chore: Cherry-pick changes from upstream by anurag-stepsecurity · Pull Request #137 · step-security/mozilla-sops-action

anurag-stepsecurity · 2026-09-08T10:21:42Z

mdgreenwald/mozilla-sops-action@v2.1.0...v2.1.1

Signed-off-by: Anurag Rajawat <anurag@stepsecurity.io>

anurag-stepsecurity · 2026-09-08T10:23:12Z

📦 Target Release Version: v2.1.1
📋 Previous Release Version: v2.1.0

github-actions · 2026-09-08T10:24:30Z

🔍 Cherry-Pick Verification Report

📦 Upstream Changes: v2.1.0...v2.1.1

📋 File-by-File Analysis:

`CHANGELOG.md`

Upstream has changes: ✅ Yes
File exists in PR: ❌ No
Status: 🔴 Missing - File missing in PR (upstream has 10 additions, 0 deletions)

`README.md`

Upstream has changes: ✅ Yes
File exists in PR: ❌ No
Status: 🔴 Missing - ❌ No PR patch available (+3 -3)

`src/run.test.ts`

Upstream has changes: ✅ Yes
File exists in PR: ✅ Yes
Changes match: ✅ Yes
Status: 🟢 Perfect - ✅ All changes applied correctly (+42 -0)

`src/run.ts`

Upstream has changes: ✅ Yes
File exists in PR: ✅ Yes
Changes match: ✅ Yes
Status: 🟢 Perfect - ✅ All changes applied correctly (+16 -1)

📊 Summary:

Total files changed upstream: 4
Files present in PR: 2/4
Files with matching changes: 2/4

❌ Overall Status: 🔴 INCOMPLETE - Missing files or changes

github-actions · 2026-09-08T10:30:14Z

PR Review

Action Type

Node-based action - runs on node24 as declared in action.yml, compiled bundle at dist/index.js.

✅ Passed Checks

License: LICENSE is present with StepSecurity copyright.
action.yml: Present; no author field, author check waived per policy.
SECURITY.md: Present with correct StepSecurity contact.
No FUNDING.yml/funding.yml: Not found.
Required workflows: Both auto_cherry_pick.yml and actions_release.yml present in .github/workflows/.
No renovate.json: Not found.
No PULL_REQUEST.md: Not found.
No ISSUE_TEMPLATE folder: Not found.
No CHANGELOG.md: Not found.
No .vscode folder: Not found.
README.md major version only: All usage examples correctly use @v2 (major version only, not full semver).
README.md banner: StepSecurity maintained-action banner present.
Subscription check URL: Correct endpoint called (agent.api.stepsecurity.io/.../maintained-actions-subscription).
Upstream variable: upstream = 'mdgreenwald/mozilla-sops-action' matches original-owner/repo-name from auto_cherry_pick.yml.
package.json author: set to step-security.
package.json repository: URL contains step-security.
dist folder: Present with dist/index.js.
Build script: package.json has a build script.
No unused dependencies: All runtime deps (@actions/core, @actions/tool-cache, axios) are used in src/run.ts.

❌ Failed Checks

LICENSE missing original author copyright: The LICENSE file lists Copyright (c) Microsoft Corporation and Copyright (c) 2025 StepSecurity, but does not include a copyright line for mdgreenwald - the direct original author identified by original-owner in auto_cherry_pick.yml. Policy requires both StepSecurity and the original author copyright. Please add Copyright (c) mdgreenwald to LICENSE.

⚠️ Warnings

chmod 777 on downloaded binary (src/run.ts line 130): Pre-existing, inherited from upstream, but unnecessarily permissive - 755 is the conventional and safer mode for a binary. Same applies to the conditional chmodSync at line 148.
Misleading test name: The test does not throw when chmod on an already-executable cache hit would fail with EPERM configures mockAccessSync to succeed, so chmodSync is never invoked and the EPERM mock is dead code in that test. The test only confirms chmod is skipped when the binary is already executable; it does not exercise the actual EPERM error path. Consider adding a case where accessSync throws (file not executable) AND chmodSync throws EPERM.

🔒 Security Findings

chmod 777 creates world-writable binary (src/run.ts line 130): fs.chmodSync(sopsDownloadPath, '777') makes the downloaded binary writable by any process on the runner, opening a narrow TOCTOU window between downloadTool and cacheFile on self-hosted/shared runners. Changing to 755 eliminates write-by-others exposure. Pre-existing, not introduced by this PR.

