From a7afabaec47b5e4410e61e86773c826abfea140c Mon Sep 17 00:00:00 2001
From: amanstep <aman@stepsecurity.io>
Date: Thu, 5 Mar 2026 10:15:28 +0530
Subject: [PATCH 1/5] fix: fixed docker vulnerabilities and updated
 subscription check code

---
 Dockerfile       |  2 +-
 README.md        |  3 +++
 action.yml       |  2 ++
 start-mongodb.sh | 44 ++++++++++++++++++++++++++++++++++----------
 4 files changed, 40 insertions(+), 11 deletions(-)

diff --git a/Dockerfile b/Dockerfile
index 55863ee..858040b 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,4 +1,4 @@
-FROM alpine:3.22.2@sha256:4b7ce07002c69e8f3d704a9c5d6fd3053be500b7f1c69fc0d80990c2ad8dd412
+FROM alpine:3.23@sha256:25109184c71bdad752c8312a8623239686a9a2071e8825f20acb8f2198c3f659
 RUN apk add --no-cache curl docker-cli
 COPY start-mongodb.sh /start-mongodb.sh
 RUN chmod +x /start-mongodb.sh
diff --git a/README.md b/README.md
index 97eb1e0..0642ab6 100644
--- a/README.md
+++ b/README.md
@@ -1,4 +1,7 @@
 
+# MongoDB Github Action
+[![StepSecurity Maintained Action](https://raw.githubusercontent.com/step-security/maintained-actions-assets/main/assets/maintained-action-banner.png)](https://docs.stepsecurity.io/actions/stepsecurity-maintained-actions)
+
 ## Introduction
 This GitHub Action starts a MongoDB server or MongoDB replica set. By default, the MongoDB server is available on the default port `27017`. You can configure a custom port using the `mongodb-port` input. The examples show how to use a custom port.
 
diff --git a/action.yml b/action.yml
index 11ea097..4f10b59 100644
--- a/action.yml
+++ b/action.yml
@@ -58,3 +58,5 @@ runs:
     - ${{ inputs.mongodb-username }}
     - ${{ inputs.mongodb-password }}
     - ${{ inputs.mongodb-container-name }}
+  env:
+    REPO_PRIVATE: ${{ github.event.repository.private }}
diff --git a/start-mongodb.sh b/start-mongodb.sh
index 94d62e8..029ed3b 100644
--- a/start-mongodb.sh
+++ b/start-mongodb.sh
@@ -11,24 +11,48 @@ MONGODB_PASSWORD=$7
 MONGODB_CONTAINER_NAME=$8
 
 # validate subscription status
-API_URL="https://agent.api.stepsecurity.io/v1/github/$GITHUB_REPOSITORY/actions/subscription"
+UPSTREAM="supercharge/mongodb-github-action"
+ACTION_REPO="${GITHUB_ACTION_REPOSITORY:-}"
+DOCS_URL="https://docs.stepsecurity.io/actions/stepsecurity-maintained-actions"
 
-# Set a timeout for the curl command (3 seconds)
-RESPONSE=$(curl --max-time 3 -s -w "%{http_code}" "$API_URL" -o /dev/null) || true
-CURL_EXIT_CODE=$?
+echo ""
+echo -e "\033[1;36mStepSecurity Maintained Action\033[0m"
+echo "Secure drop-in replacement for $UPSTREAM"
+if [ "$REPO_PRIVATE" = "false" ]; then
+  echo -e "\033[32m✓ Free for public repositories\033[0m"
+fi
+echo -e "\033[36mLearn more:\033[0m $DOCS_URL"
+echo ""
+
+if [ "$REPO_PRIVATE" != "true" ]; then
+  exit 0
+fi
+
+SERVER_URL="${GITHUB_SERVER_URL:-https://github.com}"
+
+if [ "$SERVER_URL" != "https://github.com" ]; then
+  BODY=$(printf '{"action":"%s","ghes_server":"%s"}' "$ACTION_REPO" "$SERVER_URL")
+else
+  BODY=$(printf '{"action":"%s"}' "$ACTION_REPO")
+fi
+
+API_URL="https://agent.api.stepsecurity.io/v1/github/$GITHUB_REPOSITORY/actions/maintained-actions-subscription"
+
+RESPONSE=$(curl --max-time 3 -s -w "%{http_code}" \
+  -X POST \
+  -H "Content-Type: application/json" \
+  -d "$BODY" \
+  "$API_URL" -o /dev/null) && CURL_EXIT_CODE=0 || CURL_EXIT_CODE=$?
 
