GITHUB APP

Scan every pull request

Accessibility scanning on every pull request — automatic, zero config, works with any URL.

Overview

The ADAGuard GitHub App scans any URL on every pull request and posts the accessibility score and issues as a PR comment with a GitHub Check Run. It auto-detects the preview deployment URL from the PR — or you can point it at any URL you want via a .adaguard.yml config file in your repo.

Zero config

Install once, every PR gets scanned. No setup required.

Any URL

Scan the auto-detected preview or set a custom URL.

GitHub Check Run

Pass/fail status directly in the PR — block merges on critical issues.

Install on GitHub Manage Integration

Installation

Install the GitHub App
Click "Install on GitHub" above. Select the repositories you want to scan. The free tier covers 1 private repository; public repositories are unlimited on every plan.
Open a pull request
That's it. The app listens for deployment events on your PRs. When your CI pushes a deployment, ADAGuard scans it automatically.
View the results
An accessibility score, issue list, and fix links appear as a PR comment. A GitHub Check Run shows pass or fail.
Optional: add .adaguard.yml
Drop a .adaguard.yml in your repo root to customise the URL, set a score threshold, or ignore specific rules.

How It Works

When you open or update a PR, GitHub sends a deployment_status event when your CI finishes deploying. ADAGuard receives the event, detects the URL, and kicks off a scan. Results are posted back to GitHub as a PR comment and a Check Run within seconds of the scan finishing.

Push to branch
  → CI deploys preview
    → GitHub fires deployment_status event
      → ADAGuard detects URL
        → Runs accessibility scan
          → Posts PR comment + Check Run

If no deployment event fires (e.g. your repo doesn’t use a preview platform), you can still set a custom URL in .adaguard.yml and the app will scan it on every PR.

Auto-detected Platforms

When no url is set in .adaguard.yml, the app detects the preview URL from the GitHub deployment event. These platforms send deployment events that ADAGuard can read automatically:

Vercel
Netlify
Railway
Fly.io
Cloudflare Pages
AWS Amplify
Heroku
Render
Surge.sh

Don’t use any of these? No problem — set a custom URL in .adaguard.yml and it works with any deployment setup.

Plan Limits

Feature	Free	Starter	Professional and up
Private repositories	1	2	5 (Business/Enterprise: unlimited)
Public repositories	Unlimited	Unlimited	Unlimited
Issues shown per PR	Top 5	All	All
Fix guide links	Yes	Yes	Yes
Regression tracking	No	Yes	Yes
Block merge on critical	No	No	Business+
Max pages per scan	1	1	Up to 3

View full pricing →

.adaguard.yml

Drop this file in your repo root to customise behaviour. All fields are optional — the app works with zero configuration.

.ADAGUARD.YML

# .adaguard.yml

# Set a custom URL to scan on every PR.
# If omitted, the app scans the auto-detected preview deployment URL.
# url: https://your-site.com

# Block merge when score drops below this threshold (paid plans).
fail_on_score_below: 70

# What the check's score counts (default wcag21-aa). A law (ada, section508,
# en301549, aoda, aca) or a WCAG version and level (wcag22-aa, wcag21-aaa ...).
# standard: wcag22-aa

# Suppress specific rule types (use the "type" field from scan results).
ignore_rules:
  - broken-links-redirect

# Vercel bypass token for protected preview deployments.
# Get it from: Vercel Dashboard → Project → Settings → Deployment Protection
# vercel_bypass_token: your-secret-here

# Max pages to scan per PR (default 1, up to 3 on paid plans).
max_pages: 1

Field	Type	Default	Description
url	string	auto	Custom URL to scan. Overrides the auto-detected preview URL.
fail_on_score_below	int 0–100	null	Fail the Check Run when score drops below this value. Paid plans only.
standard	string	wcag21-aa	What the score counts: ada, section508, en301549, aoda, aca, or a WCAG version and level (wcag22-aa). Findings beyond it are listed, not scored.
ignore_rules	string[]	[]	Issue type strings to suppress from results.
vercel_bypass_token	string	null	Vercel Deployment Protection bypass secret.
max_pages	int 1–3	1	Pages to scan per PR. Capped to plan limit.

