ci: add PR smoke-test workflow for the a11y-scan SPM plugin

Runs an end-to-end accessibility scan on every PR: builds the plugin and
executes a real scan against the tests/spm harness (sample SwiftUI sources
with intentional a11y issues), reusing the repo's own gated integration
test (testA11yScanPluginRuns) so the invocation stays in one place.

The scan downloads the BrowserStack CLI and makes authenticated calls, so
it is gated to same-repo PRs (secrets are never exposed to fork PRs) and
manual dispatch. Without the BROWSERSTACK_USERNAME / BROWSERSTACK_ACCESS_KEY
secrets configured the e2e test XCTSkips and the job still passes.

actions/checkout pinned by SHA to match existing workflows (DEVA11Y-476).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: Crash0v3rrid3

.github/workflows/spm-smoke-test.yml

@@ -0,0 +1,52 @@
+# Smoke-tests the `a11y-scan` SwiftPM command plugin end-to-end on every PR:
+# builds the plugin and runs a real accessibility scan against the tests/spm
+# harness (sample SwiftUI sources with intentional a11y issues). It reuses the
+# repository's own gated integration test (testA11yScanPluginRuns) so the scan
+# invocation stays defined in exactly one place.
+#
+# The scan downloads the BrowserStack CLI and makes authenticated network calls,
+# so it needs BROWSERSTACK_USERNAME / BROWSERSTACK_ACCESS_KEY repo secrets. Those
+# secrets are never exposed to fork PRs, so this job is gated to same-repo PRs
+# (and manual dispatch); fork PRs skip it. If the secrets are not configured yet,
+# the end-to-end test XCTSkips and the job still passes (build + unit test only).
+name: SPM plugin smoke test
+
+on:
+  pull_request:
+    branches: [main, master]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: spm-smoke-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  spm-smoke:
+    name: a11y-scan end-to-end (SwiftPM)
+    runs-on: macos-14
+    timeout-minutes: 25
+    # Secrets are unavailable to fork PRs, so the authenticated scan can only run
+    # on same-repo PRs or a manual dispatch. Fork PRs skip this job.
+    if: github.event_name == 'workflow_dispatch' || github.event.pull_request.head.repo.fork == false
+    env:
+      BROWSERSTACK_USERNAME: ${{ secrets.BROWSERSTACK_USERNAME }}
+      BROWSERSTACK_ACCESS_KEY: ${{ secrets.BROWSERSTACK_ACCESS_KEY }}
+      # Un-gates tests/spm/Tests/A11yDemoLibTests/testA11yScanPluginRuns, which is
+      # skipped unless RUN_A11Y_SCAN=1 and BrowserStack credentials are present.
+      RUN_A11Y_SCAN: "1"
+    steps:
+      - name: Checkout
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+
+      - name: Swift toolchain
+        run: swift --version
+
+      - name: Build plugin package
+        run: swift build
+
+      - name: End-to-end scan smoke (tests/spm)
+        working-directory: tests/spm
+        run: swift test