GitLab CI

Run accessibility checks in every merge request

Use the same wcagc check contract in GitLab CI: test preview URLs, compare findings with a baseline, and make the pipeline verdict explicit.

Create an API key

Add the pipeline template

Store the API key and target URLs as CI/CD variables, then add the reusable jobs. Merge requests only compare; the default branch owns baseline updates.

.wcagc-check:
  image: node:24-alpine
  script:
    - npx --yes github:WCAG-Compliance/wcagc-ci#v1

wcagc-merge-request:
  extends: .wcagc-check
  rules:
    - if: '$CI_PIPELINE_SOURCE == "merge_request_event"'

wcagc-default-branch-baseline:
  extends: .wcagc-check
  variables:
    WCAGC_FAIL_ON: none
    WCAGC_SET_BASELINE: "true"
  rules:
    - if: '$CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH'

Configure CI/CD variables

Keep configuration explicit and credentials out of the repository.

WCAGC_API_KEY
Required masked secret with scans:read and scans:write scopes. Do not expose it to untrusted fork pipelines.
WCAGC_URLS
Required newline- or comma-separated registered URLs, with a maximum of 20 per check.
WCAGC_FAIL_ON
Use new-critical by default, or choose any-critical, serious-or-worse, or none.
WCAGC_SET_BASELINE
Set true only in the protected default-branch job so review pipelines cannot rewrite the comparison point.

Treat merge-request pipelines as a trust boundary

GitLab protected variables are available only to eligible protected refs unless you explicitly relax that policy. Review fork and protected-variable settings before running external contributions.

Plain output and predictable exit codes

The CLI prints severity counts, new findings, the report link, and the automation-coverage limitation. PASS exits 0, a failed check or runtime error exits 1, and invalid configuration exits 2.