feat: Onboard mobiledevops/xcode-select-version-action action

[anurag-stepsecurity]

https://github.com/mobiledevops/xcode-select-version-action

[github-actions]

PR Review

Action Type

Node-based action (uses node24 runtime with a bundled dist/index.js entrypoint).

---

Passed Checks

• License: MIT license file is present.
• action.yml: Present with author set to step-security.
• SECURITY.md: Present with vulnerability reporting contact security@stepsecurity.io.
• FUNDING.yml: Not present (correct).
• actions_release.yml: Present in .github/workflows/.
• renovate.json: Not present (correct).
• PULL_REQUEST.md: Not present (correct).
• ISSUE_TEMPLATE folder: Not present (correct).
• CHANGELOG.md: Not present (correct).
• .vscode folder: Not present (correct).
• README semver tags: Action usage examples use only major version tag @v1, not full semver.
• Subscription check: Code calls the correct maintained-actions-subscription URL.
• package.json author: Set to step-security.
• package.json repository: Contains step-security in the URL.
• package.json build script: Present (ncc build src/index.ts -o dist --minify).
• dist/ folder: Present.
• Dependencies: All declared dependencies are actively used.

---

Failed Checks

• Missing auto_cherry_pick.yml: The .github/workflows/ directory does not contain auto_cherry_pick.yml. This file is required for the StepSecurity onboarding checklist and is the source of truth for the original-owner and repo-name properties used to verify the upstream variable in subscription code.

• Missing StepSecurity maintained action banner in README: The README does not include the required banner image linking to https://docs.stepsecurity.io/actions/stepsecurity-maintained-actions. An inline comment has been added at README.md line 1 with the exact suggestion.

• LICENSE missing original author copyright: The LICENSE only credits StepSecurity. As a maintained fork of mobiledevops/xcode-select-version-action, the original author copyright should be retained alongside StepSecurity's. An inline comment has been added on LICENSE line 3.

---

Warnings

• upstream value unverifiable: Because auto_cherry_pick.yml is absent, the upstream variable set to mobiledevops/xcode-select-version-action in src/subscription.ts cannot be cross-checked against the original-owner and repo-name properties that file should define. The value looks correct but should be verified once the file is added.

• process.exit(1) in subscription.ts: Calling process.exit skips GitHub Actions post-step cleanup hooks. Throwing an error instead would let core.setFailed in main.ts handle the failure consistently. An inline comment with a code suggestion has been added on src/subscription.ts line 39.

• test.yml missing name and permissions fields: The workflow has no top-level name field (harder to identify in the Actions UI) and no explicit permissions block, which may default to broad write permissions in some org configurations.

---

Security Findings

• No injection vulnerabilities: xcode.ts passes arguments to execFileSync as a vector, not via shell interpolation - a user-controlled version string cannot escape into the shell.
• GITHUB_EVENT_PATH parsing: The event JSON is read from a GitHub-controlled path and parsed safely.
• Axios call: The subscription POST uses a hardcoded URL with no user-controlled interpolation in the path.
• No other security issues found.

---

Summary

The implementation quality is solid - the code is well-structured, thoroughly tested, and correctly secured against injection. Three checklist items must be resolved before merge: the missing auto_cherry_pick.yml workflow, the missing StepSecurity maintained action banner in README, and the incomplete copyright in LICENSE.