[Raj-StepSecurity]

bazel-contrib/setup-bazel@0.19.0...0.19.1

[Raj-StepSecurity]

📦 Target Release Version: 0.19.1
📋 Previous Release Version: 0.19.0

[github-actions]

🔍 Cherry-Pick Verification Report

📦 Upstream Changes: 0.19.0...0.19.1

📋 File-by-File Analysis:

.github/workflows/ci.yml

• Upstream has changes: ✅ Yes
• File exists in PR: ❌ No
• Status: 🔴 Missing - ❌ No PR patch available (+1 -1)

.github/workflows/release.yml

• Upstream has changes: ✅ Yes
• File exists in PR: ❌ No
• Status: 🔴 Missing - File missing in PR (upstream has 2 additions, 2 deletions)

.tool-versions

• Upstream has changes: ✅ Yes
• File exists in PR: ✅ Yes
• Changes match: ❌ No
• Status: 🟡 Partial - ❌ Cherry-pick incomplete (+1 -1) | Missing 1 deletions

README.md

• Upstream has changes: ✅ Yes
• File exists in PR: ❌ No
• Status: 🔴 Missing - ❌ No PR patch available (+16 -16)

action.yml

• Upstream has changes: ✅ Yes
• File exists in PR: ✅ Yes
• Changes match: ❌ No
• Status: 🟡 Partial - ❌ Cherry-pick incomplete (+4 -0) | Missing 4 additions

config.js

• Upstream has changes: ✅ Yes
• File exists in PR: ❌ No
• Status: 🔴 Missing - ❌ No PR patch available (+3 -0)

index.js

• Upstream has changes: ✅ Yes
• File exists in PR: ❌ No
• Status: 🔴 Missing - ❌ No PR patch available (+19 -3)

---

📊 Summary:

• Total files changed upstream: 7
• Files present in PR: 2/7
• Files with matching changes: 0/7

❌ Overall Status: 🔴 INCOMPLETE - Missing files or changes

[Raj-StepSecurity]

Sync verification

Warning

1 item needs review: 1 unresolved conflict.

Upstream	Versions	Files	dist/ reproducible	config.json
bazel-contrib/setup-bazel	0.19.0 → 0.19.1 · compare	7	✅	✅

Review these

• ❌ .tool-versions: unresolved conflict

✅ 2 files: StepSecurity-specific changes only

• action.yml
• package.json

✅ 3 files: build output or lockfiles, rebuilt from source

• dist/main/sourcemap-register.js
• dist/post/sourcemap-register.js
• package-lock.json

✅ 1 file: checked field by field

• config.json

❌ 1 file: unresolved conflicts

• .tool-versions

✅ config.json checks

Check	Result
config.json is valid	✅
upstream.repository	✅
upstream.synced_tag is an upstream release	✅
upstream.synced_commit matches the tag	✅
upstream.synced_tag is the newest release	✅
upstream.archived	✅
onboarding_type	✅
action_type	✅

✅ Build checks

Check	Result
dist/ is a reproducible build of the PR	✅

✅ Integrity checks

Check	Result
every action's type is supported	✅
actions are node24 with their entrypoints built	✅
the subscription check is called	✅
every lockfile has its package.json	✅
our workflows are unchanged	✅
removed upstream files stay removed	✅
files upstream deleted are gone	✅
no workflow gains write permissions	✅
the PR description is the upstream compare link	✅

[github-actions]

PR Review

Action Type

Node-based action — uses node24 runtime as declared in action.yml, compiled via @vercel/ncc into dist/.

---

✅ Passed Checks

• License: LICENSE is present with copyright for both the original author (Alex Rodionov) and StepSecurity.
• action.yml: Present and now includes author: step-security (added by this PR).
• SECURITY.md: Present at the repo root.
• No FUNDING.yml: Not present.
• No renovate.json: Not present.
• No PULL_REQUEST.md: Not present.
• No ISSUE_TEMPLATE folder: Not present.
• No CHANGELOG.md: Not present.
• No .vscode folder: Not present.
• Workflow files: Both auto_cherry_pick.yml and actions_release.yml are present under .github/workflows/.
• README banner: StepSecurity Maintained Action banner is correctly present at the top of README.md.
• README semver usage: All usage examples correctly use @v0 (major version only, not full semver).
• Subscription check present: validateSubscription() is implemented in index.js and calls the correct URL: https://agent.api.stepsecurity.io/v1/github/${process.env.GITHUB_REPOSITORY}/actions/maintained-actions-subscription.
• Upstream variable: upstream = 'bazel-contrib/setup-bazel' correctly matches original-owner: "bazel-contrib" and repo-name: "setup-bazel" from auto_cherry_pick.yml.
• package.json author: "author": "step-security" is set.
• package.json repository: URL contains step-security.
• dist/ folder: Present with compiled index.js for both main and post entrypoints.
• Build script: "build" script is present in package.json.
• Dependencies: All declared dependencies (axios, @actions/cache, @actions/core, @actions/github, @actions/glob, @actions/tool-cache, yaml) are actively used in the source files.

---

❌ Failed Checks

• Unresolved merge conflict in .tool-versions: The file contains raw Git conflict markers (<<<<<<<, =======, >>>>>>>). This is a blocking issue — the PR cannot be merged until the conflict is resolved. The file should contain only nodejs 24.21.0 (the upstream 0.19.1 version). See inline comment for a suggested fix.

---

⚠️ Warnings

• sourcemap-register.js → sourcemap-register.cjs rename: The PR deletes dist/main/sourcemap-register.js and dist/post/sourcemap-register.js. The new .cjs variants (sourcemap-register.cjs) are present in the dist output. This is likely an upstream build tooling change and appears correct, but worth confirming the build was regenerated cleanly from the 0.19.1 source.
• Token exported as environment variable: In config.js (line 139), core.exportVariable('BAZELISK_GITHUB_TOKEN', token) exports the GitHub token to all subsequent workflow steps. This is necessary for Bazelisk to authenticate, but it broadens the token's exposure surface — worth noting if consumers are security-sensitive.

---

🔒 Security Findings

• Checksum mismatch is non-fatal (index.js, verifyChecksum function): When a Bazelisk binary checksum doesn't match the expected SHA256, the code calls core.warning() but continues execution. A checksum mismatch on a downloaded binary is a strong signal of tampering or corruption and should fail the action with core.setFailed() / throw rather than just warn. This is a pre-existing issue (not introduced by this PR) but worth flagging.

---

Summary

This PR syncs with upstream bazel-contrib/setup-bazel@0.19.1 and correctly adds the StepSecurity author field to action.yml. However, it must not be merged in its current state due to an unresolved Git merge conflict in .tool-versions. Resolve the conflict to nodejs 24.21.0 and the PR will be ready.

[github-actions]

🔍 Cherry-Pick Verification Report

📦 Upstream Changes: 0.19.0...0.19.1

📋 File-by-File Analysis:

.github/workflows/ci.yml

• Upstream has changes: ✅ Yes
• File exists in PR: ❌ No
• Status: 🔴 Missing - ❌ No PR patch available (+1 -1)

.github/workflows/release.yml

• Upstream has changes: ✅ Yes
• File exists in PR: ❌ No
• Status: 🔴 Missing - File missing in PR (upstream has 2 additions, 2 deletions)

.tool-versions

• Upstream has changes: ✅ Yes
• File exists in PR: ✅ Yes
• Changes match: ❌ No
• Status: 🟡 Partial - ❌ Cherry-pick incomplete (+1 -1) | Missing 1 deletions

README.md

• Upstream has changes: ✅ Yes
• File exists in PR: ❌ No
• Status: 🔴 Missing - ❌ No PR patch available (+16 -16)

action.yml

• Upstream has changes: ✅ Yes
• File exists in PR: ✅ Yes
• Changes match: ❌ No
• Status: 🟡 Partial - ❌ Cherry-pick incomplete (+4 -0) | Missing 4 additions

config.js

• Upstream has changes: ✅ Yes
• File exists in PR: ❌ No
• Status: 🔴 Missing - ❌ No PR patch available (+3 -0)

index.js

• Upstream has changes: ✅ Yes
• File exists in PR: ❌ No
• Status: 🔴 Missing - ❌ No PR patch available (+19 -3)

---

📊 Summary:

• Total files changed upstream: 7
• Files present in PR: 2/7
• Files with matching changes: 0/7

❌ Overall Status: 🔴 INCOMPLETE - Missing files or changes

[github-actions]

PR Review

Action Type

Node-based action — uses the node24 runtime (runs.using: node24) with bundled entry points at dist/main/index.js and dist/post/index.js.

---

✅ Passed Checks

• License: MIT license present with copyright for both the original author (Alex Rodionov) and StepSecurity.
• action.yml author: author: step-security field added in this PR ✅
• SECURITY.md: Present with contact security@stepsecurity.io ✅
• FUNDING.yml: Not present ✅
• Required workflows: .github/workflows/auto_cherry_pick.yml and .github/workflows/actions_release.yml both present ✅
• renovate.json: Not present ✅
• PULL_REQUEST.md: Not present ✅
• ISSUE_TEMPLATE folder: Not present ✅
• CHANGELOG.md: Not present ✅
• .vscode folder: Not present ✅
• README version tags: All examples use major-only tag step-security/setup-bazel@v0 — no full semver pinning ✅
• README banner: StepSecurity maintained-action banner present at the top of README.md ✅
• Subscription check URL: Correctly calls https://agent.api.stepsecurity.io/v1/github/${GITHUB_REPOSITORY}/actions/maintained-actions-subscription ✅
• Upstream variable: const upstream = 'bazel-contrib/setup-bazel' correctly matches original-owner: "bazel-contrib" + repo-name: "setup-bazel" from auto_cherry_pick.yml ✅
• package.json author: Set to step-security ✅
• package.json repository URL: Contains step-security ✅
• Unused dependencies: All declared dependencies (axios, yaml, @actions/cache, @actions/core, @actions/github, @actions/glob, @actions/tool-cache) are actively used across index.js, config.js, and post.js ✅
• dist folder: Present with dist/main/ and dist/post/ ✅
• Build script: "build" script present in package.json ✅

---

❌ Failed Checks

None — all required checks passed.

---

⚠️ Warnings

• Non-fatal checksum mismatch (index.js:92): verifyChecksum() emits only core.warning() when the SHA-256 of the downloaded Bazelisk binary does not match the expected hash. A mismatched checksum on an executable binary is a critical integrity failure and should call core.setFailed() (or throw) to halt execution. This is a pre-existing issue, not introduced by this PR, but worth addressing.
• Silent skip when checksum file is absent (index.js:143-145): If the .sha256 asset is not found for a Bazelisk release, the action silently proceeds without any integrity check. Combined with the above, binary integrity is never enforced. Pre-existing issue.
• audit_fix.yml absent: Only audit_package.yml is present in .github/workflows/. However, since package.json contains the "build" script field AND the package manager is npm, the conditional check for this file does not apply here.

---

🔒 Security Findings

1. Non-fatal binary checksum verification (index.js:88-94): When the SHA-256 checksum of the downloaded Bazelisk binary does not match the expected value, the action logs a warning and continues, allowing a potentially tampered or corrupted binary to be cached and executed. This should be a hard failure.

2. Checksum verification can be bypassed entirely (index.js:143-145): If the .sha256 checksum asset is missing from the GitHub release (e.g., for an older or malformed release), the download proceeds with no integrity check. An attacker who can influence release assets could exploit this gap.

Both findings are pre-existing in the upstream-derived code and not introduced by this PR, but they represent meaningful supply-chain risk in a setup action that installs binaries.

---

Summary

This PR correctly syncs with upstream v0.19.1, adds the required author: step-security field to action.yml, introduces the config.json tracking file, bumps Node.js to 24.21.0, and updates package.json with step-security metadata. All required compliance checks pass. The two pre-existing security findings around non-fatal checksum verification should be tracked for remediation in a follow-up.

[github-actions]

🔍 Cherry-Pick Verification Report

📦 Upstream Changes: 0.19.0...0.19.1

📋 File-by-File Analysis:

.github/workflows/ci.yml

• Upstream has changes: ✅ Yes
• File exists in PR: ❌ No
• Status: 🔴 Missing - ❌ No PR patch available (+1 -1)

.github/workflows/release.yml

• Upstream has changes: ✅ Yes
• File exists in PR: ❌ No
• Status: 🔴 Missing - File missing in PR (upstream has 2 additions, 2 deletions)

.tool-versions

• Upstream has changes: ✅ Yes
• File exists in PR: ✅ Yes
• Changes match: ❌ No
• Status: 🟡 Partial - ❌ Cherry-pick incomplete (+1 -1) | Missing 1 additions | Missing 1 deletions

README.md

• Upstream has changes: ✅ Yes
• File exists in PR: ❌ No
• Status: 🔴 Missing - ❌ No PR patch available (+16 -16)

action.yml

• Upstream has changes: ✅ Yes
• File exists in PR: ✅ Yes
• Changes match: ❌ No
• Status: 🟡 Partial - ❌ Cherry-pick incomplete (+4 -0) | Missing 4 additions

config.js

• Upstream has changes: ✅ Yes
• File exists in PR: ❌ No
• Status: 🔴 Missing - ❌ No PR patch available (+3 -0)

index.js

• Upstream has changes: ✅ Yes
• File exists in PR: ❌ No
• Status: 🔴 Missing - ❌ No PR patch available (+19 -3)

---

📊 Summary:

• Total files changed upstream: 7
• Files present in PR: 2/7
• Files with matching changes: 0/7

❌ Overall Status: 🔴 INCOMPLETE - Missing files or changes

[github-actions]

🔍 Cherry-Pick Verification Report

📦 Upstream Changes: 0.19.0...0.19.1

📋 File-by-File Analysis:

.github/workflows/ci.yml

• Upstream has changes: ✅ Yes
• File exists in PR: ❌ No
• Status: 🔴 Missing - ❌ No PR patch available (+1 -1)

.github/workflows/release.yml

• Upstream has changes: ✅ Yes
• File exists in PR: ❌ No
• Status: 🔴 Missing - File missing in PR (upstream has 2 additions, 2 deletions)

.tool-versions

• Upstream has changes: ✅ Yes
• File exists in PR: ✅ Yes
• Changes match: ❌ No
• Status: 🟡 Partial - ❌ Cherry-pick incomplete (+1 -1) | Missing 1 additions | Missing 1 deletions

README.md

• Upstream has changes: ✅ Yes
• File exists in PR: ❌ No
• Status: 🔴 Missing - ❌ No PR patch available (+16 -16)

action.yml

• Upstream has changes: ✅ Yes
• File exists in PR: ✅ Yes
• Changes match: ❌ No
• Status: 🟡 Partial - ❌ Cherry-pick incomplete (+4 -0) | Missing 4 additions

config.js

• Upstream has changes: ✅ Yes
• File exists in PR: ❌ No
• Status: 🔴 Missing - ❌ No PR patch available (+3 -0)

index.js

• Upstream has changes: ✅ Yes
• File exists in PR: ❌ No
• Status: 🔴 Missing - ❌ No PR patch available (+19 -3)

---

📊 Summary:

• Total files changed upstream: 7
• Files present in PR: 2/7
• Files with matching changes: 0/7

❌ Overall Status: 🔴 INCOMPLETE - Missing files or changes

[github-actions]

PR Review

Action Type

Node-based action (runs on node24, builds with @vercel/ncc)

---

✅ Passed Checks

• License: LICENSE file present with copyright for both the original author (Alex Rodionov, 2023) and StepSecurity (2026)
• action.yml author: author: step-security present (added in this PR)
• SECURITY.md: Present with StepSecurity contact
• No FUNDING.yml: Not present
• auto_cherry_pick.yml: Present in .github/workflows/
• actions_release.yml: Present in .github/workflows/
• No renovate.json: Not present
• No PULL_REQUEST.md: Not present
• No ISSUE_TEMPLATE folder: Not present
• No CHANGELOG.md: Not present
• No .vscode folder: Not present
• README.md version tags: All usage examples correctly use @v0 (major version only, no full semver)
• README.md StepSecurity banner: Banner image and link present at the top
• Subscription check URL: Correct — calls https://agent.api.stepsecurity.io/v1/github/${GITHUB_REPOSITORY}/actions/maintained-actions-subscription
• Upstream variable: upstream = 'bazel-contrib/setup-bazel' in index.js matches original-owner: "bazel-contrib" + repo-name: "setup-bazel" in auto_cherry_pick.yml
• package.json author: "author": "step-security" ✓
• package.json repository: URL contains step-security ✓
• dist/ folder: Present (dist/main/index.js, dist/post/index.js)
• build script: Present in package.json scripts
• All dependencies used: axios, @actions/cache, @actions/core, @actions/github, @actions/glob, @actions/tool-cache, yaml — all referenced in source files

---

❌ Failed Checks

None.

---

⚠️ Warnings

• package.json private: true: Added in this PR. Correct to prevent accidental publishing, but confirm it does not conflict with any internal release tooling.
• axios bumped from ^1.18.0 → ^1.20.0: Upstream bump; confirm no breaking changes in this range affect the subscription check's POST call.
• Node.js bump: .tool-versions updated from 24.16.0 → 24.22.0. Minor version bump, low risk.
• dist/main/sourcemap-register.js and dist/post/sourcemap-register.js removed: These were single-line minified sourcemap support files. Removal is fine if sourcemaps are no longer needed; verify ncc build still produces correct output without them.

---

🔒 Security Findings

• google-credentials not masked in logs (config.js, lines 80–87): The value of the google-credentials input is written to key.json on disk, but core.setSecret(googleCredentials) is never called. If any subsequent step echoes this value (e.g., via debug logging or shell expansion), it will appear unmasked in workflow logs. This is a pre-existing issue not introduced by this PR, but should be addressed by adding core.setSecret(googleCredentials) immediately after reading the input.
• BAZELISK_GITHUB_TOKEN exported as env var (config.js, last section): core.exportVariable('BAZELISK_GITHUB_TOKEN', token) makes the GitHub token available to all subsequent steps in the workflow. This is intentional for Bazelisk but widens the token's exposure surface. Pre-existing; no action required for this PR.

---

Summary

This PR is a clean upstream sync (0.19.0 → 0.19.1) that also adds StepSecurity-required fields (author in action.yml, scoped name/repository/publisher in package.json, and the new config.json tracking file). All compliance checks pass; the only noteworthy item is a pre-existing security gap where core.setSecret() is not called for the google-credentials input.

[github-actions]

PR Review

Action Type

Node-based action (runs on node24 runtime, compiled dist/ output via @vercel/ncc).

---

Passed Checks

• License: MIT with dual copyright -- Alex Rodionov (2023) and StepSecurity (2026).
• action.yml author: author: step-security added in this PR.
• SECURITY.md: Present at repo root.
• No FUNDING.yml: Not present.
• Required workflows: auto_cherry_pick.yml and actions_release.yml both in .github/workflows/.
• No renovate.json: Not present.
• No PULL_REQUEST.md: Not present.
• No ISSUE_TEMPLATE folder: Not present.
• No CHANGELOG.md: Not present.
• No .vscode folder: Not present.
• README semver tagging: All examples use major version only (@v0).
• README banner: StepSecurity maintained action banner present.
• Subscription check URL: validateSubscription() correctly calls the maintained-actions-subscription endpoint.
• Upstream variable: upstream = 'bazel-contrib/setup-bazel' matches original-owner + repo-name in auto_cherry_pick.yml.
• package.json author: "author": "step-security" present.
• package.json repository: URL points to step-security/setup-bazel.
• dist folder: dist/main/index.js and dist/post/index.js present.
• Build script: package.json has a build npm script.

---

Failed Checks

None.

---

Warnings

• Sourcemap files removed: dist/main/sourcemap-register.js and dist/post/sourcemap-register.js deleted. Upstream change (0.19.0 to 0.19.1) that reduces runtime debuggability of the dist bundle.
• Node.js version bump: .tool-versions updated from 24.16.0 to 24.22.0 -- routine sync.

---

Security Findings

No vulnerabilities introduced by this PR. Pre-existing issues (not introduced here):

• GITHUB_EVENT_PATH without path canonicalization (index.js): fs.readFileSync(eventPath) called after existsSync but without normalization. On self-hosted runners a tampered env could redirect to arbitrary files. Worst case: private-repo subscription bypass. Low severity; standard pattern in GitHub Actions.
• Incorrect cache-name guard (config.js, pre-existing): if (diskCacheName !== 'true') should be if (diskCacheConfig !== 'true') -- diskCacheName is always 'disk', never 'true'. Logic bug only, no security impact.

---

Summary

Clean upstream sync from bazel-contrib/setup-bazel@0.19.1 with all StepSecurity customizations in place. All mandatory checks pass; no failed checks.