feat: Onboard go-task/setup-task action

[anurag-stepsecurity]

https://github.com/go-task/setup-task

[anurag-stepsecurity]

Upstream's check is also failing https://github.com/go-task/setup-task/actions/runs/29323123008.
Once they fix their ours will also be fixed.

[github-actions]

PR Review

Action Type

Node-based action running on node24 as declared in action.yml.

---

Passed Checks

• action.yml present with author set to step-security
• SECURITY.md is present with correct reporting address
• No FUNDING.yml / funding.yml found
• No renovate.json found
• No PULL_REQUEST.md found
• No ISSUE_TEMPLATE folder found
• No CHANGELOG.md found
• No .vscode folder found
• .github/workflows contains both required files: auto_cherry_pick.yml and actions_release.yml
• README.md contains the StepSecurity maintained action banner
• README.md usage examples correctly use only the major version tag (@v2), not a full semver
• Subscription check is present and calls the correct agent URL
• Upstream variable "go-task/setup-task" correctly constructed from auto_cherry_pick.yml (original-owner: go-task, repo-name: setup-task)
• dist folder is present with bundled index.js
• package.json author is step-security
• package.json repository.url contains step-security
• actions_release.yml contains script as an input (required since package.json has no scripts.build field)
• audit_package.yml contains script as an input

---

Failed Checks

• LICENSE missing original author copyright — The LICENSE file only contains StepSecurity copyright. The source files (src/main.ts and src/installer.ts) carry "Copyright (c) 2019 ARDUINO SA" (the original upstream from which go-task/setup-task was derived), but this attribution is absent from the LICENSE file itself. The original author copyright must appear in the LICENSE file.

• @actions/github is an unused dependency — @actions/github is declared under dependencies in package.json but is never imported in any file under src/ or tests/. It must be removed.

• @actions/io is misclassified as a devDependency — src/installer.ts imports mkdirP and mv from @actions/io at runtime, making it a production dependency. It is currently listed under devDependencies and must be moved to dependencies.

---

Warnings

• axios adds an unnecessary dependency — subscription.ts uses axios for a single HTTP POST call while @actions/http-client is already a production dependency capable of the same request. This adds bundle size with no benefit.

• Workflow file naming — The expected workflow filename is audit_fix.yml, but the file is named audit_package.yml. The content is functionally correct (it delegates to the audit_fix.yml reusable workflow and includes the required script input), but the local filename differs from the expected convention.

---

Security Findings

No critical security vulnerabilities found.

• Checksum verification is properly implemented in installer.ts — downloaded binaries are verified against the official go-task release checksums before extraction.
• Token handling is safe — repo-token is used only in HTTP authorization headers and is never logged.
• No command injection, path traversal, or SSRF vulnerabilities found — all HTTP request URLs are built from hardcoded base domains with GitHub-controlled or semver-validated values.
• Subscription check error handling is correct — timeouts are non-fatal; only a 403 response triggers a hard failure.

---

Summary

This is a well-structured onboarding of the go-task/setup-task action with proper subscription enforcement and checksum verification. Three issues must be resolved before merging: the LICENSE file is missing the original ARDUINO SA copyright attribution, @actions/github must be removed as an unused dependency, and @actions/io must be moved from devDependencies to dependencies.

[github-actions]

PR Review posted as multiple inline comments. See inline comments below for details.

[github-actions]

Node-based action (node24, entry point dist/index.js).

PASSED: SECURITY.md present. No FUNDING.yml, renovate.json, PULL_REQUEST.md, CHANGELOG.md. No ISSUE_TEMPLATE or .vscode dirs. auto_cherry_pick.yml and actions_release.yml present in .github/workflows/. action.yml has author=step-security. README has StepSecurity banner. README uses major-version tag (@v2). Subscription check calls correct URL. Subscription upstream 'go-task/setup-task' matches auto_cherry_pick.yml. package.json author=step-security with step-security in repo URL. dist/ folder present. script input present in both actions_release.yml and audit_package.yml. All dependencies used.

