feat: add ignore_https_errors input for scanning self-signed SSL environments

.github/actions/auth/README.md

@@ -21,6 +21,15 @@ Authenticate with Playwright and save session state. Supports HTTP Basic and for
 > [!IMPORTANT]
 > Don’t put passwords in your workflow as plain text; instead reference a [repository secret](https://docs.github.com/en/actions/how-tos/write-workflows/choose-what-workflows-do/use-secrets#creating-secrets-for-a-repository).
 
+#### `ignore_https_errors`
+
+**Optional** Bool - whether to ignore HTTPS errors when logging in to hosts with self-signed certificates.
+
+[!WARNING]
+Enabling this disables TLS certificate validation for the authentication step itself. If an attacker can intercept traffic, they can present an untrusted certificate and capture submitted credentials (including HTTP Basic auth and form passwords) and resulting session cookies/storage.
+
+Use this only in trusted test/staging environments. For shared workflows, prefer a separate explicit opt-in for auth flows (for example, `auth_ignore_https_errors`) so certificate checks are not unintentionally disabled during credentialed requests.
+
 ### Outputs
 
 #### `auth_context`

.github/actions/auth/action.yml

@@ -11,6 +11,10 @@ inputs:
   password:
     description: "Password"
     required: true
+  ignore_https_errors:
+    description: "Whether to ignore HTTPS errors when logging in to hosts with self-signed certificates"
+    required: false
+    default: "false"
 
 outputs:
   auth_context:

.github/actions/auth/src/index.ts

@@ -15,6 +15,7 @@ export default async function () {
     const username = core.getInput('username', {required: true})
     const password = core.getInput('password', {required: true})
     core.setSecret(password)
+    const ignoreHttpsErrors = core.getInput('ignore_https_errors', {required: false}).toLowerCase() === 'true'
 
     // Launch a headless browser
     browser = await playwright.chromium.launch({
@@ -27,6 +28,7 @@ export default async function () {
         username,
         password,
       },
+      ...(ignoreHttpsErrors ? {ignoreHTTPSErrors: true} : {}),
     })
     page = await context.newPage()
 

.github/actions/find/README.md

@@ -35,6 +35,10 @@ configuration option.
 [`colorScheme`](https://playwright.dev/docs/api/class-browser#browser-new-context-option-color-scheme)
 configuration option.
 
+#### `ignore_https_errors`
+
+**Optional** Bool - whether to ignore HTTPS errors when scanning URLs with self-signed certificates.
+
 #### `include_screenshots`
 
 **Optional** Bool - whether to capture screenshots of scanned pages and include links to them in the issue

.github/actions/find/action.yml

@@ -25,6 +25,11 @@ inputs:
   color_scheme:
     description: 'Playwright colorScheme setting: https://playwright.dev/docs/api/class-browser#browser-new-context-option-color-scheme'
     required: false
+  ignore_https_errors:
+    description: 'Whether to ignore HTTPS errors when scanning URLs with self-signed certificates'
+    required: false
+    default: 'false'
+
 outputs:
   findings_file:
     description: 'Path to a JSON file containing the list of potential accessibility gaps'

.github/actions/find/src/findForUrl.ts

@@ -23,6 +23,7 @@ export async function findForUrl(
   includeScreenshots: boolean = false,
   reducedMotion?: ReducedMotionPreference,
   colorScheme?: ColorSchemePreference,
+  ignoreHttpsErrors: boolean = false,
 ): Promise<Finding[]> {
   const {url, excludeSelectors, waitForSelectors} = urlConfig
   const browser = await playwright.chromium.launch({
@@ -33,6 +34,7 @@ export async function findForUrl(
     ...(authContext?.toPlaywrightBrowserContextOptions() ?? {}),
     ...(reducedMotion ? {reducedMotion} : {}),
     ...(colorScheme ? {colorScheme} : {}),
+    ...(ignoreHttpsErrors ? {ignoreHTTPSErrors: true} : {}),
   }
   let context: playwright.BrowserContext | undefined
   try {

.github/actions/find/src/index.ts

@@ -11,6 +11,7 @@ export default async function () {
   const urls = loadUrls({urlConfigs})
   const reducedMotion = loadReducedMotion()
   const colorScheme = loadColorScheme()
+  const ignoreHttpsErrors = loadIgnoreHttpsErrors()
 
   const actualUrls = urlConfigs || urls || []
 
@@ -22,7 +23,14 @@ export default async function () {
   for (const urlConfig of actualUrls) {
     const {url} = urlConfig
     core.info(`Preparing to scan ${url}`)
-    const findingsForUrl = await findForUrl(urlConfig, authContext, includeScreenshots, reducedMotion, colorScheme)
+    const findingsForUrl = await findForUrl(
+      urlConfig,
+      authContext,
+      includeScreenshots,
+      reducedMotion,
+      colorScheme,
+      ignoreHttpsErrors,
+    )
     if (findingsForUrl.length === 0) {
       core.info(`No accessibility gaps were found on ${url}`)
       continue
@@ -108,3 +116,7 @@ function loadColorScheme() {
 
   return colorSchemeInput as ColorSchemePreference
 }
+
+function loadIgnoreHttpsErrors() {
+  return core.getInput('ignore_https_errors', {required: false}).toLowerCase() === 'true'
+}

