chore: Add meta config

[anurag-stepsecurity]

No description provided.

[github-actions]

Super-linter summary

Language	Validation result
BIOME_FORMAT	Fail ❌
BIOME_LINT	Pass ✅
CHECKOV	Pass ✅
EDITORCONFIG	Fail ❌
GITLEAKS	Pass ✅
GIT_COMMITLINT	Fail ❌
GIT_MERGE_CONFLICT_MARKERS	Pass ✅
JSCPD	Pass ✅
JSON	Pass ✅
JSON_PRETTIER	Fail ❌
PRE_COMMIT	Pass ✅
SPELL_CODESPELL	Pass ✅
TRIVY	Fail ❌

Super-linter detected linting errors

For more information, see the
GitHub Actions workflow run

Powered by Super-linter

BIOME_FORMAT

biome format --error-on-warnings --no-errors-on-unmatched /github/workspace
Checked 27 files in 184ms. No fixes applied.
Found 1 error..stepsecurity/meta.json format ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

  × Formatter would have printed the following content:

     1  1 │   {
     2    │ - ···"schema_version":·"1",
     3    │ - ···"onboarding_type":·"copied",
     4    │ - ···"archived":·false,
     5    │ - ···"maintained_action_name":·"step-security/super-linter",
     6    │ - ···"upstream_full_repo_name":·"super-linter/super-linter",
     7    │ - ···"action_type":·"docker",
     8    │ - ···"last_release":·{
     9    │ - ·····"tag_name":·"v8.6.0",
    10    │ - ·····"created_at":·"2026-06-11T09:15:31Z",
    11    │ - ·····"published_at":·"2026-06-12T04:32:40Z"
    12    │ - ···},
    13    │ - ···"sync":·{
    14    │ - ·····"ignore_presets":·[
    15    │ - ·······"defaults_v1"
    16    │ - ·····]
    17    │ - ···}
    18    │ - ·}
        2 │ + ··"schema_version":·"1",
        3 │ + ··"onboarding_type":·"copied",
        4 │ + ··"archived":·false,
        5 │ + ··"maintained_action_name":·"step-security/super-linter",
        6 │ + ··"upstream_full_repo_name":·"super-linter/super-linter",
        7 │ + ··"action_type":·"docker",
        8 │ + ··"last_release":·{
        9 │ + ····"tag_name":·"v8.6.0",
       10 │ + ····"created_at":·"2026-06-11T09:15:31Z",
       11 │ + ····"published_at":·"2026-06-12T04:32:40Z"
       12 │ + ··},
       13 │ + ··"sync":·{
       14 │ + ····"ignore_presets":·["defaults_v1"]
       15 │ + ··}
       16 │ + }
    19 17 │


format ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

  × Some errors were emitted while running checks.

EDITORCONFIG

editorconfig-checker -config /action/lib/.automation/.editorconfig-checker.json /github/workspace/.stepsecurity/meta.json
.stepsecurity/meta.json:
	2-18: Wrong amount of left-padding spaces(want multiple of 2)

1 errors found

GIT_COMMITLINT

commitlint --verbose --from 824b427263ae1781680fff2f26953ce007cab000 --to 4bb6d62c8ec76a37ea1f09c37496e9f130322fab --cwd /github/workspace
⧗   --- input ---
chore: Add meta config
✖   subject must not be sentence-case, start-case, pascal-case, upper-case [subject-case]

✖   found 1 problems, 0 warnings
ⓘ   Get help: https://www.conventionalcommits.org/

JSON_PRETTIER

prettier --check /github/workspace/.stepsecurity/meta.json
Checking formatting...[warn] .stepsecurity/meta.json
[warn] Code style issues found in the above file. Run Prettier with --write to fix.

TRIVY

trivy filesystem --config /github/workspace/.github/linters/trivy.yaml /github/workspace

Report Summary

┌─────────────────────────────────────┬────────────┬─────────────────┬───────────────────┬─────────┐
│               Target                │    Type    │ Vulnerabilities │ Misconfigurations │ Secrets │
├─────────────────────────────────────┼────────────┼─────────────────┼───────────────────┼─────────┤
│ dependencies/Gemfile.lock           │  bundler   │        4        │         -         │    -    │
├─────────────────────────────────────┼────────────┼─────────────────┼───────────────────┼─────────┤
│ dependencies/composer/composer.lock │  composer  │        0        │         -         │    -    │
├─────────────────────────────────────┼────────────┼─────────────────┼───────────────────┼─────────┤
│ dependencies/package-lock.json      │    npm     │        4        │         -         │    -    │
├─────────────────────────────────────┼────────────┼─────────────────┼───────────────────┼─────────┤
│ Dockerfile                          │ dockerfile │        -        │         0         │    -    │
├─────────────────────────────────────┼────────────┼─────────────────┼───────────────────┼─────────┤
│ test/linters/trivy/good/Dockerfile  │ dockerfile │        -        │         0         │    -    │
└─────────────────────────────────────┴────────────┴─────────────────┴───────────────────┴─────────┘
Legend:
- '-': Not scanned
- '0': Clean (no security findings detected)


