Add url_configs input to skip CSS selectors per URL from Axe scan

[Copilot]

Tracking issue with context: #212

Embedded iframes, third-party widgets, and user-generated content often should not be scanned. This adds a url_configs input — a stringified JSON array of objects each with a url field and an optional excludeSelectors field — that allows per-URL CSS selector exclusion via AxeBuilder.exclude() before analyze() is called. When url_configs is provided, it takes precedence over the urls input.

Changes

• action.yml (root) — New url_configs input; urls is now optional (required when url_configs is not provided); both forwarded to the find step
• .github/actions/find/action.yml — New url_configs input declared; urls made optional
• find/src/types.d.ts — New UrlConfig type: { url: string; excludeSelectors?: string[] }
• find/src/index.ts — Parses and validates url_configs JSON; when present, uses it instead of urls; passes each URL's excludeSelectors to findForUrl
• find/src/findForUrl.ts — findForUrl and runAxeScan accept exclude?: string[]; selectors applied via axeBuilder.exclude() before analyze()
• README.md — url_configs input documented in the inputs table and getting-started example; urls marked as conditionally required

Usage

- uses: github/accessibility-scanner@v1
  with:
    url_configs: '[{"url":"https://example.com","excludeSelectors":["iframe","#third-party-widget"]},{"url":"https://example.com/about"}]'
    repository: owner/repo
    token: ${{ secrets.GH_TOKEN }}
    cache_key: cached_results.json

The urls input continues to work as before when url_configs is not provided.

[abdulahmad307]

Actually, I don't think this is the right approach. It would make more sense if each page/url had its own exclude list. We might want to introduce a new urlConfig input that takes a list of objects with the url as a field, and any other configuration options (as opposed to the current flat list of urls). We can keep the old flat url list as an input too for those who don't need the extra configurability

[abdulahmad307]

@copilot please adjust this PR with the following:

1. replace the new input with one called 'urlConfig' - this should be a list of objects that have a 'url' as a field, and another field called 'excludeSelectors'. excludeSelectors should be a list of strings that are css selectors
2. if the urlConfig input is passed in, favor that over the 'urls' input, and use this list to scan urls
3. for each url in the urlConfig list, in the file 'findForUrl', assign the exclude list to the playwright instance before performing the scan.
4. update all related inputs/files (dont forget to update the action.yml files - both for 'find' and the root action.yml file)

[Copilot]

@copilot please adjust this PR with the following:

1. replace the new input with one called 'urlConfig' - this should be a list of objects that have a 'url' as a field, and another field called 'excl...

Done in commit 88d20c3. Here's a summary of the changes:

1. url_config input — replaces exclude. Accepts a stringified JSON array of objects with a url field and an optional excludeSelectors field (array of CSS selectors):

   url_config: '[{"url":"https://example.com","excludeSelectors":["iframe","#widget"]},{"url":"https://example.com/about"}]'

2. Precedence — when url_config is provided, it's used instead of urls. Both root and find action.yml files updated; urls is now optional in both.

3. Per-URL exclusion — in findForUrl, the excludeSelectors for each URL are applied via axeBuilder.exclude() before analyze().

4. Validation — url_config JSON is validated to be an array of objects each with a url string field, with clear error messages.

5. Docs — README.md and both action.yml files updated.