Summary

This PR correctly cherry-picks the upstream v2.1.0 to v2.1.1 fix that guards chmodSync with an isExecutable check, along with devDependency bumps and matching tests. One policy failure must be resolved before merge: LICENSE needs a copyright line for the original author (mdgreenwald). The chmod 777 concern and misleading test name are non-blocking recommendations.

github-actions · 2026-09-08T10:37:04Z

PR Review\n\n### Action Type\nNode-based action - runs on `node24` as declared in `action.yml`, compiled bundle at `dist/index.js`.\n\n### Passed Checks\n\n- License: `LICENSE` is present with StepSecurity copyright.

github-actions · 2026-09-08T10:37:53Z

test body simple

github-actions · 2026-09-08T10:38:42Z

PR Review body with no hashes at line starts - test 2

github-actions · 2026-09-08T10:47:09Z

test with no hashes and no newlines

github-actions · 2026-09-08T10:47:23Z

Test line 1
Test line 2 no hash

github-actions · 2026-09-08T10:47:35Z

Test header at start

regular line after

github-actions · 2026-09-08T10:47:55Z

placeholder

github-actions · 2026-09-08T10:56:33Z

PR Review

Action Type

Node-based action - runs on node24 as declared in action.yml, compiled bundle at dist/index.js.

✅ Passed Checks

License: LICENSE is present with StepSecurity copyright.
action.yml: Present; no author field, author check waived per policy.
SECURITY.md: Present with correct StepSecurity contact.
No FUNDING.yml/funding.yml: Not found.
Required workflows: Both auto_cherry_pick.yml and actions_release.yml present in .github/workflows/.
No renovate.json: Not found.
No PULL_REQUEST.md: Not found.
No ISSUE_TEMPLATE folder: Not found.
No CHANGELOG.md: Not found.
No .vscode folder: Not found.
README.md major version only: All usage examples correctly use @v2 (major version only, not full semver).
README.md banner: StepSecurity maintained-action banner present.
Subscription check URL: Correct endpoint called (agent.api.stepsecurity.io/.../maintained-actions-subscription).
Upstream variable: upstream = 'mdgreenwald/mozilla-sops-action' matches original-owner/repo-name from auto_cherry_pick.yml.
package.json author: set to step-security.
package.json repository: URL contains step-security.
dist folder: Present with dist/index.js.
Build script: package.json has a build script.
No unused dependencies: All runtime deps (@actions/core, @actions/tool-cache, axios) are used in src/run.ts.

❌ Failed Checks

LICENSE missing original author copyright: The LICENSE file lists Copyright (c) Microsoft Corporation and Copyright (c) 2025 StepSecurity, but does not include a copyright line for mdgreenwald - the direct original author identified by original-owner in auto_cherry_pick.yml. Policy requires both StepSecurity and the original author copyright. Please add Copyright (c) mdgreenwald to LICENSE.

⚠️ Warnings

chmod 777 on downloaded binary (src/run.ts line 130): Pre-existing, inherited from upstream, but unnecessarily permissive - 755 is the conventional and safer mode for a binary. Same applies to the conditional chmodSync at line 148.
Misleading test name: The test does not throw when chmod on an already-executable cache hit would fail with EPERM configures mockAccessSync to succeed, so chmodSync is never invoked and the EPERM mock is dead code in that test. The test only confirms chmod is skipped when the binary is already executable; it does not exercise the actual EPERM error path. Consider adding a case where accessSync throws (file not executable) AND chmodSync throws EPERM.

🔒 Security Findings

chmod 777 creates world-writable binary (src/run.ts line 130): fs.chmodSync(sopsDownloadPath, '777') makes the downloaded binary writable by any process on the runner, opening a narrow TOCTOU window between downloadTool and cacheFile on self-hosted/shared runners. Changing to 755 eliminates write-by-others exposure. Pre-existing, not introduced by this PR.

Summary

This PR correctly cherry-picks the upstream v2.1.0 to v2.1.1 fix that guards chmodSync with an isExecutable check, along with devDependency bumps and matching tests. One policy failure must be resolved before merge: LICENSE needs a copyright line for the original author (mdgreenwald). The chmod 777 concern and misleading test name are non-blocking recommendations.

github-actions · 2026-09-08T11:32:50Z

PR Review

Action Type

Node-based action - runs on node24 as declared in action.yml, compiled bundle at dist/index.js.

