CI/CD integration recipes

The CLI is a single Node binary — npx -y theaccessible-audit-ci audit works in every CI environment that has Node ≥ 20. Below are copy-paste configs for the most common platforms.

In all examples, set THEACCESSIBLE_API_KEY as a masked secret in the platform’s secrets UI, never inline.

GitLab CI

.gitlab-ci.yml

accessibility-audit:
  image: node:20-alpine
  stage: test
  script:
    - npx -y theaccessible-audit-ci audit
  artifacts:
    when: always
    paths:
      - .theaccessible/
    reports:
      sast: .theaccessible/audit-report.sarif
  allow_failure: true   # advisory mode; remove for blocking

CI_COMMIT_SHA, CI_COMMIT_REF_NAME, and CI_PROJECT_PATH are auto-detected.

CircleCI

.circleci/config.yml

version: 2.1
jobs:
  accessibility-audit:
    docker:
      - image: cimg/node:20.0
    steps:
      - checkout
      - run: npx -y theaccessible-audit-ci audit
      - store_artifacts:
          path: .theaccessible

Add THEACCESSIBLE_API_KEY under Project Settings → Environment Variables.

Jenkins (declarative pipeline)

pipeline {
  agent { docker { image 'node:20-alpine' } }
  environment { THEACCESSIBLE_API_KEY = credentials('theaccessible-api-key') }
  stages {
    stage('Accessibility audit') {
      steps {
        sh 'npx -y theaccessible-audit-ci audit'
      }
      post {
        always {
          archiveArtifacts artifacts: '.theaccessible/**', allowEmptyArchive: true
          recordIssues tools: [sarif(pattern: '.theaccessible/audit-report.sarif')]
        }
      }
    }
  }
}

Bitbucket Pipelines

bitbucket-pipelines.yml

pipelines:
  pull-requests:
    '**':
      - step:
          name: Accessibility audit
          image: node:20-alpine
          script:
            - npx -y theaccessible-audit-ci audit
          artifacts:
            - .theaccessible/**

Argo Workflows / Tekton

The CLI exits with the codes documented in the CLI README — wrap it in your normal pod-step semantics and gate the next step on 0.

Branch protection

Pair the action with GitHub branch protection rules:

1. Settings → Branches → Add rule on main.
2. Check Require status checks to pass before merging.
3. Add theaccessible/audit to the required list.

When the gate is in advisory mode the status check still posts as success — so this is safe to set up before flipping to blocking.

Self-hosted

Override the API host:

export THEACCESSIBLE_API_URL="https://audit.yourcorp.example.com"
npx -y theaccessible-audit-ci audit

The Action exposes the same toggle via the api-url input.