Master merge

Author: bsautomation

.coderabbit.yaml

@@ -0,0 +1,15 @@
+inheritance: true
+reviews:
+  review_details: true
+  request_changes_workflow: true
+  auto_review:
+    enabled: true
+knowledge_base:
+  code_guidelines:
+    filePatterns:
+      - "browserstack/browserstack-ai-harness:stacks/stack-domain-browserstack-cypress-cli/rules/**/*.md"
+      - "browserstack/browserstack-ai-harness:stacks/stack-domain-browserstack-cypress-cli/agents/*review*.md"
+      - "browserstack/browserstack-ai-harness:stacks/stack-domain-browserstack-cypress-cli/skills/*review*/**/*.md"
+      - "browserstack/browserstack-ai-harness:stacks/stack-domain-browserstack-cypress-cli/knowledge/*.md"
+      - "browserstack/browserstack-ai-harness:stacks/stack-domain-browserstack-cypress-cli/knowledge/automate/**/*.md"
+      - "browserstack/browserstack-ai-harness:stacks/stack-domain-browserstack-cypress-cli/knowledge/docs/**/*.md"

.github/workflows/Semgrep.yml

@@ -27,7 +27,10 @@ jobs:
 
     container:
       # A Docker image with Semgrep installed. Do not change this.
-      image: returntocorp/semgrep:1.166.0
+      # Pinned to a digest for supply-chain integrity (APS-19017 / INF-007).                                                                                                                                                                                                                                                
+      # returntocorp/semgrep:1.166.0 resolved 2026-09-16.                                                                                                                                                                                                                                                                 
+      image: returntocorp/semgrep:1.166.0@sha256:c180f0c93a17b420c0af5006214a29d3c747c5459c732b740191adf657dd0068
+
     # Skip any PR created by dependabot to avoid permission issues:
     if: (github.actor != 'dependabot[bot]')
 

.npmrc

@@ -1,2 +1,5 @@
+min-release-age=7
 package-lock=true
 lockfile-version=1
+strict-ssl=true
+save-exact=true

bin/commands/runs.js

@@ -212,7 +212,7 @@ module.exports = function run(args, rawArgs) {
     logger.debug("Completed setting the configs");
 
     if(!isBrowserstackInfra) {
-      if(process.env.BS_TESTOPS_BUILD_COMPLETED) {
+      if(process.env.BS_TESTOPS_BUILD_COMPLETED === "true") {
         setEventListeners(bsConfig);
       }
 
@@ -226,7 +226,7 @@ module.exports = function run(args, rawArgs) {
       if(process.env.BROWSERSTACK_TEST_ACCESSIBILITY === 'true') {
         setAccessibilityEventListeners(bsConfig);
       }
-      if(process.env.BS_TESTOPS_BUILD_COMPLETED) {
+      if(process.env.BS_TESTOPS_BUILD_COMPLETED === "true") {
         setEventListeners(bsConfig);
       }
       markBlockEnd('validateConfig');

bin/helpers/buildArtifacts.js

@@ -11,7 +11,7 @@ const logger = require('./logger').winstonLogger,
 const { default: axios } = require('axios');
 const { HttpsProxyAgent = require('https-proxy-agent') } = require('https-proxy-agent');
 const FormData = require('form-data');
-const decompress = require('decompress');
+const AdmZip = require('adm-zip');
 const unzipper = require("unzipper");
 const { setAxiosProxy } = require('./helper');
 
@@ -154,10 +154,11 @@ const downloadAndUnzip = async (filePath, fileName, url) => {
 const unzipFile = async (filePath, fileName) => {
   return new Promise( async (resolve, reject) => {
     try {
-      await decompress(path.join(filePath, fileName), filePath);
+      const zip = new AdmZip(path.join(filePath, fileName));
+      await zip.extractAllToAsync(filePath, /* overwrite */ true);
       resolve();
     } catch (error) {
-      logger.debug(`Error unzipping with decompress, trying with unzipper. Stacktrace: ${error}.`);
+      logger.debug(`Error unzipping with adm-zip, trying with unzipper. Stacktrace: ${error}.`);
       try {
         fs.createReadStream(path.join(filePath, fileName))
           .pipe(unzipper.Extract({ path: filePath }))

bin/helpers/capabilityHelper.js

@@ -4,7 +4,8 @@ const { readCypressConfigFile } = require('./readCypressConfigUtil');
 
 const logger = require("./logger").winstonLogger,
   Constants = require("./constants"),
-  Utils = require("./utils");
+  Utils = require("./utils"),
+  testhubUtils = require("../testhub/utils");
 
 const caps = (bsConfig, zip) => {
   return new Promise(function (resolve, reject) {
@@ -131,6 +132,18 @@ const caps = (bsConfig, zip) => {
       obj.run_settings = JSON.stringify(bsConfig.run_settings);
     }
 
