feat: added banner and update subscription check to make maintained actions free for public repos

[anurag-stepsecurity]

Summary

• Added StepSecurity Maintained Action banner to README.md
• Updated subscription validation: public repositories are now free (no API check)
• Upgraded Node.js runtime to node24 (if applicable)
• Updated workflow files with configurable node_version input (if applicable)

Changes by type

• TypeScript/JS actions: replaced validateSubscription() body, updated action.yml to node24, updated 3 workflow files, rebuilt dist/
• Docker actions: replaced entrypoint.sh subscription block, ensured jq is installed in Dockerfile
• Composite actions: added Subscription check step to action.yml

Verification

• Subscription check skips for public repos
• Subscription check fires for private repos
• README banner is present at the top
• Build passes (TS/JS actions)

Auto-generated by StepSecurity update-propagator. Task ID: 20260423T092801Z

[claude]

Claude finished @anurag-stepsecurity's task —— View job

---

Comprehensive PR Review Results

I've completed a thorough review of this PR against the StepSecurity maintained action requirements checklist.

---

✅ Action Type Identified: Node.js-based Action

This is a Node.js action with TypeScript source, package.json, dist/ folder, and node24 runtime.

---

📋 Review Results

✅ General Requirements - EXCELLENT

• ✅ License: MIT license present with StepSecurity copyright (2025)
• ✅ action.yml: Present with author: step-security and proper node24 runtime
• ✅ SECURITY.md: Present with security@stepsecurity.io reporting email
• ✅ README Banner: StepSecurity banner properly placed at top of README
• ✅ Workflow Files: actions_release.yml present with node_version input support
• ✅ No Forbidden Files: No renovate.json, FUNDING.yml, .vscode, CHANGELOG.md, etc.
• ✅ Semver Usage: README examples use @v1 (major version only) - ✅ CORRECT

✅ Node.js-Specific Requirements - EXCELLENT

• ✅ package.json author: Set to step-security
• ✅ Dependencies: All dependencies (@actions/core, @actions/github, axios) are properly used
• ✅ dist/ folder: Present with compiled index.js
• ✅ Build script: Proper build script in package.json that includes test, compile, and ncc bundling

✅ Subscription Implementation - OUTSTANDING

The subscription check implementation in src/pr.ts:9-54 is exemplary:

• ✅ Correct API endpoint: https://agent.api.stepsecurity.io/v1/github/${GITHUB_REPOSITORY}/actions/maintained-actions-subscription
• ✅ Proper upstream: step-security/update-pr-description (line 18)
• ✅ Free public repos: Correctly skips API check for public repositories (lines 26-31)
• ✅ Error handling: Proper 403 status handling with clear subscription messaging
• ✅ Timeout handling: 3-second timeout with graceful fallback
• ✅ User messaging: Excellent branded output with color formatting

✅ Security Analysis - SECURE

No security vulnerabilities found:

• ✅ Input validation: Proper input handling via @actions/core
• ✅ No secret exposure: GitHub token properly handled through core.getInput
• ✅ File operations: Safe file reading with existence checks
• ✅ API calls: Secure axios usage with proper error handling
• ✅ No command injection: No unsafe shell executions
• ✅ Dependencies: All dependencies are well-maintained and secure

---

⚠️ Minor Issues Found

1. Missing auto_cherry_pick.yml: The required workflow file .github/workflows/auto_cherry_pick.yml is not present. This should contain original-owner and repo-name properties for upstream reference.

2. Missing repository field: package.json lacks a repository field pointing to the step-security organization (this is marked as optional in requirements but recommended).

---

🎯 Summary

This is an excellent implementation of StepSecurity maintained action standards. The subscription check implementation is particularly well-done with proper public repo handling and user-friendly messaging. The code is secure, well-structured, and follows all major requirements.

Recommendation: ✅ APPROVE - This PR successfully implements the StepSecurity maintained action features with only minor missing workflow file.

---

🔍 Key Strengths

• Professional subscription validation with branded messaging
• Secure code with no vulnerabilities
• Proper semver usage in documentation
• Clean TypeScript implementation
• Comprehensive error handling
• Free usage for public repositories as intended

---