We actively support the following versions with security updates:

This action includes several security enhancements:

• All inputs are validated for type, length, and content
• Protection against path traversal attacks
• Sanitization of shell special characters
• Validation of boolean values

• No dynamic script generation
• Proper shell escaping for all inputs
• Secure file operations with appropriate permissions
• Error handling to prevent information disclosure

• Structured logging for security events
• Debug mode support for troubleshooting
• No sensitive information in logs

We take security vulnerabilities seriously. If you discover a security vulnerability, please follow these steps:

Please do not create a public GitHub issue for security vulnerabilities.

Send an email to the maintainers at: security@actions-mn.org

Include the following information:

• Description of the vulnerability
• Steps to reproduce the issue
• Potential impact
• Any suggested fixes or mitigations

• Initial Response: Within 48 hours
• Assessment: Within 1 week
• Fix Development: Within 2 weeks (depending on complexity)
• Release: As soon as possible after fix is ready

1. We will acknowledge receipt of your report
2. We will assess the vulnerability and determine its impact
3. We will develop and test a fix
4. We will release a security update
5. We will publicly disclose the vulnerability after the fix is available

When using this action, follow these security best practices:

# Good: Use specific version tags
- uses: actions-mn/site-gen@v2.1.0

# Avoid: Using moving tags in production
- uses: actions-mn/site-gen@main

# Validate your configuration files
- name: Validate config
  run: |
    if [[ ! -f metanorma.yml ]]; then
      echo "Configuration file not found"
      exit 1
    fi

# Only grant necessary permissions
permissions:
  contents: read

• Regularly update to the latest version
• Review release notes for security updates
• Use Dependabot for automated updates

# Use GitHub secrets for sensitive data
- uses: actions-mn/site-gen@v2.1.0
  with:
    agree-to-terms: ${{ secrets.AGREE_TO_TERMS }}

This action depends on:

• Metanorma CLI
• System packages (fonts, etc.)

Keep these dependencies updated and monitor for security advisories.

This action:

• Reads from the source directory
• Writes to the output directory
• Does not access files outside the workspace

This action may:

• Download fonts if install-fonts: true
• Access package repositories for dependencies

• Fixed: Command injection vulnerabilities
• Added: Input validation and sanitization
• Removed: Unsafe dynamic script creation
• Enhanced: Error handling and logging

• Legacy versions had security vulnerabilities and are no longer supported

For security-related questions or concerns:

• Email: security@actions-mn.org
• Security Policy: This document
• General Issues: GitHub Issues (for non-security issues only)

We appreciate the security research community and will acknowledge researchers who responsibly disclose vulnerabilities (with their permission).