+    // The only route by which a cypress session can name its TestHub build: every session
+    // this build spawns inherits these caps. Written unconditionally so an empty uuid records
+    // that build start ran and had nothing to name, which an absent key cannot express.
+    // "null" is the sentinel a failed build start leaves behind, not a uuid.
+    const testhubBuildUuid = process.env.BROWSERSTACK_TESTHUB_UUID;
+    obj.testhubBuildUuid = Utils.isUndefined(testhubBuildUuid) || testhubBuildUuid === "null"
+      ? ""
+      : testhubBuildUuid;
+    obj.buildProductMap = testhubUtils.getProductMap(bsConfig);
+
+    logger.debug(`TestHub build uuid stamped on caps: ${obj.testhubBuildUuid || "<empty>"}`);
+
     obj.cypress_cli_user_agent = Utils.getUserAgent();
 
     logger.info(`Cypress CLI User Agent: ${obj.cypress_cli_user_agent}`);

bin/helpers/reporterHTML.js

@@ -6,7 +6,7 @@ const fs = require('fs'),
       utils = require("./utils"),
       Constants = require('./constants'),
       config = require("./config"),
-      decompress = require('decompress');
+      AdmZip = require('adm-zip');
 const { isTurboScaleSession } = require('../helpers/atsHelper');
 
 const { setAxiosProxy } = require('./helper');
@@ -171,15 +171,14 @@ function getReportResponse(filePath, fileName, reportJsonUrl) {
 
 const unzipFile = async (filePath, fileName) => {
   return new Promise( async (resolve, reject) => {
-    await decompress(path.join(filePath, fileName), filePath)
-    .then((files) => {
-      let message = "Unzipped the json and html successfully."
-      resolve(message);
-    })
-    .catch((error) => {
+    try {
+      const zip = new AdmZip(path.join(filePath, fileName));
+      await zip.extractAllToAsync(filePath, /* overwrite */ true);
+      resolve("Unzipped the json and html successfully.");
+    } catch (error) {
       reject(error);
       process.exitCode = Constants.ERROR_EXIT_CODE;
-    });
+    }
   });
 }
 

bin/testhub/testhubHandler.js

@@ -41,9 +41,9 @@ class TestHubHandler {
       const response = await nodeRequest( "POST", TESTHUB_CONSTANTS.TESTHUB_BUILD_API, data, config);
       const launchData = this.extractDataFromResponse(user_config, data, response, config);
     } catch (error) {
-        console.log(error);
+        logger.debug(`EXCEPTION IN BUILD START EVENT : ${error}`);
+        testhubUtils.handleErrorForObservability(error.success === false ? error : null);
         if (error.success === false) { // non 200 response
-            testhubUtils.logBuildError(error);
             return;
         }
 

bin/testhub/utils.js

@@ -88,6 +88,10 @@ exports.setTestObservabilityVariables = (
 };
 
 exports.handleErrorForObservability = (error = null) => {
+  // Downstream reads isTestObservabilitySession(), not these ids, to decide whether
+  // observability is live. extractDataFromResponse clears it inline for a 2xx carrying
+  // success=false; this covers the paths that never get a usable response at all.
+  process.env.BROWSERSTACK_TEST_OBSERVABILITY = "false";
   process.env.BROWSERSTACK_TESTHUB_UUID = "null";
   process.env.BROWSERSTACK_TESTHUB_JWT = "null";
   process.env.BS_TESTOPS_BUILD_COMPLETED = "false";
@@ -164,7 +168,7 @@ exports.handleErrorForAccessibility = (user_config, error = null) => {
 };
 
 exports.logBuildError = (error, product = "") => {
-  if (error === undefined) {
+  if (isUndefined(error)) {
     logger.error(`${product.toUpperCase()} Build creation failed`);
 
     return;