From 8fb79d2ba7a07520952e36e85ee3657a34a56b58 Mon Sep 17 00:00:00 2001 From: Mihir Rawool Date: Tue, 27 Oct 2026 20:52:38 +0530 Subject: [PATCH 1/2] LTS-5442: pin the Semgrep image by digest LTS-5546: pull returntocorp/semgrep:1.166.0 by its immutable digest, the same pin as the other load-testing samples. The Actions steps in this workflow were already SHA-pinned. Co-Authored-By: Claude Opus 5.5 --- .github/workflows/Semgrep.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/Semgrep.yml b/.github/workflows/Semgrep.yml index e857756..17ceac4 100644 --- a/.github/workflows/Semgrep.yml +++ b/.github/workflows/Semgrep.yml @@ -27,7 +27,7 @@ jobs: container: # A Docker image with Semgrep installed. Do not change this. - image: returntocorp/semgrep:1.166.0 + image: returntocorp/semgrep:1.166.0@sha256:c180f0c93a17b420c0af5006214a29d3c747c5459c732b740191adf657dd0068 # Skip any PR created by dependabot to avoid permission issues: if: (github.actor != 'dependabot[bot]') From 70de7273c014b44c3e403750f2133127ab8930c7 Mon Sep 17 00:00:00 2001 From: Mihir Rawool Date: Wed, 28 Oct 2026 15:53:23 +0530 Subject: [PATCH 2/2] LTS-5442: re-trigger CI after re-enabling the Semgrep workflow Co-Authored-By: Claude Opus 5.5