✅ Passed Checks

License: LICENSE is present with StepSecurity copyright.
action.yml: Present; no author field, author check waived per policy.
SECURITY.md: Present with correct StepSecurity contact.
No FUNDING.yml/funding.yml: Not found.
Required workflows: Both auto_cherry_pick.yml and actions_release.yml present in .github/workflows/.
No renovate.json: Not found.
No PULL_REQUEST.md: Not found.
No ISSUE_TEMPLATE folder: Not found.
No CHANGELOG.md: Not found.
No .vscode folder: Not found.
README.md major version only: All usage examples correctly use @v2 (major version only, not full semver).
README.md banner: StepSecurity maintained-action banner present.
Subscription check URL: Correct endpoint called (agent.api.stepsecurity.io/.../maintained-actions-subscription).
Upstream variable: upstream = 'mdgreenwald/mozilla-sops-action' matches original-owner/repo-name from auto_cherry_pick.yml.
package.json author: set to step-security.
package.json repository: URL contains step-security.
dist folder: Present with dist/index.js.
Build script: package.json has a build script.
No unused dependencies: All runtime deps (@actions/core, @actions/tool-cache, axios) are used in src/run.ts.

❌ Failed Checks

LICENSE missing original author copyright: The LICENSE file lists Copyright (c) Microsoft Corporation and Copyright (c) 2025 StepSecurity, but does not include a copyright line for mdgreenwald - the direct original author identified by original-owner in auto_cherry_pick.yml. Policy requires both StepSecurity and the original author copyright. Please add Copyright (c) mdgreenwald to LICENSE.

⚠️ Warnings

chmod 777 on downloaded binary (src/run.ts line 130): Pre-existing, inherited from upstream, but unnecessarily permissive - 755 is the conventional and safer mode for a binary. Same applies to the conditional chmodSync at line 148.
Misleading test name: The test does not throw when chmod on an already-executable cache hit would fail with EPERM configures mockAccessSync to succeed, so chmodSync is never invoked and the EPERM mock is dead code in that test. The test only confirms chmod is skipped when the binary is already executable; it does not exercise the actual EPERM error path. Consider adding a case where accessSync throws (file not executable) AND chmodSync throws EPERM.

🔒 Security Findings

chmod 777 creates world-writable binary (src/run.ts line 130): fs.chmodSync(sopsDownloadPath, '777') makes the downloaded binary writable by any process on the runner, opening a narrow TOCTOU window between downloadTool and cacheFile on self-hosted/shared runners. Changing to 755 eliminates write-by-others exposure. Pre-existing, not introduced by this PR.

Summary

This PR correctly cherry-picks the upstream v2.1.0 to v2.1.1 fix that guards chmodSync with an isExecutable check, along with devDependency bumps and matching tests. One policy failure must be resolved before merge: LICENSE needs a copyright line for the original author (mdgreenwald). The chmod 777 concern and misleading test name are non-blocking recommendations.

github-actions · 2026-09-08T11:34:42Z


-   fs.chmodSync(sopspath, '777')
+   if (!isExecutable(sopspath)) {
+      fs.chmodSync(sopspath, '777')


chmod 777 is overly permissive. Setting the mode to 777 makes the binary world-writable, which on shared or self-hosted runners allows any local process to overwrite the cached sops binary — a potential supply-chain / TOCTOU attack vector. The mode 755 (owner-writable, all-execute) is the conventional and safer choice for a downloaded binary.

Suggested change

fs.chmodSync(sopspath, '777')

fs.chmodSync(sopspath, '755')

github-actions · 2026-09-08T11:34:50Z

+
+   test('downloadSops() - does not throw when chmod on an already-executable cache hit would fail with EPERM', async () => {
+      mockFind.mockReturnValue('pathToCachedDir')
+      mockPlatform.mockReturnValue('linux')


Misleading test name — EPERM path is never exercised. This test sets mockAccessSync to succeed (returns undefined), so isExecutable() returns true and chmodSync is never called at all. The EPERM error configured on mockChmodSync is dead code in this test.