.github/actions/find/tests/findForUrl.test.ts

@@ -392,4 +392,35 @@ describe('findForUrl', () => {
       expect(await categoryFor(['wcag2a', 'experimental'])).toBe('experimental')
     })
   })
+
+  describe('when ignoreHttpsErrors is enabled', () => {
+    it('forwards ignoreHTTPSErrors to the browser context', async () => {
+      actionInput = ''
+      clearAll()
+
+      await findForUrl({url: 'test.com'}, undefined, false, undefined, undefined, true)
+
+      expect(playwrightMocks.browserNewContext).toHaveBeenCalledWith({ignoreHTTPSErrors: true})
+    })
+  })
+
+  describe('when ignoreHttpsErrors is not enabled', () => {
+    it('does not forward ignoreHTTPSErrors by default', async () => {
+      actionInput = ''
+      clearAll()
+
+      await findForUrl({url: 'test.com'})
+
+      expect(playwrightMocks.browserNewContext).toHaveBeenCalledWith({})
+    })
+
+    it('does not forward ignoreHTTPSErrors when explicitly disabled', async () => {
+      actionInput = ''
+      clearAll()
+
+      await findForUrl({url: 'test.com'}, undefined, false, undefined, undefined, false)
+
+      expect(playwrightMocks.browserNewContext).toHaveBeenCalledWith({})
+    })
+  })
 })

.github/actions/find/tests/index.test.ts

@@ -43,7 +43,7 @@ describe('url_configs', () => {
 
     await find()
 
-    expect(mocks.findForUrl).toHaveBeenCalledWith(urlConfig, expect.anything(), false, undefined, undefined)
+    expect(mocks.findForUrl).toHaveBeenCalledWith(urlConfig, expect.anything(), false, undefined, undefined, false)
   })
 
   it('rejects waitForSelectors values that are not arrays of strings', async () => {

README.md

@@ -61,6 +61,7 @@ jobs:
           # dry_run: false # Optional: Set to true to scan and log what would be filed without creating/closing issues or writing the cache
           # reduced_motion: no-preference # Optional: Playwright reduced motion configuration option
           # color_scheme: light # Optional: Playwright color scheme configuration option
+          # ignore_https_errors: false # Optional: Set to true to ignore HTTPS errors when scanning URLs with self-signed certificates
           # scans: '["axe","accesslint","reflow-scan"]' # Optional: An array of scans (or plugins) to be performed. Built-in engines are 'axe' and 'accesslint'; any other entry is a plugin name. If not provided, only Axe will be performed.
           # url_configs: '[{"url":"https://example.com","excludeSelectors":["iframe","#widget"],"waitForSelectors":["#app","[data-ready]"]}]' # Optional: Per-URL config with CSS selectors to exclude from Axe or wait for before scanning. When provided, takes precedence over 'urls'.
 ```
@@ -137,6 +138,7 @@ Trigger the workflow manually or automatically based on your configuration. The
 | `file_experimental_issues`  | No       | Whether to file issues for experimental findings (checks that are not yet stable). Set to `false` to suppress new experimental issues; existing ones are left untouched. Default: `true`                                                                         | `false`                                                                     |
 | `reduced_motion`            | No       | Playwright `reducedMotion` setting for scan contexts. Allowed values: `reduce`, `no-preference`                                                                                                                                                                  | `reduce`                                                                    |
 | `color_scheme`              | No       | Playwright `colorScheme` setting for scan contexts. Allowed values: `light`, `dark`, `no-preference`                                                                                                                                                             | `dark`                                                                      |
+| `ignore_https_errors`       | No       | Whether to ignore HTTPS errors when scanning URLs with self-signed certificates. Default: `false`                                                                                                                                                                | `true`                                                                      |
 | `scans`                     | No       | An array of scans (or plugins) to be performed. Built-in engines are `axe` and `accesslint`; any other entry is treated as a plugin name. If not provided, only Axe will be performed.                                                                           | `'["axe", "accesslint", ...other plugins]'`                                 |
 | `dry_run`                   | No       | When `true`, scan and log the issues that _would_ be filed without opening, closing, reopening, or assigning any issues — and without writing to the `gh-cache` branch. Useful for safely previewing results. Default: `false`                                   | `true`                                                                      |
 | `url_configs`               | No       | A stringified JSON array of URL config objects. Each object must have a `url` field and may have `excludeSelectors` (selectors to exclude from Axe) and `waitForSelectors` (selectors that must become visible within 30 seconds before scanning). When provided, takes precedence over the `urls` input. | `'[{"url":"https://example.com","excludeSelectors":["iframe","#widget"],"waitForSelectors":["#app"]}]'` |

action.yml

@@ -63,6 +63,10 @@ inputs:
   color_scheme:
     description: 'Playwright colorScheme setting: https://playwright.dev/docs/api/class-browser#browser-new-context-option-color-scheme'
     required: false
+  ignore_https_errors:
+    description: 'Whether to ignore HTTPS errors when scanning URLs with self-signed certificates'
+    required: false
+    default: 'false'
   scans:
     description: "Stringified JSON array of scans to perform. Core engines and local plugins use string names. Allowlisted NPM plugins use an object with 'name', 'package', and optional 'version'. If not provided, only Axe will be performed"
     required: false
@@ -123,6 +127,7 @@ runs:
         login_url: ${{ inputs.login_url }}
         username: ${{ inputs.username }}
         password: ${{ inputs.password }}
+        ignore_https_errors: ${{ inputs.ignore_https_errors }}
     - name: Find
       id: find
       uses: ./../../_actions/github/accessibility-scanner/current/.github/actions/find
@@ -133,6 +138,7 @@ runs:
         include_screenshots: ${{ inputs.include_screenshots }}
         reduced_motion: ${{ inputs.reduced_motion }}
         color_scheme: ${{ inputs.color_scheme }}
+        ignore_https_errors: ${{ inputs.ignore_https_errors }}
         scans: ${{ inputs.scans }}
     - name: File
       id: file