Consent QA in CI

Run cookie consent regression checks from GitHub Actions.

ScanBell checks a public release URL in fresh default, reject, and accept browser states, then writes a compact technical QA result to the GitHub job summary.

Minimal workflow step

- uses: tmrp/scanbell-action@v1
  with:
    url: https://www.example.com
    fail_on: never

The action returns a scan ID, score, combined high/critical count, and total finding count. It remains non-blocking by default so teams can review their baseline before deciding whether to gate releases.

What the check observes

• Requests, recognized tracker heuristics, and cookie attributes before a choice.
• Whether a visible reject-like control can be found and activated.
• Signals that persist in a fresh reject state.
• A conditional accept-state comparison when the page exposes a clear control.

Opt in to a release gate

Set fail_on: high only after reviewing the site's baseline. A high or critical technical finding then fails the action. Detection confidence remains visible because automated consent-control matching and tracker classification can be incomplete.

Public targets and bounded evidence

The hosted action accepts public HTTP(S) URLs on standard web ports. It does not support authenticated or private environments. Page content, IP addresses, user agents, referrers, cookie values, and browser-storage values are not persisted.