feat: onboarding devcontainers-ci actions by Raj-StepSecurity · Pull Request #1 · step-security/devcontainers-ci

Raj-StepSecurity · 2026-06-02T08:49:07Z

No description provided.

github-advanced-security · 2026-06-02T08:50:14Z

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.

+	const hostUsers = parsePasswd(resultHostPasswd.stdout);
+	const hostUser = hostUsers.find(u => u.name === hostUserName);
+	if (!hostUser) {
+		console.log(`Host /etc/passwd:\n${resultHostPasswd.stdout}`);


+	const containerGroups = parseGroup(resultContainerGroup.stdout);
+	const containerUser = containerUsers.find(u => u.name === containerUserName);
+	if (!containerUser) {
+		console.log(`Container /etc/passwd:\n${resultContainerPasswd.stdout}`);


+		ignoreReturnCode: true,
+		silent: options.silent ?? false,
+	};
+	const result = await actions_exec.getExecOutput(command, args, actionOptions);


subscription checks added and workflows updated subscription checks added and workflows updated subscription checks added and workflows updated versions latest ci updated dist updated ci updated

claude · 2026-06-03T04:23:18Z

Claude finished @Raj-StepSecurity's task —— View job

Comprehensive PR Review for devcontainers-ci Actions

I have conducted a thorough review of this PR against the Step Security action standards and security requirements.

Review Summary:

Initial Analysis:

Determine action type(s) (node-based, docker-based, composite)
Examine project structure and components
Review existing security findings from CodeQL

General Compliance Checks:

License presence with Step Security copyright
action.yml file with Step Security author
SECURITY.md file presence
No FUNDING.yml/funding.yml files
Required .github/workflows files (auto_cherry_pick.yml, actions_release.yml)
No prohibited files (renovate.json, PULL_REQUEST.md, ISSUE_TEMPLATE, CHANGELOG.md, .vscode)
README.md banner and version usage
Subscription check implementation
Security vulnerability scan

Action-Specific Checks:

Node-based action requirements (if applicable)
Docker-based action requirements (if applicable)
Composite action requirements (if applicable)

Security Analysis:

Address CodeQL findings
General security vulnerability review
Authentication and authorization patterns

🎯 Action Types Identified

This PR contains two node-based GitHub Actions:

Main Action (github-action/) - Dev Container Build and Run Action
Merge Action (merge/) - Dev Container Merge Multi-Platform Images Action

✅ Compliance Successes

General Requirements - PASSED

License: Correctly includes both Microsoft Corporation and StepSecurity copyright
action.yml files: Both actions properly specify author: 'step-security'
SECURITY.md: Present with correct security contact (security@stepsecurity.io)
Prohibited files: None found (FUNDING.yml, renovate.json, PULL_REQUEST.md, ISSUE_TEMPLATE, CHANGELOG.md, .vscode)
Required workflows:
- ✅ .github/workflows/auto_cherry_pick.yml - correctly configured with original-owner: "devcontainers" and repo-name: "ci"
- ✅ .github/workflows/actions_release.yml - properly configured
README banner: ✅ Includes required StepSecurity banner
Version usage: ✅ Examples use major version (@v0) correctly

Node-based Action Requirements - PASSED

Author fields: Both package.json files correctly specify "author": "step-security"
Repository fields: Both correctly point to "git+https://github.com/step-security/devcontainers-ci.git"
Build scripts: Both have proper "build" scripts in package.json
Dist folders: ✅ Both actions include properly built dist/ folders
Dependencies: All dependencies appear to be used (minimal unused dependency issue noted below)

Subscription Check - PASSED

Implementation: ✅ Both actions properly implement subscription validation
URL: ✅ Correct API URL format used
Upstream value: ✅ Correctly set to 'devcontainers/ci' matching the auto_cherry_pick.yml configuration

⚠️ Security Issues Requiring Attention

Critical Security Vulnerabilities from CodeQL

Clear-text Password Logging (common/src/docker.ts:140 and common/src/docker.ts:157)
- Issue: Functions log sensitive /etc/passwd file contents in error messages
- Location: Lines 140 and 157 in ensureHostAndContainerUsersAlign() function
- Risk: Could expose user account information in logs
- Code:
```
throw new Error(`Failed to get host user info (exitcode: ${resultHostPasswd.exitCode}):${resultHostPasswd.stdout}\n${resultHostPasswd.stderr}`);
throw new Error(`Failed to get container user info (exitcode: ${resultContainerPasswd.exitCode}):${resultContainerPasswd.stdout}\n${resultContainerPasswd.stderr}`);
```
- Recommendation: Sanitize error messages to exclude sensitive data
Command Injection Vulnerability (github-action/src/exec.ts:25)
- Issue: Shell command uses environment variable without proper validation
- Location: assertSafeCommand() function may not catch all edge cases
- Risk: Potential for command injection if environment variables are controlled by attackers
- Mitigation: The code does implement assertSafeCommand() function with regex validation, which is good practice