Custom URL

By default the app scans the preview deployment URL detected from the GitHub deployment event. To scan a different URL — your staging environment, production site, or any URL — set the url field:

.ADAGUARD.YML

# Always scan this URL on every PR, regardless of deployment events
url: https://staging.your-site.com

This is useful when your repo doesn’t use a preview platform, when you want to scan a shared staging environment, or when you want to test production instead of the PR preview.

Vercel Bypass Token

If your Vercel previews use Deployment Protection, the app will hit the login wall instead of your app. Add your bypass token to let ADAGuard through.

.ADAGUARD.YML

vercel_bypass_token: your-bypass-secret-here

Where to get it: Vercel Dashboard → your project → Settings → Deployment Protection → copy the bypass secret.

Keep it secret. Do not commit it in plain text — use a GitHub secret and reference it, or rely on the dashboard integration in Settings → Integrations which stores it encrypted.

Troubleshooting

My PR was never scanned — no comment, no Check Run

Confirm the app is installed on this repository: GitHub → Settings → Integrations → ADAGuard.
Check your private repo count against your plan limit (Free = 1 private repo; public repos are unlimited). The app posts a one-time limit notice when exceeded.
If your platform doesn't send deployment events (see Auto-detected Platforms above), set url: in .adaguard.yml so the app always has something to scan.
Closed or merged PRs are never scanned — deployment events that arrive after merge are ignored.

The comment says "Preview URL Not Found"

Your CI may not be emitting a deployment_status event. Paste the preview URL into the PR description (e.g. "Preview: https://your-app.fly.dev") and push again.
Or set a permanent scan URL: dashboard Settings → Integrations → your repo → Scan URL override, or url: in .adaguard.yml.

I got a very low score and the report mentions a login page

ADAGuard hit an authentication wall instead of your app. For Vercel Deployment Protection, add your bypass token (see Vercel Bypass Token above).
If your app itself requires login, point the scan at a public page or your production URL instead.

The wrong deployment was scanned (e.g. my API instead of the frontend)

When a PR triggers multiple deployments, ADAGuard picks the most likely frontend URL. The "Tested" row in the PR comment shows which one.
To pin it, set scan_deployment_pattern: "frontend-*.vercel.app" (glob) or a fixed url: in .adaguard.yml.

The same PR has a stale comment after I pushed a fix

ADAGuard updates its existing comment in place on every push. If it looks stale, the scan may have timed out (2-minute limit) — check the Check Run status, then push again to retry.

Still stuck? Email support@adaguard.io with your repo name and PR link.

FAQ

Does it work without a .adaguard.yml file?

Yes. Zero config needed. The app auto-detects the preview deployment URL from the PR and scans it. Add .adaguard.yml only when you want to customise the URL, score threshold, or ignored rules.

Will it scan every push or just PRs?

Only pull requests. The app listens for deployment_status events tied to a PR and ignores main-branch deploys to avoid unnecessary scans.

Does the GitHub App use the same scan quota as the API?

No — they're metered independently. The GitHub App is limited by number of repositories installed (see Plan Limits above: private repos — Free 1, Starter 2, Professional 5, Business/Enterprise unlimited; public repos unlimited on every plan), not by the monthly scan count the API and dashboard use. Installing the App and calling the API against the same site draws from two separate pools, not one shared quota.

Can I get GitHub App scan results through the API?

Not today. The PR comment and Check Run are the only outputs of a GitHub App scan — those results aren't stored in a place GET /v1/scan or GET /v1/scans can read. If you need scan results back in your own tooling, use the API directly (see the API docs) instead of, or alongside, the App.