Merging main into v3 for release

.github/ISSUE_TEMPLATE/allowlist-npm-plugin-request.yml

@@ -0,0 +1,23 @@
+name: Allowlist Third Party NPM Plugin Request
+description: Fill out the details to request allowlisting your third party plugin hosted on NPM in the scanner.
+labels: 'allowlist-plugin-request'
+body:
+  - type: input
+    id: npm-package
+    attributes: 
+      label: Link to your plugin on NPM
+    validations:
+      required: true
+  - type: input
+    id: github-repo-link
+    attributes: 
+      label: Link to the source code for your plugin on GitHub
+    validations:
+      required: true
+  - type: textarea 
+    id: plugin-description
+    attributes: 
+      label: What does your plugin do?  
+      description: Please provide a brief description of your plugin's functionality.
+    validations:
+      required: true

.github/actions/find/README.md

@@ -15,6 +15,10 @@ https://primer.style
 https://primer.style/octicons/
 ```
 
+#### `url_configs`
+
+**Optional** Stringified JSON array of per-URL configuration objects. Each object must include a `url` and may include `excludeSelectors` (selectors to exclude from Axe) and `waitForSelectors` (selectors that must become visible within 30 seconds before scanning). When provided, this input takes precedence over `urls`.
+
 #### `auth_context`
 
 **Optional** Stringified JSON object containing `username`, `password`, `cookies`, and/or `localStorage` from an authenticated session. For example: `{"username":"some-user","password":"correct-horse-battery-staple","cookies":[{"name":"theme-preference","value":"light","domain":"primer.style","path":"/"}],"localStorage":{"https://primer.style":{"theme-preference":"light"}}}`

.github/actions/find/action.yml

@@ -7,7 +7,7 @@ inputs:
     required: false
     multiline: true
   url_configs:
-    description: "Stringified JSON array of URL config objects, each with a 'url' field and an optional 'excludeSelectors' field (array of CSS selectors to exclude from the Axe scan for that URL). When provided, takes precedence over the 'urls' input."
+    description: "Stringified JSON array of URL config objects, each with a 'url' field and optional 'excludeSelectors' (selectors to exclude from Axe) and 'waitForSelectors' (selectors that must be visible before scanning) fields. When provided, takes precedence over the 'urls' input."
     required: false
   auth_context:
     description: "Stringified JSON object containing 'username', 'password', 'cookies', and/or 'localStorage' from an authenticated session"
@@ -25,7 +25,6 @@ inputs:
   color_scheme:
     description: 'Playwright colorScheme setting: https://playwright.dev/docs/api/class-browser#browser-new-context-option-color-scheme'
     required: false
-
 outputs:
   findings_file:
     description: 'Path to a JSON file containing the list of potential accessibility gaps'

.github/actions/find/src/findForUrl.ts

@@ -8,14 +8,16 @@ import {loadPlugins, invokePlugin} from './pluginManager/index.js'
 import {getScansContext} from './scansContextProvider.js'
 import * as core from '@actions/core'
 
+const SELECTOR_WAIT_TIMEOUT = 30000
+
 export async function findForUrl(
   urlConfig: UrlConfig,
   authContext?: AuthContext,
   includeScreenshots: boolean = false,
   reducedMotion?: ReducedMotionPreference,
   colorScheme?: ColorSchemePreference,
 ): Promise<Finding[]> {
-  const {url, excludeSelectors} = urlConfig
+  const {url, excludeSelectors, waitForSelectors} = urlConfig
   const browser = await playwright.chromium.launch({
     headless: true,
     executablePath: process.env.CI ? '/usr/bin/google-chrome' : undefined,
@@ -25,51 +27,63 @@ export async function findForUrl(
     ...(reducedMotion ? {reducedMotion} : {}),
     ...(colorScheme ? {colorScheme} : {}),
   }
-  const context = await browser.newContext(contextOptions)
