feat: initial release

[amanstep]

No description provided.

[github-actions]

test comment

[github-actions]

PR Review

Action Type

Node-based action - uses node24 runtime with dist/index.js as the entry point, built via @vercel/ncc from main.js.

---

Passed Checks

• License: Present with copyright for both original author (Cees-Jan Kiewiet) and StepSecurity.
• action.yml: Present. No author field (ignored per policy).
• SECURITY.md: Present with correct contact email.
• FUNDING.yml: Not present
• renovate.json: Not present
• PULL_REQUEST.md: Not present
• ISSUE_TEMPLATE folder: Not present
• CHANGELOG.md: Not present
• .vscode folder: Not present
• .github/workflows/auto_cherry_pick.yml: Present
• .github/workflows/actions_release.yml: Present
• README banner: StepSecurity Maintained Action banner present at the top of README.md
• README examples: Use only the major version tag, no full semver tags
• Subscription check URL: Correctly calls the maintained-actions-subscription endpoint
• Upstream variable: wyrihaximus/github-action-helm3 correctly matches original-owner/repo-name from auto_cherry_pick.yml
• dist folder: Present
• package.json build script: Present (ncc build main.js -o dist/)
• package.json author field: Absent (ignored per policy)
• package.json repository field: Absent (ignored per policy)

---

Failed Checks

No required checklist items failed.

---

Warnings

• actions/checkout@v7 does not exist: The latest official release is v4. Every CI job in ci.yml will fail at checkout (lines 15, 54, 68, 96, 184, 292). See inline comment.
• Deprecated set-output syntax: Used throughout ci.yml. Removed from GitHub-hosted runners in May 2023; all occurrences must migrate to GITHUB_OUTPUT. See inline comment.
• Third-party actions not pinned to commit SHA: helm/kind-action@v1 and nick-fields/assert-action@v4 use mutable version tags. Should be pinned to immutable commit SHAs per GitHub hardening guidance. See inline comment.
• audit_package.yml naming: Audit workflow named audit_package.yml rather than the conventional audit_fix.yml.

---

Security Findings

1. [Critical] kubectl binary downloaded to wrong path (main.js line 121): The curl -o flag targets the directory path (dockerKubeConfigDir) instead of the file path (dockerKubeConfigDir/kubectl). The kubectl binary is never installed yet the shell wrapper references dockerKubeConfigDir/kubectl causing all kubectl calls to silently fail. See inline comment.

2. [Critical] Helm install script fetched from unpinned master branch (main.js line 122): get-helm-3 is downloaded without a pinned commit SHA and without checksum verification before execution. A compromised Helm master branch or CDN MITM would result in arbitrary code execution on every runner. Should be fetched from a tagged release with SHA256 verification. See inline comment.

3. [Medium] process variable shadows the Node.js global (main.js line 140): const process = execFile(...) inside the Promise callback shadows the Node.js global process object. Future edits inside the callback attempting process.exit() or process.env would silently operate on the child process handle. See inline comment.

---

Summary

The StepSecurity-specific onboarding requirements (license, banner, subscription check, upstream variable, workflow files) are all correctly implemented. However, the CI workflow (ci.yml) is broken as shipped - actions/checkout@v7 does not exist and widespread use of the removed set-output syntax will prevent all jobs from running. There are also two functional/security bugs in main.js: the kubectl binary is downloaded to the wrong path (directory instead of file), and the Helm installer is fetched from an unpinned master branch without checksum verification.