From 768d7acab5079efe56f01368e8719326c9d64e98 Mon Sep 17 00:00:00 2001
From: Raj-StepSecurity <rajkumar@stepsecurity.io>
Date: Wed, 8 Apr 2026 11:20:34 +0530
Subject: [PATCH 1/2] feat: added banner and update subscription check to make
 maintained actions free for public repos

---
 README.md     |  2 ++
 action.yml    |  2 ++
 entrypoint.sh | 54 +++++++++++++++++++++++++++++++++++----------------
 3 files changed, 41 insertions(+), 17 deletions(-)

diff --git a/README.md b/README.md
index ca0e257..84ef9be 100644
--- a/README.md
+++ b/README.md
@@ -1,3 +1,5 @@
+[![StepSecurity Maintained Action](https://raw.githubusercontent.com/step-security/maintained-actions-assets/main/assets/maintained-action-banner.png)](https://docs.stepsecurity.io/actions/stepsecurity-maintained-actions)
+
 # GitHub Action: Run actionlint with reviewdog
 
 This action runs [actionlint](https://github.com/rhysd/actionlint) with
diff --git a/action.yml b/action.yml
index 532244b..d2cf695 100644
--- a/action.yml
+++ b/action.yml
@@ -53,6 +53,8 @@ runs:
   using: 'docker'
   image: 'docker://ghcr.io/step-security/action-actionlint:v1.71.0@sha256:06ce34c2a9b5566d4998e5c86153628abe752ec2cada1779cb824af7d07f65f0' #v1.71.0
   entrypoint: /entrypoint.sh
+  env:
+    REPO_PRIVATE: ${{ github.event.repository.private }}
 branding:
   color: red
   icon: check-circle
diff --git a/entrypoint.sh b/entrypoint.sh
index 3a8e153..40d8cdb 100755
--- a/entrypoint.sh
+++ b/entrypoint.sh
@@ -1,22 +1,42 @@
 #!/bin/sh
 
-# validate subscription status
-API_URL="https://agent.api.stepsecurity.io/v1/github/$GITHUB_REPOSITORY/actions/subscription"
-
-# Set a timeout for the curl command (3 seconds)
-RESPONSE=$(curl --max-time 3 -s -w "%{http_code}" "$API_URL" -o /dev/null) || true
-CURL_EXIT_CODE=$?
-
-# Decide based on curl exit code and HTTP status
-if [ $CURL_EXIT_CODE -ne 0 ]; then
-  echo "Timeout or API not reachable. Continuing to next step."
-elif [ "$RESPONSE" = "200" ]; then
-  :
-elif [ "$RESPONSE" = "403" ]; then
-  echo "Subscription is not valid. Reach out to support@stepsecurity.io"
-  exit 1
-else
-  echo "Timeout or API not reachable. Continuing to next step."
+UPSTREAM="reviewdog/action-actionlint"
+ACTION_REPO="${GITHUB_ACTION_REPOSITORY:-}"
+DOCS_URL="https://docs.stepsecurity.io/actions/stepsecurity-maintained-actions"
+
+echo ""
+echo -e "\033[1;36mStepSecurity Maintained Action\033[0m"
+echo "Secure drop-in replacement for $UPSTREAM"
+if [ "$REPO_PRIVATE" = "false" ]; then
+  echo -e "\033[32m✓ Free for public repositories\033[0m"
+fi
+echo -e "\033[36mLearn more:\033[0m $DOCS_URL"
+echo ""
+
+if [ "$REPO_PRIVATE" != "false" ]; then
+  SERVER_URL="${GITHUB_SERVER_URL:-https://github.com}"
+
+  if [ "$SERVER_URL" != "https://github.com" ]; then
+    BODY=$(printf '{"action":"%s","ghes_server":"%s"}' "$ACTION_REPO" "$SERVER_URL")
+  else
+    BODY=$(printf '{"action":"%s"}' "$ACTION_REPO")
+  fi
+
+  API_URL="https://agent.api.stepsecurity.io/v1/github/$GITHUB_REPOSITORY/actions/maintained-actions-subscription"
+
+  RESPONSE=$(curl --max-time 3 -s -w "%{http_code}" \
+    -X POST \
+    -H "Content-Type: application/json" \
+    -d "$BODY" \
+    "$API_URL" -o /dev/null) && CURL_EXIT_CODE=0 || CURL_EXIT_CODE=$?
+
+  if [ $CURL_EXIT_CODE -ne 0 ]; then
+    echo "Timeout or API not reachable. Continuing to next step."
+  elif [ "$RESPONSE" = "403" ]; then
+    echo -e "::error::\033[1;31mThis action requires a StepSecurity subscription for private repositories.\033[0m"
+    echo -e "::error::\033[31mLearn how to enable a subscription: $DOCS_URL\033[0m"
+    exit 1
+  fi
 fi
 if [ "${RUNNER_DEBUG}" = "1" ] ; then
   set -x

From 5854b1ccca6507d0920a0fc338c11a17cc0bdd7c Mon Sep 17 00:00:00 2001
From: Raj-StepSecurity <rajkumar@stepsecurity.io>
Date: Wed, 8 Apr 2026 11:27:57 +0530
Subject: [PATCH 2/2] updated subscription check

---
 Dockerfile    | 3 ++-
 action.yml    | 2 --
 entrypoint.sh | 1 +
 3 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/Dockerfile b/Dockerfile
index 1cf8bb7..4bd92fa 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -11,7 +11,8 @@ RUN set -eux; \
     apk add --no-cache \
       git curl wget xz \
       build-base \
-      python3 py3-pyflakes
+      python3 py3-pyflakes \
+      jq
 
 # Install ShellCheck (prebuilt tarball matching arch)
 RUN set -eux; \
diff --git a/action.yml b/action.yml
index d2cf695..532244b 100644
--- a/action.yml
+++ b/action.yml
@@ -53,8 +53,6 @@ runs:
   using: 'docker'
   image: 'docker://ghcr.io/step-security/action-actionlint:v1.71.0@sha256:06ce34c2a9b5566d4998e5c86153628abe752ec2cada1779cb824af7d07f65f0' #v1.71.0
   entrypoint: /entrypoint.sh
-  env:
-    REPO_PRIVATE: ${{ github.event.repository.private }}
 branding:
   color: red
   icon: check-circle
diff --git a/entrypoint.sh b/entrypoint.sh
index 40d8cdb..c01869b 100755
--- a/entrypoint.sh
+++ b/entrypoint.sh
@@ -1,5 +1,6 @@
 #!/bin/sh
 
+REPO_PRIVATE=$(jq -r '.repository.private | tostring' "$GITHUB_EVENT_PATH" 2>/dev/null || echo "")
 UPSTREAM="reviewdog/action-actionlint"
 ACTION_REPO="${GITHUB_ACTION_REPOSITORY:-}"
 DOCS_URL="https://docs.stepsecurity.io/actions/stepsecurity-maintained-actions"