Telemetry and need for subscription

[Bromeon]

The following code phones home to a stepsecurity.io API, when running in private repos.

msvc-dev-cmd/index.js

Lines 27 to 49 in 0ab97ba

	if (repoPrivate === false) return;
	const serverUrl = process.env.GITHUB_SERVER_URL || "https://github.com";
	const body = { action: action || "" };
	if (serverUrl !== "https://github.com") body.ghes_server = serverUrl;
	try {
	await axios.post(
	`https://agent.api.stepsecurity.io/v1/github/${process.env.GITHUB_REPOSITORY}/actions/maintained-actions-subscription`,
	body,
	{ timeout: 3000 },
	);
	} catch (error) {
	if (axios.isAxiosError(error) && error.response?.status === 403) {
	core.error(
	`\u001b[1;31mThis action requires a StepSecurity subscription for private repositories.\u001b[0m`,
	);
	core.error(
	`\u001b[31mLearn how to enable a subscription: ${docsUrl}\u001b[0m`,
	);
	process.exit(1);
	}
	core.info("Timeout or API not reachable. Continuing to next step.");
	}

The naming of surrounding code suggests that this is for subscription purposes. However, the msvc-dev-cmd ReadMe doesn't mention this API call, just hints at it with "Private repos require subscription" text inside an image.

This repo claims to be a "Secure drop-in replacement for ilammy/msvc-dev-cmd", but there was no subscription requirement in the original GitHub action. It would be nice if the existence and purpose of any telemetry could be documented explicitly. Thanks a lot!