feat: onboarding upload-rust-binary-action

[Raj-StepSecurity]

No description provided.

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.

[github-actions]

PR Review

Action Type
Composite action using shell script (main.sh). No Node.js or Docker involved.

Passed Checks

• SECURITY.md present with correct contact.
• action.yml present and well-structured.
• .github/workflows/actions_release.yml present.
• .github/workflows/auto_cherry_pick.yml present with correct original-owner (taiki-e) and repo-name.
• No FUNDING.yml, renovate.json, PULL_REQUEST.md, ISSUE_TEMPLATE, CHANGELOG.md, or .vscode folder.
• README StepSecurity maintained-action banner present.
• Subscription check calls the correct URL.
• Upstream variable taiki-e/upload-rust-binary-action matches auto_cherry_pick.yml.
• README examples use major version tags only.
• Composite action steps in action.yml do not invoke unpinned external actions.

Failed Checks

• LICENSE missing original author copyright: LICENSE credits only StepSecurity; taiki-e must also be credited. See inline comment on LICENSE line 3.
• LICENSE file and README License section are inconsistent: LICENSE has only MIT, but README references LICENSE-APACHE and LICENSE-MIT that do not exist. See inline comment on README.md line 747.

Warnings

• ci.yml line 83: setup-cross-toolchain-action@release uses a mutable floating tag; replace with versioned tag or commit SHA before merge.
• ci.yml lines 78-79: taiki-e/checkout-action@v1 and taiki-e/install-action@v2 pinned to mutable version tags; pin to commit SHAs.
• action.yml line 118: Typo in dry-run-intended description; dru-run should be dry-run. See inline comment.
• main.sh line 354: eval with cargo metadata output; safer to use separate jq assignments that avoid eval.

Security Findings

1. Shell injection via unsanitized target input (main.sh line 269): INPUT_TARGET is processed into target_upper and embedded inside eval without stripping shell metacharacters. A crafted target value could execute arbitrary commands. Validate target against an allowlist before use in eval. See inline comment.

2. JSON injection in subscription check (action.yml lines 198-200): The HTTP body uses printf without JSON-escaping ACTION_REPO and SERVER_URL. A double-quote in either value produces malformed JSON. Use jq -n --arg to construct the body safely. See inline comment.

Summary
The onboarding structure is solid overall. Two blocking issues must be resolved before merge: LICENSE must credit the original author taiki-e, and the license files referenced in the README must actually exist. The shell injection risk in main.sh should also be addressed as a security fix.

[github-actions]

PR Review

Action Type

Composite Action — action.yml uses runs: using: composite with a shell step that invokes main.sh.

---

✅ Passed Checks

• SECURITY.md is present with vulnerability reporting instructions.
• FUNDING.yml is not present.
• renovate.json is not present.
• PULL_REQUEST.md is not present.
• ISSUE_TEMPLATE folder is not present.
• CHANGELOG.md is not present.
• .vscode folder is not present.
• .github/workflows/ contains both auto_cherry_pick.yml and actions_release.yml.
• README.md includes the StepSecurity maintained action banner.
• README.md correctly uses only the major version tag (@v1) in all step-security/upload-rust-binary-action usage examples.
• Subscription check is present in action.yml and calls the correct API URL: https://agent.api.stepsecurity.io/v1/github/$GITHUB_REPOSITORY/actions/maintained-actions-subscription.
• Upstream variable in the subscription check (UPSTREAM="taiki-e/upload-rust-binary-action") correctly matches the original-owner + repo-name fields from auto_cherry_pick.yml (taiki-e / upload-rust-binary-action).
• action.yml is present (no author field; ignored per policy).

