[Raj-StepSecurity]

https://github.com/hashicorp-contrib/setup-packer/tree/v3.0.1

[Copilot]

🟡 Changes recommended

Missing archive checksum verification, absent subscription validation in the shipped bundle, CI-blocking lockfile mismatches, and unsafe release tagging leave critical security and release-integrity issues unresolved.

6 open issues

• Reformat the remaining tab-indented source · New
• Regenerate and commit the bundle with subscription validation · New
• Verify archive checksums before extraction · New
• Run the build script and fail on errors · New
• Remove the stale npm lockfile or update audit selection · New
• Restore the ia32 architecture mapping · New

What changed in this PR

This PR prepares the Packer setup action for v3.0.1, migrating build tooling to Yarn and ncc and updating release and dependency-audit automation.

Changes:

• Switches package tooling, dependency versions, TypeScript presets, and formatting configuration.
• Changes installer validation and architecture handling.
• Adds release tagging and version-specific audit automation, and updates usage documentation.

File	Description
yarn.lock	Adds Yarn dependency resolutions.
tsconfig.json	Switches to the Node 20 preset.
src/​installer.ts	Changes architecture mapping and removes version and checksum validation.
src/​index.ts	Reformats the entry point and removes the void prefix.
scripts/​release.sh	Adds release-tag creation and publishing.
README.md	Updates v3 examples and version-selection guidance.
package.json	Sets v3.0.1 and adopts Yarn and ncc.
dist/​LICENSE.txt	Updates bundled dependency notices.
biome.json	Adopts Biome 1 configuration and space indentation.
.yarnrc.yml	Selects the node-modules linker.
.pre-commit-config.yaml	Removes pre-commit hooks.
.gitignore	Adds Yarn exclusions and removes the IDE exclusion.
.github/​workflows/​main.yml	Migrates checks to Yarn and adds Renovate bundle commits.
.github/​workflows/​dependency-review.yml	Updates action pins, permissions, and workflow steps.
.github/​workflows/​audit_package.yml	Adds Yarn and build-script inputs.
.github/​workflows/​audit_package_v3.0.1.yml	Adds audits targeting the v3.0.1 maintenance branch.
.github/​workflows/​actions_release.yml	Adds Yarn release-build inputs.
.github/​dependabot.yml	Removes scheduled Dependabot updates.

_{Review effort: Balanced}

[Copilot]

🟡 Changes recommended

Missing version validation permits deletion or overwriting outside the tool cache, while removed checksum verification allows unverified executables to be installed and cached.

6 open issues

• Validate versions before using them in URLs or cache paths · New
• Regenerate and commit the bundle with subscription validation
• Reformat the remaining tab-indented source
• Update the audit workflow to use Yarn · New
• Commit and validate rebuilt distribution files · New
• Remove the stale npm lockfile or update audit selection

3 resolved since last review

• Verify archive checksums before extraction
• Restore the ia32 architecture mapping
• Run the build script and fail on errors

_{Review effort: Balanced}

[Copilot]

🔵 Needs a closer look

Unresolved blockers leave Renovate build output uncommitted, the legacy npm audit failing after lockfile removal, and existing code violating the re-enabled useLiteralKeys lint rule.

5 open issues

• Regenerate and commit the bundle with subscription validation
• Reformat the remaining tab-indented source
• Commit and validate rebuilt distribution files
• Update the audit workflow to use Yarn
• Remove the stale npm lockfile or update audit selection

1 previously missed issue

In code that hasn't changed since last review

Restore the useLiteralKeys override to avoid lint errors

biome.json:13

Removing the useLiteralKeys override re-enables that recommended rule, but src/subscription.ts still contains accesses such as process.env["GITHUB_EVENT_PATH"] and body["ghes_server"]. These now produce lint errors in the Hygiene job's yarn lint step. Restore the override so the existing indexed-access syntax remains accepted.

1 resolved since last review

• Validate versions before using them in URLs or cache paths

_{Review effort: Balanced}

[Copilot]

🔵 Needs a closer look

The original scheduled audit still defaults to npm and runs npm ci, which will fail after package-lock.json is deleted, so it must be migrated to Yarn or removed.

