Enhance verify-action-build.py with deep composite/docker verification

[potiuk]

Summary

• Fix Node.js version detection: correctly extract version from using: field (e.g. node20 → 20) and handle use: typos
• Deep verification for non-JS actions: composite and docker actions now get comprehensive analysis instead of just "SKIPPED":
  • Recursive nested action inspection (all action types — composite, node, docker)
  • Dockerfile analysis (base image pinning, suspicious commands)
  • Script pattern scanning (eval, exec, pipe-to-shell, base64 obfuscation, HTTP requests)
  • Dependency pinning checks (Python requirements, package.json, lock files)
  • Action metadata analysis (shell injection risks, GITHUB_ENV/GITHUB_PATH writes, secrets references)
  • Repository metadata (license, security policy, well-known org trust signal)
• Trusted orgs: nested actions from actions and github orgs skip deep recursive inspection (still checked for hash-pinning) and are marked as trusted in the summary table
• Well-known orgs (informational signal in repo metadata check): actions, github, google-github-actions, aws-actions, azure, docker, hashicorp, pypa, gradle
• Verification summary table: structured at-a-glance table of all checks with pass/warn/fail status, plus nested actions sub-table showing type, pinning, approved, and trusted status
• Extract action refs from actions.yml: --from-pr and dependabot review now also detect action references from added entries in actions.yml (not just workflow uses: lines), e.g. PR Add lhotari/sandboxed-trivy-action v1.0.1 #582

Test plan

• Tested with composite action: pypa/gh-action-pypi-publish@ed0c539...
• Tested with JS action: actions/checkout@11bd719... — no regressions
• Tested --ci mode (non-interactive)
• Tested q quit in interactive prompts
• Tested --from-pr 582 (actions.yml format extraction)
• Tested --from-pr 618 (workflow uses: format extraction)
• Test with --check-dependabot-prs flow
• Test with a docker-type action

Generated with Claude Code

[potiuk]

Example raport before approval:

[potiuk]

Generated with literally few prompts with Claude and few manual fixes after testing and reviewing code.

[potiuk]

Verified two proposed actions - also enhanced action detection so that `--from-pr will properly detect the action from a PR manully adding actions.yaml

[dave2wave]

Hard to tell since the current three PRs don't fall completely into the changes. I did notice better workflow.

[dave2wave]

@potiuk it looks this PR has fallen behind. Close, rebase, or recreate?

[potiuk]

@potiuk it looks this PR has fallen behind. Close, rebase, or recreate?

Just conflicts to solve - and waits for approval.

[potiuk]

rebased

[potiuk]

This one should handle actions like lhotari's better. @raboof @dave2wave -> possibly worth merging

[raboof]

I think this seems OK to me, though it's a lot to digest.

The script is also getting quite large, it might be time to start moving it to its own folder, moving some of the 'inline' code/scripts/dockerfiles to dedicated files, and accompanying new features with regression tests?

[potiuk]

The script is also getting quite large, it might be time to start moving it to its own folder, moving some of the 'inline' code/scripts/dockerfiles to dedicated files, and accompanying new features with regression tests?

Correct. I will do it shortly.

[potiuk]

Removed the "open in browser". Merging just deep-composite action verification.