Repository navigation
LTS-5442: add the Robot Framework sample tests and pin the Semgrep image - #2
Merged
Merged
Conversation
The Playwright-Robot sample shipped in load-testing-backend (sample/sample-playwright-robot-repo.zip, LTS-2848) was never pushed to this repo, which only held a README and the Semgrep workflow. Add its five files unchanged so the public sample matches what customers run and the code can be reviewed and scanned here. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
|
Important Review skippedAuto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the
 |
…, checkout assertion, .npmrc, shared-account note) - LTS-5660: requirements.txt is now a hash-pinned lock (uv, py3.10 universal); direct deps moved to requirements.in - LTS-5661: browserstack-load.yml ships error-percentage and p95 thresholds - LTS-5662: checkout test asserts the order confirmation message - LTS-5663: README explains every VU shares the demo user - LTS-5664: drop access=public from .npmrc Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The yml was copied from the backend's bundled zip, which uses the backend's internal shape (loadTestName, framework: playwright-robot, loadProfileStages with startVUs/targetVUs, "1m 30s" durations). browserstack-cli rejects those keys. Use the CLI shape instead: testName, testType/framework/language per the CLI's robot sample, loadProfile.stages with from/to, and no-space durations. Verified with `browserstack-cli load run`: passed, both thresholds passed. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
MohitSinghBS
previously approved these changes
Oct 28, 2026
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…release-age) Matches the playwright and webdriverio samples: npm refuses package versions published less than 7 days ago, which blunts freshly-hijacked releases. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
LTS-5546: pull returntocorp/semgrep:1.166.0 by its immutable digest, the same pin as the other load-testing samples. The Actions steps in this workflow were already SHA-pinned. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
MihirR-BS
changed the title
MohitSinghBS
approved these changes
Oct 29, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This repo only held a README and the Semgrep workflow. The actual Playwright-Robot sample lives only in load-testing-backend as
sample/sample-playwright-robot-repo.zip, added under LTS-2848. That means customers browsing the repo see no tests, and the LTS-5442 security review scanned an empty repo.This PR adds the zip's five files unchanged (each byte-identical to the BE zip):
browserstack-load.ymlrequirements.txt(robotframework==7.1.0,robotframework-browser==18.4.0)resources/common.resourcetests/bstack_test_add_to_cart.robottests/bstack_test_checkout_flow.robotNext step: rerun the security AI review against this branch, so LTS-5442 covers the real sample code. Any findings will be fixed here and mirrored back into the BE zip in load-testing-backend#3604.
This PR also carries the Semgrep digest pin that was #1, which is now closed in favour of this one.
Part of LTS-5442.
Security fixes (LTS-5442 rescan of this branch)
requirements.txtis a hash-pinned lock generated byuv pip compile --universal --python-version 3.10 --generate-hashes. The direct dependencies are inrequirements.in. All 12 wheels download in pip hash-checking mode for linux/py3.10, which is the pod's Python.browserstack-load.ymlhas error-percentage < 5% and p95 < 10 s BLU thresholds, withfailOnBreach: falseso a slow demo run reports the breach instead of aborting#confirmation-message= "Your Order has been successfully placed." (the same check the selenium serenity sample makes)access=publicremoved from.npmrc;min-release-age=7added (matches the playwright and webdriverio samples, and clears Semgrep'snpm-missing-minimum-release-age).github/workflows/Semgrep.ymlpullsreturntocorp/semgrep:1.166.0@sha256:c180f0c93a17b420c0af5006214a29d3c747c5459c732b740191adf657dd0068instead of the mutable1.166.0tag, the same pin as the other load-testing samples. The bundled BE zip doesn't include.github/, so this has no #3604 counterpart.BE zip mirror: browserstack/load-testing-backend#3604.
🤖 Generated with Claude Code