feat: Initial commit (#1)

I verified that this branch’s code works:
- Workflow file:
https://github.com/github/accessibility-sandbox/blob/d10b6f3690948ccd65f44f209fdc453564132db1/.github/workflows/continuous-accessibility-scanner.yml
(Hubber access only)
- Successful workflow run:
https://github.com/github/accessibility-sandbox/actions/runs/16604894366
(Hubber access only)

Author: smockle

.github/CODEOWNERS

@@ -0,0 +1 @@
+* @github/accessibility-reviewers

.gitignore

@@ -0,0 +1,3 @@
+dist
+node_modules
+test-results

README.md

@@ -1,2 +1,42 @@
-# automated-a11y-scanning
-To be transferred/customer-facing: sharing our a11y automation with the world
+# continuous-accessibility-scanner
+
+Finds potential accessibility gaps, files GitHub issues to track them, and attempts to fix them with Copilot.
+
+## Usage
+
+### Inputs
+
+#### `urls`
+
+**Required** Newline-delimited list of URLs to check for accessibility issues. For example:
+
+```txt
+https://primer.style
+https://primer.style/octicons/
+```
+
+#### `repository`
+
+**Required** Repository (with owner) to file issues in. For example: `primer/primer-docs`.
+
+#### `token`
+
+**Required** Personal access token (PAT) with fine-grained permissions 'issues: write' and 'pull_requests: write'.
+
+### Example workflow
+
+```YAML
+name: Continuous Accessibility Scanner
+on: workflow_dispatch
+
+jobs:
+  continuous_accessibility_scanner:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: github/continuous-accessibility-scanner@main
+        with:
+          urls: |
+            https://primer.style/octicons/
+          repository: github/accessibility-sandbox
+          token: ${{ secrets.GH_TOKEN }}
+```

action.yml

@@ -0,0 +1,22 @@
+name: "continuous-accessibility-scanner"
+description: "Finds potential accessibility gaps, files GitHub issues to track them, and attempts to fix them with Copilot."
+
+inputs:
+  urls:
+    description: "Newline-delimited list of URLs to check for accessibility issues"
+    required: true
+    multiline: true
+  repository:
+    description: "Repository (with owner) to file issues in"
+    required: true
+  token:
+    description: "Personal access token (PAT) with fine-grained permissions 'issues: write' and 'pull_requests: write'"
+    required: true
+
+runs:
+  using: "node20"
+  main: "bootstrap.js"
+
+branding:
+  icon: "compass"
+  color: "blue"

bootstrap.js

@@ -0,0 +1,57 @@
+#!/usr/bin/env node
+//@ts-check
+
+import fs from 'node:fs'
+import * as url from 'node:url'
+import { spawn } from 'node:child_process'
+
+function spawnPromisified(command, args, options) {
+  return new Promise((resolve, reject) => {
+    const proc = spawn(command, args, options)
+    proc.stdout.setEncoding('utf8')
+    proc.stdout.on('data', (data) => {
+      console.log(data)
+    })
+    proc.stderr.setEncoding('utf8')
+    proc.stderr.on('data', (data) => {
+      console.error(data)
+    })
+    proc.on('close', (code) => {
+      if (code !== 0) {
+        reject(code)
+      } else {
+        resolve(code)
+      }
+    })
+  })
+}
+
+await (async () => {
+  // If dependencies are not vendored-in, install them at runtime.
+  try {
+    await fs.accessSync(
+      url.fileURLToPath(new URL('./node_modules', import.meta.url)),
+      fs.constants.R_OK
+    )
+  } catch {
+    try {
+      await spawnPromisified('npm', ['ci'], {
+        cwd: url.fileURLToPath(new URL('.', import.meta.url))
+      })
+    } catch {
+      process.exit(1)
+    }
+  } finally {
+    // Compile TypeScript.
+    try {
+      await spawnPromisified('npm', ['run', 'build'], {
+        cwd: url.fileURLToPath(new URL('.', import.meta.url))
+      })
+    } catch {
+      process.exit(1)
+    }
+    // Run the main script.
+    const action = await import('./dist/index.js')
+    await action.default()
+  }
+})()