Skip to content

Conversation

@marcusquinn
Copy link
Owner

Summary

  • Adds WAVE API integration to accessibility-helper.sh for comprehensive CSS/JS-rendered accessibility analysis
  • New commands: wave, wave-mobile, wave-docs, wave-credits — covering all 4 WAVE report types with desktop and mobile viewport support
  • Integrates WAVE into the existing audit command alongside Lighthouse and pa11y (gracefully skips if no API key)
  • Secure API key loading via gopass (encrypted) or credentials.sh (plaintext fallback)
  • Hardened URL encoding (passes URL via sys.argv to avoid shell injection)
  • Updated documentation in both accessibility-audit.md and accessibility.md with usage examples, report type reference, and API key setup instructions
  • Updated subagent-index.toon to reflect WAVE API capability

Quality

  • ShellCheck: zero violations
  • Bash syntax: valid
  • Follows existing patterns: local var="$1", explicit returns, shared-constants integration
  • All WAVE functions follow the same error handling pattern as existing Lighthouse/pa11y functions

Testing

  • bash -n syntax validation passes
  • shellcheck passes clean
  • WAVE API integration follows documented API at https://wave.webaim.org/api/
  • URL encoding hardened against shell injection (sys.argv instead of string interpolation)

Task

Closes t215.4

@gemini-code-assist
Copy link

Summary of Changes

Hello @marcusquinn, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request significantly enhances the accessibility auditing capabilities by incorporating the WAVE API. This integration allows for more comprehensive analysis of web pages, including those rendered with CSS and JavaScript, and provides new dedicated commands for various WAVE functionalities. The changes improve the overall robustness and utility of the accessibility helper script, making it a more powerful tool for identifying and addressing accessibility issues.

Highlights

  • WAVE API Integration: Integrated the WAVE API into accessibility-helper.sh to provide comprehensive CSS/JS-rendered accessibility analysis, complementing existing Lighthouse and pa11y audits.
  • New Commands: Introduced new commands: wave for general audits, wave-mobile for mobile viewport analysis, wave-docs for looking up WAVE item documentation, and wave-credits to check API credit balance.
  • Enhanced Audit Command: The existing audit command now gracefully integrates WAVE API analysis alongside Lighthouse and pa11y, automatically skipping if no API key is configured.
  • Secure API Key Management: Implemented secure loading of the WAVE API key via gopass (encrypted) or a credentials.sh file (plaintext fallback), and added support for an environment variable.
  • Robust URL Handling: Hardened URL encoding by passing URLs via sys.argv to a Python script, mitigating potential shell injection vulnerabilities.
  • Updated Documentation: Updated accessibility-audit.md and accessibility.md with detailed usage examples, report type references, API key setup instructions, and an updated subagent-index.toon.
Changelog
  • .agents/scripts/accessibility-helper.sh
    • Added WAVE API endpoint constants and a note about API request limits.
    • Implemented load_wave_api_key function to retrieve the API key from gopass, credentials file, or environment variables.
    • Created run_wave_audit function to execute WAVE API audits, including URL encoding, HTTP request handling, and API response parsing.
    • Developed parse_wave_report function to display WAVE API results, including statistics, category summaries, and item details.
    • Added run_wave_mobile function for performing WAVE audits with a mobile viewport.
    • Implemented wave_docs function to fetch and display documentation for specific WAVE items.
    • Created wave_credits function to check the remaining WAVE API credits.
    • Modified run_full_audit to conditionally include WAVE API analysis if an API key is available.
    • Extended the main function to support new commands: wave, wave-mobile, wave-docs, and wave-credits.
    • Updated the help message to list the new WAVE commands, report types, and the WAVE_API_KEY environment variable.
  • .agents/services/accessibility/accessibility-audit.md
    • Updated the quick commands section to include examples for wave and wave with XPath.
    • Modified the audit workflow table to reflect the inclusion of WAVE API for web (desktop and mobile) and its contribution to color contrast data.
    • Updated the summary table to add entries for comprehensive WAVE API analysis, element-level issues, mobile accessibility, and item documentation.
  • .agents/subagent-index.toon
    • Updated the purpose description for accessibility-helper.sh to explicitly mention WAVE API integration.
  • .agents/tools/accessibility/accessibility.md
    • Updated the quick reference commands to include wave.
    • Added WAVE API to the list of tools used for comprehensive analysis.
    • Introduced a new dedicated section for 'WAVE API Analysis', detailing its purpose, usage examples for different report types, mobile audits, documentation lookup, and credit checks.
    • Provided instructions for WAVE API key setup using aidevops secret set or an environment variable.
    • Added WAVE API to the integration table, highlighting its capabilities.
    • Included WAVE_API_KEY in the environment variables section.
    • Updated the report storage section to list wave_YYYYMMDD_HHMMSS.json as a generated report file.
Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature Command Description
Code Review /gemini review Performs a code review for the current pull request in its current state.
Pull Request Summary /gemini summary Provides a summary of the current pull request in its current state.
Comment @gemini-code-assist Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help /gemini help Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here.

You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.

Footnotes

  1. Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution.

Copy link

@gemini-code-assist gemini-code-assist bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code Review

This pull request adds a significant new feature by integrating the WAVE API for accessibility analysis. The implementation is well-structured, with new commands for different WAVE functionalities and integration into the existing audit command. The documentation updates are comprehensive and clear. I've identified a few areas for improvement regarding adherence to the style guide, script efficiency, and user feedback. Overall, this is a great addition, and my comments are focused on making the script more robust and performant.

