Merge main into v2 for release (#170)

Per the
[docs](https://github.com/github/accessibility/blob/main/docs/accessibility-scanner-maintainers-guide.md#publishing-new-versions),
we need to make sure v2 is up-to-date so it can have the latest
features.
> If tests pass, open a PR that merges main into v2 (to ensure v2 always
includes the latest 2.x code). Once approved with passing checks, merge.
(base: v2 -> compare: main)

both tests have passed:
-
[scorecard](https://github.com/github/accessibility-scorecard/actions/runs/23203836900)
-
[sandbox](https://github.com/github/accessibility-sandbox/actions/runs/23202066711)

Author: abdulahmad307

.github/actions/auth/package-lock.json

@@ -17,7 +17,7 @@
     "playwright": "^1.58.2"
   },
   "devDependencies": {
-    "@types/node": "^25.3.3",
+    "@types/node": "^25.4.0",
     "typescript": "^5.9.3"
   }
 }

.github/actions/auth/package.json

@@ -17,6 +17,10 @@ inputs:
   screenshot_repository:
     description: "Repository (with owner) where screenshots are stored on the gh-cache branch. Defaults to the 'repository' input if not set. Required if issues are open in a different repo to construct proper screenshot URLs."
     required: false
+  open_grouped_issues:
+    description: "In the 'file' step, also open grouped issues which link to all issues with the same root cause"
+    required: false
+    default: "false"
 
 outputs:
   filings:

.github/actions/file/action.yml

@@ -18,7 +18,7 @@
     "@octokit/plugin-throttling": "^11.0.3"
   },
   "devDependencies": {
-    "@types/node": "^25.3.3",
+    "@types/node": "^25.4.0",
     "typescript": "^5.9.3"
   }
 }

.github/actions/file/package-lock.json

@@ -1,4 +1,4 @@
-import type {Finding, ResolvedFiling, RepeatedFiling} from './types.d.js'
+import type {Finding, ResolvedFiling, RepeatedFiling, FindingGroupIssue, Filing, IssueResponse} from './types.d.js'
 import process from 'node:process'
 import * as core from '@actions/core'
 import {Octokit} from '@octokit/core'
@@ -11,6 +11,7 @@ import {isResolvedFiling} from './isResolvedFiling.js'
 import {openIssue} from './openIssue.js'
 import {reopenIssue} from './reopenIssue.js'
 import {updateFilingsWithNewFindings} from './updateFilingsWithNewFindings.js'
+import {OctokitResponse} from '@octokit/types'
 const OctokitWithThrottling = Octokit.plugin(throttling)
 
 export default async function () {
@@ -22,10 +23,12 @@ export default async function () {
   const cachedFilings: (ResolvedFiling | RepeatedFiling)[] = JSON.parse(
     core.getInput('cached_filings', {required: false}) || '[]',
   )
+  const shouldOpenGroupedIssues = core.getBooleanInput('open_grouped_issues')
   core.debug(`Input: 'findings: ${JSON.stringify(findings)}'`)
   core.debug(`Input: 'repository: ${repoWithOwner}'`)
   core.debug(`Input: 'screenshot_repository: ${screenshotRepo}'`)
   core.debug(`Input: 'cached_filings: ${JSON.stringify(cachedFilings)}'`)
+  core.debug(`Input: 'open_grouped_issues: ${shouldOpenGroupedIssues}'`)
 
   const octokit = new OctokitWithThrottling({
     auth: token,
@@ -48,8 +51,12 @@ export default async function () {
   })
   const filings = updateFilingsWithNewFindings(cachedFilings, findings)
 
+  // Track new issues for grouping
+  const newIssuesByProblemShort: Record<string, FindingGroupIssue[]> = {}
+  const trackingIssueUrls: Record<string, string> = {}
+
   for (const filing of filings) {
-    let response
+    let response: OctokitResponse<IssueResponse> | undefined
     try {
       if (isResolvedFiling(filing)) {
         // Close the filing’s issue (if necessary)
@@ -58,8 +65,19 @@ export default async function () {
       } else if (isNewFiling(filing)) {
         // Open a new issue for the filing
         response = await openIssue(octokit, repoWithOwner, filing.findings[0], screenshotRepo)
-        // eslint-disable-next-line @typescript-eslint/no-explicit-any
-        ;(filing as any).issue = {state: 'open'} as Issue
+        ;(filing as Filing).issue = {state: 'open'} as Issue
+
+        // Track for grouping
+        if (shouldOpenGroupedIssues) {
+          const problemShort: string = filing.findings[0].problemShort
+          if (!newIssuesByProblemShort[problemShort]) {
+            newIssuesByProblemShort[problemShort] = []
+          }
+          newIssuesByProblemShort[problemShort].push({
+            url: response.data.html_url,
+            id: response.data.number,
+          })
+        }
       } else if (isRepeatedFiling(filing)) {
         // Reopen the filing's issue (if necessary) and update the body with the latest finding
         response = await reopenIssue(
@@ -82,11 +100,37 @@ export default async function () {
         )
       }
     } catch (error) {
-      core.setFailed(`Failed on filing: ${filing}\n${error}`)
+      core.setFailed(`Failed on filing: ${JSON.stringify(filing, null, 2)}\n${error}`)
       process.exit(1)
     }
   }
 
