feat: onboarding audit-check action

[Raj-StepSecurity]

No description provided.

[github-actions]

PR Review

Action Type

Node-based action — runs on node24 via dist/index.js, written in TypeScript and bundled with ncc.

---

✅ Passed Checks

• License: MIT license present with dual copyright — original actions-rs team and StepSecurity (2026).
• action.yml: Present with author: 'step-security'.
• SECURITY.md: Present with contact email security@stepsecurity.io.
• FUNDING.yml: Not present.
• renovate.json: Not present.
• PULL_REQUEST.md: Not present.
• ISSUE_TEMPLATE folder: Not present.
• CHANGELOG.md: Not present.
• .vscode folder: Not present.
• .github/workflows: Contains both required auto_cherry_pick.yml and actions_release.yml.
• README banner: StepSecurity maintained-action banner is present at the top of README.md.
• README version tags: All usage examples use major-version-only tags (@v2, @v7) — no full semver tags.
• Subscription check URL: Correctly calls https://agent.api.stepsecurity.io/v1/github/${GITHUB_REPOSITORY}/actions/maintained-actions-subscription.
• Upstream variable: upstream = 'rustsec/audit-check' correctly matches original-owner/repo-name (rustsec / audit-check) from auto_cherry_pick.yml.
• dist folder: Present and bundled.
• package.json build script: Present (ncc build src/main.ts).
• package.json author: "step-security".
• package.json repository: Points to github.com/step-security/audit-check.

---

❌ Failed Checks

• Lint step disabled in CI (.github/workflows/ci.yml lines 15–16): The npm run lint step is commented out with # octokit types problem ?. Linting never runs in CI, leaving potential TypeScript/ESLint issues undetected. The underlying type conflict must be resolved and lint re-enabled.

• Misplaced permissions block in audit_package.yml: The top-level permissions block appears after the jobs: block (lines 29–33). While GitHub Actions parses it correctly (YAML keys are order-independent), this is non-standard and makes the security posture harder to audit at a glance. The permissions block should be moved above jobs:.

---

⚠️ Warnings

• Nunjucks auto-escaping not enabled (src/reporter.ts): nunjucks.configure() does not set autoescape: true. Advisory titles, descriptions, and URLs from cargo-audit output are rendered unescaped into the GitHub Check body and issue templates. Consider enabling autoescape: true and marking only truly trusted fields with | safe.

• Actions not pinned to commit SHA in workflows: actions/checkout@v7 and actions/setup-node@v7 in ci.yml, and reusable workflow refs @v1 in actions_release.yml, auto_cherry_pick.yml, and audit_package.yml are pinned by tag only. Tags are mutable. Pinning to a specific commit SHA is recommended for supply chain security.

• removeTrailingSlash lacks empty-string guard (src/main.ts): Accessing str[str.length - 1] on an empty string returns undefined, so the trailing-slash condition silently passes. A defensive check would prevent unexpected behavior if working-directory is explicitly set to an empty string.

---

🔒 Security Findings

• Nunjucks unescaped output (Low severity): Advisory data fields (description, URL, title) from the RustSec advisory database — fetched via cargo-audit — are interpolated into GitHub Check output without HTML escaping. A maliciously crafted advisory entry could inject markdown or HTML. Mitigation: enable autoescape: true in nunjucks.configure() in src/reporter.ts.

• GITHUB_REPOSITORY in HTTP URL path (Informational): process.env.GITHUB_REPOSITORY is directly interpolated into the subscription API URL. This value is set by GitHub's runner and is not user-controlled in normal workflows, so exploitation risk is low. URL-encoding the value (encodeURIComponent) before interpolation would be more defensive.

---

Summary

The onboarding PR is largely well-structured — the subscription check, upstream variable, licensing, and StepSecurity metadata are all correct. Two issues need addressing before merge: the commented-out lint step in CI must be restored (or the root type conflict fixed), and the permissions block in audit_package.yml should be moved above jobs:. The nunjucks auto-escape gap is a low-severity security concern worth fixing.

[anurag-stepsecurity]

LGTM.