FAILED: (1) LICENSE header missing original author - has 'Copyright (c) 2026 StepSecurity' but omits 'Copyright (c) 2019 ARDUINO SA'. Source files carry both; LICENSE must too. (2) src/subscription.ts has no copyright header (installer.ts and main.ts both have dual copyright headers).

SECURITY: (1) xt0rted/markdownlint-problem-matcher@v3 in ci.yml is pinned by mutable tag not commit SHA - vulnerable to supply-chain attack via tag mutation. (2) JSON.parse in src/subscription.ts line 10 has no try/catch around the file read - malformed event file causes uncaught exception; wrap in try/catch.

WARNINGS: All ci.yml actions are tag-pinned not SHA-pinned.

SUMMARY: Well-structured with correct subscription logic and branding. Two blockers: LICENSE missing ARDUINO SA copyright, and subscription.ts missing copyright header.

[github-actions]

PR Review

Action Type

Node-based action (runs via node24, entry point dist/index.js).

---

✅ Passed Checks

• License file present — LICENSE (GPL-3.0) is present with Copyright (c) 2026 StepSecurity
• action.yml present with author: "step-security"
• SECURITY.md present — reports to security@stepsecurity.io
• No FUNDING.yml — absent from both root and .github/
• .github/workflows/auto_cherry_pick.yml present
• .github/workflows/actions_release.yml present
• No renovate.json — not present
• No PULL_REQUEST.md — not present
• No ISSUE_TEMPLATE folder — not present
• No CHANGELOG.md — not present
• No .vscode folder — not present
• README.md usage examples use major version only — all examples use @v2
• README.md contains StepSecurity maintained action banner — correct banner and link present
• Subscription check URL correct — calls https://agent.api.stepsecurity.io/v1/github/${process.env.GITHUB_REPOSITORY}/actions/maintained-actions-subscription
• Upstream variable matches auto_cherry_pick.yml — upstream = "go-task/setup-task" matches original-owner: "go-task" + repo-name: "setup-task"
• package.json author is "step-security" ✓
• package.json repository.url contains "step-security" ✓
• All declared dependencies are used — @actions/core, @actions/http-client, @actions/io, @actions/tool-cache, axios, semver are all referenced in source
• dist/ folder present — dist/index.js, dist/package.json, dist/unzip, dist/unzip-darwin all committed
• No build script in package.json — correctly handled: both actions_release.yml and audit_package.yml include a script input (npx tsc && npx ncc build)

---

❌ Failed Checks

• LICENSE file missing original author copyright — The LICENSE file header only contains Copyright (c) 2026 StepSecurity. The original author (Copyright (c) 2019 ARDUINO SA) is credited in source file headers but is absent from the LICENSE file itself. Both copyright lines must appear in LICENSE to satisfy the requirement.

---

⚠️ Warnings

• Redundant HTTP client — axios is used solely in src/subscription.ts while @actions/http-client (already a dependency) is used in src/installer.ts. Using a single HTTP client would reduce bundle size and dependency surface.
• 3rd-party CI workflow actions not pinned to commit SHAs — ruby/setup-ruby@v1 and xt0rted/markdownlint-problem-matcher@v3 in ci.yml use mutable major-version tags. Best practice for supply-chain security is to pin to an immutable SHA.

---

🔒 Security Findings

• Checksum verification silently skipped on failure (src/installer.ts, verifyChecksum function) — If fetching the checksum file fails for any reason (network error, interference), the action logs a warning and continues installing the binary without integrity verification. An attacker who can disrupt the checksum URL while serving a modified binary via the download URL would bypass this protection entirely. The action should either fail hard on checksum fetch failure or make this behaviour explicitly opt-in/out via an input parameter.

---

Summary

The onboarding PR is well-structured and passes almost all required checks. One blocking issue must be resolved before merge: the LICENSE file must include the original author's copyright (ARDUINO SA) alongside StepSecurity's. The checksum-skip-on-failure behaviour in the installer is also a security concern that warrants attention.