ci: PR smoke test for a11y-scan SPM plugin (end-to-end scan)

[Crash0v3rrid3]

What

Adds .github/workflows/spm-smoke-test.yml — a GitHub Actions workflow that smoke-tests the a11y-scan SwiftPM command plugin end-to-end on every PR.

On a macOS runner it:

1. cd tests/spm && swift build — compiles the a11y-scan command plugin (via the path dependency) and the sample sources. (The repo root is a plugin-only package with no buildable target, so it is not built directly.)
2. cd tests/spm && swift test with RUN_A11Y_SCAN=1 + credentials — this un-gates the repo's existing testA11yScanPluginRuns, which runs scripts/run-a11y-scan.sh --non-strict (a real scan: downloads the BrowserStack CLI, authenticates, scans the sample SwiftUI sources with intentional a11y issues) and asserts exit 0.

It reuses the harness the repo already ships (tests/spm/) rather than duplicating the swift package plugin … scan invocation, so there's a single source of truth for how the plugin is run.

Design notes

• Fork-safe. The scan needs BROWSERSTACK_USERNAME / BROWSERSTACK_ACCESS_KEY, and secrets are never exposed to fork PRs. The job is gated with github.event.pull_request.head.repo.fork == false (plus workflow_dispatch for manual runs). Fork PRs skip the job instead of failing.
• Degrades gracefully. If the secrets aren't configured yet, testA11yScanPluginRuns XCTSkips and the job still passes (build + unit test only) — so merging this doesn't turn the tree red before secrets are added.
• --non-strict is used by the underlying test, so planted a11y issues in the sample views don't fail the run — a clean exit means the whole download → auth → scan pipeline worked.
• actions/checkout is pinned by SHA (v4.2.2) to match Semgrep.yml / verify-selfupdate-checksums.yml (supply-chain hardening, DEVA11Y-476).

Verified locally (macOS, Swift 6.2)

• tests/spm swift build → Compiling plugin a11y-scan + sample sources, build complete.
• tests/spm swift test (no RUN_A11Y_SCAN) → testLibraryIdentity passes, testA11yScanPluginRuns skips, exit 0. Confirms the no-secrets path stays green.
• The full authenticated scan path was not run locally (no creds on this machine); it exercises on CI once the secrets are set.

⚠️ Required before this actually runs the scan

Add two repo secrets (Settings → Secrets and variables → Actions):

• BROWSERSTACK_USERNAME
• BROWSERSTACK_ACCESS_KEY

Until then the job passes but the e2e scan self-skips.

Notes / open questions

• Covers the SwiftPM harness (tests/spm/). The tests/xcode-app/ build-phase harness is not wired up here — happy to add an Xcode job in a follow-up if you want CI to cover that integration path too.
• No DEVA11Y ticket linked yet — branch is chore/spm-pr-smoke-test; rename/link as needed.

🤖 Generated with Claude Code

[Crash0v3rrid3]

Smoke gate is green ✅ — and it caught a real pre-existing bug

The first CI run failed at the scan step:

error: Plugin 'a11y-scan' wants permission to allow all network connections on ports: 80, 443. Use `--allow-network-connections all:80,443` to allow this.

Root cause (not in the workflow): the harness scripts passed --allow-network-connections 'all(ports: [])' — that's PackageDescription API syntax pasted into a CLI flag, and the empty port list didn't satisfy the plugin's declared need for ports 80/443. This had never been exercised in CI before, so it went unnoticed. Fixed to all:80,443 in:

• tests/spm/scripts/run-a11y-scan.sh
• tests/xcode-app/scripts/run-a11y-scan.sh
• tests/spm/README.md

After the fix, the end-to-end scan runs and passes (42s) with the repo secrets. BROWSERSTACK_USERNAME / BROWSERSTACK_ACCESS_KEY are clearly already configured on the repo — the scan authenticated and completed.

(Non-blocking) The Node 20 deprecation warning is from actions/checkout v4.2.2, which the repo's other workflows also pin — left as-is for consistency.