Skip to content

LTS-5442: pin the Semgrep image by digest - #1

Closed
MihirR-BS wants to merge 2 commits into
mainfrom
LTS-5442-playwright-robot-sample-security
Closed

LTS-5442: pin the Semgrep image by digest#1
MihirR-BS wants to merge 2 commits into
mainfrom
LTS-5442-playwright-robot-sample-security

Conversation

@MihirR-BS

@MihirR-BS MihirR-BS commented Oct 27, 2026 •
edited by atlassian Bot
Loading

Copy link
Copy Markdown
Contributor

Fixes LTS-5546 (Medium) from the LTS-5442 security AI review.

.github/workflows/Semgrep.yml now pulls returntocorp/semgrep:1.166.0@sha256:c180f0c93a17b420c0af5006214a29d3c747c5459c732b740191adf657dd0068 instead of the mutable 1.166.0 tag. That's the digest Docker Hub serves for that tag today, and the same pin used in the other load-testing samples. The workflow's Actions steps were already SHA-pinned. The workflow still parses as YAML.

LTS-5551 (SEMGREP_RULES: p/default fetched live) is handled on the story. It's the same line in every load-testing sample's Semgrep template, not something specific to this repo.

No load-testing-backend change: the bundled sample/sample-playwright-robot-repo.zip doesn't include .github/.

Part of LTS-5442.

🤖 Generated with Claude Code

@MihirR-BS @claude
LTS-5442: pin the Semgrep image by digest
8fb79d2 
LTS-5546: pull returntocorp/semgrep:1.166.0 by its immutable digest, the
same pin as the other load-testing samples. The Actions steps in this
workflow were already SHA-pinned.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@MihirR-BS
MihirR-BS requested a review from a team as a code owner October 27, 2026 15:22
@coderabbitai

coderabbitai Bot commented Oct 27, 2026 •
edited
Loading

Copy link
Copy Markdown

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

Run configuration
  • Source mode: Auto
  • Repository: Unavailable
  • Branch: Unavailable
  • File: No configuration file from this repository applied
  • Commit: Unavailable
  • Layers: Central YAML (base), Organization UI (inherited), Workspace UI (inherited); Enforced overrides: Organization
  • Review profile: ASSERTIVE
  • Plan: Enterprise
  • Run ID: 2792cfd6-e0b5-4f9e-a550-1c1d408cc90e

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • 🔍 Trigger review
  • Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Comment @coderabbitai help to get the list of available commands.

@MihirR-BS MihirR-BS mentioned this pull request Oct 27, 2026
Merged
@MihirR-BS @claude
LTS-5442: re-trigger CI after re-enabling the Semgrep workflow
70de727 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@MihirR-BS

MihirR-BS commented Oct 28, 2026

Copy link
Copy Markdown
Contributor Author

Folded into #2, which now carries this Semgrep digest pin (commit cc99335) along with the sample code, so the robot repo has one PR to review.

@MihirR-BS MihirR-BS closed this Oct 28, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@MohitSinghBS MohitSinghBS MohitSinghBS approved these changes
@adityasonani-bs adityasonani-bs Awaiting requested review from adityasonani-bs adityasonani-bs is a code owner automatically assigned from browserstack/load-testing-dev

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@MihirR-BS @MohitSinghBS