-# Decide based on curl exit code and HTTP status
 if [ $CURL_EXIT_CODE -ne 0 ]; then
   echo "Timeout or API not reachable. Continuing to next step."
-elif [ "$RESPONSE" = "200" ]; then
-  :
 elif [ "$RESPONSE" = "403" ]; then
-  echo "Subscription is not valid. Reach out to support@stepsecurity.io"
+  echo -e "\033[1;31mThis action requires a StepSecurity subscription for private repositories.\033[0m"
+  echo -e "\033[31mLearn how to enable a subscription: $DOCS_URL\033[0m"
   exit 1
-else
-  echo "Timeout or API not reachable. Continuing to next step."
 fi
 
+
 # `mongosh` is used starting from MongoDB 5.x
 MONGODB_CLIENT="mongosh --quiet"
 

From 0c26d3852e4e5d0c1fd9b1ff262f6595c0fcb407 Mon Sep 17 00:00:00 2001
From: amanstep <aman@stepsecurity.io>
Date: Thu, 5 Mar 2026 10:21:21 +0530
Subject: [PATCH 2/5] fix: fixed vulnerabilities

---
 package-lock.json | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/package-lock.json b/package-lock.json
index 0ff4839..b753d77 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -424,9 +424,9 @@
       }
     },
     "node_modules/ajv": {
-      "version": "6.12.6",
-      "resolved": "https://registry.npmjs.org/ajv/-/ajv-6.12.6.tgz",
-      "integrity": "sha512-j3fVLgvTo527anyYyJOGTYJbG+vnnQYvE0m5mmkc1TK+nxAppkCLMIL0aZ4dblVCNoGShhm+kzE4ZUykBoMg4g==",
+      "version": "6.14.0",
+      "resolved": "https://registry.npmjs.org/ajv/-/ajv-6.14.0.tgz",
+      "integrity": "sha512-IWrosm/yrn43eiKqkfkHis7QioDleaXQHdDVPKg0FSwwd/DuvyX79TZnFOnYpB7dcsFAMmtFztZuXPDvSePkFw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -2860,9 +2860,9 @@
       }
     },
     "node_modules/minimatch": {
-      "version": "3.1.2",
-      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.1.2.tgz",
-      "integrity": "sha512-J7p63hRiAjw1NDEww1W7i37+ByIrOWO5XQQAzZ3VOcL0PNybwpfmV/N05zFAzwQ9USyEcX6t3UO+K5aqBQOIHw==",
+      "version": "3.1.5",
+      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.1.5.tgz",
+      "integrity": "sha512-VgjWUsnnT6n+NUk6eZq77zeFdpW2LWDzP6zFGrCbHXiYNul5Dzqk2HHQ5uFH2DNW5Xbp8+jVzaeNt94ssEEl4w==",
       "dev": true,
       "license": "ISC",
       "dependencies": {

From 986ac148048e9b8182e23a2c226aeb27d8a30ea5 Mon Sep 17 00:00:00 2001
From: amanstep <aman@stepsecurity.io>
Date: Thu, 5 Mar 2026 10:23:02 +0530
Subject: [PATCH 3/5] fix: testing dockerfile

---
 action.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/action.yml b/action.yml
index 4f10b59..e91a8bf 100644
--- a/action.yml
+++ b/action.yml
@@ -48,7 +48,7 @@ inputs:
 
 runs:
   using: 'docker'
-  image: 'docker://ghcr.io/step-security/mongodb-github-action:v1.12.3@sha256:5bfa348282e98f7115aff1092b9d54e954bcd3efd83eb326c12dce4c29d71d4f' #v1.12.3
+  image: 'Dockerfile' #v1.12.3
   args:
     - ${{ inputs.mongodb-image }}
     - ${{ inputs.mongodb-version }}

From bb1bf4833f2315e0de9aaac739b8da2b9c0779b3 Mon Sep 17 00:00:00 2001
From: amanstep <aman@stepsecurity.io>
Date: Thu, 5 Mar 2026 10:55:38 +0530
Subject: [PATCH 4/5] fix: improved subscription check code

