CI

equall scan . --diff [base] --fail-on <severity>

Compares the change against its base and reports only what the change introduced. Existing debt ("legacy" findings) never fails the check. Identity is a fingerprint, not the line number, so a reformat doesn't read as new.

Nothing leaves your runner: the scan is static, runs on the checked-out code, no account, no token, nothing uploaded.

FlagsCopy Anchor Link

--fail-on only works with --diff. --diff can't be combined with --min-score. Without --fail-on, --diff only reports and always exits 0.

equall scan <dir> --diff limits the diff to <dir>. Paths stay relative to the repository root.

With --diff, --level sets the target level (default AA) and --json prints the diff result. The full-scan options --include, --exclude, --standard and --no-readability are not used: the diff scans every changed .html, .htm, .jsx, .tsx, .vue, .svelte and .astro file, minus the files a full scan skips by default.

Start with --fail-on critical; switch to serious to be stricter.

Exit codesCopy Anchor Link

These apply to --diff. A full scan (without --diff) follows the exit codes on Scanning.

What blocks the mergeCopy Anchor Link

• New WCAG violations at or above --fail-on.

What's reported but never blocksCopy Anchor Link

• New violations below the threshold — a warning.
• New review-only findings — static analysis can't confirm them, flagged "to review".
• New advisory findings — best practice, or above the target conformance level.
• Legacy findings already present in the changed files at the base.
• Changed files that can't be statically tested (CSS, scripts, config) — the count is named in the output.
• Changed files a scanner couldn't analyze — listed as "not checked", since their findings are unknown.
• Files a full scan also skips (tests, stories, build output).

--json prints the diff result as JSON: new_issues, new_review_only, new_advisory, legacy_issues, not_testable, unchecked, excluded, summary.

GitHub annotationsCopy Anchor Link

On GitHub Actions, the check writes annotations on the pull request: errors for new violations at the threshold, warnings below it, notices for review-only and advisory findings, warnings for files not checked. Findings without a line number (axe, markup-level) are annotated at file level and appear in the check summary instead of inline.

GitHub caps annotations at 10 errors and 10 warnings per step. The job summary and the terminal output list everything.

History and shallow clonesCopy Anchor Link

The comparison needs the base branch and the history it shares with the change. Without it, the check exits 2 with a message naming what to fetch.

• GitHub Actions — actions/checkout with fetch-depth: 0.
• GitLab CI — GIT_DEPTH: 0. The base is the merge-base commit GitLab computes (CI_MERGE_REQUEST_DIFF_BASE_SHA).
• Azure Pipelines — checkout: self with fetchDepth: 0.

CI snippetsCopy Anchor Link

GitHub ActionsCopy Anchor Link

Trigger on pull_request, not pull_request_target — the latter checks out the base branch, so the diff is empty.

on: pull_request

jobs:
  a11y:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - uses: actions/setup-node@v4
        with:
          node-version: 22
      - run: npx equall-cli@^0.3.3 scan . --diff --fail-on critical

A ready-made GitHub Action is coming; this snippet is the fallback until then.

GitLab CICopy Anchor Link

a11y:
  image: node:22
  rules:
    - if: $CI_PIPELINE_SOURCE == "merge_request_event"
  variables:
    GIT_DEPTH: 0
  script:
    - npx equall-cli@^0.3.3 scan . --diff --fail-on critical

Azure PipelinesCopy Anchor Link

pr:
  - main

pool:
  vmImage: ubuntu-latest

steps:
  - checkout: self
    fetchDepth: 0
  - task: NodeTool@0
    inputs:
      versionSpec: '22.x'
  - script: npx equall-cli@^0.3.3 scan . --diff --fail-on critical

Generic shell / any CICopy Anchor Link

git fetch origin main
npx equall-cli@^0.3.3 scan . --diff origin/main --fail-on critical

Use the exit code to gate the build.