CI and code scanning

Add it to a workflow

Run the audit, write a SARIF log, then hand the log to code scanning. The two steps are independent, so the audit still fails the job on its own.

name: Icons
on: [push, pull_request]

jobs:
  iconlens:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - uses: oven-sh/setup-bun@v2
        with:
          bun-version: 1.3.x

      - name: Install iconlens
        run: curl -fsSL https://raw.githubusercontent.com/srivtx/iconlens/main/install.sh | sh

      - name: Audit icons
        run: iconlens --dir src/assets/icons --sarif iconlens.sarif

      - name: Upload SARIF
        if: always()
        uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: iconlens.sarif

What a SARIF result contains

Each issue becomes one SARIF result:

• ruleId is the rule code, such as SVG-NAME-001.
• level is mapped from severity: error → error, warning → warning, info → note.
• The physical location points at the file, so the annotation lands on the pull request.
• properties.severity and properties.wcag carry the original values.

Failing the build

Without --sarif, the exit code is the gate. iconlens --dir icons/ exits 1 on any error-severity issue. Add --fail-on warning to fail on warnings too. The flag changes only the exit code; the report is the same either way.

$ iconlens --dir src/assets/icons --fail-on warninglogo.svg  errors:3  warnings:2  info:0ERROR    SVG-NAME-001   Root svg has role="img" but no accessible name.WARNING  SVG-USE-007    <use> references missing target "#missing".exit 1