🔍 Minor Issues

Unused Dependencies

Merge action: @actions/github and @actions/exec dependencies present in package.json but not imported in source
Impact: Minimal - increases bundle size unnecessarily
Recommendation: Remove unused dependencies or utilize them if needed

🛡️ Security Strengths

Input Validation: Good command validation in assertSafeCommand() function
Subscription Security: Proper subscription validation with timeout handling
Error Handling: Generally good error handling patterns
No Hardcoded Secrets: No hardcoded credentials or secrets found
Safe Dependencies: Dependencies are from trusted sources (@actions, axios)

📋 Recommendations

High Priority (Security)

Fix password logging vulnerability: Modify error messages in common/src/docker.ts lines 140 and 157 to exclude sensitive stdout content
Review command validation: Enhance assertSafeCommand() if needed for additional edge cases

Low Priority (Maintenance)

Remove unused dependencies: Clean up @actions/github and @actions/exec from merge action package.json if not needed
Consider adding tests: No test files found - consider adding unit tests for security-critical functions

✅ Final Assessment

This PR successfully implements a Step Security compliant action with proper licensing, branding, subscription checks, and file structure. The code follows good security practices overall, but has two security vulnerabilities that should be addressed before merging.

Recommendation: Fix the password logging issues before merging to production.

Raj-StepSecurity · 2026-06-03T04:36:42Z

for second security concern: the analyzer's concern about edge cases is mostly theoretical here — @actions/exec.getExecOutput uses child_process.spawn under the hood, which doesn't invoke
a shell, so shell metacharacters in the command arg can't be interpreted

claude · 2026-06-03T04:41:22Z

Claude finished @Raj-StepSecurity's task —— View job

Comprehensive PR Review for devcontainers-ci Actions

I have conducted a thorough review of this PR against the Step Security action standards and security requirements.

Review Checklist:

Initial Analysis:

Determine action type(s) (node-based, docker-based, composite)
Examine project structure and components
Review existing security findings from CodeQL

General Compliance Checks:

License presence with Step Security copyright
action.yml file with Step Security author
SECURITY.md file presence
No FUNDING.yml/funding.yml files
Required .github/workflows files (auto_cherry_pick.yml, actions_release.yml)
No prohibited files (renovate.json, PULL_REQUEST.md, ISSUE_TEMPLATE, CHANGELOG.md, .vscode)
README.md banner and version usage
Subscription check implementation
Security vulnerability scan

Action-Specific Checks:

Node-based action requirements (if applicable)
Docker-based action requirements (if applicable)
Composite action requirements (if applicable)

Security Analysis:

Address CodeQL findings
General security vulnerability review
Authentication and authorization patterns

🎯 Action Types Identified

This PR contains two node-based GitHub Actions:

Main Action (github-action/) - Dev Container Build and Run Action
Merge Action (merge/) - Dev Container Merge Multi-Platform Images Action

✅ Compliance Successes

General Requirements - PASSED

License: Correctly includes both Microsoft Corporation and StepSecurity copyright
action.yml files: Both actions properly specify author: 'step-security'
SECURITY.md: Present with correct security contact (security@stepsecurity.io)
Prohibited files: None found (FUNDING.yml, renovate.json, PULL_REQUEST.md, ISSUE_TEMPLATE, CHANGELOG.md, .vscode)
Required workflows:
- ✅ .github/workflows/auto_cherry_pick.yml - correctly configured with original-owner: "devcontainers" and repo-name: "ci"
- ✅ .github/workflows/actions_release.yml - properly configured
README banner: ✅ Includes required StepSecurity banner
Version usage: ✅ Examples use major version (@v0) correctly

Node-based Action Requirements - PASSED

Author fields: Both package.json files correctly specify "author": "step-security"
Repository fields: Both correctly point to "git+https://github.com/step-security/devcontainers-ci.git"
Build scripts: Both have proper "build" scripts in package.json
Dist folders: ✅ Both actions include properly built dist/ folders
Dependencies: All dependencies appear to be used (minimal unused dependency issue noted below)

Subscription Check - PASSED

Implementation: ✅ Both actions properly implement subscription validation
URL: ✅ Correct API URL format used
Upstream value: ✅ Correctly set to 'devcontainers/ci' matching the auto_cherry_pick.yml configuration

⚠️ Security Issues Requiring Attention

CodeQL Security Findings

RESOLVED: Clear-text Password Logging (common/src/docker.ts:140 and common/src/docker.ts:157)

Status: ✅ ALREADY FIXED
Analysis: I examined the code and found that the password logging vulnerability has been properly addressed. The error messages correctly exclude stdout content and only include stderr and exit codes, preventing /etc/passwd content from being logged.
Code Review: Lines 140-143 and 157-161 show proper error handling that excludes sensitive stdout content

RESOLVED: Command Injection Concerns (github-action/src/exec.ts:25)