+  // Open tracking issues for groups with >1 new issue and link back from each
+  // new issue
+  if (shouldOpenGroupedIssues) {
+    for (const [problemShort, issues] of Object.entries(newIssuesByProblemShort)) {
+      if (issues.length > 1) {
+        const capitalizedProblemShort = problemShort[0].toUpperCase() + problemShort.slice(1)
+        const title: string = `${capitalizedProblemShort} issues`
+        const body: string =
+          `# ${capitalizedProblemShort} issues\n\n` + issues.map(issue => `- [ ] ${issue.url}`).join('\n')
+        try {
+          const trackingResponse = await octokit.request(`POST /repos/${repoWithOwner}/issues`, {
+            owner: repoWithOwner.split('/')[0],
+            repo: repoWithOwner.split('/')[1],
+            title,
+            body,
+          })
+          const trackingUrl: string = trackingResponse.data.html_url
+          trackingIssueUrls[problemShort] = trackingUrl
+          core.info(`Opened tracking issue for '${capitalizedProblemShort}' with ${issues.length} issues.`)
+        } catch (error) {
+          core.warning(`Failed to open tracking issue for '${capitalizedProblemShort}': ${error}`)
+        }
+      }
+    }
+  }
+
   core.setOutput('filings', JSON.stringify(filings))
   core.debug(`Output: 'filings: ${JSON.stringify(filings)}'`)
   core.info("Finished 'file' action")

.github/actions/file/package.json

@@ -18,6 +18,14 @@ export type Issue = {
   state?: 'open' | 'reopened' | 'closed'
 }
 
+export type IssueResponse = {
+  id: number
+  node_id: string
+  number: number
+  html_url: string
+  title: string
+}
+
 export type ResolvedFiling = {
   findings: never[]
   issue: Issue
@@ -34,3 +42,8 @@ export type RepeatedFiling = {
 }
 
 export type Filing = ResolvedFiling | NewFiling | RepeatedFiling
+
+export type FindingGroupIssue = {
+  url: string
+  id: number
+}

.github/actions/file/src/index.ts

@@ -31,6 +31,14 @@ configuration option.
 [`colorScheme`](https://playwright.dev/docs/api/class-browser#browser-new-context-option-color-scheme)
 configuration option.
 
+#### `include_screenshots`
+
+**Optional** Bool - whether to capture screenshots of scanned pages and include links to them in the issue
+
+#### `scans`
+
+**Optional** Stringified JSON array of scans (string) to perform. If not provided, only Axe will be performed.
+
 ### Outputs
 
 #### `findings`

.github/actions/file/src/types.d.ts

@@ -1,33 +1,36 @@
-name: "Find"
-description: "Finds potential accessibility gaps."
+name: 'Find'
+description: 'Finds potential accessibility gaps.'
 
 inputs:
   urls:
-    description: "Newline-delimited list of URLs to check for accessibility issues"
+    description: 'Newline-delimited list of URLs to check for accessibility issues'
     required: true
     multiline: true
   auth_context:
     description: "Stringified JSON object containing 'username', 'password', 'cookies', and/or 'localStorage' from an authenticated session"
     required: false
   include_screenshots:
-    description: "Whether to capture screenshots of scanned pages and include links to them in the issue"
+    description: 'Whether to capture screenshots of scanned pages and include links to them in the issue'
+    required: false
+    default: 'false'
+  scans:
+    description: 'Stringified JSON array of scans to perform. If not provided, only Axe will be performed'
     required: false
-    default: "false"
   reduced_motion:
-    description: "Playwright reducedMotion setting: https://playwright.dev/docs/api/class-browser#browser-new-page-option-reduced-motion"
+    description: 'Playwright reducedMotion setting: https://playwright.dev/docs/api/class-browser#browser-new-page-option-reduced-motion'
     required: false
   color_scheme:
-    description: "Playwright colorScheme setting: https://playwright.dev/docs/api/class-browser#browser-new-context-option-color-scheme"
+    description: 'Playwright colorScheme setting: https://playwright.dev/docs/api/class-browser#browser-new-context-option-color-scheme'
     required: false
 
 outputs:
   findings:
-    description: "List of potential accessibility gaps, as stringified JSON"
+    description: 'List of potential accessibility gaps, as stringified JSON'
 
 runs:
-  using: "node24"
-  main: "bootstrap.js"
+  using: 'node24'
+  main: 'bootstrap.js'
 
 branding:
-  icon: "compass"
-  color: "blue"
+  icon: 'compass'
+  color: 'blue'