Web App Security Skill

Version updated for https://github.com/parousia8888/web-app-security-skill to version v0.5.2.

  • This action is used across all versions by ? repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

This GitHub Action automates the process of scanning web applications to identify security vulnerabilities using AI coding agents. It helps in auditing, hardening, and retesting projects to ensure that they are secure and compliant with best practices. The action generates detailed reports with risk summaries and explanations, providing insights into potential issues and their impact.

What’s Changed

v0.5.2 release evidence

Scope, audit, harden, and retest web projects with AI coding agents and reproducible evidence.

Web App Security Skill v0.5.2 is a focused correctness patch over v0.5.1. It repairs report rendering, pnpm workspace lockfile evidence, nested JavaScript/TypeScript template coverage and path-only retest evasion without expanding the stable rule boundary or changing evidence states.

Release identity

  • Version/tag: v0.5.2
  • Source identity: the commit peeled from the SSH-signed annotated tag; the exact commit is recorded in web-app-security-skill-0.5.2.release.json and the provenance attestation.
  • Runtime matrix: Node.js 22 and 24 on Ubuntu and macOS; Bash 3.2 remains covered on macOS.
  • Stable corpus: 20 built-in risk rules, two evidence-integrity rules and eight opt-in external adapter rules, unchanged from v0.5.1.

This file is part of the source commit it describes and therefore does not embed a fabricated self-referential source SHA. The signed tag, manifest and provenance establish the published source identity.

Correctness fixes

Structured risk summaries

The v3 Markdown and HTML renderers now read each state’s structured { total, bySeverity } value. They omit zero-count states and render both state totals and nonzero severity counts. The report’s first risk summary no longer coerces those objects to [object Object].

pnpm workspace lockfiles

The missing-lockfile rule now reads bounded pnpm-workspace.yaml package patterns and recognizes an applicable ancestor pnpm-lock.yaml. Positive and negative package patterns form an include/exclude boundary. Unreadable, oversized or unsupported workspace metadata makes the check incomplete and emits evidence-integrity coverage; it does not produce a confirmed absence.

This parser supports the ordinary string-list form and JSON-compatible inline arrays. It is not a general YAML implementation. A package excluded from the workspace still needs its own applicable lockfile.

Nested template coverage

The bounded JavaScript/TypeScript tokenizer now tracks nested template literals and their expression depth, including templates inside TSX brace expressions. Template text remains ignored as data while code inside ${...} remains tokenized and scanned. An unterminated template still produces partial coverage and explicit unknown evidence.

Rename-aware retesting

Retesting now derives a path-independent movement fingerprint from rule identity, adapter identity and normalized evidence. A unique one-to-one match across old and new paths is reported as unchanged with reason condition_moved. Duplicate or otherwise ambiguous matches remain separate new and fixed observations so the comparison does not guess.

Compatibility and security boundary

  • Finding/report v3, persisted-subject comparison and v2 migration semantics remain compatible.
  • Syntax and external scanner matches remain suspected until independent evidence confirms them.
  • Missing or failed source evidence remains unknown; no parser fix turns unavailable evidence into a pass.
  • Passive network defaults, authorization acknowledgements and review-only repair behavior are unchanged.
  • This release is not general SAST/DAST coverage, authenticated testing or proof that a project is secure.

Release verification

The release workflow runs npm run check, rebuilds all four release assets twice and compares every byte, verifies archive structure, checksums, manifest and SPDX SBOM, exercises isolated install and upgrade, then requests GitHub build provenance before publication.

Verify the signed tag:

git -c gpg.ssh.allowedSignersFile=.github/release-signers verify-tag v0.5.2

After publication, verify SHA256SUMS, compare the manifest source commit with git rev-parse 'v0.5.2^{}', verify provenance, and only then add the immutable asset digests to the verified installer. The mutable v1 alias moves only after the public consumer workflow passes.