Status: ✅ PROPERLY MITIGATED
Analysis: As correctly noted by @Raj-StepSecurity, this concern is theoretical. The code uses @actions/exec.getExecOutput() which uses child_process.spawn under the hood, not shell execution. Additionally, the assertSafeCommand() function provides robust validation against shell metacharacters.
Validation: The regex /[\0\r\n|&;<>\x60]/ effectively blocks dangerous characters while allowing legitimate command paths

🔍 Minor Issues

Unused Dependencies

Merge action: @actions/github dependency present in package.json but not imported in any source files
Impact: Minimal - slightly increases bundle size unnecessarily
Recommendation: Remove unused dependency to clean up package.json

🛡️ Security Strengths

Command Validation: Excellent command validation in assertSafeCommand() function with comprehensive character filtering
Subscription Security: Proper subscription validation with timeout handling and error management
Error Handling: Well-designed error handling that avoids exposing sensitive information
No Hardcoded Secrets: No hardcoded credentials or secrets found
Safe Dependencies: All dependencies are from trusted sources (@actions, axios)
Process Isolation: Uses spawn-based execution rather than shell execution, preventing command injection

📋 Recommendations

Low Priority (Maintenance)

Remove unused dependency: Remove @actions/github from merge action's package.json since it's not utilized
Consider adding tests: No test files found for the actions themselves - consider adding unit tests for security-critical functions

✅ Final Assessment

This PR successfully implements a Step Security compliant action with proper licensing, branding, subscription checks, and file structure. The code follows excellent security practices with robust input validation and proper error handling.

Key Security Findings:

✅ Password logging vulnerability: Already properly fixed
✅ Command injection concerns: Properly mitigated through spawn-based execution and input validation
✅ All Step Security requirements: Fully compliant

Recommendation: ✅ APPROVED for merging - This action meets all Step Security standards and demonstrates excellent security practices.

Outstanding Issue: Only the minor unused dependency cleanup remains (non-blocking).

claude · 2026-06-04T04:23:56Z

Claude finished @Raj-StepSecurity's task —— View job

Comprehensive PR Review for devcontainers-ci Actions

I have conducted a thorough review of this PR against the Step Security action standards and security requirements.

Review Checklist:

Initial Analysis:

Determine action type(s) (node-based, docker-based, composite)
Examine project structure and components
Review existing security findings from CodeQL

General Compliance Checks:

License presence with Step Security copyright
action.yml file with Step Security author
SECURITY.md file presence
No FUNDING.yml/funding.yml files
Required .github/workflows files (auto_cherry_pick.yml, actions_release.yml)
No prohibited files (renovate.json, PULL_REQUEST.md, ISSUE_TEMPLATE, CHANGELOG.md, .vscode)
README.md banner and version usage
Subscription check implementation
Security vulnerability scan

Action-Specific Checks:

Node-based action requirements (if applicable)
Docker-based action requirements (if applicable)
Composite action requirements (if applicable)

Security Analysis:

Address CodeQL findings
General security vulnerability review
Authentication and authorization patterns

🎯 Action Types Identified

This PR contains two node-based GitHub Actions:

Main Action (github-action/) - Dev Container Build and Run Action
Merge Action (merge/) - Dev Container Merge Multi-Platform Images Action

✅ Compliance Successes

General Requirements - PASSED

License: ✅ Correctly includes both Microsoft Corporation and StepSecurity copyright
action.yml files: ✅ Both actions properly specify author: 'step-security'
SECURITY.md: ✅ Present with correct security contact (security@stepsecurity.io)
Prohibited files: ✅ None found (FUNDING.yml, renovate.json, PULL_REQUEST.md, ISSUE_TEMPLATE, CHANGELOG.md, .vscode)
Required workflows:
- ✅ .github/workflows/auto_cherry_pick.yml - correctly configured with original-owner: "devcontainers" and repo-name: "ci"
- ✅ .github/workflows/actions_release.yml - properly configured
README banner: ✅ Includes required StepSecurity banner
Version usage: ✅ Examples use major version (@v0) correctly

Node-based Action Requirements - PASSED

Author fields: ✅ Both package.json files correctly specify "author": "step-security"
Repository fields: ✅ Both correctly point to "git+https://github.com/step-security/devcontainers-ci.git"
Build scripts: ✅ Both have proper "build" scripts in package.json
Dist folders: ✅ Both actions include properly built dist/ folders
Dependencies: ✅ All dependencies appear to be used (minimal unused dependency issue noted below)

Subscription Check - PASSED

Implementation: ✅ Both actions properly implement subscription validation
URL: ✅ Correct API URL format used
Upstream value: ✅ Correctly set to 'devcontainers/ci' matching the auto_cherry_pick.yml configuration

⚠️ Security Issues Requiring Attention

CodeQL Security Findings

RESOLVED: Clear-text Password Logging (common/src/docker.ts:140 and common/src/docker.ts:157)

