Scan every pull request

Overview

The ADAGuard GitHub App scans the preview of every pull request and posts the accessibility score and issues as a PR comment and a GitHub check. It finds the preview URL on its own, or you can point it at any URL with a .adaguard.yml config file in your repo.

Installation

1. 1
   Install the GitHub App

   Click "Install on GitHub" above. Select the repositories you want to scan. On Free the App scans 3 pull requests a month, public or private; after that it asks you to sign in or upgrade, and the 3 start again on the 1st. Paid plans scan every pull request.
2. 2
   Open a pull request

   That's it. ADAGuard scans when the pull request is opened or updated, and again when its preview deployment reports success.
3. 3
   View the results

   The score, the issues and fix links appear in one PR comment, updated on every push. A check named "ADAGuard Accessibility" shows the score.
4. 4
   Optional: add .adaguard.yml

   Add .adaguard.yml to your repo root to set the URL to scan, the standard, or (Business and up) a minimum score.

How It Works

ADAGuard scans when a pull request is opened, updated or reopened, and again when GitHub reports that its preview deployment succeeded (deployment_status). The result is posted back as a PR comment and a check as soon as the scan finishes. The URL it scans is, in order: the URL you set (in Settings → Integrations or .adaguard.yml), the preview URL from the deployment event, or a preview URL found in the pull request description. It checks the pull request’s preview, not your live site: deployments your host marks as production, including GitHub Pages, are skipped. Nothing to set up.

Open or update a pull request
  → your platform deploys a preview
    → GitHub reports the deployment (deployment_status)
      → ADAGuard picks the URL
        → runs the accessibility scan (up to 1 minute)
          → posts the PR comment and the check

If no deployment event fires (e.g. your repo doesn’t use a preview platform), you can still set a custom URL in .adaguard.yml and the app will scan it on every PR.

Auto-detected Platforms

When no URL is set, the App finds the preview itself. These platforms report their preview to GitHub, so it is picked up automatically:

• Vercel
• Netlify
• Railway
• Render
• Cloudflare Pages

These don’t report previews to GitHub. Paste the preview URL into the pull request description (for example Preview: https://your-app.fly.dev) and it is picked up on the next push:

• Fly.io
• Heroku review apps
• AWS Amplify
• Surge.sh
• GitHub Pages

On any other host, set a custom URL and every pull request scans it.

Comment and Check

ADAGuard keeps one comment per pull request and updates it on every push. It always shows one thing: the result, or what to do when there is no result (sign in, upgrade, a missing preview, a preview behind a login).

• The result: the score, what changed since the last scan (paid plans), and the issues — the top 5 on Free, all of them on paid plans — each with its element, WCAG criteria and a fix link. On Professional and up, step-by-step fixes are included. A score of 90 or more with no issues is a one-line comment.
• The check is named ADAGuard Accessibility. It passes at 70 or above and is neutral below — it never fails unless you ask it to. On Business and up you can make it fail below a score, on any critical or serious issue, or both, in Settings → Integrations or .adaguard.yml. To stop a merge, also make it a required status check in your branch protection rules.
• Ignored issues: issue kinds you ignore (Settings → Integrations or ignore_rules) are left out of the comment and the check; the comment says how many. The score is unchanged.
• Before you sign in: the App scans 3 pull requests. On the next one, the comment asks you to sign in to ADAGuard, and scanning continues once you do.

Plan Limits

A private repository takes a slot the first time one of its pull requests is scanned. Over the hourly or daily cap, the check says “Scan skipped — rate limit reached” and the next push scans again once the cap resets. View full pricing →

.adaguard.yml

Drop this file in your repo root to customise behaviour. All fields are optional — the app works with zero configuration.

# .adaguard.yml

# Scan this URL on every pull request instead of the detected preview.
# url: https://staging.your-site.com

# What the check's score counts (default wcag21-aa). A law (ada, section508,
# en301549, aoda, aca) or a WCAG version and level (wcag22-aa, wcag21-aaa ...).
# standard: wcag22-aa

# Make the check fail (Business and Enterprise). Off unless you set it.
# fail_on_score_below: 70
# fail_on_critical: true

# Leave these kinds of issues out of the comment and the check:
# color-contrast, missing-alt-text, form-labels, heading-structure,
# link-text, aria, keyboard — or an exact issue type from a result.
# ignore_rules:
#   - color-contrast

# Pages to scan per pull request (default 1, maximum 3).
max_pages: 1

# Scan this path of the preview, e.g. when its home page needs a login.
# The first entry is scanned on every pull request.
# public_pages:
#   - /pricing

# When a pull request has several deployments, scan the one matching this glob.
# scan_deployment_pattern: "web-*.vercel.app"

Custom URL

By default the App scans the preview it detects. To scan a different URL — your staging environment, production site or any other — set it in Settings → Integrations (“Scan this address instead”) or with the url field:

# Always scan this URL on every PR, regardless of deployment events
url: https://staging.your-site.com

This is useful when your repo doesn’t use a preview platform, when you want to scan a shared staging environment, or when you want to test production instead of the PR preview.

Protected Previews

If your previews are protected, the App reaches a login page instead of your app, and the comment says so. Give ADAGuard a way in, in Settings → Integrations → your repository → Preview protection, where it is stored encrypted:

• Vercel Deployment Protection: the bypass secret (Vercel → your project → Settings → Deployment Protection).
• HTTP Basic auth (for example Netlify or Render password protection): the username and password.
• Cloudflare Access: a service token’s client ID and secret.

README Badge

Show the latest pull-request score in your README. The badge and a public report page update after each scan:

[![Accessibility](https://api.adaguard.io/badge/gh/OWNER/REPO/badge.svg)](https://www.adaguard.io/report/gh/OWNER/REPO)

Replace OWNER/REPO with your repository. The score is against WCAG 2.1 AA, so it means the same thing on every repository.

Troubleshooting

Still stuck? Email support@adaguard.io with your repo name and PR link.

FAQ