---
 start-mongodb.sh | 42 ++++++++++++++++++++----------------------
 1 file changed, 20 insertions(+), 22 deletions(-)

diff --git a/start-mongodb.sh b/start-mongodb.sh
index 029ed3b..58185ef 100644
--- a/start-mongodb.sh
+++ b/start-mongodb.sh
@@ -24,32 +24,30 @@ fi
 echo -e "\033[36mLearn more:\033[0m $DOCS_URL"
 echo ""
 
-if [ "$REPO_PRIVATE" != "true" ]; then
-  exit 0
-fi
-
-SERVER_URL="${GITHUB_SERVER_URL:-https://github.com}"
+if [ "$REPO_PRIVATE" = "true" ]; then
+  SERVER_URL="${GITHUB_SERVER_URL:-https://github.com}"
 
-if [ "$SERVER_URL" != "https://github.com" ]; then
-  BODY=$(printf '{"action":"%s","ghes_server":"%s"}' "$ACTION_REPO" "$SERVER_URL")
-else
-  BODY=$(printf '{"action":"%s"}' "$ACTION_REPO")
-fi
+  if [ "$SERVER_URL" != "https://github.com" ]; then
+    BODY=$(printf '{"action":"%s","ghes_server":"%s"}' "$ACTION_REPO" "$SERVER_URL")
+  else
+    BODY=$(printf '{"action":"%s"}' "$ACTION_REPO")
+  fi
 
-API_URL="https://agent.api.stepsecurity.io/v1/github/$GITHUB_REPOSITORY/actions/maintained-actions-subscription"
+  API_URL="https://agent.api.stepsecurity.io/v1/github/$GITHUB_REPOSITORY/actions/maintained-actions-subscription"
 
-RESPONSE=$(curl --max-time 3 -s -w "%{http_code}" \
-  -X POST \
-  -H "Content-Type: application/json" \
-  -d "$BODY" \
-  "$API_URL" -o /dev/null) && CURL_EXIT_CODE=0 || CURL_EXIT_CODE=$?
+  RESPONSE=$(curl --max-time 3 -s -w "%{http_code}" \
+    -X POST \
+    -H "Content-Type: application/json" \
+    -d "$BODY" \
+    "$API_URL" -o /dev/null) && CURL_EXIT_CODE=0 || CURL_EXIT_CODE=$?
 
-if [ $CURL_EXIT_CODE -ne 0 ]; then
-  echo "Timeout or API not reachable. Continuing to next step."
-elif [ "$RESPONSE" = "403" ]; then
-  echo -e "\033[1;31mThis action requires a StepSecurity subscription for private repositories.\033[0m"
-  echo -e "\033[31mLearn how to enable a subscription: $DOCS_URL\033[0m"
-  exit 1
+  if [ $CURL_EXIT_CODE -ne 0 ]; then
+    echo "Timeout or API not reachable. Continuing to next step."
+  elif [ "$RESPONSE" = "403" ]; then
+    echo -e "\033[1;31mThis action requires a StepSecurity subscription for private repositories.\033[0m"
+    echo -e "\033[31mLearn how to enable a subscription: $DOCS_URL\033[0m"
+    exit 1
+  fi
 fi
 
 

From f756cdc9f4a4145705624a5bfb7a1e2db1896553 Mon Sep 17 00:00:00 2001
From: amanstep <aman@stepsecurity.io>
Date: Thu, 5 Mar 2026 11:01:18 +0530
Subject: [PATCH 5/5] fix: reverted image property in action.yml to original
 value

---
 action.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/action.yml b/action.yml
index e91a8bf..4f10b59 100644
--- a/action.yml
+++ b/action.yml
@@ -48,7 +48,7 @@ inputs:
 
 runs:
   using: 'docker'
-  image: 'Dockerfile' #v1.12.3
+  image: 'docker://ghcr.io/step-security/mongodb-github-action:v1.12.3@sha256:5bfa348282e98f7115aff1092b9d54e954bcd3efd83eb326c12dce4c29d71d4f' #v1.12.3
   args:
     - ${{ inputs.mongodb-image }}
     - ${{ inputs.mongodb-version }}