@binclusive/a11y 0.1.0 → 0.1.2

package/README.md

@@ -4,19 +4,21 @@ A local accessibility checker for React/TSX code, grounded in a real-world audit
 
 > **It runs entirely on your machine. No network, no account, no upload — your code never leaves the laptop.** That's not a privacy policy, it's how it's built: there's nothing to upload. Point it at a private repo with zero hesitation.
 
-This is a private review build. Clone it, point it at any React codebase (yours, ours), and see what it finds — no setup, no explanation needed.
+This is a private review build. Clone it, point it at any React codebase (yours or ours), and see what it finds — no setup, no explanation needed.
 
 > **New here? Start with the [Getting Started](docs/GETTING-STARTED.md) walkthrough.** Zero to your first fix — install, `init`, wire your editor, read a finding, clear it, gate CI.
+>
+> **Just want it on your PRs?** The [CI Quickstart](docs/QUICKSTART-CI.md) is the 5-minute path — copy [`examples/github-actions/a11y.yml`](examples/github-actions/a11y.yml), open a PR, read the findings. No account, no secret.
 
 ---
 
 ## See it in 30 seconds
 
-On **an open-source component library's own demo app**, `eslint-plugin-jsx-a11y` (the linter everyone runs) passes the docs search box **clean** — while a11y-checker catches its unlabeled `<Input>`, ranks it (`22/26 orgs`), and hands you the fix.
+On **shadcn/ui's own `taxonomy` app**, `eslint-plugin-jsx-a11y` (the linter everyone runs) passes the docs search box **clean** — while a11y-checker catches its unlabeled `<Input>`, ranks it (`22/26 orgs`), and hands you the fix.
 
-![a11y-checker vs eslint on a component library demo app](demo/component-library.gif)
+![a11y-checker vs eslint on shadcn/ui taxonomy](demo/taxonomy.gif)
 
-**▶ [Watch all five demos →](demo/README.md)** — the head-to-head above, a getting-started walkthrough on an open-source monorepo, the `binclusive.json` config reference, the state of accessibility across 31 OSS repos, and the agentic self-fix loop. Each is a replayable [asciinema](https://asciinema.org) cast (`asciinema play demo/<name>.cast`), not just a GIF.
+**▶ [Watch all five demos →](demo/README.md)** — the head-to-head above, a getting-started walkthrough on the cal.com monorepo, the `binclusive.json` config reference, the state of accessibility across 31 OSS repos, and the agentic self-fix loop. Each is a replayable [asciinema](https://asciinema.org) cast (`asciinema play demo/<name>.cast`), not just a GIF.
 
 ---
 
@@ -33,7 +35,7 @@ That's the whole thing. It scans every `.tsx` under the folder and prints a cove
 
 No clone handy? Point it at this repo's own test fixtures: `pnpm scan ./test/fixtures`.
 
-> **No React source?** (A live site, an ASP.NET/Razor app, plain HTML.) The same checker can render a real page in a browser and audit the live DOM — `pnpm scan:url https://example.com`. See **[Auditing HTML & live pages (non-React)](#auditing-html--live-pages-non-react)** below.
+> **No React source?** (A live site, an ASP.NET/Razor app, plain HTML.) The same checker can render a real page in a browser and audit the live DOM — `pnpm scan:url https://www.example.com`. See **[Auditing HTML & live pages (non-React)](#auditing-html--live-pages-non-react)** below.
 
 > **Using your own design system?** (Almost everyone is.) A cold scan leaves most of your components in `declare` — *that's expected, not a failure.* To turn on its best trick (finding bugs *inside* your own components), it needs to know which of your components are buttons, inputs, etc. You don't write that by hand:
 >
@@ -88,19 +90,19 @@ There's also a **second producer**: a rendered-DOM collector that drives a real
 
 ## Auditing HTML & live pages (non-React)
 
-The scan above works on `.tsx` source. But not every page *has* React source on disk — a deployed customer site, an ASP.NET/Razor app, a plain HTML/Bootstrap/jQuery page. For those, point the checker at the **rendered page** instead of the source:
+The scan above works on `.tsx` source. But not every page *has* React source on disk — a deployed site, an ASP.NET/Razor app, a plain HTML/Bootstrap/jQuery page. For those, point the checker at the **rendered page** instead of the source:
 
 ```bash
 pnpm exec playwright install chromium   # one-time: the browser the render path drives
 ```
 
 ```bash
-pnpm scan:url https://example.com       # any deployed URL
+pnpm scan:url https://www.example.com   # a deployed site
 pnpm scan:url http://localhost:5000     # your local dev server
 pnpm scan:url ./wwwroot/index.html      # a local static .html file (bare path works)
 ```
 
-`<target>` takes an `http(s)://` URL, a `file://` URL, or a **bare local path** (auto-converted to `file://`). Under the hood it renders the page in real Chromium (via Playwright), runs **axe-core** against the live DOM, then flows every finding through the *same* corpus / WCAG / enforcement machinery as the source scan — so a contrast bug on example.com comes back tiered and gated exactly like a missing label in your `.tsx`.
+`<target>` takes an `http(s)://` URL, a `file://` URL, or a **bare local path** (auto-converted to `file://`). Under the hood it renders the page in real Chromium (via Playwright), runs **axe-core** against the live DOM, then flows every finding through the *same* corpus / WCAG / enforcement machinery as the source scan — so a contrast bug on a live site comes back tiered and gated exactly like a missing label in your `.tsx`.
 
 This is the source-less path — one command audits any live site, React or not.
 
