Fix NPM plugin module resolution - #252
Merged
Merged
Conversation
Install runtime NPM plugins from the Find action root so bare ESM imports resolve the same node_modules tree from source and compiled loaders. Add a cross-workspace integration test against the released alt-text plugin. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 8b9119b6-5862-4597-b7d9-ad1522e125f4
taarikashenafi
marked this pull request as ready for review
July 28, 2026 23:19
taarikashenafi
requested review from
JoyceZhu,
Copilot and
joshfarrant
and removed request for
Copilot and
joshfarrant
July 28, 2026 23:19
Install published plugins beside the active source or compiled loader so ESM resolution works without re-resolving the Find action's locked dependencies. Align scanner docs and tests with the released alt-text plugin workflow syntax. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 8b9119b6-5862-4597-b7d9-ad1522e125f4
Contributor
There was a problem hiding this comment.
Pull request overview
Fixes runtime resolution of npm plugins by installing them beside the compiled loader.
Changes:
- Uses an explicit npm installation prefix.
- Adds unit and integration coverage.
- Updates plugin documentation to v1.1.0.
Show a summary per file
| File | Description |
|---|---|
README.md |
Updates plugin version example. |
PLUGINS.md |
Documents version requirements and plugin v1.1.0. |
action.yml |
Clarifies the scans input format. |
.github/actions/find/tests/pluginNpmLoader.test.ts |
Verifies prefixed installation. |
.github/actions/find/tests/pluginNpmLoader.integration.test.ts |
Tests installation outside the consumer workspace. |
.github/actions/find/tests/findForUrl.test.ts |
Covers combined Axe and npm plugin input. |
.github/actions/find/src/pluginManager/pluginNpmLoader.ts |
Installs plugins beside the loader module. |
.github/actions/find/README.md |
Documents object-form npm plugins. |
Review details
Tip
Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
- Files reviewed: 8/8 changed files
- Comments generated: 1
- Review effort level: Medium
Remove the source-local node_modules tree created by the published package integration test so every run leaves the checkout clean. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 8b9119b6-5862-4597-b7d9-ad1522e125f4
JoyceZhu
approved these changes
Jul 29, 2026
Merged
taarikashenafi
added a commit
that referenced
this pull request
Jul 30, 2026
## Summary Cuts the v3.4.1 patch release to fix NPM plugin module resolution introduced in v3.4.0. ## Fix NPM plugins are now installed beside the compiled Find action loader, allowing Node to resolve and import them correctly when the scanner runs from a consumer repository (#252). This fixes the failure encountered when loading: ```yaml scans: | ["axe", {"name": "alt-text-scan", "package": "@github/accessibility-scanner-alt-text-plugin", "version": "1.1.0"}]
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
v3.4.0 installs NPM plugins from the consumer workspace, then imports them from the Find action. The install succeeds, but Node can't resolve the package from
dist/pluginManager/pluginNpmLoader.js.This happened in the alt text plugin workflow after switching to the new package object in #62.
This installs the package beside the loader module with an explicit npm prefix. In the action that's
dist/pluginManager/node_modules, so the bare ESM import finds it without usingGITHUB_WORKSPACE. Keeping the install out of the Find action root also avoids npm re-resolving the action's own dependencies.The allowlist, version pinning,
--ignore-scripts,--no-save,--no-package-lock, duplicate handling, and warnings are unchanged.I tested the exact input from #62:
In a clean scanner copy with a separate consumer cwd, the published 1.1.0 package loaded from the compiled action. A local page produced both the plugin's
placeholder-alt-textfinding and Axe'sbutton-namefinding. The Find action's dependency versions were unchanged after the install.Also ran all 82 action tests, lint, format check, and the Find build. I updated the scanner docs that still showed plugin 1.0.0 or described
scansas strings only.This needs a scanner v3.4.1 after merge. The plugin stays on v1.1.0, then its workflow pin can move from the v3.4.0 commit to the v3.4.1 commit.