Automate accessibility.
From the pipeline.

name: Accessibility Gate

on:
  push:
    branches: [main]
  pull_request:

env:
  API: https://accessibility.api.developingtoday.net

jobs:
  a11y:
    name: WCAG check
    runs-on: ubuntu-latest

    steps:
      # ── 1. Get a JWT via your identity provider ──────────────────────────────
      # This example uses an Azure Entra service principal (client credentials).
      # Swap for Google if your org uses that provider.
      - name: Authenticate
        id: auth
        run: |
          PROVIDER_TOKEN=$(curl -sf -X POST \
            "https://login.microsoftonline.com/${{ secrets.AZURE_TENANT_ID }}/oauth2/v2.0/token" \
            -d "client_id=${{ secrets.AZURE_CLIENT_ID }}" \
            -d "client_secret=${{ secrets.AZURE_CLIENT_SECRET }}" \
            -d "grant_type=client_credentials" \
            -d "scope=api://c6ea719f-9fb0-43ef-9e0c-2e84740e7d77/.default" \
            | jq -r '.access_token')

          JWT=$(curl -sf -X POST "${{ env.API }}/api/auth/exchange-provider-token" \
            -H "Content-Type: application/json" \
            -d "{\"token\": \"$PROVIDER_TOKEN\"}" \
            | jq -r '.token')

          echo "::add-mask::$JWT"
          echo "jwt=$JWT" >> $GITHUB_OUTPUT

      # ── 2. Trigger a scan on the specific page ───────────────────────────────
      - name: Trigger scan
        run: |
          curl -sf -X POST \
            "${{ env.API }}/api/orgs/${{ secrets.A11Y_ORG_ID }}/users/${{ secrets.A11Y_USER_ID }}/audit-projects/${{ secrets.A11Y_PROJECT_ID }}/pages/${{ secrets.A11Y_PAGE_ID }}/scan" \
            -H "Authorization: Bearer ${{ steps.auth.outputs.jwt }}"
          echo "Scan queued for page ${{ secrets.A11Y_PAGE_ID }}"

      # ── 3. Stream SSE events and exit when the scan completes ────────────────
      - name: Await completion
        run: |
          timeout 90 bash -c '
            curl -sN \
              "${{ env.API }}/api/orgs/${{ secrets.A11Y_ORG_ID }}/users/${{ secrets.A11Y_USER_ID }}/audit-projects/${{ secrets.A11Y_PROJECT_ID }}/events" \
              -H "Authorization: Bearer ${{ steps.auth.outputs.jwt }}" \
              -H "Accept: text/event-stream" | \
            while IFS= read -r line; do
              echo "$line"
              [[ "$line" == *"ScanCompleted"* || "$line" == *"ScanFailed"* ]] && exit 0
            done
          '

      # ── 4. Fetch findings for the page and fail on violations ────────────────
      - name: Check for violations
        run: |
          FINDINGS=$(curl -sf \
            "${{ env.API }}/api/orgs/${{ secrets.A11Y_ORG_ID }}/users/${{ secrets.A11Y_USER_ID }}/audit-projects/${{ secrets.A11Y_PROJECT_ID }}/findings?pageId=${{ secrets.A11Y_PAGE_ID }}&status=Open" \
            -H "Authorization: Bearer ${{ steps.auth.outputs.jwt }}")

          COUNT=$(echo "$FINDINGS" | jq '[.[] | select(.impact == "critical" or .impact == "serious")] | length')
          echo "Critical/serious violations: $COUNT"

          if [ "$COUNT" -gt "0" ]; then
            echo "::error::$COUNT critical or serious WCAG violation(s) found on this page."
            echo "Review: https://accessibility.developingtoday.net"
            exit 1
          fi
          echo "No critical or serious violations. Scan passed."

#!/usr/bin/env bash
# a11y-check.sh — scan one page and fail on violations
# Uses SSE event stream for completion — no polling.
set -euo pipefail

API="https://accessibility.api.developingtoday.net"

log() { echo "[a11y] $*"; }

# ── 1. Authenticate via Entra service principal ──────────────────────────────
log "Authenticating..."
PROVIDER_TOKEN=$(curl -sf -X POST \
  "https://login.microsoftonline.com/${AZURE_TENANT_ID}/oauth2/v2.0/token" \
  -d "client_id=${AZURE_CLIENT_ID}" \
  -d "client_secret=${AZURE_CLIENT_SECRET}" \
  -d "grant_type=client_credentials" \
  -d "scope=api://c6ea719f-9fb0-43ef-9e0c-2e84740e7d77/.default" \
  | jq -r '.access_token')

JWT=$(curl -sf -X POST "$API/api/auth/exchange-provider-token" \
  -H "Content-Type: application/json" \
  -d "{\"token\": \"$PROVIDER_TOKEN\"}" \
  | jq -r '.token')
log "JWT obtained."

# ── 2. Trigger page scan ─────────────────────────────────────────────────────
BASE="$API/api/orgs/${A11Y_ORG_ID}/users/${A11Y_USER_ID}/audit-projects/${A11Y_PROJECT_ID}"

curl -sf -X POST "$BASE/pages/${A11Y_PAGE_ID}/scan" \
  -H "Authorization: Bearer $JWT"
log "Scan queued for page ${A11Y_PAGE_ID}."

# ── 3. Stream SSE until ScanCompleted or ScanFailed ──────────────────────────
log "Waiting for scan via event stream..."
timeout 90 bash -c "
  curl -sN '$BASE/events' \
    -H 'Authorization: Bearer $JWT' \
    -H 'Accept: text/event-stream' | \
  while IFS= read -r line; do
    echo \"[event] $line\"
    [[ \"$line\" == *'ScanCompleted'* || \"$line\" == *'ScanFailed'* ]] && exit 0
  done
"

# ── 4. Check findings and gate ───────────────────────────────────────────────
log "Fetching findings..."
FINDINGS=$(curl -sf \
  "$BASE/findings?pageId=${A11Y_PAGE_ID}&status=Open" \
  -H "Authorization: Bearer $JWT")

COUNT=$(echo "$FINDINGS" | jq '[.[] | select(.impact == "critical" or .impact == "serious")] | length')
log "Critical/serious violations: $COUNT"

if [ "$COUNT" -gt "0" ]; then
  log "FAILED — $COUNT violation(s) require attention."
  log "Review at: https://accessibility.developingtoday.net"
  exit 1
fi
log "PASSED."