-  const page = await context.newPage()
-  await page.goto(url)
+  let context: playwright.BrowserContext | undefined
+  try {
+    context = await browser.newContext(contextOptions)
+    const page = await context.newPage()
+    await page.goto(url)
+    await Promise.all(
+      (waitForSelectors ?? []).map(selector =>
+        page.locator(selector).waitFor({state: 'visible', timeout: SELECTOR_WAIT_TIMEOUT}),
+      ),
+    )
 
-  const findings: Finding[] = []
-  const addFinding = async (findingData: Finding) => {
-    let screenshotId
-    if (includeScreenshots) {
-      screenshotId = await generateScreenshots(page)
+    const findings: Finding[] = []
+    const addFinding = async (findingData: Finding) => {
+      let screenshotId
+      if (includeScreenshots) {
+        screenshotId = await generateScreenshots(page)
+      }
+      findings.push({...findingData, screenshotId})
     }
-    findings.push({...findingData, screenshotId})
-  }
 
-  try {
-    const scansContext = getScansContext()
+    try {
+      const scansContext = getScansContext()
 
-    if (scansContext.shouldRunPlugins) {
-      const plugins = await loadPlugins()
-      for (const plugin of plugins) {
-        if (scansContext.scansToPerform.includes(plugin.name)) {
-          core.info(`Running plugin: ${plugin.name}`)
-          await invokePlugin({
-            plugin,
-            page,
-            addFinding,
-          })
-        } else {
-          core.info(`Skipping plugin ${plugin.name} because it is not included in the 'scans' input`)
+      if (scansContext.shouldRunPlugins) {
+        const plugins = await loadPlugins()
+        for (const plugin of plugins) {
+          if (scansContext.scansToPerform.includes(plugin.name)) {
+            core.info(`Running plugin: ${plugin.name}`)
+            await invokePlugin({
+              plugin,
+              page,
+              addFinding,
+            })
+          } else {
+            core.info(`Skipping plugin ${plugin.name} because it is not included in the 'scans' input`)
+          }
         }
       }
-    }
 
-    if (scansContext.shouldPerformAxeScan) {
-      await runAxeScan({page, addFinding, excludeSelectors})
-    }
+      if (scansContext.shouldPerformAxeScan) {
+        await runAxeScan({page, addFinding, excludeSelectors})
+      }
 
-    if (scansContext.shouldPerformAccesslintScan) {
-      await runAccesslintScan({page, addFinding})
+      if (scansContext.shouldPerformAccesslintScan) {
+        await runAccesslintScan({page, addFinding})
+      }
+    } catch (e) {
+      core.error(`Error during accessibility scan: ${e}`)
+    }
+    return findings
+  } finally {
+    try {
+      await context?.close()
+    } finally {
+      await browser.close()
     }
-  } catch (e) {
-    core.error(`Error during accessibility scan: ${e}`)
   }
-  await context.close()
-  await browser.close()
-  return findings
 }
 
 async function runAxeScan({

.github/actions/find/src/index.ts

@@ -55,6 +55,13 @@ function loadUrlConfigs() {
       if (typeof item !== 'object' || item === null || typeof item.url !== 'string') {
         throw new Error("Each entry in 'url_configs' must be an object with a 'url' string field.")
       }
+      if (
+        item.waitForSelectors !== undefined &&
+        (!Array.isArray(item.waitForSelectors) ||
+          item.waitForSelectors.some((selector: unknown) => typeof selector !== 'string'))
+      ) {
+        throw new Error("Each 'waitForSelectors' field in 'url_configs' must be an array of CSS selector strings.")
+      }
     }
 
     return parsed as UrlConfig[]

.github/actions/find/src/types.d.ts

@@ -50,4 +50,5 @@ export type ColorSchemePreference = 'light' | 'dark' | 'no-preference' | null
 export type UrlConfig = {
   url: string
   excludeSelectors?: string[]
+  waitForSelectors?: string[]
 }