feat: Onboard jannekem/run-python-script-action action

[anurag-stepsecurity]

Description

This PR onboards https://github.com/jannekem/run-python-script-action action.

[github-actions]

PR Review

Action Type

Node-based action — uses the node24 runtime with dist/index.mjs as the entry point.

---

Passed Checks

• License: Present with copyright of both original author (Janne Kemppainen, 2020) and StepSecurity (2026).
• action.yml: Present. No author field — ignored per policy.
• SECURITY.md: Present.
• FUNDING.yml / funding.yml: Not present.
• Workflow files: .github/workflows/ contains both auto_cherry_pick.yml and actions_release.yml.
• renovate.json: Not present.
• PULL_REQUEST.md: Not present.
• ISSUE_TEMPLATE folder: Not present.
• CHANGELOG.md: Not present.
• .vscode folder: Not present.
• README version tags: All usage examples use @v1 (major version only).
• README banner: StepSecurity Maintained Action banner is present.
• Subscription check: Present in subscription.mjs, calls the correct URL https://agent.api.stepsecurity.io/v1/github/${GITHUB_REPOSITORY}/actions/maintained-actions-subscription.
• Upstream variable: upstream = 'jannekem/run-python-script-action' correctly matches original-owner: "jannekem" + repo-name: "run-python-script-action" from auto_cherry_pick.yml.
• package.json author: "author": "step-security".
• package.json repository: URL contains step-security.
• All dependencies used: @actions/core, @actions/exec, axios, and tmp are all referenced in source files.
• dist/ folder: Present.
• build script in package.json: "build" script present; package manager is npm.

---

Failed Checks

• Typo in package.json name field: The name is "run-python-srcipt-action" (letters transposed — "srcipt" instead of "script"). Should be "run-python-script-action".

---

Warnings

• Unescaped group(title) in util.py: The group() function passes title directly into the workflow command string without calling _escape_data(), unlike debug(), warning(), and error() which do escape their arguments. A title containing newline characters can inject arbitrary workflow commands.
• Action tags not SHA-pinned in CI workflows: check-build.yaml and smoke-test.yaml reference actions/checkout@v7, actions/setup-node@v7, and actions/setup-python@v7 using mutable version tags rather than pinned commit SHAs. Pinning to a commit SHA is a supply-chain security best practice.

---

Security Findings

1. Potential shell injection in smoke-test.yaml

Lines such as:

grep -F "smoke-ok" <<< '${{ steps.basic.outputs.stdout }}'

interpolate action output expressions directly into shell commands inside single-quoted strings. GitHub Actions evaluates ${{ }} expressions before the shell runs. If any output value contains a single-quote character, it breaks shell quoting and allows arbitrary command injection. The safe pattern passes outputs through environment variables:

env:
  STDOUT: ${{ steps.basic.outputs.stdout }}
run: grep -F "smoke-ok" <<< "$STDOUT"

2. Missing escape in util.py group() function

The group(title) function emits ::group::<title> without escaping newlines in title. A caller passing a multiline title (e.g. "title\n::error::injected") can inject arbitrary workflow commands into the log stream. Fix: wrap with _escape_data() as the other functions do.

---

Summary

The onboarding is mostly complete and correct — license, subscription check, upstream variable, banner, and all structural file requirements pass. Two issues need addressing before merge: the typo in package.json's name field, and the shell-injection-unsafe output interpolation pattern in smoke-test.yaml. The unescaped group() title in util.py is also a real security gap that should be fixed.