5 open issues

• Regenerate and commit the bundle with subscription validation
• Reformat the remaining tab-indented source
• Commit and validate rebuilt distribution files
• Update the audit workflow to use Yarn
• Remove the stale npm lockfile or update audit selection

_{Review effort: Balanced}

[Copilot]

🟡 Changes recommended

The ESM bundle lacks a require bridge and crashes before run(), while the unchanged npm audit workflow will fail because package-lock.json is deleted.

6 open issues

• Add a require bridge for Node built-ins in the ESM bundle · New
• Regenerate and commit the bundle with subscription validation
• Reformat the remaining tab-indented source
• Commit and validate rebuilt distribution files
• Update the audit workflow to use Yarn
• Remove the stale npm lockfile or update audit selection

_{Review effort: Balanced}

[Copilot]

🔵 Needs a closer look

The ESM declaration breaks every invocation of the CommonJS action bundle, while the retained npm audit workflow will fail after package-lock.json is removed.

4 open issues

• Regenerate and commit the bundle with subscription validation
• Reformat the remaining tab-indented source
• Update the audit workflow to use Yarn
• Remove the stale npm lockfile or update audit selection

2 resolved since last review

• Add a require bridge for Node built-ins in the ESM bundle
• Commit and validate rebuilt distribution files

_{Review effort: Balanced}

[Copilot]

🟡 Changes recommended

The cleanup removes required third-party license notices without restoring them, and the existing scheduled npm audit will fail because package-lock.json is deleted.

6 open issues

• Regenerate and commit the bundle with subscription validation
• Reformat the remaining tab-indented source
• Restore third-party license notices after cleaning dist · New
• Update the audit workflow to use Yarn
• Remove the stale npm lockfile or update audit selection
• Pin the action using its full 40-character commit SHA · New

_{Review effort: Balanced}

[github-actions]

PR Review

Action Type

Node-based action — uses node24 runtime (defined in action.yml) with dist/index.js as the entry point.

---

✅ Passed Checks

• License: LICENSE file is present and includes copyright for both the original author (Sora Morimoto) and StepSecurity.
• action.yml author: author: 'step-security' is correctly set.
• SECURITY.md: Present with a valid vulnerability reporting address.
• No FUNDING.yml: Not present in the repository.
• No renovate.json: Not present.
• No PULL_REQUEST.md: Not present.
• No ISSUE_TEMPLATE folder: Not present.
• No CHANGELOG.md: Not present.
• No .vscode folder: Not present.
• README banner: The StepSecurity Maintained Action banner is correctly included at the top of README.md.
• README version examples: All usage examples correctly reference the major version (@v3) rather than a full semver tag.
• Subscription check URL: src/subscription.ts correctly calls https://agent.api.stepsecurity.io/v1/github/$GITHUB_REPOSITORY/actions/maintained-actions-subscription.
• Subscription upstream value: Set to hashicorp-contrib/setup-packer, which matches the original project owner/repo.
• package.json author: "author": "step-security" is correctly set.
• No repository field in package.json: Field absent — no check required.
• dist folder: Present and updated.
• actions_release.yml: Present and now includes script and yarn_version inputs to support the new yarn-based build.
• All declared dependencies appear used: @actions/core, @actions/github, @actions/io, @actions/tool-cache, and axios are all referenced in the source.

---

❌ Failed Checks

• Missing auto_cherry_pick.yml: The .github/workflows/ folder is required to contain auto_cherry_pick.yml, but no such file exists in this branch. This file must be added.

• audit_package.yml not updated for yarn: The package manager has been switched from npm to yarn in this PR, but the existing .github/workflows/audit_package.yml does not pass script, package_manager, or yarn_version inputs to the reusable audit_fix.yml. The new audit_package_v3.0.1.yml correctly includes these inputs, but the old file is left broken. Either update audit_package.yml to match or remove it if it is superseded.

• harden-runner removed from main.yml: Both the hygiene and test jobs previously used step-security/harden-runner@v2 with egress-policy: audit. This PR removes those steps entirely, eliminating runtime egress monitoring from the CI pipeline. The harden-runner should be restored, especially for a StepSecurity-maintained action.

---

⚠️ Warnings

• README version text inconsistency (line 64): The prose says "it's safe to use the major version (v2) in your workflow" but every example in the README uses @v3. This should be corrected to v3. (Inline comment posted.)

• Unpinned third-party actions in main.yml: actions/checkout@v7 and actions/setup-node@v7 were previously pinned to full SHAs (actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1, actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1). This PR removes those pins. SHA-pinning should be restored. (Inline comments posted.)

• Duplicate audit workflow files: Both audit_package.yml and audit_package_v3.0.1.yml exist. Keeping two overlapping scheduled audit workflows will result in redundant weekly runs. Decide which one to keep and remove the other.

• dist/LICENSE.txt removed: The bundled third-party license file was deleted. Some bundled dependencies (Apache-2.0, MIT, ISC) may require their license text to be distributed alongside the bundle. Verify this is intentional.

• process.exit(1) in subscription check (src/subscription.ts:46): Using process.exit bypasses GitHub Actions post steps and Node.js cleanup hooks. Replacing it with core.setFailed(message); return; is the idiomatic Actions pattern. (Inline comment posted.)

• void run() changed to run(): Dropping void means an unhandled rejection from the top-level async call is no longer explicitly suppressed. Since the function has an internal try/catch, this is benign, but it is a subtle behaviour change.

---

🔒 Security Findings

1. Removal of harden-runner from CI — the CI pipeline no longer monitors outbound network calls. This is a regression for a StepSecurity-maintained action where security tooling is expected to be present in its own CI.

2. Unpinned actions in main.yml — actions/checkout@v7 and actions/setup-node@v7 without SHA pins are vulnerable to silent tag reassignment (supply chain attack). The previous version was SHA-pinned; this PR reverses that hardening.

3. process.exit(1) can bypass post-run cleanup — if the subscription API returns 403, the process is killed immediately without running any registered cleanup steps, which could leave the runner in a dirty state.

---

Summary

The core action logic and subscription check are correct, but this PR introduces several regressions: the required auto_cherry_pick.yml workflow is absent, the existing audit_package.yml is not updated for the new yarn package manager, and the CI pipeline loses its harden-runner coverage and SHA-pinned action references. These issues should be resolved before merging.

[Copilot]

🟡 Changes recommended

The build removes third-party license notices without regenerating them, and the legacy scheduled audit still runs npm ci despite package-lock.json being deleted.

8 open issues

• Regenerate and commit the bundle with subscription validation
• Reformat the remaining tab-indented source
• Migrate or remove the legacy npm audit workflow · New
• Restore third-party license notices in dist · New
• Restore third-party license notices after cleaning dist
• Update the audit workflow to use Yarn
• Remove the stale npm lockfile or update audit selection
• Pin the action using its full 40-character commit SHA

_{Review effort: Balanced}

[github-actions]

PR Review

Action Type

Node-based action — runs on node24, entry point dist/index.js.

---

Passed Checks

• License: LICENSE file present with copyright of both original author (Sora Morimoto) and StepSecurity.
• action.yml: Present with author: 'step-security'.
• SECURITY.md: Present.
• FUNDING.yml: Not present (correct).
• actions_release.yml: Present in .github/workflows/.
• renovate.json: Not present (correct).
• PULL_REQUEST.md: Not present (correct).
• ISSUE_TEMPLATE folder: Not present (correct).
• CHANGELOG.md: Not present (correct).
• .vscode folder: Not present (correct).
• README banner: StepSecurity Maintained Action banner is present at the top of README.md.
• README version usage: Usage examples correctly use only major version (@v3), not full semver.
• Subscription check URL: Correct — calls https://agent.api.stepsecurity.io/v1/github/$GITHUB_REPOSITORY/actions/maintained-actions-subscription.
• Subscription upstream value: hashicorp-contrib/setup-packer matches the upstream referenced in the PR description.
• package.json author: "author": "step-security".
• dist folder: Present with dist/index.js.
• package.json build script: "build" script present.
• Dependencies: All declared dependencies (@actions/core, @actions/github, @actions/io, @actions/tool-cache, axios) are actively used in source code.

---

Failed Checks

• Missing auto_cherry_pick.yml: The file .github/workflows/auto_cherry_pick.yml is not present in the repository. This is a required workflow per the onboarding checklist. It is also needed to cross-verify that the upstream value in src/subscription.ts (hashicorp-contrib/setup-packer) matches the original-owner/repo-name fields defined in that file.

• harden-runner removed from main.yml: The PR removes step-security/harden-runner@v2 from both jobs in .github/workflows/main.yml. This is a security regression — it eliminates egress auditing from the CI pipeline. As a StepSecurity-maintained action, CI workflows should use harden-runner to demonstrate the product's own capabilities.

• Unpinned action references in main.yml: The PR replaces previously-pinned SHA-based action refs (e.g., actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1) with floating major-version tags (actions/checkout@v7, actions/setup-node@v7). Floating tags can be silently redirected and represent a supply-chain risk in CI.

---

Warnings

• permissions: placement in audit_package_v3.0.1.yml: The top-level permissions: block is placed after the jobs: block. While YAML is unordered and GitHub Actions parses it correctly, it should be moved above jobs: for readability and consistency.

• dist/LICENSE.txt removed: The bundled third-party license file has been deleted from dist/. This file documents licenses of all bundled npm dependencies; removing it may create legal compliance issues for licenses that require notice preservation.

• README example inconsistency: The README Example workflow uses actions/checkout@v4, while .github/workflows/main.yml uses actions/checkout@v7. These should be consistent.

• Mixed package manager signals: The PR adds .yarnrc.yml (setting nodeLinker: node-modules) while package-lock.json (npm) remains the primary lock file, which may cause confusion.

• Loose devDependency version ranges: The previous version used exact pinned versions for devDependencies; this PR switches to caret ranges (e.g., "^1.9.4"). While package-lock.json mitigates this for npm ci, exact pinning is more predictable.

---

Security Findings

1. harden-runner removed (medium severity): Both CI jobs in main.yml no longer use step-security/harden-runner, removing outbound network call auditing. This is especially concerning for a StepSecurity-maintained action that should model best practices.

2. Floating CI action tags (medium severity): actions/checkout@v7 and actions/setup-node@v7 are mutable references. If re-pointed via a supply-chain attack, CI could execute malicious code with repository write permissions. These should be pinned to full commit SHAs.

3. Unvalidated JSON.parse on GitHub event file (low / acceptable risk): src/subscription.ts reads and parses GITHUB_EVENT_PATH without schema validation. Risk is low since this file is controlled by the GitHub Actions runtime, but defensive validation would improve robustness.

---

Summary

The core action logic is correctly ported from the upstream v3.0.1 release and the subscription check is properly implemented, but the PR must add auto_cherry_pick.yml, restore harden-runner in main.yml, and re-pin CI action references to commit SHAs before it is ready to merge.

[github-actions]

Security: harden-runner removed and action unpinned.

The previous version of this step was pinned to a full commit SHA:

uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

and was preceded by step-security/harden-runner@v2 for egress auditing.

Two issues here:

1. harden-runner should be restored as the first step in every job — it audits outbound calls and is the flagship feature of StepSecurity. Removing it from a StepSecurity-maintained repo sends the wrong signal.
2. Floating major-version tags like @v7 are mutable and can be re-pointed to malicious commits. Pin to a full SHA:

Suggested change

	uses: actions/checkout@v7
	uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

[github-actions]

Warning: permissions block placed after jobs.

Top-level permissions should appear before jobs: for readability and consistency with the rest of the workflows in this repo. While GitHub Actions parses YAML as an unordered dictionary (so this works), the convention is to place it near the top of the file alongside on: and name:.