PXTA 0.2.0 adds pxta check. It runs the same three-pass audit and then judges it, exiting 1 when a tag fires before the banner is answered, ignores a reject or sends personal data. Out of the box it fails on anything medium or high, and on a banner PXTA couldn’t answer, so a check that skipped its reject pass never passes quietly. A short JSON rules file changes that: the severity that breaks the build, which trackers may be on the site at all, which must never appear, and exceptions that each need a written reason and can carry an end date. It can also judge a saved findings.json, with no browser needed.
Reports from CI get passed around, so --redact swaps the personal values in the report, the findings and the request capture for REDACTED, whatever encoding they arrived in. The finding still says which tracker sent what, so the evidence survives without the leaked value. PXTA then reads the files back, and if anything is left the run fails and the files are deleted. There’s a GitHub Action too. It runs the release it’s pinned to, checks it against the published checksums and uploads only the report files. Its annotations never quote what the site sent, since anyone who can see the run reads them. The release post has a rules file and the workflow.
Two independent reviews ran before the release. The second found that the annotations could still carry a page address with a query in brackets, and that a short first name after an escaped character slipped past redaction. Both were fixed and covered by tests first. The recorded run passed 90 tests, up from 70. Open source under Apache 2.0, with releases for Linux, macOS and Windows.