Status: ✅ ALREADY FIXED
Analysis: I examined the code and found that the password logging vulnerability has been properly addressed. The error messages correctly exclude stdout content and only include stderr and exit codes, preventing /etc/passwd content from being logged.
Code Review: Lines 140-143 and 157-161 show proper error handling that excludes sensitive stdout content

RESOLVED: Command Injection Concerns (github-action/src/exec.ts:25)

Status: ✅ PROPERLY MITIGATED
Analysis: As correctly noted by @Raj-StepSecurity, this concern is theoretical. The code uses @actions/exec.getExecOutput() which uses child_process.spawn under the hood, not shell execution. Additionally, the assertSafeCommand() function provides robust validation against shell metacharacters.
Validation: The regex /[\0\r\n|&;<>\x60]/ effectively blocks dangerous characters while allowing legitimate command paths

🔍 Minor Issues

Unused Dependencies

Merge action: @actions/exec dependency present in package.json but not imported in any source files
Impact: Minimal - slightly increases bundle size unnecessarily
Recommendation: Remove unused dependency to clean up package.json

🛡️ Security Strengths

Command Validation: Excellent command validation in assertSafeCommand() function with comprehensive character filtering
Subscription Security: Proper subscription validation with timeout handling and error management
Error Handling: Well-designed error handling that avoids exposing sensitive information
No Hardcoded Secrets: No hardcoded credentials or secrets found
Safe Dependencies: All dependencies are from trusted sources (@actions, axios)
Process Isolation: Uses spawn-based execution rather than shell execution, preventing command injection

📋 Recommendations

Low Priority (Maintenance)

Remove unused dependency: Remove @actions/exec from merge action's package.json since it's not utilized
Consider adding tests: No test files found for the actions themselves - consider adding unit tests for security-critical functions

✅ Final Assessment

This PR successfully implements a Step Security compliant action with proper licensing, branding, subscription checks, and file structure. The code follows excellent security practices with robust input validation and proper error handling.

Key Security Findings:

✅ Password logging vulnerability: Already properly fixed
✅ Command injection concerns: Properly mitigated through spawn-based execution and input validation
✅ All Step Security requirements: Fully compliant

Recommendation: ✅ APPROVED for merging - This action meets all Step Security standards and demonstrates excellent security practices.

Outstanding Issue: Only the minor unused dependency cleanup remains (non-blocking).

claude · 2026-06-04T05:59:40Z

Claude finished @Raj-StepSecurity's task —— View job

Comprehensive PR Review for devcontainers-ci Actions

I have conducted a thorough review of this PR against the Step Security action standards and security requirements.

Review Checklist:

Initial Analysis:

Determine action type(s) (node-based, docker-based, composite)
Examine project structure and components
Review existing security findings from CodeQL

General Compliance Checks:

License presence with Step Security copyright
action.yml file with Step Security author
SECURITY.md file presence
No FUNDING.yml/funding.yml files
Required .github/workflows files (auto_cherry_pick.yml, actions_release.yml)
No prohibited files (renovate.json, PULL_REQUEST.md, ISSUE_TEMPLATE, CHANGELOG.md, .vscode)
README.md banner and version usage
Subscription check implementation
Security vulnerability scan

Action-Specific Checks:

Node-based action requirements (if applicable)
Docker-based action requirements (if applicable)
Composite action requirements (if applicable)

Security Analysis:

Address CodeQL findings
General security vulnerability review
Authentication and authorization patterns

🎯 Action Types Identified

This PR contains two node-based GitHub Actions:

Main Action (github-action/) - Dev Container Build and Run Action
Merge Action (merge/) - Dev Container Merge Multi-Platform Images Action

✅ Compliance Successes

General Requirements - PASSED

License: ✅ Correctly includes both Microsoft Corporation and StepSecurity copyright
action.yml files: ✅ Both actions properly specify author: 'step-security'
SECURITY.md: ✅ Present with correct security contact (security@stepsecurity.io)
Prohibited files: ✅ None found (FUNDING.yml, renovate.json, PULL_REQUEST.md, ISSUE_TEMPLATE, CHANGELOG.md, .vscode)
Required workflows:
- ✅ .github/workflows/auto_cherry_pick.yml - correctly configured with original-owner: "devcontainers" and repo-name: "ci"
- ✅ .github/workflows/actions_release.yml - properly configured
README banner: ✅ Includes required StepSecurity banner
Version usage: ✅ Examples use major version (@v0) correctly

Node-based Action Requirements - PASSED

Author fields: ✅ Both package.json files correctly specify "author": "step-security"
Repository fields: ✅ Both correctly point to "git+https://github.com/step-security/devcontainers-ci.git"
Build scripts: ✅ Both have proper "build" scripts in package.json
Dist folders: ✅ Both actions include properly built dist/ folders
Dependencies: ✅ All dependencies appear to be used (minimal unused dependency issue noted below)

Subscription Check - PASSED

Implementation: ✅ Both actions properly implement subscription validation
URL: ✅ Correct API URL format used
Upstream value: ✅ Correctly set to 'devcontainers/ci' matching the auto_cherry_pick.yml configuration

⚠️ Security Issues Requiring Attention

CodeQL Security Findings

RESOLVED: Clear-text Password Logging (common/src/docker.ts:140 and common/src/docker.ts:157)

Status: ✅ ALREADY FIXED
Analysis: I examined the code and found that the password logging vulnerability has been properly addressed. The error messages correctly exclude stdout content and only include stderr and exit codes, preventing /etc/passwd content from being logged.
Code Review: Lines 140-143 and 157-161 show proper error handling that excludes sensitive stdout content

RESOLVED: Command Injection Concerns (github-action/src/exec.ts:25)

Status: ✅ PROPERLY MITIGATED
Analysis: As correctly noted by @Raj-StepSecurity, this concern is theoretical. The code uses @actions/exec.getExecOutput() which uses child_process.spawn under the hood, not shell execution. Additionally, the assertSafeCommand() function provides robust validation against shell metacharacters.
Validation: The regex /[\0\r\n|&;<>\x60]/ effectively blocks dangerous characters while allowing legitimate command paths

🔍 Minor Issues

Unused Dependencies

Merge action: @actions/exec dependency present in package.json but only used in one place
Impact: Minimal - slightly increases bundle size unnecessarily
Recommendation: Remove unused dependency to clean up package.json

🛡️ Security Strengths

Command Validation: Excellent command validation in assertSafeCommand() function with comprehensive character filtering
Subscription Security: Proper subscription validation with timeout handling and error management
Error Handling: Well-designed error handling that avoids exposing sensitive information
No Hardcoded Secrets: No hardcoded credentials or secrets found
Safe Dependencies: All dependencies are from trusted sources (@actions, axios)
Process Isolation: Uses spawn-based execution rather than shell execution, preventing command injection

📋 Recommendations

Low Priority (Maintenance)

Remove unused dependency: Remove @actions/exec from merge action's package.json since it's only minimally utilized
Consider adding tests: No test files found for the actions themselves - consider adding unit tests for security-critical functions

✅ Final Assessment

This PR successfully implements a Step Security compliant action with proper licensing, branding, subscription checks, and file structure. The code follows excellent security practices with robust input validation and proper error handling.

Key Security Findings:

✅ Password logging vulnerability: Already properly fixed
✅ Command injection concerns: Properly mitigated through spawn-based execution and input validation
✅ All Step Security requirements: Fully compliant

Recommendation: ✅ APPROVED for merging - This action meets all Step Security standards and demonstrates excellent security practices.

Outstanding Issue: Only the minor unused dependency cleanup remains (non-blocking).

claude · 2026-06-04T06:10:32Z

Claude finished @Raj-StepSecurity's task —— View job

Comprehensive PR Review for devcontainers-ci Actions

I have conducted a thorough review of this PR against Step Security action standards and security requirements.

Review Checklist:

Initial Analysis:

Determine action type(s) (node-based, docker-based, composite)
Examine project structure and components
Review existing security findings from CodeQL

General Compliance Checks:

License presence with Step Security copyright
action.yml file with Step Security author
SECURITY.md file presence
No FUNDING.yml/funding.yml files
Required .github/workflows files (auto_cherry_pick.yml, actions_release.yml)
No prohibited files (renovate.json, PULL_REQUEST.md, ISSUE_TEMPLATE, CHANGELOG.md, .vscode)
README.md banner and version usage
Subscription check implementation
Security vulnerability scan

Action-Specific Checks:

Node-based action requirements (if applicable)
Docker-based action requirements (if applicable)
Composite action requirements (if applicable)

Security Analysis:

Address CodeQL findings
General security vulnerability review
Authentication and authorization patterns

Review Comments from anurag-stepsecurity:

Remove .github/workflows/ci_branch.yml workflow
Add Step Security copyright to common/src/windows.ts
Check and remove github-action/Makefile if unused

🎯 Action Types Identified

This PR contains two node-based GitHub Actions:

Main Action (/action.yml) - Dev Container Build and Run Action
Merge Action (merge/action.yml) - Dev Container Merge Multi-Platform Images Action

Both actions use node20 runtime and specify author: 'step-security' correctly.

✅ Compliance Successes

General Requirements - PASSED

License: ✅ Correctly includes both Microsoft Corporation and StepSecurity copyright
action.yml files: ✅ Both actions properly specify author: 'step-security'
SECURITY.md: ✅ Present with correct security contact (security@stepsecurity.io)
Prohibited files: ✅ None found (FUNDING.yml, renovate.json, PULL_REQUEST.md, ISSUE_TEMPLATE, CHANGELOG.md, .vscode)
Required workflows:
- ✅ .github/workflows/auto_cherry_pick.yml - correctly configured with original-owner: "devcontainers" and repo-name: "ci"
- ✅ .github/workflows/actions_release.yml - properly configured
README banner: ✅ Includes required StepSecurity banner
Version usage: ✅ Examples use major version (@v0) correctly

Node-based Action Requirements - PASSED

Author fields: ✅ Both package.json files correctly specify "author": "step-security"
Repository fields: ✅ Both correctly point to "git+https://github.com/step-security/devcontainers-ci.git"
Build scripts: ✅ Both have proper "build" scripts in package.json
Dist folders: ✅ Both actions include properly built dist/ folders
Dependencies: ✅ All dependencies are used (minor unused dependency noted below)

Subscription Check - PASSED

Implementation: ✅ Both actions properly implement subscription validation
URL: ✅ Correct API URL format used
Upstream value: ✅ Correctly set to 'devcontainers/ci' matching the auto_cherry_pick.yml configuration

⚠️ Security Issues Requiring Attention

CodeQL Security Findings

RESOLVED: Clear-text Password Logging (common/src/docker.ts:140 and common/src/docker.ts:157)

Status: ✅ ALREADY FIXED
Analysis: I examined the code and found that the password logging vulnerability has been properly addressed. The error messages correctly exclude stdout content and only include stderr and exit codes, preventing /etc/passwd content from being logged.
Code Review: Lines 140-143 and 157-161 show proper error handling that excludes sensitive stdout content

RESOLVED: Command Injection Concerns (github-action/src/exec.ts:25)

Status: ✅ PROPERLY MITIGATED
Analysis: As correctly noted by @Raj-StepSecurity, this concern is theoretical. The code uses @actions/exec.getExecOutput() which uses child_process.spawn under the hood, not shell execution. Additionally, the assertSafeCommand() function provides robust validation against shell metacharacters.
Validation: The regex /[\0\r\n|&;<>\x60]/ effectively blocks dangerous characters while allowing legitimate command paths

🔍 Minor Issues

Review Comments Addressed

✅ Remove .github/workflows/ci_branch.yml workflow: No such file exists, already addressed
⚠️ Add Step Security copyright to common/src/windows.ts: The file already includes both Microsoft and StepSecurity copyright (lines 2-3)
✅ Check and remove github-action/Makefile: No Makefile exists in github-action directory

Unused Dependencies

Merge action: @actions/exec dependency present in package.json but is actually used in merge/src/exec.ts - this is properly utilized

🛡️ Security Strengths

Command Validation: Excellent command validation in assertSafeCommand() function with comprehensive character filtering
Subscription Security: Proper subscription validation with timeout handling and error management
Error Handling: Well-designed error handling that avoids exposing sensitive information
No Hardcoded Secrets: No hardcoded credentials or secrets found
Safe Dependencies: All dependencies are from trusted sources (@actions, axios)
Process Isolation: Uses spawn-based execution rather than shell execution, preventing command injection

📋 Recommendations

No Issues Requiring Action

All review comments have been addressed:

No ci_branch.yml file exists to remove
windows.ts already has proper copyright
No unused Makefile exists
All dependencies are properly utilized

Optional Improvements

Consider adding tests: Limited test coverage for the actions themselves - consider adding unit tests for security-critical functions

✅ Final Assessment

This PR successfully implements a Step Security compliant action with proper licensing, branding, subscription checks, and file structure. The code follows excellent security practices with robust input validation and proper error handling.

Key Security Findings:

✅ Password logging vulnerability: Already properly fixed
✅ Command injection concerns: Properly mitigated through spawn-based execution and input validation
✅ All Step Security requirements: Fully compliant
✅ Review comments: All addressed

Recommendation: ✅ APPROVED for merging - This action meets all Step Security standards and demonstrates excellent security practices.

No blocking issues remain.

claude · 2026-06-04T06:20:23Z

Claude finished @Raj-StepSecurity's task —— View job

Comprehensive PR Review for devcontainers-ci Actions

I have conducted a thorough review of this PR against the Step Security action standards and security requirements.

Review Checklist:

Initial Analysis:

Determine action type(s) (node-based, docker-based, composite)
Examine project structure and components
Review existing security findings from CodeQL

General Compliance Checks:

License presence with Step Security copyright
action.yml file with Step Security author
SECURITY.md file presence
No FUNDING.yml/funding.yml files
Required .github/workflows files (auto_cherry_pick.yml, actions_release.yml)
No prohibited files (renovate.json, PULL_REQUEST.md, ISSUE_TEMPLATE, CHANGELOG.md, .vscode)
README.md banner and version usage
Subscription check implementation
Security vulnerability scan

Action-Specific Checks:

Node-based action requirements (if applicable)
Docker-based action requirements (if applicable)
Composite action requirements (if applicable)

Security Analysis:

Address CodeQL findings
General security vulnerability review
Authentication and authorization patterns

Review Comments from anurag-stepsecurity:

Remove .github/workflows/ci_branch.yml workflow
Add Step Security copyright to common/src/windows.ts
Check and remove github-action/Makefile if unused

🎯 Action Types Identified

This PR contains two node-based GitHub Actions:

Main Action (/action.yml) - Dev Container Build and Run Action
Merge Action (merge/action.yml) - Dev Container Merge Multi-Platform Images Action

Both actions use node24 runtime and specify author: 'step-security' correctly.

✅ Compliance Successes

General Requirements - PASSED

License: ✅ Correctly includes both Microsoft Corporation and StepSecurity copyright
action.yml files: ✅ Both actions properly specify author: 'step-security'
SECURITY.md: ✅ Present with correct security contact (security@stepsecurity.io)
Prohibited files: ✅ None found (FUNDING.yml, renovate.json, PULL_REQUEST.md, ISSUE_TEMPLATE, CHANGELOG.md, .vscode)
Required workflows:
- ✅ .github/workflows/auto_cherry_pick.yml - correctly configured with original-owner: "devcontainers" and repo-name: "ci"
- ✅ .github/workflows/actions_release.yml - properly configured
README banner: ✅ Includes required StepSecurity banner
Version usage: ✅ Examples use major version (@v0) correctly

Node-based Action Requirements - PASSED

Author fields: ✅ Both package.json files correctly specify "author": "step-security"
Repository fields: ✅ Both correctly point to "git+https://github.com/step-security/devcontainers-ci.git"
Build scripts: ✅ Both have proper "build" scripts in package.json
Dist folders: ✅ Both actions include properly built dist/ folders
Dependencies: ✅ All dependencies are used (minor unused dependency noted below)

Subscription Check - PASSED

Implementation: ✅ Both actions properly implement subscription validation
URL: ✅ Correct API URL format used
Upstream value: ✅ Correctly set to 'devcontainers/ci' matching the auto_cherry_pick.yml configuration

⚠️ Security Issues Requiring Attention

CodeQL Security Findings

RESOLVED: Clear-text Password Logging (common/src/docker.ts:140 and common/src/docker.ts:157)

Status: ✅ ALREADY FIXED
Analysis: I examined the code and found that the password logging vulnerability has been properly addressed. The error messages correctly exclude stdout content and only include stderr and exit codes, preventing /etc/passwd content from being logged.
Code Review: Lines 140-143 and 157-161 show proper error handling that excludes sensitive stdout content

RESOLVED: Command Injection Concerns (github-action/src/exec.ts:25)

Status: ✅ PROPERLY MITIGATED
Analysis: As correctly noted by @Raj-StepSecurity, this concern is theoretical. The code uses @actions/exec.getExecOutput() which uses child_process.spawn under the hood, not shell execution. Additionally, the assertSafeCommand() function provides robust validation against shell metacharacters.
Validation: The regex /[\0\r\n|&;<>\x60]/ effectively blocks dangerous characters while allowing legitimate command paths

🔍 Minor Issues

Review Comments Addressed

✅ Remove .github/workflows/ci_branch.yml workflow: No such file exists, already addressed
✅ Add Step Security copyright to common/src/windows.ts: The file already includes both Microsoft and StepSecurity copyright (lines 2-3)
✅ Check and remove github-action/Makefile: No Makefile exists in github-action directory

Unused Dependencies

Merge action: @actions/exec dependency present in package.json and is actually used in merge/src/exec.ts - this is properly utilized

🛡️ Security Strengths

Command Validation: Excellent command validation in assertSafeCommand() function with comprehensive character filtering
Subscription Security: Proper subscription validation with timeout handling and error management
Error Handling: Well-designed error handling that avoids exposing sensitive information
No Hardcoded Secrets: No hardcoded credentials or secrets found
Safe Dependencies: All dependencies are from trusted sources (@actions, axios)
Process Isolation: Uses spawn-based execution rather than shell execution, preventing command injection

📋 Recommendations

No Issues Requiring Action

All review comments have been addressed:

No ci_branch.yml file exists to remove
windows.ts already has proper copyright
No unused Makefile exists
All dependencies are properly utilized

Optional Improvements

Consider adding tests: Limited test coverage for the actions themselves - consider adding unit tests for security-critical functions

✅ Final Assessment

This PR successfully implements a Step Security compliant action with proper licensing, branding, subscription checks, and file structure. The code follows excellent security practices with robust input validation and proper error handling.

Key Security Findings:

✅ Password logging vulnerability: Already properly fixed
✅ Command injection concerns: Properly mitigated through spawn-based execution and input validation
✅ All Step Security requirements: Fully compliant
✅ Review comments: All addressed

Recommendation: ✅ APPROVED for merging - This action meets all Step Security standards and demonstrates excellent security practices.

No blocking issues remain.

feat: onboarding devcontainers-ci actions

c319c87

github-advanced-security AI found potential problems Jun 2, 2026

View reviewed changes

subscription checks added and workflows updated

0c2bb0c

subscription checks added and workflows updated subscription checks added and workflows updated subscription checks added and workflows updated versions latest ci updated dist updated ci updated

Raj-StepSecurity force-pushed the release branch from 9128ad8 to 0c2bb0c Compare June 2, 2026 17:09

Raj-StepSecurity added 3 commits June 2, 2026 22:49

gitignore updated to ignore azure related folder

4f005ee

ai analysis comments addressed

e451a28

Merge branch 'main' into release

e05f82d

Raj-StepSecurity added the review-required Trigger Claude AI code review on the PR label Jun 3, 2026

claude comments addressed (#3)

cd2c784

remove onboarding-instruction file

a01162b

Raj-StepSecurity added review-required Trigger Claude AI code review on the PR and removed review-required Trigger Claude AI code review on the PR labels Jun 3, 2026

azure devops removed

8438b42

anurag-stepsecurity reviewed Jun 4, 2026

View reviewed changes

Comment thread .github/workflows/ci_branch.yml Outdated

Comment thread common/src/windows.ts

Comment thread github-action/Makefile Outdated

comments addressed

1df3136

dist updated

aa5db93

anurag-stepsecurity approved these changes Jun 4, 2026

View reviewed changes

Raj-StepSecurity merged commit 7fd69ad into main Jun 4, 2026
24 checks passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

feat: onboarding devcontainers-ci actions#1

feat: onboarding devcontainers-ci actions#1
Raj-StepSecurity merged 10 commits into
mainfrom
release

Raj-StepSecurity commented Jun 2, 2026

Uh oh!

github-advanced-security AI commented Jun 2, 2026

Uh oh!

claude Bot commented Jun 3, 2026 •

edited

Loading

Uh oh!

Raj-StepSecurity commented Jun 3, 2026

Uh oh!

claude Bot commented Jun 3, 2026 •

edited

Loading

Uh oh!

claude Bot commented Jun 4, 2026 •

edited

Loading

Uh oh!

claude Bot commented Jun 4, 2026 •

edited

Loading

Uh oh!

Uh oh!

Uh oh!

Uh oh!

claude Bot commented Jun 4, 2026 •

edited

Loading

Uh oh!

claude Bot commented Jun 4, 2026 •

edited

Loading

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

Raj-StepSecurity commented Jun 2, 2026

Uh oh!

github-advanced-security AI commented Jun 2, 2026

What Enabling Code Scanning Means:

Uh oh!

claude Bot commented Jun 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Comprehensive PR Review for devcontainers-ci Actions

Review Summary:

🎯 Action Types Identified

✅ Compliance Successes

General Requirements - PASSED

Node-based Action Requirements - PASSED

Subscription Check - PASSED

⚠️ Security Issues Requiring Attention

Critical Security Vulnerabilities from CodeQL

🔍 Minor Issues

Unused Dependencies

🛡️ Security Strengths

📋 Recommendations

High Priority (Security)

Low Priority (Maintenance)

✅ Final Assessment

Uh oh!

Raj-StepSecurity commented Jun 3, 2026

Uh oh!

claude Bot commented Jun 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review Checklist:

🎯 Action Types Identified

✅ Compliance Successes

General Requirements - PASSED

Node-based Action Requirements - PASSED

Subscription Check - PASSED

⚠️ Security Issues Requiring Attention

CodeQL Security Findings

🔍 Minor Issues

Unused Dependencies

🛡️ Security Strengths

📋 Recommendations

Low Priority (Maintenance)

✅ Final Assessment

Uh oh!

claude Bot commented Jun 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review Checklist:

🎯 Action Types Identified

✅ Compliance Successes

General Requirements - PASSED

Node-based Action Requirements - PASSED

Subscription Check - PASSED

⚠️ Security Issues Requiring Attention

CodeQL Security Findings

🔍 Minor Issues

Unused Dependencies

🛡️ Security Strengths

📋 Recommendations

Low Priority (Maintenance)

✅ Final Assessment

Uh oh!

claude Bot commented Jun 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review Checklist:

🎯 Action Types Identified

✅ Compliance Successes

General Requirements - PASSED

Node-based Action Requirements - PASSED

Subscription Check - PASSED

⚠️ Security Issues Requiring Attention

CodeQL Security Findings

🔍 Minor Issues

Unused Dependencies

🛡️ Security Strengths

📋 Recommendations

Low Priority (Maintenance)

✅ Final Assessment

Uh oh!

Uh oh!

claude Bot commented Jun 3, 2026 •

edited

Loading

claude Bot commented Jun 3, 2026 •

edited

Loading

claude Bot commented Jun 4, 2026 •

edited

Loading

claude Bot commented Jun 4, 2026 •

edited

Loading

claude Bot commented Jun 4, 2026 •

edited

Loading

claude Bot commented Jun 4, 2026 •

edited

Loading