Repository navigation
Conversation
Opt-in input that sets Playwright's ignoreHTTPSErrors on the browser context so the scanner can run against staging hosts with self-signed or invalid certs. Default off; behavior unchanged unless enabled. Closes github#150 Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
…s-errors-self-signed-ssl # Conflicts: # .github/actions/find/action.yml # .github/actions/find/tests/findForUrl.test.ts # README.md
|
Main's newer inputs collided with this one, so a436263 merges main and keeps both: |
helen
left a comment
helen
left a comment
There was a problem hiding this comment.
Looks good to me at a glance, letting tests run and getting a second gut check and then will see if I can go ahead and roll this into the release I am preparing to cut
There was a problem hiding this comment.
🟡 Changes recommended
The HTTPS-error opt-in is missing from authentication, blocking built-in login on self-signed hosts, and the added sixth argument breaks an existing test assertion.
2 open issues
What changed in this PR
Adds an opt-in ignore_https_errors setting for scanning environments with self-signed or invalid certificates, addressing #150. Certificate validation remains enabled by default.
Changes:
- Declares the input and forwards it to the Find action.
- Enables Playwright’s
ignoreHTTPSErrorscontext option only when requested. - Documents the setting and adds tests for enabled, omitted, and disabled values.
| File | Description |
|---|---|
README.md |
Documents the input in the workflow example and inputs table. |
action.yml |
Declares the input and forwards it to Find. |
.github/actions/find/tests/findForUrl.test.ts |
Tests browser-context options for all three input states. |
.github/actions/find/src/index.ts |
Parses the input and passes it to URL scans. |
.github/actions/find/src/findForUrl.ts |
Conditionally enables Playwright’s HTTPS-error bypass. |
.github/actions/find/README.md |
Documents the Find action’s new input. |
.github/actions/find/action.yml |
Declares the optional input with a default of false. |
Review effort: Max (auto)
| includeScreenshots, | ||
| reducedMotion, | ||
| colorScheme, | ||
| ignoreHttpsErrors, |
There was a problem hiding this comment.
Updated in d3018b0. The passes waitForSelectors through to the URL scan assertion now expects the trailing false for the new argument. The index and findForUrl tests pass locally (27/27).
| include_screenshots: ${{ inputs.include_screenshots }} | ||
| reduced_motion: ${{ inputs.reduced_motion }} | ||
| color_scheme: ${{ inputs.color_scheme }} | ||
| ignore_https_errors: ${{ inputs.ignore_https_errors }} |
There was a problem hiding this comment.
Good catch. d3018b0 adds an ignore_https_errors input to the auth action, applies ignoreHTTPSErrors to its browser context when it is true, and the root action.yml now passes the input to Authenticate as well as Find. The auth README documents it. tsc, eslint and prettier are clean on the auth action.
|
@mvanhorn I triggered a Copilot review since I know I was only looking at the diff, comments seem legit so I'll leave it to you to address whenever you want to revisit. @abdulahmad307 mirrored into #293 so that the tests can successfully run, hopefully this time we can merge this one once ready though. |
The built-in login flow ran in a browser context without ignoreHTTPSErrors, so login failed on self-signed hosts before Find could run. Auth now takes the same input and the root action passes it through. The find index test expects the new sixth argument.
|
Pushed d3018b0 for the two review comments. The fork run of |
|
one final request; copilot is suggesting to add this warning to the readme: #294 (comment). If we can get that in, I think we'll be good to merge this PR in (I will close the duplicate PR that I opened - we just used that to run test workflows) |
Added a warning about disabling TLS certificate validation when ignoring HTTPS errors in the README.
|
actually, I added the warning myself in this commit: https://github.com/github/accessibility-scanner/pull/224/commits |
Summary
Adds an
ignore_https_errorsinput so the scanner can run against environments with self-signed or otherwise invalid certificates, e.g. internal staging hosts (#150). Off by default; nothing changes unless explicitly opted in.Changes
action.yml: new optionalignore_https_errorsinput (defaultfalse), documented in the README.index.ts: reads the input (loadIgnoreHttpsErrors) and threads it through to the scan.findForUrl.ts: when enabled, sets Playwright'signoreHTTPSErrors: trueon the browser context; when disabled the context options are untouched.Note: this touches the same file as #223 (the SPA networkidle wait), so whichever lands second may need a trivial rebase; the changes are logically independent.
Testing
vitest run tests/findForUrl.test.ts— 8 passed, including new cases asserting the context getsignoreHTTPSErrorsonly when the input is enabled.Closes #150
AI was used for assistance.