feat: added banner and update subscription check to make maintained actions free for public repos

[Raj-StepSecurity]

Summary

• Added StepSecurity Maintained Action banner to README.md
• Updated subscription validation: public repositories are now free (no API check)
• Upgraded Node.js runtime to node24 (if applicable)
• Updated workflow files with configurable node_version input (if applicable)

Changes by type

• TypeScript/JS actions: replaced validateSubscription() body, updated action.yml to node24, updated 3 workflow files, rebuilt dist/
• Docker actions: replaced entrypoint.sh subscription block, ensured jq is installed in Dockerfile
• Composite actions: added Subscription check step to action.yml

Verification

• Subscription check skips for public repos
• Subscription check fires for private repos
• README banner is present at the top
• Build passes (TS/JS actions)

Auto-generated by StepSecurity update-propagator. Task ID: 20260413T045616Z

[claude]

Claude finished @Raj-StepSecurity's task —— View job

---

StepSecurity Maintained Action Review

Reviewing PR #70 for StepSecurity maintained action compliance...

Review Checklist:

• Determine action type (node/docker/composite)
• Check licensing and copyright requirements
• Verify action.yml structure and authorship
• Check required/forbidden files and folders
• Validate README banner and usage examples
• Review subscription check implementation
• Scan for security vulnerabilities
• Verify StepSecurity branding consistency

Action Type Identified: Node.js-based action (has package.json, action.yml runs using node24, dist/ folder present)

✅ Compliance Review Results

Licensing & Copyright:

• ✅ LICENSE file present with both original author (Stefan Zweifel) and StepSecurity copyright
• ✅ action.yml has author: step-security correctly set

File Structure:

• ✅ action.yml present with correct author
• ✅ SECURITY.md file present
• ✅ Required workflow files: auto_cherry_pick.yml, actions_release.yml present
• ✅ No forbidden files found (FUNDING.yml, renovate.json, PULL_REQUEST.md, CHANGELOG.md, .vscode, ISSUE_TEMPLATE)
• ✅ dist/ folder present for Node.js action

README Compliance:

• ✅ StepSecurity banner present at top of README
• ✅ Usage examples correctly use major version (@v7) instead of full semver
• ✅ All examples reference step-security/git-auto-commit-action@v7

Subscription Check Implementation:

• ✅ Subscription check implemented correctly in index.js:14-58
• ✅ Makes API call to correct URL: https://agent.api.stepsecurity.io/v1/github/${GITHUB_REPOSITORY}/actions/maintained-actions-subscription
• ✅ Upstream variable correctly set to "stefanzweifel/git-auto-commit-action" matching auto_cherry_pick.yml original-owner/repo-name
• ✅ Public repositories bypass subscription check (line 35: if (repoPrivate === false) return;)
• ✅ Private repositories require valid subscription, exit on 403 response

Dependencies & Build:

• ✅ Only necessary dependencies: axios (used), child_process/path/fs (Node.js built-ins)
• ✅ No unused dependencies detected
• ✅ dist/ folder present and built
• ✅ package.json has build script: "ncc build index.js -m -o dist"

Security Assessment:

• ✅ No security vulnerabilities detected
• ✅ No hardcoded secrets or credentials
• ✅ Proper error handling for subscription API calls
• ✅ Input validation and safe API usage

Summary

This PR successfully implements StepSecurity maintained action standards. All compliance requirements are met:

• Proper licensing and branding
• Correct file structure
• Valid subscription check with public repo exemption
• Security best practices followed
• Clean dependency management

✅ APPROVED - All StepSecurity maintained action requirements satisfied.

[claude]

Claude finished @Raj-StepSecurity's task —— View job

---

StepSecurity Maintained Action Review

Conducting comprehensive review of PR #70 for StepSecurity maintained action compliance...

Review Checklist:

• Determine action type (node/docker/composite)
• Check licensing and copyright requirements
• Verify action.yml structure and authorship
• Check required/forbidden files and folders
• Validate README banner and usage examples
• Review subscription check implementation
• Scan for security vulnerabilities
• Verify StepSecurity branding consistency

Action Type Identified: Node.js-based action (has package.json, action.yml runs using node24, dist/ folder present)

✅ Compliance Review Results

Licensing & Copyright:

• ✅ LICENSE file present with both original author (Stefan Zweifel) and StepSecurity copyright
• ✅ action.yml has author: step-security correctly set

File Structure:

• ✅ action.yml present with correct author
• ✅ SECURITY.md file present
• ✅ Required workflow files: auto_cherry_pick.yml, actions_release.yml present
• ✅ No forbidden files found (FUNDING.yml, renovate.json, PULL_REQUEST.md, CHANGELOG.md, .vscode, ISSUE_TEMPLATE)
• ✅ dist/ folder present for Node.js action

README Compliance:

• ✅ StepSecurity banner present at top of README
• ✅ Usage examples correctly use major version (@v7) instead of full semver
• ✅ All examples reference step-security/git-auto-commit-action@v7

Subscription Check Implementation:

• ✅ Subscription check implemented correctly in index.js:14-58
• ✅ Makes API call to correct URL: https://agent.api.stepsecurity.io/v1/github/${GITHUB_REPOSITORY}/actions/maintained-actions-subscription
• ✅ Upstream variable correctly set to "stefanzweifel/git-auto-commit-action" matching auto_cherry_pick.yml original-owner/repo-name
• ✅ Public repositories bypass subscription check (line 35: if (repoPrivate === false) return;)
• ✅ Private repositories require valid subscription, exit on 403 response

Dependencies & Build:

• ✅ Only necessary dependencies: axios (used), child_process/path/fs (Node.js built-ins)
• ✅ No unused dependencies detected
• ✅ dist/ folder present and built
• ✅ package.json has build script: "ncc build index.js -m -o dist"

Security Assessment:

• ✅ No security vulnerabilities detected
• ✅ No hardcoded secrets or credentials
• ✅ Proper error handling for subscription API calls
• ✅ Input validation and safe API usage

Summary

This PR successfully implements StepSecurity maintained action standards. All compliance requirements are met:

• Proper licensing and branding
• Correct file structure
• Valid subscription check with public repo exemption
• Security best practices followed
• Clean dependency management

✅ APPROVED - All StepSecurity maintained action requirements satisfied.

---