feat: added banner and update subscription check to make maintained actions free for public repos

[anurag-stepsecurity]

Summary

• Added StepSecurity Maintained Action banner to README.md
• Updated subscription validation: public repositories are now free (no API check)
• Upgraded Node.js runtime to node24
• Updated workflow files with configurable node_version input

Changes by type

• TypeScript/JS actions: replaced validateSubscription() body, updated action.yml to node24, updated 3 workflow files, rebuilt dist/
• Bumped eslint ecmaVersion to 2020 to support optional chaining

Verification

• Subscription check skips for public repos
• Subscription check fires for private repos
• README banner is present at the top
• Build passes

Auto-generated by StepSecurity update-propagator. Task ID: 20260423T092801Z

[claude]

Claude finished @anurag-stepsecurity's task —— View job

---

Comprehensive PR Review

I've completed a thorough review of this pull request based on StepSecurity maintained actions standards.

Review Checklist:

• Analyze action type and structure
• Check required files and folders
• Review subscription check implementation
• Validate README banner
• Check Node.js upgrade implementation
• Review workflow files
• Scan for security vulnerabilities
• Validate package.json configuration
• Check dist folder and build process

Action Type Identified: Node.js-based GitHub Action (uses node24 runtime)

✅ Required Files and Folders Check - PASSED

• LICENSE present with both original author and StepSecurity copyright
• SECURITY.md present
• action.yml has author: step-security
• .github/workflows folder with required files:
  • auto_cherry_pick.yml
  • actions_release.yml
  • audit_package.yml (additional workflow)
• dist/ folder present
• No FUNDING.yml files
• No renovate.json
• No PULL_REQUEST.md
• No ISSUE_TEMPLATE folder
• No CHANGELOG.md
• No .vscode folder

✅ Subscription Check Implementation - PASSED

The subscription check implementation in src/index.js:7-51 is correctly implemented:

• Correct API URL: Uses https://agent.api.stepsecurity.io/v1/github/${process.env.GITHUB_REPOSITORY}/actions/maintained-actions-subscription
• Public repo exemption: Skips API call for public repositories (line 28: if (repoPrivate === false) return;)
• Upstream variable: upstream = 'mmoyaferrer/set-github-variable' matches the original-owner/repo-name from auto_cherry_pick.yml (lines 25-26)
• Error handling: Properly handles 403 responses and timeouts
• Banner display: Shows StepSecurity branding with appropriate messaging

✅ README Banner - PASSED

The README.md correctly includes the StepSecurity Maintained Action banner:

• Banner present: Line 1 contains the exact required banner
• Correct format: [![](https://raw.githubusercontent.com/step-security/maintained-actions-assets/main/assets/maintained-action-banner.png)](https://docs.stepsecurity.io/actions/stepsecurity-maintained-actions)
• Usage example: Line 21 correctly uses major version @v1 (not full semver)

✅ Node.js Upgrade Implementation - PASSED

The Node.js upgrade to node24 has been properly implemented:

• action.yml: Runtime updated to node24 (line 43)
• Workflows updated: All workflow files now include configurable node_version input with default "24"
• ESLint compatibility: Updated ecmaVersion to 2020 to support optional chaining operator used in the code

✅ Workflow Files Review - PASSED

All required workflow files are present and properly configured:

• auto_cherry_pick.yml: Properly configured with original-owner "mmoyaferrer" and repo-name "set-github-variable"
• actions_release.yml: Updated with node_version input and default "24", includes script parameter
• audit_package.yml: Updated with node_version input and script parameter for build process

✅ Security Vulnerabilities Scan - PASSED

Code review shows no security vulnerabilities:

• No dangerous functions: No eval, exec, spawn, or dynamic imports found
• Environment variables: Only standard GitHub Actions environment variables used (GITHUB_EVENT_PATH, GITHUB_ACTION_REPOSITORY, GITHUB_SERVER_URL, GITHUB_REPOSITORY)
• No secret exposure: No console.log or setSecret misuse
• Input validation: Proper error handling and timeout mechanisms in place
• HTTPS endpoints: All API calls use HTTPS

✅ Package.json Configuration - PASSED

• Repository field: Correctly points to step-security organization
• Build script: Present as ncc build src/index.js -o dist
• Dependencies: All dependencies are used and appropriate for the action's functionality
• Author field: Not present (acceptable as per requirements)

✅ Dist Folder and Build Process - PASSED

• Dist folder present: Contains compiled action code
• Build process: Configured properly with @vercel/ncc for bundling
• Compiled code: dist/index.js appears properly generated from source

🎉 Overall Assessment: APPROVED

This pull request fully complies with all StepSecurity maintained action standards. The implementation correctly:

1. ✅ Adds the required StepSecurity banner
2. ✅ Implements subscription validation with public repo exemption
3. ✅ Upgrades to Node.js 24 runtime
4. ✅ Updates all workflow files with proper configuration
5. ✅ Maintains all required files and folder structure
6. ✅ Contains no security vulnerabilities
7. ✅ Uses proper build and distribution setup

No action items required - this PR is ready for merge.