feat: onboarding github-app-auth-action action

[Raj-StepSecurity]

No description provided.

[github-actions]

Test

[github-actions]

PR Review

Action Type

Node-based action (TypeScript, compiled to dist/index.js and dist/post.js, runs on node24).

---

✅ Passed Checks

• License: Present with both StepSecurity and original author (Contributors to the Electron project) copyright.
• action.yml: Present with author: 'step-security'.
• SECURITY.md: Present.
• FUNDING.yml: Not present.
• Workflows: .github/workflows/ contains both auto_cherry_pick.yml and actions_release.yml.
• renovate.json, PULL_REQUEST.md, ISSUE_TEMPLATE, CHANGELOG.md, .vscode: None present.
• README semver: Examples use only major version tag (@v2).
• README banner: StepSecurity banner present at top of README.md.
• Subscription check URL: Correctly calls the maintained-actions-subscription endpoint.
• Upstream variable: const upstream = 'electron/github-app-auth-action' matches original-owner/repo-name in auto_cherry_pick.yml.
• package.json repository: Contains step-security.
• dist folder: Present with dist/index.js and dist/post.js.
• Dependencies: All declared dependencies used in source.
• Build script input: Yarn used (non-npm); script input present in actions_release.yml, audit_package.yml, auto_cherry_pick.yml.

---

❌ Failed Checks

• package.json build script uses wrong file extensions: Script is esbuild src/index.js src/post.js but actual sources are src/index.ts and src/post.ts. Running yarn package or yarn bundle will fail with a file-not-found error. Fix: esbuild src/index.ts src/post.ts --bundle --outdir=dist --platform=node --target=node24.

---

⚠️ Warnings

• Node.js version mismatch: action.yml uses node24, package.json requires >=24, but check-dist.yml and ci.yml use node-version: 20. Version-specific bugs could slip through CI.
• process.exit(1) in subscription check (src/index.ts line 59): Bypasses TypeScript error handling. Rest of action uses core.setFailed() + return — this block should be consistent.
• Credentials not masked: creds input (GitHub App private key) is never passed to core.setSecret(). The output token is correctly masked but the raw credentials are not.

---

🔒 Security Findings

• Unmasked credential input (src/index.ts line ~121): core.getInput('creds') returns a GitHub App private key. Add core.setSecret(creds) immediately after reading to redact credentials from all log output.
• No other vulnerabilities found. YAML parsing is safe. GitHub-provided env vars used without user-controlled interpolation. Post step correctly revokes the token.

---

Summary

The action passes the majority of onboarding checks. One blocking issue: the package build script in package.json references .js file paths instead of the actual .ts source files, breaking all future builds. The creds input should also be masked with core.setSecret() immediately after being read.

[github-actions]

PR Review

Action Type

Node-based action (TypeScript, compiled to dist/index.js and dist/post.js, runs under node24).

---

✅ Passed Checks

• License: LICENSE is present with copyright for both the original Electron project contributors and StepSecurity.
• action.yml: Present with author: 'step-security' set correctly.
• SECURITY.md: Present with a vulnerability reporting contact.
• No FUNDING.yml: Not present.
• No renovate.json: Not present.
• No PULL_REQUEST.md: Not present.
• No ISSUE_TEMPLATE folder: Not present.
• No CHANGELOG.md: Not present.
• No .vscode folder: Not present.
• Required workflows: .github/workflows/auto_cherry_pick.yml and .github/workflows/actions_release.yml are both present.
• StepSecurity banner: README.md contains the required StepSecurity Maintained Action banner at the top.
• Version tags in README: All uses: examples use only the major version tag (@v2), not full semver.
• Subscription check URL: validateSubscription() correctly calls https://agent.api.stepsecurity.io/v1/github/${GITHUB_REPOSITORY}/actions/maintained-actions-subscription.
• upstream variable: Value is electron/github-app-auth-action, which correctly matches original-owner: "electron" + repo-name: "github-app-auth-action" from auto_cherry_pick.yml.
• dist/ folder: Present with index.js and post.js; subscription check code is confirmed present in built output.
• package.json author: No author field present — check skipped per policy.
• package.json repository: Contains step-security in the repository URL.
• script input in release/audit workflows: Both actions_release.yml and audit_package.yml expose a script input (required since the package manager is yarn, not npm).
• All dependencies used: axios, yaml, @actions/core, @actions/github, and @electron/github-app-auth are all actively used in source.

---

❌ Failed Checks

• package build script references wrong file extensions: package.json line 24 calls esbuild src/index.js src/post.js ..., but only src/index.ts and src/post.ts exist. esbuild does not auto-resolve .js → .ts, so yarn package will fail on a clean build. The committed dist/ is functional, but any rebuild attempt will break. Fix: change entry points to src/index.ts src/post.ts. (See inline comment.)

---

⚠️ Warnings

• Broken Super-Linter badge in README: Line 5 of README.md references .github/workflows/linter.yml in its badge URL, but that workflow file does not exist in this repository. The badge will display a permanent error. Either add the workflow or remove the badge. (See inline comment.)
• Audit workflow filename: The workflow file is named audit_package.yml rather than the conventional audit_fix.yml. The content is correct, but the naming deviates from the standard convention referenced in the onboarding checklist.
• process.exit(1) in subscription check: When a private-repo subscription check returns 403, the code calls process.exit(1) rather than core.setFailed(). This hard-kills the process before the post-step cleanup (token revocation) can run. This is intentional for enforcement, but worth documenting clearly.

---

🔒 Security Findings

No critical security issues found.

• Token is correctly masked via core.setSecret(token) before being set as output.
• GITHUB_EVENT_PATH is read as a file path from the environment — this is controlled by the GitHub Actions runtime and is not exploitable.
• permissions input is parsed through the yaml library with full error handling; no injection risk identified.
• The subscription body sends GITHUB_ACTION_REPOSITORY to the StepSecurity API over HTTPS — no sensitive data is exposed.
• Workflow files in .github/workflows/ci.yml and check-dist.yml use actions/checkout@v7 and actions/setup-node@v7 without SHA pinning, which is a minor supply-chain risk for CI workflows (not the main action itself).

---

Summary

The onboarding is well-structured and nearly complete. One blocking bug must be fixed before shipping: the yarn package build script references .js entry points that don't exist — the dist is currently functional (committed from a prior build), but any future rebuild will fail. The broken Super-Linter badge should also be cleaned up before merging.