the scanner is finding the same issues multiple times even after the copilot PR is applied.

[ag039dp]

I tried to document my findings for this, hopefully it makes sense. The short version is that the scanner is opening multiple issues for the same finding in a single run, and is also reopening the same issues/prs even though they have already been applied and merged.

multiple issues for the same finding.docx

[ag039dp]

update, adding gh-cache file in case it helps any. we are using this repo to test scanner stuff so it's been run a lot but maybe it will show something useful. the last 4 findings are from the most recent scan, it didn't find the same button3 color contrast issue as the previous three scans. instead if found an issue with the color contrast on button4 in the same file. it sure would be nice if it would open one issue per file, and also if it would find all the issues the first time instead of taking repetitive scans.

[ag039dp]

gh-cache-tn-mw-mgmt-main.json

[ag039dp]

I think the actual issue is that copilot opens multiple PRs for the same file for but i can only apply on PR at a time., so it changes one thing. then i apply the next PR and so on until all the findings from one scan are fixed. but because things like color contrast are being changed one at a time, the changes cause new contrast issues that are discovered in the next scan. it's a circle that i've gone around about 5 times now on this particular repo.

[Th3S4mur41]

Having the same problem, the scanner is creating the same issue over and over again after each new scan.

What I would expect instead:

• If the issue already exists and is still open, do nothing
• If the issue already exists and was closed by a PR, reopen with comment
• If the issue already exists and was closes with 'not planned' (e.g. false positive), do nothing

[helen]

Hmm @Th3S4mur41 this shouldn't happen for exact same findings provided the caching is working. Is it still happening? Can you take a look inside whichever branch you are using for the cache and see what's in there (defined in the workflow file)?

[Th3S4mur41]

Hi @helen yes, it's still happening.
I made the mistake at the beginning to run the scanner both on main and pull requests, but I fixed that.
It's now only running on main.
But maybe the cache got corrupted because of that?

The repo is public: https://github.com/Th3S4mur41/th3s4mur41.me

On push on main, the usual checks will run (on push) and if successful, the website will be deployed (workflow_run) and the a11y scan job is triggered.

The a11y scan is configured to download the sitemap on each push and then scan every single url from the sitemap

This is one of the initial issues I keep getting duplicates for: Th3S4mur41/th3s4mur41.me#2051

Let me know if you need more info or if I should try some fixes ☺️