feat(workflows): align ADO pipeline with GitHub a11y scan workflow AB#2011

- replace local CLI-based scan with deployed app API calls via curl
- add matrix strategy for three target URLs with parallel execution
- add weekly schedule (Monday 06:00 UTC)
- publish SARIF results as pipeline artifacts
- update README Azure Pipelines section with correct path

🔍 - Generated by Copilot

Author: emmanuelknafo

.azuredevops/pipelines/a11y-scan.yml

@@ -0,0 +1,60 @@
+trigger: none
+
+schedules:
+  - cron: '0 6 * * 1' # Every Monday at 06:00 UTC
+    displayName: 'Weekly accessibility scan'
+    branches:
+      include:
+        - main
+    always: true
+
+pool:
+  vmImage: 'ubuntu-latest'
+
+variables:
+  SCANNER_BASE_URL: 'https://a11y-scan-demo-app.azurewebsites.net'
+
+strategy:
+  matrix:
+    codepen-sample:
+      siteName: 'codepen-sample'
+      siteUrl: 'https://codepen.io/leezee/pen/eYbXzpJ'
+    a11y-scan-demo-app:
+      siteName: 'a11y-scan-demo-app'
+      siteUrl: 'https://a11y-scan-demo-app.azurewebsites.net/'
+    ontario-gov:
+      siteName: 'ontario-gov'
+      siteUrl: 'https://www.ontario.ca/page/government-ontario'
+  maxParallel: 3
+
+steps:
+  - checkout: self
+    displayName: 'Checkout repository'
+
+  - script: |
+      mkdir -p results
+      HTTP_STATUS=$(curl -s -o results/$(siteName).sarif -w "%{http_code}" \
+        -X POST "$(SCANNER_BASE_URL)/api/ci/scan" \
+        -H "Content-Type: application/json" \
+        -d '{"url": "$(siteUrl)", "format": "sarif"}' \
+        --max-time 120)
+
+      echo "HTTP status: $HTTP_STATUS"
+
+      if [ "$HTTP_STATUS" -ne 200 ]; then
+        echo "##vso[task.logissue type=error]Scan failed for $(siteUrl) (HTTP $HTTP_STATUS)"
+        cat results/$(siteName).sarif
+        exit 1
+      fi
+
+      echo "SARIF file written: results/$(siteName).sarif"
+      echo "File size: $(wc -c < results/$(siteName).sarif) bytes"
+    displayName: 'Run accessibility scan - $(siteName)'
+    timeoutInMinutes: 5
+
+  - task: PublishBuildArtifacts@1
+    condition: always()
+    inputs:
+      pathToPublish: 'results'
+      artifactName: 'a11y-sarif-$(siteName)'
+    displayName: 'Publish SARIF artifact - $(siteName)'

README.md

@@ -358,8 +358,10 @@ violations visible as Code Scanning alerts under the repository Security tab.
 
 ### Azure Pipelines
 
-An Azure Pipelines definition (`azure-pipelines/a11y-scan.yml`) provides equivalent
-functionality for Azure DevOps environments.
+An equivalent Azure Pipelines definition (`.azuredevops/pipelines/a11y-scan.yml`) scans the
+same three URLs via the deployed app's CI API, using matrix strategy for parallel execution
+and publishing SARIF artifacts. Configure it in Azure DevOps by pointing a pipeline to this
+file in the GitHub repository.
 
 ## Observability