[dependabot]

Bumps snapsynapse/skill-a11y-audit/.github/actions/scan from 2.7.0 to 3.1.0.

Release notes

Sourced from snapsynapse/skill-a11y-audit/.github/actions/scan's releases.

v3.1.0

Released from commit 6af2c95a56ff058cddf0c6febc71512db1d6d19b through [PR #15](snapsynapse/skill-a11y-audit#15).

Major accessibility acceptance

The additive --fail-on major mode rejects current critical and serious findings, including findings already present in a regression baseline. Moderate, minor, and explicitly best-practice-only findings remain advisory. Mixed standards and best-practice rules retain their normal severity. Unknown-impact violations and major incomplete candidates remain inconclusive; missing coverage and operational errors cannot become a pass. Existing modes and defaults are preserved.

Experimental CLI contract pilot

Explicitly select --contract posix-json-v1 on a11y-audit/scripts/run-audit.js to receive one terminal JSON result on stdout, with diagnostic and child-process output on stderr. The result distinguishes operational completion from gate acceptance, rejection, or inconclusive evidence and preserves raw child outcomes. Reports complete after a substantiated gate rejection. A later operational failure takes precedence while retaining the gate result.

The opt-in path uses exit 0 for accepted or report-only completion, 2 for gate rejection, 3 for inconclusive evidence, and documented operational codes such as 64 for usage errors. Unknown operational failures remain exit 1; retryability is not guessed. See a11y-audit/references/cli-contract.md and the versioned result schema.

Default invocations retain their existing output and exit behavior. This pilot does not migrate every helper CLI or Action to the experimental envelope and introduces no runtime dependency on LocalBrain or GitHub Projects. Broader portfolio adoption remains subsequent work.

Compatibility and identity

Node.js 22.12.0 or later is required, as in v3.0.0. Dependency pins are unchanged. Package version is 3.1.0, skill bundle version is 43, and assistant guide version is 0.3.15. Root and hosted guides are identical: 8,087 bytes, SHA-256 5336f01caff74893df033b4cfc8676631de24eb2c1c7526ac8523ad1a628ea35.

Verification

• PR validation: all ten jobs passed at 3a75fdffb7001c449664e35fde5b94e0497b2c4e, including real PR base/head selection.
• Exact-main validation: all ten jobs passed at the release commit. This covers 29 deterministic validations and 17 CLI cases across Node 22.12.0, 22, 24 and 26; browser and real CLI consumers run on Node 22.12.0, 24 and 26.
• Hosted Action and isolated consumer checks passed, including fresh browser acquisition, cache reuse and stale-install repair. Root/scanner audits, pinned GuideCheck 0.7.0, actionlint and zizmor passed.
• The initial PR browser jobs exposed a missing test dependency install. The corrected workflow installs the committed root validation graph before browser tests; all checks then passed without runtime or dependency-pin changes.
• Pages deployment passed at the release commit. All ten live public files matched the clean build byte-for-byte, and the nonexistent-route check returned HTTP 404.
• The exact Git archive extraction passed a fresh locked validation install, four real external CLI consumer scenarios (accepted 0, rejected with report 2, report-only 0, missing coverage 1), clean site build and offline search checks.

Distribution

The tar.gz and zip archives contain every tracked file from the release commit, plus these release notes. Both archives are checked against the Git source blobs, and SHA256SUMS records their digests. Existing ignored files and local dependencies are excluded. Distribution remains GitHub release archives; the private npm package is not published to the npm registry.

The repository's preparation records are snapshots from before final publication. This release record and the linked immutable hosted runs provide the final publication evidence. No consumer site's findings or regression baseline were rewritten by this tool release.

v3.0.0: Node 22.12+ and Puppeteer 25

v3.0.0

Released 2026-09-05 from commit 3aba59f6ca726fe155ecf5464c80d547b7d667e0.

Upgrade requirement

Node.js 22.12.0 or later is required. Node 18 and 20 are no longer supported. The reusable Action defaults to Node 22; pin it to v3.0.0 for this release. The managed scanner graph pins Puppeteer 25.10.0 and axe-core 4.12.1.

Changes

• Breaking: root and scanner package metadata and lockfiles require Node.js

  =22.12.0. Node 18 and 20 support ends with this major version.

... (truncated)

Commits

• 6af2c95 Merge pull request #15 from snapsynapse/codex/a11y-v3.1.0-cli-pilot
• 3a75fdf Install CLI consumer validation dependencies in browser CI
• 7f62965 Record approval for v3.1.0 publication
• ba4d6cc Prepare v3.1.0 release metadata and local validation record
• f180997 Add opt-in JSON CLI contract with verified gate outcomes
• e9ffec4 Add major accessibility gate and record CLI pilot scope
• 3aba59f Release v3.0.0: Node 22 and Puppeteer 25 (#13)
• 5a0c963 Release v2.8.1 (#12)
• 25f8a18 Fix scan-time dependency resilience (#11)
• 6df2b8e release: prepare v2.8.0 interoperability adapter (#10)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)