The test is actually a duplicate of the skips chmod on a cache hit that is already executable test above it. To genuinely test the EPERM scenario described in the name and the source-code comment, the test would need mockAccessSync to throw (so the binary is not considered executable) and mockChmodSync to throw EPERM — then verify the error propagates (or is swallowed, depending on the desired behaviour). Consider either renaming this test to reflect what it actually asserts, or rewriting it to cover the real EPERM path.

github-actions · 2026-09-09T08:58:18Z

🔍 Cherry-Pick Verification Report

📦 Upstream Changes: v2.1.0...v2.1.1

📋 File-by-File Analysis:

`CHANGELOG.md`

Upstream has changes: ✅ Yes
File exists in PR: ❌ No
Status: 🔴 Missing - File missing in PR (upstream has 10 additions, 0 deletions)

`README.md`

Upstream has changes: ✅ Yes
File exists in PR: ❌ No
Status: 🔴 Missing - ❌ No PR patch available (+3 -3)

`src/run.test.ts`

Upstream has changes: ✅ Yes
File exists in PR: ✅ Yes
Changes match: ✅ Yes
Status: 🟢 Perfect - ✅ All changes applied correctly (+42 -0)

`src/run.ts`

Upstream has changes: ✅ Yes
File exists in PR: ✅ Yes
Changes match: ✅ Yes
Status: 🟢 Perfect - ✅ All changes applied correctly (+16 -1)

📊 Summary:

Total files changed upstream: 4
Files present in PR: 2/4
Files with matching changes: 2/4

❌ Overall Status: 🔴 INCOMPLETE - Missing files or changes

chore: Cherry-pick changes from upstream

9ef6f7f

Signed-off-by: Anurag Rajawat <anurag@stepsecurity.io>

anurag-stepsecurity added the review-required This PR requires review label Sep 8, 2026

Raj-StepSecurity approved these changes Sep 8, 2026

View reviewed changes

github-actions Bot reviewed Sep 8, 2026

View reviewed changes

Merge branch 'main' into auto-cherry-pick

5496bc6

anurag-stepsecurity removed the review-required This PR requires review label Sep 9, 2026

anurag-stepsecurity merged commit f740a28 into main Sep 9, 2026
19 of 20 checks passed

anurag-stepsecurity deleted the auto-cherry-pick branch September 9, 2026 09:00

Conversation

anurag-stepsecurity commented Sep 8, 2026

Uh oh!

anurag-stepsecurity commented Sep 8, 2026

Uh oh!

github-actions Bot commented Sep 8, 2026

🔍 Cherry-Pick Verification Report

📋 File-by-File Analysis:

CHANGELOG.md

README.md

src/run.test.ts

src/run.ts

📊 Summary:

Uh oh!

github-actions Bot commented Sep 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

PR Review

Action Type

✅ Passed Checks

❌ Failed Checks

⚠️ Warnings

🔒 Security Findings

Summary

Uh oh!

github-actions Bot commented Sep 8, 2026

PR Review\n\n### Action Type\nNode-based action - runs on node24 as declared in action.yml, compiled bundle at dist/index.js.\n\n### Passed Checks\n\n- License: LICENSE is present with StepSecurity copyright.

Uh oh!

github-actions Bot commented Sep 8, 2026

Uh oh!

github-actions Bot commented Sep 8, 2026

Uh oh!

github-actions Bot commented Sep 8, 2026

Uh oh!

github-actions Bot commented Sep 8, 2026

Uh oh!

github-actions Bot commented Sep 8, 2026

Test header at start

Uh oh!

github-actions Bot commented Sep 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Sep 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

PR Review

Action Type

✅ Passed Checks

❌ Failed Checks

⚠️ Warnings

🔒 Security Findings

Summary

Uh oh!

github-actions Bot commented Sep 8, 2026

PR Review

Action Type

✅ Passed Checks

❌ Failed Checks

⚠️ Warnings

🔒 Security Findings

Summary

Uh oh!

github-actions Bot Sep 8, 2026

Choose a reason for hiding this comment

Uh oh!

github-actions Bot Sep 8, 2026

Choose a reason for hiding this comment

Uh oh!

github-actions Bot commented Sep 9, 2026

🔍 Cherry-Pick Verification Report

📋 File-by-File Analysis:

CHANGELOG.md

README.md

src/run.test.ts

src/run.ts

📊 Summary:

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

`CHANGELOG.md`

`README.md`

`src/run.test.ts`

`src/run.ts`

github-actions Bot commented Sep 8, 2026 •

edited

Loading

PR Review\n\n### Action Type\nNode-based action - runs on `node24` as declared in `action.yml`, compiled bundle at `dist/index.js`.\n\n### Passed Checks\n\n- License: `LICENSE` is present with StepSecurity copyright.

github-actions Bot commented Sep 8, 2026 •

edited

Loading

github-actions Bot commented Sep 8, 2026 •

edited

Loading

`CHANGELOG.md`

`README.md`

`src/run.test.ts`

`src/run.ts`