For OSS Maintainers: VEX Notice
--------------------------------
If you're an OSS maintainer and Trivy has detected vulnerabilities in your project that you believe are not actually exploitable, consider issuing a VEX (Vulnerability Exploitability eXchange) statement.
VEX allows you to communicate the actual status of vulnerabilities in your project, improving security transparency and reducing false positives for your users.
Learn more and start using VEX: https://trivy.dev/docs/v0.71/guide/supply-chain/vex/repo#publishing-vex-documents

To disable this notice, set the TRIVY_DISABLE_VEX_NOTICE environment variable.


dependencies/Gemfile.lock (bundler)
===================================
Total: 4 (UNKNOWN: 0, LOW: 1, MEDIUM: 1, HIGH: 1, CRITICAL: 1)

┌─────────────────┬────────────────┬──────────┬────────┬───────────────────┬───────────────┬─────────────────────────────────────────────────────────────┐
│     Library     │ Vulnerability  │ Severity │ Status │ Installed Version │ Fixed Version │                            Title                            │
├─────────────────┼────────────────┼──────────┼────────┼───────────────────┼───────────────┼─────────────────────────────────────────────────────────────┤
│ concurrent-ruby │ CVE-2026-54906 │ CRITICAL │ fixed  │ 1.3.6             │ >= 1.3.7      │ concurrent-ruby: rubygem-concurrent-ruby: concurrent-ruby:  │
│                 │                │          │        │                   │               │ Synchronization flaw in ReadWriteLock allows unauthorized   │
│                 │                │          │        │                   │               │ lock release and...                                         │
│                 │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-54906                  │
│                 ├────────────────┼──────────┤        │                   │               ├─────────────────────────────────────────────────────────────┤
│                 │ CVE-2026-54904 │ HIGH     │        │                   │               │ concurrent-ruby: rubygem-concurrent-ruby: concurrent-ruby:  │
│                 │                │          │        │                   │               │ Denial of Service due to infinite loop in                   │
│                 │                │          │        │                   │               │ AtomicReference#update...                                   │
│                 │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-54904                  │
│                 ├────────────────┼──────────┤        │                   │               ├─────────────────────────────────────────────────────────────┤
│                 │ CVE-2026-54905 │ MEDIUM   │        │                   │               │ concurrent-ruby: Concurrent-ruby: Incorrect write lock      │
│                 │                │          │        │                   │               │ granting leading to broken mutual exclusion                 │
│                 │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-54905                  │
├─────────────────┼────────────────┼──────────┤        ├───────────────────┼───────────────┼─────────────────────────────────────────────────────────────┤
│ json            │ CVE-2026-54696 │ LOW      │        │ 2.19.5            │ >= 2.19.9     │ Ruby JSON is a JSON implementation for Ruby. Versions 2.9.0 │
│                 │                │          │        │                   │               │ through 2....                                               │
│                 │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-54696                  │
└─────────────────┴────────────────┴──────────┴────────┴───────────────────┴───────────────┴─────────────────────────────────────────────────────────────┘

dependencies/package-lock.json (npm)
====================================
Total: 4 (UNKNOWN: 0, LOW: 0, MEDIUM: 4, HIGH: 0, CRITICAL: 0)

┌─────────────┬────────────────┬──────────┬────────┬───────────────────┬───────────────┬─────────────────────────────────────────────────────────────┐
│   Library   │ Vulnerability  │ Severity │ Status │ Installed Version │ Fixed Version │                            Title                            │
├─────────────┼────────────────┼──────────┼────────┼───────────────────┼───────────────┼─────────────────────────────────────────────────────────────┤
│ js-yaml     │ CVE-2026-53550 │ MEDIUM   │ fixed  │ 3.14.2            │ 4.2.0, 3.15.0 │ js-yaml: js-yaml: Denial of Service via crafted YAML merge  │
│             │                │          │        │                   │               │ keys                                                        │
│             │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-53550                  │
│             │                │          │        ├───────────────────┤               │                                                             │
│             │                │          │        │ 4.1.1             │               │                                                             │
│             │                │          │        │                   │               │                                                             │
│             │                │          │        │                   │               │                                                             │
├─────────────┼────────────────┤          │        ├───────────────────┼───────────────┼─────────────────────────────────────────────────────────────┤
│ markdown-it │ CVE-2026-48988 │          │        │ 14.1.1            │ 14.2.0        │ markdown-it is a Markdown parser. Versions 14.1.1 and below │
│             │                │          │        │                   │               │ contain a ...                                               │
│             │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-48988                  │
├─────────────┼────────────────┤          │        ├───────────────────┼───────────────┼─────────────────────────────────────────────────────────────┤
│ postcss     │ CVE-2026-41305 │          │        │ 8.4.31            │ 8.5.10        │ postcss: PostCSS: Cross-Site Scripting (XSS) via improper   │
│             │                │          │        │                   │               │ escaping of style closing tags...                           │
│             │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-41305                  │
└─────────────┴────────────────┴──────────┴────────┴───────────────────┴───────────────┴─────────────────────────────────────────────────────────────┘

