c0626"><code>a30dfa4</code></a> Update CRuby releases on Windows</li> <li>See full diff in <a href="https://github.com/ruby/setup-ruby/compare/003a5c4d8d6321bd302e38f6f0ec593f77f06600...95ef2b042f9d7a56d8268cba8559e2842e2ad01b">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=ruby/setup-ruby&package-manager=github_actions&previous-version=1.319.0&new-version=1.321.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions </details>

Install runtime NPM plugins from the Find action root so bare ESM imports resolve the same node_modules tree from source and compiled loaders. Add a cross-workspace integration test against the released alt-text plugin. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 8b9119b6-5862-4597-b7d9-ad1522e125f4

Install published plugins beside the active source or compiled loader so ESM resolution works without re-resolving the Find action's locked dependencies. Align scanner docs and tests with the released alt-text plugin workflow syntax. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 8b9119b6-5862-4597-b7d9-ad1522e125f4

Remove the source-local node_modules tree created by the published package integration test so every run leaves the checkout clean. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 8b9119b6-5862-4597-b7d9-ad1522e125f4

v3.4.0 installs NPM plugins from the consumer workspace, then imports them from the Find action. The install succeeds, but Node can't resolve the package from `dist/pluginManager/pluginNpmLoader.js`. This happened in [the alt text plugin workflow](https://github.com/github/accessibility-scanner-alt-text-plugin/actions/runs/30406827436) after switching to the new package object in #62. This installs the package beside the loader module with an explicit npm prefix. In the action that's `dist/pluginManager/node_modules`, so the bare ESM import finds it without using `GITHUB_WORKSPACE`. Keeping the install out of the Find action root also avoids npm re-resolving the action's own dependencies. The allowlist, version pinning, `--ignore-scripts`, `--no-save`, `--no-package-lock`, duplicate handling, and warnings are unchanged. I tested the exact input from #62: ```yaml scans: | ["axe", {"name": "alt-text-scan", "package": "@github/accessibility-scanner-alt-text-plugin", "version": "1.1.0"}] ``` In a clean scanner copy with a separate consumer cwd, the published 1.1.0 package loaded from the compiled action. A local page produced both the plugin's `placeholder-alt-text` finding and Axe's `button-name` finding. The Find action's dependency versions were unchanged after the install. Also ran all 82 action tests, lint, format check, and the Find build. I updated the scanner docs that still showed plugin 1.0.0 or described `scans` as strings only. This needs a scanner v3.4.1 after merge. The plugin stays on v1.1.0, then its workflow pin can move from the v3.4.0 commit to the v3.4.1 commit.

Copilot

🟢 Ready to approve

The resolution fix is focused, contract-consistent, and covered by unit and integration tests.

This review doesn't count toward merge requirements. Sign up for the private preview to control whether Copilot approvals count.

Pull request overview

Fixes NPM plugin resolution for the v3.4.1 release by installing plugins beside the compiled loader.

Changes:

Installs NPM plugins under the loader’s module path.
Adds integration and regression coverage.
Updates plugin documentation, examples, and workflow dependency pin.

File summaries

File	Description
`README.md`	Updates the plugin example to v1.1.0.
`PLUGINS.md`	Documents v3.4.1 requirements and plugin version.
`action.yml`	Clarifies the `scans` input format.
`.github/workflows/test.yml`	Updates the pinned Ruby setup action.
`.github/actions/find/tests/pluginNpmLoader.test.ts`	Verifies the new NPM install path.
`.github/actions/find/tests/pluginNpmLoader.integration.test.ts`	Tests installation outside the consumer workspace.
`.github/actions/find/tests/findForUrl.test.ts`	Covers the documented mixed scan input.
`.github/actions/find/src/pluginManager/pluginNpmLoader.ts`	Installs packages beside the compiled loader.
`.github/actions/find/README.md`	Documents object-form NPM plugin entries.

Review details

Files reviewed: 9/9 changed files
Comments generated: 0
Review effort level: Medium

We're testing this review assessment. Please use 👍 or 👎 to tell us if it's correct.

github-advanced-security · 2026-07-30T01:40:07Z

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.

dependabot Bot and others added 6 commits July 27, 2026 20:04

taarikashenafi requested a review from a team as a code owner July 29, 2026 21:52

taarikashenafi requested review from Copilot and rickyzhangca July 29, 2026 21:52

Copilot started reviewing on behalf of taarikashenafi July 29, 2026 21:53 View session

Copilot AI approved these changes Jul 29, 2026

View reviewed changes

taarikashenafi requested a review from JoyceZhu July 29, 2026 21:56

JoyceZhu reviewed Jul 29, 2026

View reviewed changes

Comment thread .github/actions/find/README.md

JoyceZhu reviewed Jul 29, 2026

View reviewed changes

Comment thread .github/workflows/test.yml

JoyceZhu reviewed Jul 29, 2026

View reviewed changes

Comment thread PLUGINS.md

taarikashenafi mentioned this pull request Jul 29, 2026

Address v3.4.1 release review feedback #254

Closed

Copilot AI added a commit that referenced this pull request Jul 29, 2026

Address three review comments from @JoyceZhu on PR #253

6099b82

taarikashenafi requested a review from JoyceZhu July 29, 2026 22:49

JoyceZhu approved these changes Jul 30, 2026

View reviewed changes

taarikashenafi merged commit 7451987 into v3 Jul 30, 2026
11 checks passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

v3.4.1 - #253

v3.4.1#253
taarikashenafi merged 6 commits into
v3from
main

taarikashenafi commented Jul 29, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

github-advanced-security AI commented Jul 30, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Uh oh!

Conversation

taarikashenafi commented Jul 29, 2026

Summary

Fix

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🟢 Ready to approve

Uh oh!

Uh oh!

Uh oh!

Uh oh!

github-advanced-security AI commented Jul 30, 2026

What Enabling Code Scanning Means:

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants