feat: added banner and update subscription check to make maintained actions free for public repos

[Raj-StepSecurity]

Summary

• Added StepSecurity Maintained Action banner to README.md
• Updated subscription validation: public repositories are now free (no API check)
• Upgraded Node.js runtime to node24
• Updated workflow files with configurable node_version input
• Removed GuardDog workflow

Changes by type

• TypeScript/JS actions: replaced validateSubscription() body, updated action.yml to node24, updated workflow files, rebuilt dist/

Verification

• Subscription check skips for public repos
• Subscription check fires for private repos
• README banner is present at the top
• Build passes (TS/JS actions)

Auto-generated by StepSecurity update-propagator. Task ID: 20260423T051539Z

[claude]

Claude finished @Raj-StepSecurity's task —— View job

---

Pull Request Review

Completed comprehensive review based on StepSecurity maintained action criteria.

Review Progress

• Analyze repository structure and required files
• Review license and copyright requirements
• Check security.md and workflow files
• Verify subscription check implementation
• Review Node.js specific requirements
• Check for security vulnerabilities
• Verify README banner and usage examples
• Provide comprehensive feedback

---

✅ Passing Requirements

License and Copyright:

• ✅ MIT license present with StepSecurity copyright (LICENSE:3)
• ✅ action.yml has author: step-security (action.yml:3)
• ✅ package.json has "author": "step-security" (package.json:14)
• ✅ Repository field in package.json correctly points to step-security org (package.json:11)

Security and Required Files:

• ✅ SECURITY.md file present
• ✅ No prohibited files found (FUNDING.yml, renovate.json, PULL_REQUEST.md, ISSUE_TEMPLATE, CHANGELOG.md, .vscode)

Action Configuration:

• ✅ This is a Node.js-based action using node24 runtime (action.yml:22)
• ✅ dist/ folder present with compiled code
• ✅ package.json contains build script for ncc build (package.json:7)

README:

• ✅ StepSecurity banner present at top of README (README.md:1)
• ✅ Usage example uses major version @v1 instead of full semver (README.md:49)

Dependencies:

• ✅ All dependencies appear to be used (@actions/core, @actions/github, @vercel/ncc for build, axios for API calls)

Subscription Check Implementation:

• ✅ Subscription check function present (index.js:8-52)
• ✅ Correct API endpoint used: https://agent.api.stepsecurity.io/v1/github/${process.env.GITHUB_REPOSITORY}/actions/maintained-actions-subscription (index.js:36)
• ✅ Public repositories are correctly exempted from subscription check (index.js:29: if (repoPrivate === false) return;)

---

❌ Issues Found

Critical Issues:

1. Missing auto_cherry_pick.yml workflow ⚠️

   • Required workflow .github/workflows/auto_cherry_pick.yml is missing
   • This file should contain original-owner and repo-name properties for upstream tracking

2. Incorrect upstream value in subscription check ⚠️

   • index.js:16 sets upstream = "Khan/pull-request-comment-trigger"
   • This should match the format <original-owner>/<repo-name> from auto_cherry_pick.yml
   • Cannot verify correct value without auto_cherry_pick.yml file

Workflow Issues:

3. Missing auto_cherry_pick.yml in workflows 📁
   • .github/workflows/ should contain auto_cherry_pick.yml in addition to actions_release.yml
   • Currently has: actions_release.yml, audit_package.yml, claude_review.yml, codeql.yml, dependency-review.yml, scorecards.yml, test.yml
   • Missing: auto_cherry_pick.yml

---

🔍 Security Analysis

No security vulnerabilities detected:

• ✅ No hardcoded secrets or API keys
• ✅ Input validation present for required parameters
• ✅ Error handling implemented with proper exit codes
• ✅ GitHub token properly validated before use (index.js:66-69)
• ✅ Timeout configured for external API calls (index.js:38)
• ✅ Subscription check properly handles private vs public repo logic

---

📋 Action Type Analysis

This is a Node.js-based GitHub Action with:

• Node.js 24 runtime (recently upgraded from older version)
• Compiled distribution using @vercel/ncc
• Standard GitHub Actions SDK dependencies
• External API integration for subscription validation

---

🔧 Required Fixes

1. Add auto_cherry_pick.yml workflow with proper original-owner and repo-name fields
2. Update upstream variable in index.js:16 to match the values from auto_cherry_pick.yml
3. Verify the upstream repo reference is correct for the original action being maintained

The subscription check implementation is otherwise correctly configured for the new public repo exemption feature.

