[APS-19017] fix: supply-chain hygiene (mocha->devDeps, pin Semgrep image, files allowlist)

[Rohannagariya1]

Security Fix: APS-19017 (Low, supply-chain hygiene)

Applies the SAFE mechanical hygiene fixes from the ticket. The mocha dependencies → devDependencies move (INF-005) was proposed but has been reverted after review — reasoning below.

INF-007 — unpinned Semgrep CI image

Pinned .github/workflows/Semgrep.yml from image: returntocorp/semgrep:1.166.0 (version tag) to image: returntocorp/semgrep:1.166.0@sha256:c180f0c93a17b420c0af5006214a29d3c747c5459c732b740191adf657dd0068 (version tag + digest).

Why: a version tag can be re-published by the maintainer at any time. If Return-to-corp's Docker Hub account is compromised, an attacker can replace :1.166.0 with a malicious image → every CI run of this repo pulls it → attacker gets access to GitHub Actions secrets (including the npm publish token — which would let them publish a malicious version of this CLI to every BrowserStack customer). Digest is cryptographically immutable — Docker refuses to pull anything except an image whose bytes hash to c180f0c9....

Verified: digest resolved via Docker Hub manifest API on 2026-09-16; same image bits master runs against today, just referenced by content-hash instead of tag.

INF-008 — tarball ships .github/ and CODEOWNERS

Added a files allowlist to package.json: ["bin/", "README.md", "LICENSE.md"].

Why: master has no files field; the .npmignore only excludes test/ and results/. So the current npm tarball includes .github/, CODEOWNERS, .nycrc.yml, .eslintrc*, .gitignore, .editorconfig — all internal repo hygiene files, none of which the CLI needs to run.

Verified: npm pack --dry-run on this branch → 120.8 kB tarball, 62 files, containing only bin/* + README.md + LICENSE.md + package.json (auto-included by npm). .github/, CODEOWNERS, test/, .nycrc.yml correctly excluded. All runtime code (bin/runner.js entry, bin/testObservability/*, bin/helpers/*, bin/commands/*, bin/templates/*, bin/testhub/*, bin/accessibility-automation/*) still ships.

Note on allowlist contents: the ticket originally suggested ["bin/", "README.md", "LICENSE", "index.js"]. Adjusted to match repo reality — the file is LICENSE.md (not LICENSE), and index.js doesn't exist in the repo (pre-existing broken main field, not addressed here).

INF-001 — axios

Already ^1.15.0 on master. No change needed. Confirmed via npm ls axios.

INF-005 — mocha in production dependencies — REVERTED

Was in an earlier version of this PR; removed after code review found two problems with the ticket's reasoning:

1. The CVE the ticket cites (GHSA-5c6j-r48x-rmvq via serialize-javascript) is already mitigated on master. package.json has "overrides": { "serialize-javascript": ">=7.0.5" } — npm respects this override during resolution, so mocha's transitive serialize-javascript resolves to the patched version regardless of mocha being in dependencies or not. The security scanner that generated APS-19017 didn't account for this existing override.

2. Removing mocha would break TestObservability for globally-installed CLI customers. bin/testObservability/reporter/index.js:12 does require('mocha/lib/runnable') (regular require, not requireModule) with a code comment explicitly saying "need to handle as this isn't present in older mocha versions" — i.e., the developer intentionally wanted the bundled mocha as a version-safety fallback. Because the CLI is installed globally per BrowserStack's official docs (npm install -g browserstack-cypress-cli) and TestObservability is enabled by default for Cypress v10+, this require would fail with MODULE_NOT_FOUND on every default-config customer's next session — Node's regular require can't reach the customer's node_modules from a globally-installed CLI's directory.

Net effect of the revert: no code change, but the ticket's INF-005 concern is already addressed by the existing overrides on master.

NOT applied — needs separate decision

• CSL-003 (constants.js:401 md5 → sha256): Changes the upload-dedup hash algorithm. Client-only change would leave the CLI sending SHA-256 hashes that BS's server-side dedup (currently keyed on MD5) doesn't recognize → every next upload for every customer becomes a full re-upload until the SHA-256 cache warms. Also may need server-side changes if the dedup logic hard-codes MD5 length/format. Requires client+server coordination and one-time bandwidth spike acceptance. Deferred for a separate ticket/PR — noted on APS-19017.

Testing

• npm pack --dry-run — tarball contains only bin/ + README.md + LICENSE.md + package.json. Verified.
• npm test — 13 failing, all a subset of master's pre-existing 16 failures (flaky usage-reporting / video-config / stub-count families, unrelated to this change). No new regressions.
• All 6 CI checks green: CodeQL (actions), CodeQL (javascript-typescript), CodeQL (overall), semgrep/ci, Semgrep OSS, CodeRabbit.
• Digest verified against live Docker Hub registry-API response (2026-09-16).

Jira Ticket

https://browserstack.atlassian.net/browse/APS-19017

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Central YAML (base), Organization UI (inherited), Workspace UI (inherited)

Review profile: ASSERTIVE

Plan: Enterprise

Run ID: af87d3d0-c1af-4db7-b027-569418ff540d

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}