Skip to content
Permalink

Comparing changes

Choose two branches to see what’s changed or to start a new pull request. If you need to, you can also or learn more about diff comparisons.

Open a pull request

Create a new pull request by comparing changes across two branches. If you need to, you can also . Learn more about diff comparisons here.
base repository: browserstack/browserstack-local-php
Failed to load repositories. Confirm that selected base ref is valid, then try again.
Loading
base: master
Choose a base ref
...
head repository: browserstack/browserstack-local-php
Failed to load repositories. Confirm that selected head ref is valid, then try again.
Loading
compare: locsec/WI-7132e51e
Choose a head ref
Checking mergeability… Don’t worry, you can still create the pull request.
  • 3 commits
  • 2 files changed
  • 2 contributors

Commits on Aug 12, 2026

  1. Pin Semgrep CI image by digest and drop security-events from the cont… 

    …ainer job

The Semgrep workflow runs a third-party container on a daily cron with
`security-events: write` and the repository checked out. Two hardening changes
(CWE-829, Inclusion of Functionality from Untrusted Control Sphere):

1. Pin `returntocorp/semgrep` by immutable digest instead of the `1.166.0` tag.
   A version tag on Docker Hub is still mutable — it can be re-pointed at new
   content upstream, and the next scheduled run would execute unreviewed code
   with no PR gate. The digest is the same image that tag resolves to today
   (multi-arch index, pushed 2026-06-11), so this is a no-op for behaviour.

2. Move the SARIF upload into its own job. `security-events: write` is now held
   only by a job that runs no third-party code; the container job keeps
   `contents: read`. If the image is ever compromised it can no longer forge
   entries in the code-scanning dashboard. The SARIF crosses between jobs as a
   workflow artifact, uploaded with `if: always()` because `semgrep ci` exits
   non-zero when it has blocking findings.

Also adds a Dependabot config for `github-actions` so the action SHA pins do not
go stale. Dependabot cannot bump a workflow `container:` digest
(dependabot/dependabot-core#5819), so the refresh command for the image pin is
recorded next to it.

Ref: https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
    @07souravkunda @claude
    07souravkunda and claude committed Aug 12, 2026
    Configuration menu
    Copy the full SHA
    1fc44b3 View commit details
    Browse the repository at this point in the history

  2. Add a 7-day cooldown to the Dependabot config 

    Flagged by this repo's own Semgrep scan on the previous commit
(package_managers.dependabot.dependabot-missing-cooldown): without a cooldown,
Dependabot proposes a version the moment it is published, which is exactly the
window a hijacked release exploits. Compromised releases are typically yanked
within a few days, so wait 7.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
    @07souravkunda @claude
    07souravkunda and claude committed Aug 12, 2026
    Configuration menu
    Copy the full SHA
    8b08eb9 View commit details
    Browse the repository at this point in the history

  3. Don't turn the upload job red when no SARIF was ever produced 

    Review nit: if the container job dies before `semgrep ci` runs — a container-pull
failure, or checkout failing — no SARIF is written, and the upload job then went
red on "artifact not found", pointing a debugger at the download step instead of
at the real upstream cause. Two reds where the pre-split workflow showed one.

Tolerate the missing artifact and skip the upload when there is no file. The
normal case is unaffected: `semgrep ci` exiting 1 on blocking findings still
writes the SARIF, still uploads it, and still reaches the dashboard.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
    @07souravkunda @claude
    07souravkunda and claude committed Aug 12, 2026
    Configuration menu
    Copy the full SHA
    233e0b0 View commit details
    Browse the repository at this point in the history
Loading