feat: Onboard olafurpg/setup-scala action

[anurag-stepsecurity]

Description

This PR onboards https://github.com/olafurpg/setup-scala action.

[github-actions]

Security: Unvalidated user input used as RegExp pattern (ReDoS risk)

javaVersion comes directly from action input and is passed to new RegExp() without any sanitization. A specially crafted value (e.g. (a+)+b) can cause catastrophic backtracking and hang the runner process indefinitely.

Suggested change

	const pattern = new RegExp(javaVersion);
	const pattern = new RegExp(javaVersion.replace(/[.*+?^${}()|[\]\\]/g, '\\$&'));

Alternatively, consider using a simple String.prototype.includes() or startsWith() match if full regex isn't needed.

[github-actions]

Security: Downloading executable scripts from unpinned mutable branch references

All three URLs reference mutable branch HEADs (develop, master) with no checksum verification. The downloaded scripts are immediately made executable and placed on PATH. A compromised commit to any of these upstream repos results in arbitrary code execution on the runner.

Pin to specific commit SHAs instead of branch names, and verify a checksum after download:

Suggested change

	await curl(
	"https://raw.githubusercontent.com/sbt/sbt/develop/sbt",
	path.join(bin, "sbt")
	);
	await curl(
	"https://raw.githubusercontent.com/dwijnand/sbt-extras/master/sbt",
	path.join(bin, "sbtx")
	);
	await curl(
	"https://raw.githubusercontent.com/coursier/sbt-extras/master/sbt",
	path.join(bin, "csbt")
	await curl(
	"https://raw.githubusercontent.com/sbt/sbt/<COMMIT_SHA>/sbt",
	path.join(bin, "sbt")
	);
	await curl(
	"https://raw.githubusercontent.com/dwijnand/sbt-extras/<COMMIT_SHA>/sbt",
	path.join(bin, "sbtx")
	);
	await curl(
	"https://raw.githubusercontent.com/coursier/sbt-extras/<COMMIT_SHA>/sbt",
	path.join(bin, "csbt")
	);

[github-actions]

Failed Check: name field is a template leftover

The name field is still "typescript-action" from the GitHub Actions template. It should be updated to match the actual action name.

Suggested change

	"name": "typescript-action",
	"name": "setup-scala",

[github-actions]

PR Review

Action Type

Node-based action — uses node24 runtime via runs.using: "node24" in action.yml.

---

✅ Passed Checks

• License: LICENSE present with copyright for both StepSecurity (2026) and the original author (GitHub, Inc. and contributors, 2018).
• action.yml: Present with author: 'step-security'.
• SECURITY.md: Present with correct contact email.
• FUNDING.yml: Not present. ✓
• .github/workflows/auto_cherry_pick.yml: Present. ✓
• .github/workflows/actions_release.yml: Present. ✓
• renovate.json: Not present. ✓
• PULL_REQUEST.md: Not present. ✓
• ISSUE_TEMPLATE folder: Not present. ✓
• CHANGELOG.md: Not present. ✓
• .vscode folder: Not present. ✓
• README banner: StepSecurity Maintained Action banner is correctly present at the top of README.md.
• Subscription check: Present in src/subscription.ts with the correct URL https://agent.api.stepsecurity.io/v1/github/${GITHUB_REPOSITORY}/actions/maintained-actions-subscription.
• Subscription upstream value: 'olafurpg/setup-scala' correctly matches original-owner: "olafurpg" + repo-name: "setup-scala" from auto_cherry_pick.yml.
• dist folder: Present with all required files (index.js, index.js.map, sourcemap-register.js, licenses.txt).
• package.json author: Set to "step-security". ✓
• package.json repository: Contains step-security. ✓
• package.json build script: Present — "build": "tsc && ncc build src/main.ts -o dist ...". ✓
• actions_release.yml script input: Present (since package manager is yarn, not npm). ✓
• audit_package.yml script input: Present. ✓
• README versioning: Setup-scala usage examples correctly use only the major version tag (@v14), not a full semver tag.

---

❌ Failed Checks

• package.json name field is a template leftover: The name is set to "typescript-action" (a GitHub Actions template default) instead of "setup-scala". See inline comment on package.json line 2.

---

⚠️ Warnings

• actions/checkout@v7 in README examples: All README code examples reference actions/checkout@v7, but v7 is not a published release of that action (current latest major is v4). These examples are documentation-only but may confuse users. They should reference a real, existing major version tag.

---

🔒 Security Findings

1. Unpinned branch downloads (supply-chain risk — HIGH) in src/install.ts lines 124–134: The installSbt() function downloads three shell scripts from mutable branch HEAD references (develop, master) with no checksum verification. The files are immediately marked executable and added to PATH. A malicious or compromised commit to any of these upstream repositories (sbt/sbt, dwijnand/sbt-extras, coursier/sbt-extras) would result in arbitrary code execution on every runner that uses this action. Pins to specific commit SHAs and post-download hash verification are required. See inline comment.

2. User input used as unescaped RegExp pattern (ReDoS — MEDIUM) in src/install.ts line 97: The javaVersion action input is passed directly to new RegExp(javaVersion) without any sanitization. A specially crafted value with pathological regex structure (e.g. (a+)+b) can trigger catastrophic backtracking and hang the runner. The input should be escaped before constructing the RegExp, or a non-regex matching strategy should be used. See inline comment.

---

Summary

The onboarding is largely complete and passes most structural checks, but two security issues need to be addressed before merge: unpinned/unverified script downloads in installSbt() pose a real supply-chain risk, and unescaped user input in new RegExp() introduces a ReDoS vector. Additionally, the package.json name field must be updated from the template default, and the actions/checkout version in README examples should reference a valid published tag.