---

❌ Failed Checks

• License is missing the original author’s copyright. The LICENSE file only lists Copyright (c) 2026 StepSecurity. Since this is a maintained fork of taiki-e/upload-rust-binary-action (original license: Apache-2.0 OR MIT, as declared in main.sh’s SPDX header), the license must include both StepSecurity’s and the original author’s (taiki-e) copyright notice.
• Unpinned non-official GitHub Actions in ci.yml. Composite action guidelines require non-official actions to be pinned to a full commit SHA:
  • taiki-e/checkout-action@v1 (lines 78, 155) — pinned to a mutable tag, not a SHA.
  • taiki-e/install-action@v2 (lines 79, 156) — pinned to a mutable tag, not a SHA.
  • step-security/setup-cross-toolchain-action@release (line 83) — pinned to the release branch, not a tag or SHA. A TODO comment on this line acknowledges it needs to be replaced after release.

---

⚠️ Warnings

• The step-security/setup-cross-toolchain-action@release reference in ci.yml has a # replace post release comment indicating it is intentionally temporary. This must be updated to a stable version tag or SHA before the action is published.
• The subscription check in action.yml constructs its JSON BODY using printf with unescaped shell variables ($ACTION_REPO, $SERVER_URL). While these values come from GitHub-controlled environment variables, a repository name or server URL containing a double-quote could produce malformed JSON. Consider using jq -n --arg for proper escaping.

---

🔒 Security Findings

• Unescaped variables in JSON construction (action.yml, subscription check step): BODY=$(printf ’{"action":"%s"}’ "$ACTION_REPO") inserts $ACTION_REPO (from GITHUB_ACTION_REPOSITORY) without JSON-escaping. If the value contains a double-quote, the JSON would be malformed. Low severity since the value is GitHub-infrastructure-controlled, but best practice is to use jq for JSON assembly.
• eval with dynamic variable name (main.sh, line 269): uses user-supplied INPUT_TARGET to construct an environment variable name via eval. The sanitization (replacing -/. with _, uppercasing) is sufficient for well-formed Rust target triples, but consider using Bash indirect expansion (${!var_name}) as a safer alternative.

---

Summary

The onboarding PR is mostly well-structured with all required workflow files, the StepSecurity banner, and a correct subscription check. Two blocking issues must be addressed: the LICENSE file must include the original author’s (taiki-e) copyright alongside StepSecurity’s, and the non-official third-party actions in ci.yml must be pinned to immutable commit SHAs.

[github-actions]

PR Review

Action Type: Composite action - uses runs: using: composite in action.yml, executing main.sh via inline shell steps with no Node.js or Docker runtime.

---

Passed Checks

• SECURITY.md is present with a vulnerability reporting contact.
• FUNDING.yml / funding.yml is absent.
• .github/workflows/actions_release.yml is present.
• .github/workflows/auto_cherry_pick.yml is present with correct original-owner: taiki-e and repo-name: upload-rust-binary-action.
• renovate.json is absent.
• PULL_REQUEST.md is absent.
• ISSUE_TEMPLATE folder is absent.
• CHANGELOG.md is absent.
• .vscode folder is absent.
• README.md usage examples correctly reference only the major version tag (@v1) - no full semver pins in any uses: blocks.
• README.md StepSecurity banner is present.
• Subscription check is present in action.yml and calls the correct maintained-actions-subscription endpoint.
• UPSTREAM variable (taiki-e/upload-rust-binary-action) correctly matches original-owner/repo-name from auto_cherry_pick.yml.
• action.yml is present; no author field found, so that check is skipped per policy.
• Composite steps use only inline run: shell scripts - no external uses: actions inside the composite, so pinning is not required.

---

Failed Checks

• LICENSE is missing the original author copyright. The file reads Copyright (c) 2026 StepSecurity only. As a maintained fork of taiki-e/upload-rust-binary-action, the MIT license must also carry the original author copyright (e.g. Copyright (c) taiki-e). Both copyright holders must be attributed. An inline comment has been left on LICENSE line 3.

---

Warnings

• eval with unsanitised target_upper in main.sh line 269. The variable is derived from user-controlled INPUT_TARGET via substitutions that do not strip shell metacharacters such as dollar signs or parentheses. While exploitation requires controlling workflow inputs (self-injection), best practice is to validate target against [a-zA-Z0-9._-] before the eval. An inline comment has been left on main.sh line 269.
• README Security section references full semver tag patterns in prose (not in a uses: block), so the major-version-only rule is not violated, but it could mislead readers.

