Merge pull request #1191 from browserstack/APS-19017-supply-chain-hygiene

[APS-19017] fix: pin Semgrep CI image to sha256 digest

Author: karanshah-browserstack

.github/workflows/Semgrep.yml

@@ -27,7 +27,10 @@ jobs:
 
     container:
       # A Docker image with Semgrep installed. Do not change this.
-      image: returntocorp/semgrep:1.166.0
+      # Pinned to a digest for supply-chain integrity (APS-19017 / INF-007).                                                                                                                                                                                                                                                
+      # returntocorp/semgrep:1.166.0 resolved 2026-09-16.                                                                                                                                                                                                                                                                 
+      image: returntocorp/semgrep:1.166.0@sha256:c180f0c93a17b420c0af5006214a29d3c747c5459c732b740191adf657dd0068
+
     # Skip any PR created by dependabot to avoid permission issues:
     if: (github.actor != 'dependabot[bot]')