# axe-linter-action

A GitHub Action to lint for any accessibility issues in your pull requests.

## Input

### `api_key`

**Required** Your API key for axe-linter.

### `axe_linter_url`

**Optional** The URL for the axe-linter API. Defaults to `https://axe-linter.deque.com`.

\* To request an API key for axe-linter, please visit [accessibility.deque.com/linter-contact-us](https://accessibility.deque.com/linter-contact-us). Once provisioned please visit [https://docs.deque.com/linter/1.0.0/en/axe-linter-api-key](https://docs.deque.com/linter/1.0.0/en/axe-linter-api-key) to get your API key.

## Example Usage

Create a file in your repository called `.github/workflows/axe-linter.yml` with the following contents:

```yaml
name: Lint for accessibility issues

on:
  - pull_request

concurrency:
  group: ${{ github.workflow }}-${{ github.head_ref || github.ref }}
  cancel-in-progress: true # Cancel things if new events come in to conserve resources.

jobs:
  build:
    runs-on: ubuntu-latest
    permissions:
      contents: read # Required to check out the repository
      pull-requests: read # Required to read the pull request
    steps:
      - name: Checkout Repository
        uses: actions/checkout@<commit-sha> # v6.0.2
      - name: Run Axe Linter
        uses: dequelabs/axe-linter-action@<commit-sha> # v2.x.y
        with:
          api_key: ${{ secrets.AXE_LINTER_API_KEY }}
          github_token: ${{ secrets.GITHUB_TOKEN }}
```

## Pinning the action version

The example above pins each action to a full-length commit SHA, with a trailing
comment noting the human-readable version it corresponds to. This is the
recommended approach for supply-chain safety — the action you run can never
change underneath you:

```yaml
- uses: dequelabs/axe-linter-action@<commit-sha> # v2.x.y
```

Replace each `<commit-sha>` with a SHA from that action's own releases or
tags page — for axe-linter-action, its
[releases](https://github.com/dequelabs/axe-linter-action/releases) or
[tags](https://github.com/dequelabs/axe-linter-action/tags) page — and let
[Dependabot](https://docs.github.com/en/code-security/dependabot/working-with-dependabot/keeping-your-actions-up-to-date-with-dependabot)
keep the pins up to date for you.

## Step summary

Every run writes a [job step summary](https://docs.github.com/actions/using-workflows/workflow-commands-for-github-actions#adding-a-job-summary)
to the workflow run page with a detailed accounting of what happened:

- **All findings**, grouped per file — not just the first few. GitHub caps
  inline annotations at 10 per step, so the summary is the place to see the
  complete list.
- **Skipped files** (empty or over the size limit) and why they were skipped.
- On failure, a clear explanation and the error, so a run that goes wrong is
  easier to debug.

## Limitation

There is a limitation on the amount of annotations that can be made per step.

- 10 warning annotations
- 10 error annotations

If there are more errors, they will not appear as inline annotations. All
findings are still listed in full in the [step summary](#step-summary), and the
complete details are also available in the action logs.

Additional information can be found in [this GitHub discussion](https://github.com/orgs/community/discussions/26680).

Individual files larger than 900,000 bytes are skipped and logged as a warning. The axe-linter API has a 1 MB request size cap, so oversized files are filtered out pre-emptively to avoid 413 server request errors.