Comment on lines +154 to +156
http_code=$(curl -s -w "%{http_code}" -o "$report_file" \
--max-time "$LONG_TIMEOUT" \
"$api_url" 2>/dev/null) || {

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

medium

Redirecting curl's stderr to /dev/null violates the repository style guide (rule #50) and can hide important error messages (e.g., certificate issues, DNS problems), making debugging difficult. Please remove 2>/dev/null to allow curl errors to be visible. The || block will still correctly handle network-level failures that cause curl to exit with a non-zero status. This issue is also present in wave_docs and wave_credits.

Suggested change
http_code=$(curl -s -w "%{http_code}" -o "$report_file" \
--max-time "$LONG_TIMEOUT" \
"$api_url" 2>/dev/null) || {
http_code=$(curl -s -w "%{http_code}" -o "$report_file" \
--max-time "$LONG_TIMEOUT" \
"$api_url") || {
References
  1. Rule docs: update branch creation to recommend worktrees for parallel sessions #50 states that 2>/dev/null is acceptable only when redirecting to log files, not for blanket suppression. The current usage hides potentially important curl errors from the user, making debugging harder. (link)

Comment on lines +330 to +335
title=$(echo "$result" | jq -r '.title // "N/A"')
type=$(echo "$result" | jq -r '.type // "N/A"')
summary=$(echo "$result" | jq -r '.summary // "N/A"')
purpose=$(echo "$result" | jq -r '.purpose // "N/A"')
actions=$(echo "$result" | jq -r '.actions // "N/A"')
details=$(echo "$result" | jq -r '.details // "N/A"')

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

medium

This function makes multiple calls to jq on the same JSON data, which is inefficient as it forks a new process for each variable. You can extract all required values with a single jq call for better performance and to make the code more robust if values contain special characters. This pattern is repeated in wave_credits as well.

Suggested change
title=$(echo "$result" | jq -r '.title // "N/A"')
type=$(echo "$result" | jq -r '.type // "N/A"')
summary=$(echo "$result" | jq -r '.summary // "N/A"')
purpose=$(echo "$result" | jq -r '.purpose // "N/A"')
actions=$(echo "$result" | jq -r '.actions // "N/A"')
details=$(echo "$result" | jq -r '.details // "N/A"')
mapfile -t values < <(echo "$result" | jq -r '.title // "N/A", .type // "N/A", .summary // "N/A", .purpose // "N/A", .actions // "N/A", .details // "N/A"')
title="${values[0]}"
type="${values[1]}"
summary="${values[2]}"
purpose="${values[3]}"
actions="${values[4]}"
details="${values[5]}"

echo ""

# WAVE API (if key is available)
if load_wave_api_key 2>/dev/null; then

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

medium

Suppressing the stderr of load_wave_api_key prevents the user from seeing the detailed and helpful error messages that the function provides when an API key cannot be found. This makes it harder for users to diagnose setup issues. The else block provides a generic message, but the specific instructions from load_wave_api_key are more valuable. Please remove 2>/dev/null.

Suggested change
if load_wave_api_key 2>/dev/null; then
if load_wave_api_key; then

…is (t215.4)

Integrate WAVE API v3.1 into accessibility-helper.sh with full CLI support:
- wave: run WAVE analysis with configurable report types (1-4)
- wave-mobile: mobile viewport (375px) analysis
- wave-docs: look up WAVE item documentation (no API key needed)
- wave-credits: check remaining API credits
- Automatic inclusion in full audit when API key is available
- Secure credential loading via gopass/env/credentials.sh

Decision: chose report type 2 as default (item details) — balances
cost (2 credits) with useful detail. Type 1 (stats only) is too
sparse for actionable remediation; types 3/4 available for deep dives.
- Pass URL via sys.argv instead of string interpolation in python3 URL
  encoder — prevents shell injection when URLs contain single quotes
- Update subagent-index.toon to mention WAVE API in accessibility-helper
  description
@marcusquinn marcusquinn merged commit 98a469d into main Feb 10, 2026
7 of 8 checks passed
@github-actions
Copy link

🔍 Code Quality Report

�[0;35m[MONITOR]�[0m Code Review Monitoring Report

�[0;34m[INFO]�[0m Latest Quality Status:
SonarCloud: 0 bugs, 0 vulnerabilities, 35 code smells

�[0;34m[INFO]�[0m Recent monitoring activity:
Tue Feb 10 15:53:42 UTC 2026: Code review monitoring started
Tue Feb 10 15:53:43 UTC 2026: SonarCloud - Bugs: 0, Vulnerabilities: 0, Code Smells: 35

📈 Current Quality Metrics

  • BUGS: 0
  • CODE SMELLS: 35
  • VULNERABILITIES: 0

Generated on: Tue Feb 10 15:53:46 UTC 2026


Generated by AI DevOps Framework Code Review Monitoring

@coderabbitai
Copy link
Contributor

coderabbitai bot commented Feb 10, 2026

Warning

Rate limit exceeded

@marcusquinn has exceeded the limit for the number of commits that can be reviewed per hour. Please wait 15 minutes and 16 seconds before requesting another review.

⌛ How to resolve this issue?

After the wait time has elapsed, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout.

Please see our FAQ for further information.

✨ Finishing touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Post copyable unit tests in a comment
  • Commit unit tests in branch feature/t215.4

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands and usage tips.

@sonarqubecloud
Copy link

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant