feat: Initial release #2

amanstep · 2025-09-18T09:26:28Z

No description provided.

.github/workflows/docker.yaml

README.md

Raj-StepSecurity · 2025-09-18T09:57:30Z

check for both claude comments

claude · 2025-09-18T14:19:08Z

Claude finished @amanstep's task —— View job

Claude Code PR Review

Conducted comprehensive review of this Docker-based GitHub Action PR based on Step Security criteria.

Review Tasks:

Identify action type (Docker/Node/Composite)
Check general requirements (license, author, security.md, workflows, etc.)
Verify Docker-based action specific requirements
Review security vulnerabilities
Check if previous reviewer feedback has been addressed
Provide comprehensive feedback

✅ General Requirements - COMPLIANT

License: ✅ Present with copyright for both Step Security (2025) and PlanetScale (2023) as original author (LICENSE:190-191)
Author in action.yaml: ✅ Set to "step-security" (action.yaml:3)
Security.md: ✅ Present and correct
FUNDING files: ✅ None present (correct)
Required workflows: ✅ All present (.github/workflows/auto_cherry_pick.yml, actions_release.yml, claude_review.yml)
Forbidden files: ✅ None present (renovate.json, PULL_REQUEST.md, ISSUE_TEMPLATE, CHANGELOG.md, .vscode)
README usage examples: ✅ Uses major version (@v0) instead of full semver (README.md:45, 57)
Subscription check: ✅ Correctly implemented in entrypoint.sh:7-23 with proper API URL

❌ Docker-based Action Requirements - CRITICAL ISSUES FOUND

Published docker image: ❌ CRITICAL - action.yaml:36 uses local "Dockerfile" instead of a published image from ghcr.io/step-security org
Major version tagging: ❌ CRITICAL - docker.yaml:54-55 only tags with full semver, missing major version tags
Security hardening: ❌ Missing harden-runner from workflows:
- ci.yaml:13 (uses pinned SHA checkout but no harden-runner)
- licensing.yaml:17 (uses pinned SHA checkout but no harden-runner)

✅ Security Analysis - SECURE

No security vulnerabilities detected in the code
Proper input validation and error handling in entrypoint.sh
Secure subscription check implementation with timeout handling (entrypoint.sh:7-23)
No secrets or sensitive information exposed

❌ Previous Review Comments - PARTIALLY ADDRESSED

The PR still has unresolved review comments from Raj-StepSecurity:

docker.yaml: Remove pinned SHAs and update with latest tags (NOT ADDRESSED - ci.yaml:13 and licensing.yaml:17 still use pinned SHAs)
README.md: Remove unspecified line (UNCLEAR - specific line not identified)
README.md:36: Update version to v5 (NOT FOUND - no v5 reference exists in README)

🔧 Critical Issues Requiring Resolution

HIGH PRIORITY:

Fix Docker image usage: Update action.yaml:36 to use published image:

runs:
  using: "docker"
  image: "ghcr.io/step-security/ghcommit-action:v0"

Add major version tagging: Update docker.yaml:54-55 to include major version:

tags: |
  ghcr.io/${{ github.repository }}:${{ github.event.inputs.release_tag }}
  ghcr.io/${{ github.repository }}:v0

Add harden-runner: Include step-security/harden-runner in workflows:
- Add to ci.yaml before actions/checkout (line 13)
- Add to licensing.yaml before actions/checkout (line 17)

MEDIUM PRIORITY:
4. Address reviewer feedback:

Update pinned SHAs in ci.yaml:13 and licensing.yaml:17 to latest tags
Clarify which README.md line needs removal

Overall Assessment

This action FAILS Docker-based action requirements due to critical issues with Docker image usage and tagging. The action uses a local Dockerfile instead of a published image, which violates Step Security requirements for Docker-based actions.

claude · 2025-09-18T19:56:27Z

Claude finished @amanstep's task —— View job

Claude Code PR Review

Conducted comprehensive review of this Docker-based GitHub Action PR based on Step Security criteria.

Review Tasks:

Identify action type (Docker/Node/Composite)
Check general requirements (license, author, security.md, workflows, etc.)
Verify Docker-based action specific requirements
Review security vulnerabilities
Check if previous reviewer feedback has been addressed
Provide comprehensive review feedback

✅ General Requirements - COMPLIANT

License: ✅ Present with copyright for both Step Security (2025) and PlanetScale (2023) as original author (LICENSE:190-191)
Author in action.yaml: ✅ Set to "step-security" (action.yaml:3)
Security.md: ✅ Present and correct
FUNDING files: ✅ None present (correct)
Required workflows: ✅ All present (.github/workflows/auto_cherry_pick.yml, actions_release.yml, claude_review.yml)
Forbidden files: ✅ None present (renovate.json, PULL_REQUEST.md, ISSUE_TEMPLATE, CHANGELOG.md, .vscode)
README usage examples: ✅ Uses major version (@v0) instead of full semver (README.md:45, 57)
Subscription check: ✅ Correctly implemented in entrypoint.sh:7-23 with proper API URL

❌ Docker-based Action Requirements - CRITICAL ISSUES FOUND

Published docker image: ❌ CRITICAL - action.yaml:36 uses local "Dockerfile" instead of a published image from ghcr.io/step-security org
Major version tagging: ❌ CRITICAL - docker.yaml:54-55 only tags with full semver, missing major version tags
Security hardening: ❌ Missing harden-runner from workflows:
- ci.yaml:13 (uses pinned SHA checkout but no harden-runner)
- licensing.yaml:17 (uses pinned SHA checkout but no harden-runner)

✅ Security Analysis - SECURE

No security vulnerabilities detected in the code
Proper input validation and error handling in entrypoint.sh
Secure subscription check implementation with timeout handling (entrypoint.sh:7-23)
No secrets or sensitive information exposed

❌ Previous Review Comments - PARTIALLY ADDRESSED

The PR still has unresolved review comments from Raj-StepSecurity:

docker.yaml: Remove pinned SHAs and update with latest tags (NOT ADDRESSED - ci.yaml:13 and licensing.yaml:17 still use pinned SHAs)
README.md: Remove unspecified line (UNCLEAR - specific line not identified)
README.md:36: Update version to v5 (NOT FOUND - no v5 reference exists in README)

🔧 Critical Issues Requiring Resolution

HIGH PRIORITY:

Fix Docker image usage: Update action.yaml:36 to use published image:

runs:
  using: "docker"
  image: "ghcr.io/step-security/ghcommit-action:v0"

Add major version tagging: Update docker.yaml:54-55 to include major version:

tags: |
  ghcr.io/${{ github.repository }}:${{ github.event.inputs.release_tag }}
  ghcr.io/${{ github.repository }}:v0

Add harden-runner: Include step-security/harden-runner in workflows:
- Add to ci.yaml before actions/checkout (line 13)
- Add to licensing.yaml before actions/checkout (line 17)

MEDIUM PRIORITY:
4. Address reviewer feedback:

Update pinned SHAs in ci.yaml:13 and licensing.yaml:17 to latest tags
Clarify which README.md line needs removal

Overall Assessment

This action FAILS Docker-based action requirements due to critical issues with Docker image usage and tagging. The action uses a local Dockerfile instead of a published image, which violates Step Security requirements for Docker-based actions.

varunsh-coder · 2025-09-19T08:18:51Z

Dockerfile

+FROM --platform=$TARGETARCH ghcr.io/planetscale/ghcommit:v0.1.74 AS ghcommit
+
+# hadolint ignore=DL3007
+FROM --platform=$TARGETARCH pscale.dev/wolfi-prod/base:latest AS base


might have to remove it since we cannot pin it and it is fetching from pscale.dev

claude · 2025-09-19T12:53:57Z

Claude finished @amanstep's task —— View job

Claude Code PR Review

Conducted comprehensive review of this Docker-based GitHub Action PR based on Step Security criteria.

Review Tasks:

Identify action type (Docker/Node/Composite)
Check general requirements (license, author, security.md, workflows, etc.)
Verify Docker-based action specific requirements
Review security vulnerabilities
Check if previous reviewer feedback has been addressed
Provide comprehensive review feedback

✅ General Requirements - COMPLIANT

License: ✅ Present with copyright for both Step Security (2025) and PlanetScale (2023) as original author (LICENSE:190-191)
Author in action.yaml: ✅ Set to "step-security" (action.yaml:3)
Security.md: ✅ Present and correct
FUNDING files: ✅ None present (correct)
Required workflows: ✅ All present (.github/workflows/auto_cherry_pick.yml, actions_release.yml, claude_review.yml)
Forbidden files: ✅ None present (renovate.json, PULL_REQUEST.md, ISSUE_TEMPLATE, CHANGELOG.md, .vscode)
README usage examples: ✅ Uses major version (@v0) instead of full semver (README.md:45, 57)
Subscription check: ✅ Correctly implemented in entrypoint.sh:7-23 with proper API URL

❌ Docker-based Action Requirements - CRITICAL ISSUES FOUND

Published docker image: ❌ CRITICAL - action.yaml:36 uses local "Dockerfile" instead of a published image from ghcr.io/step-security org
Major version tagging: ❌ CRITICAL - docker.yaml:54-55 only tags with full semver, missing major version tags
Security hardening: ⚠️ MIXED - Missing harden-runner from ci.yaml:13, but present in docker.yaml:20-23

✅ Security Analysis - SECURE

No security vulnerabilities detected in the code
Proper input validation and error handling in entrypoint.sh
Secure subscription check implementation with timeout handling (entrypoint.sh:7-23)
No secrets or sensitive information exposed
Dockerfile follows security best practices with specific version pinning

❌ Previous Review Comments - PARTIALLY ADDRESSED

The PR still has unresolved review comments from team members:

ci.yaml:13: ❌ Still uses pinned SHA actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 instead of latest tag
README.md line removal: ❓ Unclear which specific line needs removal
README.md v5 reference: ❓ No v5 reference found in current README
Dockerfile concerns: ⚠️ New comment from varunsh-coder about potential removal due to pscale.dev dependency

🔧 Critical Issues Requiring Resolution

HIGH PRIORITY:

Fix Docker image usage: Update action.yaml:36 to use published image:

runs:
  using: "docker"
  image: "ghcr.io/step-security/ghcommit-action:v0"

Add major version tagging: Update docker.yaml:54-55 to include major version:

tags: |
  ghcr.io/${{ github.repository }}:${{ github.event.inputs.release_tag }}
  ghcr.io/${{ github.repository }}:v0

Add harden-runner to ci.yaml: Include step-security/harden-runner before actions/checkout (line 13)

MEDIUM PRIORITY:
4. Address reviewer feedback:

Update pinned SHA in ci.yaml:13 to use actions/checkout@v5 instead of SHA
Clarify which README.md line needs removal
Address Dockerfile dependency concerns raised by varunsh-coder

Overall Assessment

This action FAILS Docker-based action requirements due to critical issues with Docker image usage and tagging. The action uses a local Dockerfile instead of a published image, which violates Step Security requirements for Docker-based actions.

Recommendation: Address the critical Docker image and tagging issues before merging this PR.

feat: Initial release

11a2218

amanstep added the review required Claude review required for PR. label Sep 18, 2025

ci: remove PR trigger from ci workflow

acb48cc

Raj-StepSecurity reviewed Sep 18, 2025

View reviewed changes

.github/workflows/docker.yaml Show resolved Hide resolved

Raj-StepSecurity reviewed Sep 18, 2025

View reviewed changes

README.md Outdated Show resolved Hide resolved

Raj-StepSecurity reviewed Sep 18, 2025

View reviewed changes

README.md Outdated Show resolved Hide resolved

step-security deleted a comment from claude bot Sep 18, 2025

amanstep added 2 commits September 18, 2025 17:11

docs: update readme and made changes to docker workflow

a384f8a

docs: updated readme

ef1ef09

step-security deleted a comment from claude bot Sep 18, 2025

feat: added curl to docker so that subscription check gets evaluated

94e33f8

varunsh-coder reviewed Sep 19, 2025

View reviewed changes

feat: made changes to Dockerfile addressing security concerns

5ba69f0

Raj-StepSecurity approved these changes Sep 19, 2025

View reviewed changes

amanstep merged commit 27abbc7 into main Sep 19, 2025
4 checks passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

feat: Initial release #2

feat: Initial release #2

Uh oh!

amanstep commented Sep 18, 2025

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Raj-StepSecurity commented Sep 18, 2025

Uh oh!

claude bot commented Sep 18, 2025 •

edited

Loading

Uh oh!

claude bot commented Sep 18, 2025 •

edited

Loading

Uh oh!

varunsh-coder Sep 19, 2025

Uh oh!

claude bot commented Sep 19, 2025 •

edited

Loading

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

feat: Initial release #2

feat: Initial release #2

Uh oh!

Conversation

amanstep commented Sep 18, 2025

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Raj-StepSecurity commented Sep 18, 2025

Uh oh!

claude bot commented Sep 18, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Claude Code PR Review

Review Tasks:

✅ General Requirements - COMPLIANT

❌ Docker-based Action Requirements - CRITICAL ISSUES FOUND

✅ Security Analysis - SECURE

❌ Previous Review Comments - PARTIALLY ADDRESSED

🔧 Critical Issues Requiring Resolution

Overall Assessment

Uh oh!

claude bot commented Sep 18, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Claude Code PR Review

Review Tasks:

✅ General Requirements - COMPLIANT

❌ Docker-based Action Requirements - CRITICAL ISSUES FOUND

✅ Security Analysis - SECURE

❌ Previous Review Comments - PARTIALLY ADDRESSED

🔧 Critical Issues Requiring Resolution

Overall Assessment

Uh oh!

varunsh-coder Sep 19, 2025

Choose a reason for hiding this comment

Uh oh!

claude bot commented Sep 19, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Claude Code PR Review

Review Tasks:

✅ General Requirements - COMPLIANT

❌ Docker-based Action Requirements - CRITICAL ISSUES FOUND

✅ Security Analysis - SECURE

❌ Previous Review Comments - PARTIALLY ADDRESSED

🔧 Critical Issues Requiring Resolution

Overall Assessment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

claude bot commented Sep 18, 2025 •

edited

Loading

claude bot commented Sep 18, 2025 •

edited

Loading

claude bot commented Sep 19, 2025 •

edited

Loading