feat: added banner and update subscription check to make maintained actions free for public repos

[anurag-stepsecurity]

Summary

• Added StepSecurity Maintained Action banner to README.md
• Updated subscription validation: public repositories are now free (no API check)
• Upgraded Node.js runtime to node24 (if applicable)
• Updated workflow files with configurable node_version input (if applicable)

Changes by type

• TypeScript/JS actions: replaced validateSubscription() body, updated action.yml to node24, updated 3 workflow files, rebuilt dist/
• Docker actions: replaced entrypoint.sh subscription block, ensured jq is installed in Dockerfile
• Composite actions: added Subscription check step to action.yml

Verification

• Subscription check skips for public repos
• Subscription check fires for private repos
• README banner is present at the top
• Build passes (TS/JS actions)

Auto-generated by StepSecurity update-propagator. Task ID: 20260423T092801Z

[claude]

Claude finished @anurag-stepsecurity's task —— View job

---

StepSecurity Maintained Action PR Review

Todo List

• Determine action type (node/docker/composite)
• Review general requirements (license, security.md, workflows, etc.)
• Check README banner and usage examples
• Review subscription check implementation
• Verify upstream variable configuration
• Check type-specific requirements
• Scan for security vulnerabilities
• Compile final review feedback

Review Results

Action Type: Composite Action

✅ General Requirements - ALL PASSING

• License: ✅ Present with StepSecurity copyright and original author (GitHub, Inc.)
• Author in action.yml: ✅ Set to 'step-security'
• SECURITY.md: ✅ Present with correct contact
• FUNDING.yml/funding.yml: ✅ Not present (good)
• Required workflow files: ✅ Both auto_cherry_pick.yml and actions_release.yml exist
• renovate.json: ✅ Not present (good)
• PULL_REQUEST.md: ✅ Not present (good)
• ISSUE_TEMPLATE folder: ✅ Not present (good)
• CHANGELOG.md: ✅ Not present (good)
• /.vscode folder: ✅ Not present (good)

✅ README Requirements - ALL PASSING

• Banner: ✅ StepSecurity banner present at top of README
• Usage examples: ✅ Use major version only (@v1) - no complete semver tags

✅ Subscription Check - ALL PASSING

• Correct API URL: ✅ Uses https://agent.api.stepsecurity.io/v1/github/$GITHUB_REPOSITORY/actions/maintained-actions-subscription
• Upstream variable: ✅ Set to step-security/github-api-commit-action (matches auto_cherry_pick.yml: grafana/github-api-commit-action → step-security/github-api-commit-action)
• Public repo logic: ✅ Skips subscription check for public repos with clear messaging
• Error handling: ✅ Proper timeout and error handling for API calls

✅ Composite Action Requirements - ALL PASSING

• Action pinning: ✅ All non-official GitHub actions are properly pinned to commit SHAs:
  • step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a
  • ossf/scorecard-action@62b2cac7ed8198b15735ed49ab1e5cf35480ba46

✅ Security Scan - NO ISSUES FOUND

• No security vulnerabilities detected in the action logic
• Template injection: ✅ Properly handled with comment explaining security consideration
• Input validation: ✅ Proper handling of user inputs
• API security: ✅ Secure API calls with proper timeout and error handling

🎉 OVERALL ASSESSMENT: APPROVED

This PR successfully implements all required StepSecurity maintained action standards. The implementation is clean, secure, and follows all specified guidelines. The subscription check correctly exempts public repositories while maintaining security for private ones.

Key improvements in this PR:

• ✅ Added StepSecurity banner to README
• ✅ Implemented public repository exemption for subscription checks
• ✅ Maintained all security and compliance requirements
• ✅ Proper action pinning and security practices

[claude]

Claude finished @anurag-stepsecurity's task —— View job

---

StepSecurity Maintained Action PR Review

Todo List

• Determine action type (node/docker/composite)
• Review general requirements (license, security.md, workflows, etc.)
• Check README banner and usage examples
• Review subscription check implementation
• Verify upstream variable configuration
• Check type-specific requirements
• Scan for security vulnerabilities
• Compile final review feedback

Review Results

Action Type: Composite Action

✅ General Requirements - ALL PASSING

• License: ✅ Present with StepSecurity copyright and original author (GitHub, Inc.)
• Author in action.yml: ✅ Set to 'step-security'
• SECURITY.md: ✅ Present with correct contact
• FUNDING.yml/funding.yml: ✅ Not present (good)
• Required workflow files: ✅ Both auto_cherry_pick.yml and actions_release.yml exist
• renovate.json: ✅ Not present (good)
• PULL_REQUEST.md: ✅ Not present (good)
• ISSUE_TEMPLATE folder: ✅ Not present (good)
• CHANGELOG.md: ✅ Not present (good)
• /.vscode folder: ✅ Not present (good)

✅ README Requirements - ALL PASSING

• Banner: ✅ StepSecurity banner present at top of README
• Usage examples: ✅ Use major version only (@v1) - no complete semver tags

✅ Subscription Check - ALL PASSING

• Correct API URL: ✅ Uses https://agent.api.stepsecurity.io/v1/github/$GITHUB_REPOSITORY/actions/maintained-actions-subscription
• Upstream variable: ✅ Set to grafana/github-api-commit-action (matches auto_cherry_pick.yml: grafana/github-api-commit-action)
• Public repo logic: ✅ Skips subscription check for public repos with clear messaging
• Error handling: ✅ Proper timeout and error handling for API calls

✅ Composite Action Requirements - ALL PASSING

• Action pinning: ✅ No external actions used - all steps use shell commands only

✅ Security Scan - NO ISSUES FOUND

• No security vulnerabilities detected in the action logic
• Template injection: ✅ Properly handled with comment explaining security consideration (action.yml:244)
• Input validation: ✅ Proper handling of user inputs
• API security: ✅ Secure API calls with proper timeout and error handling

🎉 OVERALL ASSESSMENT: APPROVED

This PR successfully implements all required StepSecurity maintained action standards. The implementation is clean, secure, and follows all specified guidelines. The subscription check correctly exempts public repositories while maintaining security for private ones.

Key improvements in this PR:

• ✅ Added StepSecurity banner to README
• ✅ Implemented public repository exemption for subscription checks
• ✅ Maintained all security and compliance requirements
• ✅ No external action dependencies to manage