---

[claude]

Claude finished @Raj-StepSecurity's task —— View job

---

Pull Request Review

Completed comprehensive review based on StepSecurity maintained action criteria.

Review Progress

• Analyze repository structure and required files
• Review license and copyright requirements
• Check security.md and workflow files
• Verify subscription check implementation
• Review Node.js specific requirements
• Check for security vulnerabilities
• Verify README banner and usage examples
• Provide comprehensive feedback

---

✅ Passing Requirements

License and Copyright:

• ✅ MIT license present with StepSecurity copyright (LICENSE:3)
• ✅ action.yml has author: step-security (action.yml:3)
• ✅ package.json has "author": "step-security" (package.json:14)
• ✅ Repository field in package.json correctly points to step-security org (package.json:11)

Security and Required Files:

• ✅ SECURITY.md file present
• ✅ No prohibited files found (FUNDING.yml, renovate.json, PULL_REQUEST.md, ISSUE_TEMPLATE, CHANGELOG.md, .vscode)

Action Configuration:

• ✅ This is a Node.js-based action using node24 runtime (action.yml:22)
• ✅ dist/ folder present with compiled code
• ✅ package.json contains build script for ncc build (package.json:7)

README:

• ✅ StepSecurity banner present at top of README (README.md:1)
• ✅ Usage example uses major version @v1 instead of full semver (README.md:49)

Dependencies:

• ✅ All dependencies appear to be used (@actions/core, @actions/github, @vercel/ncc for build, axios for API calls)

Subscription Check Implementation:

• ✅ Subscription check function present (index.js:8-52)
• ✅ Correct API endpoint used: https://agent.api.stepsecurity.io/v1/github/${process.env.GITHUB_REPOSITORY}/actions/maintained-actions-subscription (index.js:36)
• ✅ Public repositories are correctly exempted from subscription check (index.js:29: if (repoPrivate === false) return;)

---

❌ Issues Found

Critical Issues:

1. Missing auto_cherry_pick.yml workflow ⚠️

   • Required workflow .github/workflows/auto_cherry_pick.yml is missing
   • This file should contain original-owner and repo-name properties for upstream tracking

2. Incorrect upstream value in subscription check ⚠️

   • index.js:16 sets upstream = "Khan/pull-request-comment-trigger"
   • This should match the format <original-owner>/<repo-name> from auto_cherry_pick.yml
   • Cannot verify correct value without auto_cherry_pick.yml file

Workflow Issues:

3. Missing auto_cherry_pick.yml in workflows 📁
   • .github/workflows/ should contain auto_cherry_pick.yml in addition to actions_release.yml
   • Currently has: actions_release.yml, audit_package.yml, claude_review.yml, codeql.yml, dependency-review.yml, scorecards.yml, test.yml
   • Missing: auto_cherry_pick.yml

---

🔍 Security Analysis

No security vulnerabilities detected:

• ✅ No hardcoded secrets or API keys
• ✅ Input validation present for required parameters
• ✅ Error handling implemented with proper exit codes
• ✅ GitHub token properly validated before use (index.js:66-69)
• ✅ Timeout configured for external API calls (index.js:38)
• ✅ Subscription check properly handles private vs public repo logic

---

📋 Action Type Analysis

This is a Node.js-based GitHub Action with:

• Node.js 24 runtime (recently upgraded from older version)
• Compiled distribution using @vercel/ncc
• Standard GitHub Actions SDK dependencies
• External API integration for subscription validation

---

🔧 Required Fixes

1. Add auto_cherry_pick.yml workflow with proper original-owner and repo-name fields
2. Update upstream variable in index.js:16 to match the values from auto_cherry_pick.yml
3. Verify the upstream repo reference is correct for the original action being maintained

The subscription check implementation is otherwise correctly configured for the new public repo exemption feature.

---