@@ -134,9 +136,12 @@ jobs:
   a11y:
     runs-on: ubuntu-latest
     steps:
+      # fetch-depth: 0 — the a11y diff scan needs base history; a shallow clone finds 0 changed files (a11y#198)
       - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
       - id: a11y
-        uses: Binclusive/a11y-checker-plugin@main
+        uses: Binclusive/a11y@v0.1.1
       - if: always()  # advisory gate exits 0; upload regardless of findings
         uses: github/codeql-action/upload-sarif@v3
         with:
@@ -148,6 +153,12 @@ provenance (`deterministic` vs `agent`) in the SARIF property bag. The SARIF
 file exists only to render on **your** GitHub — it carries file/line for local
 annotation and is never sent to the Binclusive dashboard.
 
+> **Pin for supply-chain safety.** The examples pin to the released tag
+> `@v0.1.1`. For production, pin to a commit SHA — `uses:
+> Binclusive/a11y@<sha>  # v0.1.1` — rather than a floating tag or branch, so a
+> moved tag can't silently change what runs in your CI. Dependabot
+> (`github-actions` ecosystem) will bump the pin for you.
+
 ### Optional — opt into a blocking check (default off)
 
 The check is **non-blocking by default**: it exits 0 on any severity or volume of
@@ -163,7 +174,7 @@ way.
 
 ```yaml
       - id: a11y
-        uses: Binclusive/a11y-checker-plugin@main
+        uses: Binclusive/a11y@v0.1.1
         with:
           fail-on: critical    # optional — block only on critical findings
           # max-violations: 0  # optional — block on any finding at all
@@ -188,7 +199,7 @@ means "lane off", never an error; the scan still exits 0.
 
 ```yaml
       - id: a11y
-        uses: Binclusive/a11y-checker-plugin@main
+        uses: Binclusive/a11y@v0.1.1
         with:
           llm-api-key:  ${{ secrets.LLM_API_KEY }}  # optional — your BYOK model key
           llm-model:    ""                          # optional — override the model
@@ -218,7 +229,7 @@ does not, and nothing new crosses the wire.
 
 ```yaml
       - id: a11y
-        uses: Binclusive/a11y-checker-plugin@main
+        uses: Binclusive/a11y@v0.1.1
         with:
           binclusive-app-id:          ${{ vars.BINCLUSIVE_APP_ID }}
           binclusive-app-private-key: ${{ secrets.BINCLUSIVE_APP_PRIVATE_KEY }}
@@ -238,7 +249,7 @@ artifact:
 
 ```sh
 docker run --rm -v "$PWD:/workspace" -w /workspace -e A11Y_PLATFORM=null \
-  ghcr.io/binclusive/a11y-checker:latest \
+  ghcr.io/binclusive/a11y:latest \
   check /workspace/src --ci --format sarif > a11y.sarif
 ```
 
@@ -259,6 +270,7 @@ native platform adapters build on, are in **[`docs/CI.md`](docs/CI.md)**.
 |---|---|
 | **Adopt it with your own design system** | **`WALKTHROUGH.md`** |
 | **Run it on any CI/CD (CircleCI / Jenkins / Drone / generic)** | **`docs/CI.md`** |
+| **Ready-made configs for GitLab / CircleCI / Buildkite / Jenkins / Bitbucket** | **[`examples/ci/`](examples/ci/)** |
 | **Audit a live URL or HTML page (non-React)** | **`docs/AUDIT-URL.md`** |
 | The pitch + the moat, with numbers | `docs/decks/numbers.html` |
 | Real findings on real OSS projects | `docs/decks/showcase.html` |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@binclusive/a11y",
-  "version": "0.1.0",
+  "version": "0.1.2",
   "type": "module",
   "description": "Local accessibility checker for React/TSX, grounded in axe-core's published rule catalog. Runs entirely on your machine — no network, no upload.",
   "main": "./src/index.ts",
@@ -15,7 +15,7 @@
   ],
   "repository": {
     "type": "git",
-    "url": "git+https://github.com/Binclusive/a11y-checker-plugin.git"
+    "url": "git+https://github.com/Binclusive/a11y.git"
   },
   "publishConfig": {
     "registry": "https://registry.npmjs.org",
@@ -56,6 +56,8 @@
     "mcp": "tsx ./src/mcp.ts",
     "gen:baseline": "tsx ./src/baseline/gen-baseline.ts",
     "typecheck": "tsc --noEmit",
+    "decisions:check": "tsx ./scripts/check-decisions.ts",
+    "check:action-pin": "node ./scripts/check-action-pin.mjs",
     "test": "vitest run",
     "//test:e2e": "Rendered-DOM e2e (real Chromium). Excluded from `test`. CI must run `npx playwright install chromium` first.",
     "test:e2e": "vitest run --config vitest.e2e.config.ts",
@@ -63,6 +65,9 @@
     "matrix:run": "tsx experiments/stack-matrix/run.ts",
     "matrix:report": "tsx experiments/stack-matrix/report.ts",
     "matrix:baseline": "tsx experiments/stack-matrix/baseline.ts",
-    "matrix:check": "tsx experiments/stack-matrix/check.ts"
+    "matrix:check": "tsx experiments/stack-matrix/check.ts",
+    "android:matrix:run": "tsx experiments/android-matrix/run.ts",
+    "android:matrix:baseline": "tsx experiments/android-matrix/baseline.ts",
+    "android:matrix:check": "tsx experiments/android-matrix/check.ts"
   }
 }