Comparing main...ci/DEVA11Y-477-spm-pin-bump · browserstack/AccessibilityDevTools · GitHub
Skip to content
Permalink

Comparing changes

Choose two branches to see what’s changed or to start a new pull request. If you need to, you can also or learn more about diff comparisons.

Open a pull request

Create a new pull request by comparing changes across two branches. If you need to, you can also . Learn more about diff comparisons here.
base repository: browserstack/AccessibilityDevTools
Failed to load repositories. Confirm that selected base ref is valid, then try again.
Loading
base: main
Choose a base ref
...
head repository: browserstack/AccessibilityDevTools
Failed to load repositories. Confirm that selected head ref is valid, then try again.
Loading
compare: ci/DEVA11Y-477-spm-pin-bump
Choose a head ref
Checking mergeability… Don’t worry, you can still create the pull request.
  • 1 commit
  • 8 files changed
  • 2 contributors

Commits on Oct 16, 2026

  1. ci(spm): pin generated SPM dependency to a commit SHA and auto-bump i… 

    …t (DEVA11Y-477)

scripts/{bash,zsh,fish}/spm.sh generated a Package.swift that tracked
branch: "main", so every scan resolved whatever HEAD of main was at that moment
(F-005, CWE-829). Pin it to revision 806f98c (latest main commit touching
Package.swift/Plugins) and regenerate the .sha256 self-update sidecars.

To keep scans on the latest plugin without a mutable ref, add
spm-pin-bump.yml: when plugin code lands on main (plus weekly / manual), it
runs .github/scripts/update-spm-pin.sh and opens or refreshes a PR moving the
pin, listing the plugin commits being pulled in. Bumps go through review, and
since bump PRs only touch scripts/ they never move the pin themselves. A guard
job fails PRs where any spm.sh stops pinning a full 40-char revision, so the
PR #30-style revert to branch: "main" can't recur silently.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
    @Crash0v3rrid3 @claude
    Crash0v3rrid3 and claude committed Oct 16, 2026
    Configuration menu
    Copy the full SHA
    c2c1753 View commit details
    Browse the repository at this point in the history
Loading