---

Security Findings

• Medium severity: potential shell injection via eval on user-supplied target input (main.sh line 269). If INPUT_TARGET contains metacharacters, the substitutions building target_upper do not strip them, allowing arbitrary command execution. Recommended fix: validate target against ^[a-zA-Z0-9._-]+$ and bail on invalid input before computing target_upper.

---

Summary: One mandatory fix is required before merging - the LICENSE must credit the original author taiki-e alongside StepSecurity. The eval in main.sh should also be hardened with explicit character validation to prevent shell injection.

[github-actions]

PR Review

Action Type

Composite Action — action.yml uses using: composite and delegates main logic to main.sh (bash). No Node.js runtime or Docker image involved.

---

✅ Passed Checks

• SECURITY.md is present.
• FUNDING.yml is not present.
• .github/workflows/auto_cherry_pick.yml is present and correctly configured.
• .github/workflows/actions_release.yml is present.
• renovate.json is not present.
• PULL_REQUEST.md is not present.
• ISSUE_TEMPLATE folder is not present.
• CHANGELOG.md is not present.
• .vscode folder is not present.
• README.md examples all use only major version tag (@v1), no complete semver tags.
• StepSecurity banner is present at the top of README.md.
• Subscription check is present in action.yml and correctly calls https://agent.api.stepsecurity.io/v1/github/$GITHUB_REPOSITORY/actions/maintained-actions-subscription.
• Upstream variable value taiki-e/upload-rust-binary-action correctly matches original-owner: "taiki-e" and repo-name: "upload-rust-binary-action" from auto_cherry_pick.yml.
• action.yml is present (no author field — ignored per review criteria).
• Composite action pinning: action.yml steps do not use any external uses: references — all steps are inline scripts.

---

❌ Failed Checks

• License missing original author copyright: The LICENSE file only attributes copyright to 2026 StepSecurity. Since this is a maintained fork of taiki-e/upload-rust-binary-action, the original author's copyright must also be included (e.g., Copyright (c) 2020 Taiki Endo).

• CI workflow uses unpinned third-party actions: .github/workflows/ci.yml uses the following non-official GitHub actions that are not pinned to commit SHAs:

  • taiki-e/checkout-action@v1 — should be pinned to a commit SHA
  • taiki-e/install-action@v2 — should be pinned to a commit SHA
  • step-security/setup-cross-toolchain-action@release — critical: uses a floating branch name (release) instead of a tag or commit SHA

---

⚠️ Warnings

• step-security/setup-cross-toolchain-action@release uses a floating branch reference — worse than a semver tag. Any commit pushed to the release branch immediately affects CI.
• The UPSTREAM variable in the subscription check is used for display only (not as the API input), which is correct behavior.

---

🔒 Security Findings

• Potential command injection via eval with user-controlled target triple (main.sh line 269): target_upper is derived from INPUT_TARGET via character substitution and tr uppercasing, then interpolated inside an eval expression: eval "printf '%s\n' ${CARGO_TARGET_${target_upper}_LINKER:-}". Shell metacharacters (e.g., $(cmd)) survive the character substitutions and are executed by eval. Risk is low since target values come from workflow authors, but this pattern should be replaced with bash indirect variable reference syntax (${!varname}).

• Supply chain risk in CI: step-security/setup-cross-toolchain-action@release in ci.yml references a mutable branch. A compromised push to that branch would run arbitrary code in this repo's CI.

---

Summary

The core action structure, subscription logic, documentation, and file hygiene are all well-implemented. Two issues must be fixed before merging: the LICENSE file needs the original upstream author's copyright attribution, and the CI workflow actions must be pinned to commit SHAs — especially setup-cross-toolchain-action@release, which uses a dangerously mutable branch reference.