[github-actions]

Super-linter summary

Language	Validation result
BIOME_FORMAT	Fail ❌
BIOME_LINT	Pass ✅
CHECKOV	Pass ✅
EDITORCONFIG	Fail ❌
GITLEAKS	Pass ✅
GIT_COMMITLINT	Fail ❌
GIT_MERGE_CONFLICT_MARKERS	Pass ✅
JSCPD	Pass ✅
JSON	Pass ✅
JSON_PRETTIER	Fail ❌
PRE_COMMIT	Pass ✅
SPELL_CODESPELL	Pass ✅
TRIVY	Fail ❌

Super-linter detected linting errors

For more information, see the
GitHub Actions workflow run

Powered by Super-linter

BIOME_FORMAT

biome format --error-on-warnings --no-errors-on-unmatched /github/workspace
Checked 27 files in 179ms. No fixes applied.
Found 1 error..stepsecurity/meta.json format ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

  × Formatter would have printed the following content:

     1  1 │   {
     2    │ - ···"schema_version":·"1",
     3    │ - ···"onboarding_type":·"copied",
     4    │ - ···"archived":·false,
     5    │ - ···"maintained_action_name":·"step-security/super-linter",
     6    │ - ···"upstream_full_repo_name":·"super-linter/super-linter",
     7    │ - ···"action_type":·"docker",
     8    │ - ···"last_release":·{
     9    │ - ·····"tag_name":·"v8.6.0",
    10    │ - ·····"created_at":·"2026-06-11T09:15:31Z",
    11    │ - ·····"published_at":·"2026-06-12T04:32:40Z"
    12    │ - ···},
    13    │ - ···"sync":·{
    14    │ - ·····"ignore_presets":·[
    15    │ - ·······"defaults_v1"
    16    │ - ·····]
    17    │ - ···}
    18    │ - ·}
        2 │ + ··"schema_version":·"1",
        3 │ + ··"onboarding_type":·"copied",
        4 │ + ··"archived":·false,
        5 │ + ··"maintained_action_name":·"step-security/super-linter",
        6 │ + ··"upstream_full_repo_name":·"super-linter/super-linter",
        7 │ + ··"action_type":·"docker",
        8 │ + ··"last_release":·{
        9 │ + ····"tag_name":·"v8.6.0",
       10 │ + ····"created_at":·"2026-06-11T09:15:31Z",
       11 │ + ····"published_at":·"2026-06-12T04:32:40Z"
       12 │ + ··},
       13 │ + ··"sync":·{
       14 │ + ····"ignore_presets":·["defaults_v1"]
       15 │ + ··}
       16 │ + }
    19 17 │


format ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

  × Some errors were emitted while running checks.

EDITORCONFIG

editorconfig-checker -config /action/lib/.automation/.editorconfig-checker.json /github/workspace/.stepsecurity/meta.json
.stepsecurity/meta.json:
	2-18: Wrong amount of left-padding spaces(want multiple of 2)

1 errors found

GIT_COMMITLINT

commitlint --verbose --from 824b427263ae1781680fff2f26953ce007cab000 --to 4bb6d62c8ec76a37ea1f09c37496e9f130322fab --cwd /github/workspace
⧗   --- input ---
chore: Add meta config
✖   subject must not be sentence-case, start-case, pascal-case, upper-case [subject-case]

✖   found 1 problems, 0 warnings
ⓘ   Get help: https://www.conventionalcommits.org/

JSON_PRETTIER

prettier --check /github/workspace/.stepsecurity/meta.json
Checking formatting...[warn] .stepsecurity/meta.json
[warn] Code style issues found in the above file. Run Prettier with --write to fix.

TRIVY

trivy filesystem --config /github/workspace/.github/linters/trivy.yaml /github/workspace

Report Summary

┌─────────────────────────────────────┬────────────┬─────────────────┬───────────────────┬─────────┐
│               Target                │    Type    │ Vulnerabilities │ Misconfigurations │ Secrets │
├─────────────────────────────────────┼────────────┼─────────────────┼───────────────────┼─────────┤
│ dependencies/Gemfile.lock           │  bundler   │        4        │         -         │    -    │
├─────────────────────────────────────┼────────────┼─────────────────┼───────────────────┼─────────┤
│ dependencies/composer/composer.lock │  composer  │        0        │         -         │    -    │
├─────────────────────────────────────┼────────────┼─────────────────┼───────────────────┼─────────┤
│ dependencies/package-lock.json      │    npm     │        4        │         -         │    -    │
├─────────────────────────────────────┼────────────┼─────────────────┼───────────────────┼─────────┤
│ Dockerfile                          │ dockerfile │        -        │         0         │    -    │
├─────────────────────────────────────┼────────────┼─────────────────┼───────────────────┼─────────┤
│ test/linters/trivy/good/Dockerfile  │ dockerfile │        -        │         0         │    -    │
└─────────────────────────────────────┴────────────┴─────────────────┴───────────────────┴─────────┘
Legend:
- '-': Not scanned
- '0': Clean (no security findings detected)


For OSS Maintainers: VEX Notice
--------------------------------
If you're an OSS maintainer and Trivy has detected vulnerabilities in your project that you believe are not actually exploitable, consider issuing a VEX (Vulnerability Exploitability eXchange) statement.
VEX allows you to communicate the actual status of vulnerabilities in your project, improving security transparency and reducing false positives for your users.
Learn more and start using VEX: https://trivy.dev/docs/v0.71/guide/supply-chain/vex/repo#publishing-vex-documents

To disable this notice, set the TRIVY_DISABLE_VEX_NOTICE environment variable.


dependencies/Gemfile.lock (bundler)
===================================
Total: 4 (UNKNOWN: 0, LOW: 1, MEDIUM: 1, HIGH: 1, CRITICAL: 1)

┌─────────────────┬────────────────┬──────────┬────────┬───────────────────┬───────────────┬─────────────────────────────────────────────────────────────┐
│     Library     │ Vulnerability  │ Severity │ Status │ Installed Version │ Fixed Version │                            Title                            │
├─────────────────┼────────────────┼──────────┼────────┼───────────────────┼───────────────┼─────────────────────────────────────────────────────────────┤
│ concurrent-ruby │ CVE-2026-54906 │ CRITICAL │ fixed  │ 1.3.6             │ >= 1.3.7      │ concurrent-ruby: rubygem-concurrent-ruby: concurrent-ruby:  │
│                 │                │          │        │                   │               │ Synchronization flaw in ReadWriteLock allows unauthorized   │
│                 │                │          │        │                   │               │ lock release and...                                         │
│                 │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-54906                  │
│                 ├────────────────┼──────────┤        │                   │               ├─────────────────────────────────────────────────────────────┤
│                 │ CVE-2026-54904 │ HIGH     │        │                   │               │ concurrent-ruby: rubygem-concurrent-ruby: concurrent-ruby:  │
│                 │                │          │        │                   │               │ Denial of Service due to infinite loop in                   │
│                 │                │          │        │                   │               │ AtomicReference#update...                                   │
│                 │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-54904                  │
│                 ├────────────────┼──────────┤        │                   │               ├─────────────────────────────────────────────────────────────┤
│                 │ CVE-2026-54905 │ MEDIUM   │        │                   │               │ concurrent-ruby: Concurrent-ruby: Incorrect write lock      │
│                 │                │          │        │                   │               │ granting leading to broken mutual exclusion                 │
│                 │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-54905                  │
├─────────────────┼────────────────┼──────────┤        ├───────────────────┼───────────────┼─────────────────────────────────────────────────────────────┤
│ json            │ CVE-2026-54696 │ LOW      │        │ 2.19.5            │ >= 2.19.9     │ Ruby JSON is a JSON implementation for Ruby. Versions 2.9.0 │
│                 │                │          │        │                   │               │ through 2....                                               │
│                 │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-54696                  │
└─────────────────┴────────────────┴──────────┴────────┴───────────────────┴───────────────┴─────────────────────────────────────────────────────────────┘

dependencies/package-lock.json (npm)
====================================
Total: 4 (UNKNOWN: 0, LOW: 0, MEDIUM: 4, HIGH: 0, CRITICAL: 0)

┌─────────────┬────────────────┬──────────┬────────┬───────────────────┬───────────────┬─────────────────────────────────────────────────────────────┐
│   Library   │ Vulnerability  │ Severity │ Status │ Installed Version │ Fixed Version │                            Title                            │
├─────────────┼────────────────┼──────────┼────────┼───────────────────┼───────────────┼─────────────────────────────────────────────────────────────┤
│ js-yaml     │ CVE-2026-53550 │ MEDIUM   │ fixed  │ 3.14.2            │ 4.2.0, 3.15.0 │ js-yaml: js-yaml: Denial of Service via crafted YAML merge  │
│             │                │          │        │                   │               │ keys                                                        │
│             │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-53550                  │
│             │                │          │        ├───────────────────┤               │                                                             │
│             │                │          │        │ 4.1.1             │               │                                                             │
│             │                │          │        │                   │               │                                                             │
│             │                │          │        │                   │               │                                                             │
├─────────────┼────────────────┤          │        ├───────────────────┼───────────────┼─────────────────────────────────────────────────────────────┤
│ markdown-it │ CVE-2026-48988 │          │        │ 14.1.1            │ 14.2.0        │ markdown-it is a Markdown parser. Versions 14.1.1 and below │
│             │                │          │        │                   │               │ contain a ...                                               │
│             │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-48988                  │
├─────────────┼────────────────┤          │        ├───────────────────┼───────────────┼─────────────────────────────────────────────────────────────┤
│ postcss     │ CVE-2026-41305 │          │        │ 8.4.31            │ 8.5.10        │ postcss: PostCSS: Cross-Site Scripting (XSS) via improper   │
│             │                │          │        │                   │               │ escaping of style closing tags...                           │
│             │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-41305                  │
└─────────────┴────────────────┴──────────┴────────┴───────────────────┴───────────────┴─────────────────────────────────────────────────────────────┘

[github-actions]

Super-linter summary

Language	Validation result
BIOME_FORMAT	Fail ❌
BIOME_LINT	Pass ✅
CHECKOV	Pass ✅
EDITORCONFIG	Fail ❌
GITLEAKS	Pass ✅
GIT_COMMITLINT	Fail ❌
GIT_MERGE_CONFLICT_MARKERS	Pass ✅
JSCPD	Pass ✅
JSON	Pass ✅
JSON_PRETTIER	Fail ❌
PRE_COMMIT	Pass ✅
SPELL_CODESPELL	Pass ✅
TRIVY	Fail ❌

Super-linter detected linting errors

For more information, see the
GitHub Actions workflow run

Powered by Super-linter

BIOME_FORMAT

Checked 27 files in 176ms. No fixes applied.
Found 1 error..stepsecurity/meta.json format ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

  × Formatter would have printed the following content:

     1  1 │   {
     2    │ - ···"schema_version":·"1",
     3    │ - ···"onboarding_type":·"copied",
     4    │ - ···"archived":·false,
     5    │ - ···"maintained_action_name":·"step-security/super-linter",
     6    │ - ···"upstream_full_repo_name":·"super-linter/super-linter",
     7    │ - ···"action_type":·"docker",
     8    │ - ···"last_release":·{
     9    │ - ·····"tag_name":·"v8.6.0",
    10    │ - ·····"created_at":·"2026-06-11T09:15:31Z",
    11    │ - ·····"published_at":·"2026-06-12T04:32:40Z"
    12    │ - ···},
    13    │ - ···"sync":·{
    14    │ - ·····"ignore_presets":·[
    15    │ - ·······"defaults_v1"
    16    │ - ·····]
    17    │ - ···}
    18    │ - ·}
        2 │ + ··"schema_version":·"1",
        3 │ + ··"onboarding_type":·"copied",
        4 │ + ··"archived":·false,
        5 │ + ··"maintained_action_name":·"step-security/super-linter",
        6 │ + ··"upstream_full_repo_name":·"super-linter/super-linter",
        7 │ + ··"action_type":·"docker",
        8 │ + ··"last_release":·{
        9 │ + ····"tag_name":·"v8.6.0",
       10 │ + ····"created_at":·"2026-06-11T09:15:31Z",
       11 │ + ····"published_at":·"2026-06-12T04:32:40Z"
       12 │ + ··},
       13 │ + ··"sync":·{
       14 │ + ····"ignore_presets":·["defaults_v1"]
       15 │ + ··}
       16 │ + }
    19 17 │


format ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

  × Some errors were emitted while running checks.

EDITORCONFIG

.stepsecurity/meta.json:
	2-18: Wrong amount of left-padding spaces(want multiple of 2)

1 errors found

GIT_COMMITLINT

⧗   --- input ---
chore: Add meta config
✖   subject must not be sentence-case, start-case, pascal-case, upper-case [subject-case]

✖   found 1 problems, 0 warnings
ⓘ   Get help: https://www.conventionalcommits.org/

JSON_PRETTIER

Checking formatting...[warn] .stepsecurity/meta.json
[warn] Code style issues found in the above file. Run Prettier with --write to fix.

TRIVY

Report Summary

┌─────────────────────────────────────┬────────────┬─────────────────┬───────────────────┬─────────┐
│               Target                │    Type    │ Vulnerabilities │ Misconfigurations │ Secrets │
├─────────────────────────────────────┼────────────┼─────────────────┼───────────────────┼─────────┤
│ dependencies/Gemfile.lock           │  bundler   │        4        │         -         │    -    │
├─────────────────────────────────────┼────────────┼─────────────────┼───────────────────┼─────────┤
│ dependencies/composer/composer.lock │  composer  │        0        │         -         │    -    │
├─────────────────────────────────────┼────────────┼─────────────────┼───────────────────┼─────────┤
│ dependencies/package-lock.json      │    npm     │        4        │         -         │    -    │
├─────────────────────────────────────┼────────────┼─────────────────┼───────────────────┼─────────┤
│ Dockerfile                          │ dockerfile │        -        │         0         │    -    │
├─────────────────────────────────────┼────────────┼─────────────────┼───────────────────┼─────────┤
│ test/linters/trivy/good/Dockerfile  │ dockerfile │        -        │         0         │    -    │
└─────────────────────────────────────┴────────────┴─────────────────┴───────────────────┴─────────┘
Legend:
- '-': Not scanned
- '0': Clean (no security findings detected)


For OSS Maintainers: VEX Notice
--------------------------------
If you're an OSS maintainer and Trivy has detected vulnerabilities in your project that you believe are not actually exploitable, consider issuing a VEX (Vulnerability Exploitability eXchange) statement.
VEX allows you to communicate the actual status of vulnerabilities in your project, improving security transparency and reducing false positives for your users.
Learn more and start using VEX: https://trivy.dev/docs/v0.71/guide/supply-chain/vex/repo#publishing-vex-documents

To disable this notice, set the TRIVY_DISABLE_VEX_NOTICE environment variable.


dependencies/Gemfile.lock (bundler)
===================================
Total: 4 (UNKNOWN: 0, LOW: 1, MEDIUM: 1, HIGH: 1, CRITICAL: 1)

┌─────────────────┬────────────────┬──────────┬────────┬───────────────────┬───────────────┬─────────────────────────────────────────────────────────────┐
│     Library     │ Vulnerability  │ Severity │ Status │ Installed Version │ Fixed Version │                            Title                            │
├─────────────────┼────────────────┼──────────┼────────┼───────────────────┼───────────────┼─────────────────────────────────────────────────────────────┤
│ concurrent-ruby │ CVE-2026-54906 │ CRITICAL │ fixed  │ 1.3.6             │ >= 1.3.7      │ concurrent-ruby: rubygem-concurrent-ruby: concurrent-ruby:  │
│                 │                │          │        │                   │               │ Synchronization flaw in ReadWriteLock allows unauthorized   │
│                 │                │          │        │                   │               │ lock release and...                                         │
│                 │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-54906                  │
│                 ├────────────────┼──────────┤        │                   │               ├─────────────────────────────────────────────────────────────┤
│                 │ CVE-2026-54904 │ HIGH     │        │                   │               │ concurrent-ruby: rubygem-concurrent-ruby: concurrent-ruby:  │
│                 │                │          │        │                   │               │ Denial of Service due to infinite loop in                   │
│                 │                │          │        │                   │               │ AtomicReference#update...                                   │
│                 │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-54904                  │
│                 ├────────────────┼──────────┤        │                   │               ├─────────────────────────────────────────────────────────────┤
│                 │ CVE-2026-54905 │ MEDIUM   │        │                   │               │ concurrent-ruby: Concurrent-ruby: Incorrect write lock      │
│                 │                │          │        │                   │               │ granting leading to broken mutual exclusion                 │
│                 │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-54905                  │
├─────────────────┼────────────────┼──────────┤        ├───────────────────┼───────────────┼─────────────────────────────────────────────────────────────┤
│ json            │ CVE-2026-54696 │ LOW      │        │ 2.19.5            │ >= 2.19.9     │ Ruby JSON is a JSON implementation for Ruby. Versions 2.9.0 │
│                 │                │          │        │                   │               │ through 2....                                               │
│                 │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-54696                  │
└─────────────────┴────────────────┴──────────┴────────┴───────────────────┴───────────────┴─────────────────────────────────────────────────────────────┘

dependencies/package-lock.json (npm)
====================================
Total: 4 (UNKNOWN: 0, LOW: 0, MEDIUM: 4, HIGH: 0, CRITICAL: 0)

┌─────────────┬────────────────┬──────────┬────────┬───────────────────┬───────────────┬─────────────────────────────────────────────────────────────┐
│   Library   │ Vulnerability  │ Severity │ Status │ Installed Version │ Fixed Version │                            Title                            │
├─────────────┼────────────────┼──────────┼────────┼───────────────────┼───────────────┼─────────────────────────────────────────────────────────────┤
│ js-yaml     │ CVE-2026-53550 │ MEDIUM   │ fixed  │ 3.14.2            │ 4.2.0, 3.15.0 │ js-yaml: js-yaml: Denial of Service via crafted YAML merge  │
│             │                │          │        │                   │               │ keys                                                        │
│             │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-53550                  │
│             │                │          │        ├───────────────────┤               │                                                             │
│             │                │          │        │ 4.1.1             │               │                                                             │
│             │                │          │        │                   │               │                                                             │
│             │                │          │        │                   │               │                                                             │
├─────────────┼────────────────┤          │        ├───────────────────┼───────────────┼─────────────────────────────────────────────────────────────┤
│ markdown-it │ CVE-2026-48988 │          │        │ 14.1.1            │ 14.2.0        │ markdown-it is a Markdown parser. Versions 14.1.1 and below │
│             │                │          │        │                   │               │ contain a ...                                               │
│             │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-48988                  │
├─────────────┼────────────────┤          │        ├───────────────────┼───────────────┼─────────────────────────────────────────────────────────────┤
│ postcss     │ CVE-2026-41305 │          │        │ 8.4.31            │ 8.5.10        │ postcss: PostCSS: Cross-Site Scripting (XSS) via improper   │
│             │                │          │        │                   │               │ escaping of style closing tags...                           │
│             │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-41305                  │
└─────────────┴────────────────┴──────────┴────────┴───────────────────┴───────────────┴─────────────────────────────────────────────────────────────┘

[github-actions]

Super-linter summary

Language	Validation result
BIOME_FORMAT	Fail ❌
BIOME_LINT	Pass ✅
CHECKOV	Pass ✅
EDITORCONFIG	Fail ❌
GITLEAKS	Pass ✅
GIT_COMMITLINT	Fail ❌
GIT_MERGE_CONFLICT_MARKERS	Pass ✅
JSCPD	Pass ✅
JSON	Pass ✅
JSON_PRETTIER	Fail ❌
PRE_COMMIT	Pass ✅
SPELL_CODESPELL	Pass ✅
TRIVY	Fail ❌

Super-linter detected linting errors

For more information, see the
GitHub Actions workflow run

Powered by Super-linter

BIOME_FORMAT

Checked 27 files in 162ms. No fixes applied.
Found 1 error..stepsecurity/meta.json format ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

  × Formatter would have printed the following content:

     1  1 │   {
     2    │ - ···"schema_version":·"1",
     3    │ - ···"onboarding_type":·"copied",
     4    │ - ···"archived":·false,
     5    │ - ···"maintained_action_name":·"step-security/super-linter",
     6    │ - ···"upstream_full_repo_name":·"super-linter/super-linter",
     7    │ - ···"action_type":·"docker",
     8    │ - ···"last_release":·{
     9    │ - ·····"tag_name":·"v8.6.0",
    10    │ - ·····"created_at":·"2026-06-11T09:15:31Z",
    11    │ - ·····"published_at":·"2026-06-12T04:32:40Z"
    12    │ - ···},
    13    │ - ···"sync":·{
    14    │ - ·····"ignore_presets":·[
    15    │ - ·······"defaults_v1"
    16    │ - ·····]
    17    │ - ···}
    18    │ - ·}
        2 │ + ··"schema_version":·"1",
        3 │ + ··"onboarding_type":·"copied",
        4 │ + ··"archived":·false,
        5 │ + ··"maintained_action_name":·"step-security/super-linter",
        6 │ + ··"upstream_full_repo_name":·"super-linter/super-linter",
        7 │ + ··"action_type":·"docker",
        8 │ + ··"last_release":·{
        9 │ + ····"tag_name":·"v8.6.0",
       10 │ + ····"created_at":·"2026-06-11T09:15:31Z",
       11 │ + ····"published_at":·"2026-06-12T04:32:40Z"
       12 │ + ··},
       13 │ + ··"sync":·{
       14 │ + ····"ignore_presets":·["defaults_v1"]
       15 │ + ··}
       16 │ + }
    19 17 │


format ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

  × Some errors were emitted while running checks.

EDITORCONFIG

.stepsecurity/meta.json:
	2-18: Wrong amount of left-padding spaces(want multiple of 2)

1 errors found

GIT_COMMITLINT

⧗   --- input ---
chore: Add meta config
✖   subject must not be sentence-case, start-case, pascal-case, upper-case [subject-case]

✖   found 1 problems, 0 warnings
ⓘ   Get help: https://www.conventionalcommits.org/

JSON_PRETTIER

Checking formatting...[warn] .stepsecurity/meta.json
[warn] Code style issues found in the above file. Run Prettier with --write to fix.

TRIVY

Report Summary

┌─────────────────────────────────────┬────────────┬─────────────────┬───────────────────┬─────────┐
│               Target                │    Type    │ Vulnerabilities │ Misconfigurations │ Secrets │
├─────────────────────────────────────┼────────────┼─────────────────┼───────────────────┼─────────┤
│ dependencies/Gemfile.lock           │  bundler   │        4        │         -         │    -    │
├─────────────────────────────────────┼────────────┼─────────────────┼───────────────────┼─────────┤
│ dependencies/composer/composer.lock │  composer  │        0        │         -         │    -    │
├─────────────────────────────────────┼────────────┼─────────────────┼───────────────────┼─────────┤
│ dependencies/package-lock.json      │    npm     │        4        │         -         │    -    │
├─────────────────────────────────────┼────────────┼─────────────────┼───────────────────┼─────────┤
│ Dockerfile                          │ dockerfile │        -        │         0         │    -    │
├─────────────────────────────────────┼────────────┼─────────────────┼───────────────────┼─────────┤
│ test/linters/trivy/good/Dockerfile  │ dockerfile │        -        │         0         │    -    │
└─────────────────────────────────────┴────────────┴─────────────────┴───────────────────┴─────────┘
Legend:
- '-': Not scanned
- '0': Clean (no security findings detected)


For OSS Maintainers: VEX Notice
--------------------------------
If you're an OSS maintainer and Trivy has detected vulnerabilities in your project that you believe are not actually exploitable, consider issuing a VEX (Vulnerability Exploitability eXchange) statement.
VEX allows you to communicate the actual status of vulnerabilities in your project, improving security transparency and reducing false positives for your users.
Learn more and start using VEX: https://trivy.dev/docs/v0.71/guide/supply-chain/vex/repo#publishing-vex-documents

To disable this notice, set the TRIVY_DISABLE_VEX_NOTICE environment variable.


dependencies/Gemfile.lock (bundler)
===================================
Total: 4 (UNKNOWN: 0, LOW: 1, MEDIUM: 1, HIGH: 1, CRITICAL: 1)

┌─────────────────┬────────────────┬──────────┬────────┬───────────────────┬───────────────┬─────────────────────────────────────────────────────────────┐
│     Library     │ Vulnerability  │ Severity │ Status │ Installed Version │ Fixed Version │                            Title                            │
├─────────────────┼────────────────┼──────────┼────────┼───────────────────┼───────────────┼─────────────────────────────────────────────────────────────┤
│ concurrent-ruby │ CVE-2026-54906 │ CRITICAL │ fixed  │ 1.3.6             │ >= 1.3.7      │ concurrent-ruby: rubygem-concurrent-ruby: concurrent-ruby:  │
│                 │                │          │        │                   │               │ Synchronization flaw in ReadWriteLock allows unauthorized   │
│                 │                │          │        │                   │               │ lock release and...                                         │
│                 │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-54906                  │
│                 ├────────────────┼──────────┤        │                   │               ├─────────────────────────────────────────────────────────────┤
│                 │ CVE-2026-54904 │ HIGH     │        │                   │               │ concurrent-ruby: rubygem-concurrent-ruby: concurrent-ruby:  │
│                 │                │          │        │                   │               │ Denial of Service due to infinite loop in                   │
│                 │                │          │        │                   │               │ AtomicReference#update...                                   │
│                 │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-54904                  │
│                 ├────────────────┼──────────┤        │                   │               ├─────────────────────────────────────────────────────────────┤
│                 │ CVE-2026-54905 │ MEDIUM   │        │                   │               │ concurrent-ruby: Concurrent-ruby: Incorrect write lock      │
│                 │                │          │        │                   │               │ granting leading to broken mutual exclusion                 │
│                 │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-54905                  │
├─────────────────┼────────────────┼──────────┤        ├───────────────────┼───────────────┼─────────────────────────────────────────────────────────────┤
│ json            │ CVE-2026-54696 │ LOW      │        │ 2.19.5            │ >= 2.19.9     │ Ruby JSON is a JSON implementation for Ruby. Versions 2.9.0 │
│                 │                │          │        │                   │               │ through 2....                                               │
│                 │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-54696                  │
└─────────────────┴────────────────┴──────────┴────────┴───────────────────┴───────────────┴─────────────────────────────────────────────────────────────┘

dependencies/package-lock.json (npm)
====================================
Total: 4 (UNKNOWN: 0, LOW: 0, MEDIUM: 4, HIGH: 0, CRITICAL: 0)

┌─────────────┬────────────────┬──────────┬────────┬───────────────────┬───────────────┬─────────────────────────────────────────────────────────────┐
│   Library   │ Vulnerability  │ Severity │ Status │ Installed Version │ Fixed Version │                            Title                            │
├─────────────┼────────────────┼──────────┼────────┼───────────────────┼───────────────┼─────────────────────────────────────────────────────────────┤
│ js-yaml     │ CVE-2026-53550 │ MEDIUM   │ fixed  │ 3.14.2            │ 4.2.0, 3.15.0 │ js-yaml: js-yaml: Denial of Service via crafted YAML merge  │
│             │                │          │        │                   │               │ keys                                                        │
│             │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-53550                  │
│             │                │          │        ├───────────────────┤               │                                                             │
│             │                │          │        │ 4.1.1             │               │                                                             │
│             │                │          │        │                   │               │                                                             │
│             │                │          │        │                   │               │                                                             │
├─────────────┼────────────────┤          │        ├───────────────────┼───────────────┼─────────────────────────────────────────────────────────────┤
│ markdown-it │ CVE-2026-48988 │          │        │ 14.1.1            │ 14.2.0        │ markdown-it is a Markdown parser. Versions 14.1.1 and below │
│             │                │          │        │                   │               │ contain a ...                                               │
│             │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-48988                  │
├─────────────┼────────────────┤          │        ├───────────────────┼───────────────┼─────────────────────────────────────────────────────────────┤
│ postcss     │ CVE-2026-41305 │          │        │ 8.4.31            │ 8.5.10        │ postcss: PostCSS: Cross-Site Scripting (XSS) via improper   │
│             │                │          │        │                   │               │ escaping of style closing tags...                           │
│             │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-41305                  │
└─────────────┴────────────────┴──────────┴────────┴───────────────────┴───────────────┴─────────────────────────────────────────────────────────────┘