Skip to content

LTS-3295: add supply-chain hardened .npmrc #15

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
pattu777 merged 3 commits into from
Jul 7, 2026
Merged

LTS-3295: add supply-chain hardened .npmrc #15

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
88e3b95
LTS-3295: add supply-chain hardened .npmrc
amitsi-bs Jul 6, 2026
b12f55b
LTS-3295: complete .npmrc hardening + bump SDK to latest
amitsi-bs Jul 7, 2026
7ce26c6
LTS-3295: add min-release-age=7 to .npmrc (clears semgrep npm-missing…
amitsi-bs Jul 7, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
22 changes: 22 additions & 0 deletions .npmrc
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,22 @@
# Supply-chain hardening directives (SC-12282 / LTS-3295)
# See: https://browserstack.atlassian.net/wiki/spaces/ENG/pages/6091571922/Supply+Chain+Security+Enhancements+Tech+Spec
#
# access=restricted is intentionally OMITTED — this is a public, customer-facing
# sample repository, not a published private package.
#
# ignore-scripts=true is now safe: these tests run remotely on BrowserStack, and
# Edge/Gecko are not supported on our platform, so the local driver-binary
# postinstalls (edgedriver/geckodriver) are not needed. browserstack-node-sdk is
# pinned to the latest release (1.61.0) so no update-postinstall is needed either.
#
# engine-strict=true enforces the package.json `engines.node` floor (>=18), which
# matches our runner pod and what @wdio/cli 9 already requires. Customers on EOL
# Node (<18) get a clear upgrade message instead of obscure failures.

strict-ssl=true
save-exact=true
audit-level=high
legacy-peer-deps=false
Comment thread
github-advanced-security[bot] marked this conversation as resolved.
Fixed
ignore-scripts=true

@rohit-Bstack rohit-Bstack Jul 7, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Tested with this configuration to initiate tests with cli and ui?

@amitsi-bs amitsi-bs Jul 7, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes — validated end-to-end on the real prod BLU pod via the CLI (browserstack-cli load run), for both this WebdriverIO sample and the Playwright one:

  • pod installs the sample with the hardened .npmrc (ignore-scripts + engine-strict + min-release-age) — no install/scripts/engine issues
  • engines.node is honored (pod ran Node 18.20.4), SDK resolved, test ran to completion, VUH + web-vitals/network metrics published, video/logs uploaded
  • Playwright: 2/2 tests passed (test_status=completed); WebdriverIO: add-to-cart passed (the checkout step failed on a sample selector unrelated to this change)

The dashboard-UI-initiated flow uploads the same package + browserstack-load.yml, so it exercises the identical install/run path — I can attach a UI-triggered run too if you'd like that explicitly on record.

engine-strict=true
Comment thread
github-advanced-security[bot] marked this conversation as resolved.
Fixed
min-release-age=7
Loading
Loading