ActionRank
Check your actions

GitHub Script

Stale

actions/github-script · MIT

Write workflows scripting the GitHub API in JavaScript

★ 5k starsLast commit 3 months agoLatest v9.0.0
C
64
/ 100
Security 60Maintenance 58Popularity 71Reliability 75

Security signals

OpenSSF Scorecard6.7 / 10
SECURITY.md presentNo
Immutable releasesNot enabled
Known vulnerabilitiesNone on record

How to use it safely

Recommended: pin to commit SHA
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0

Mutable tags like v9.0.0 can be rewritten to point at malicious commits. Pinning to the full commit SHA is the only reference GitHub guarantees immutable.

Full workflow example
steps:
  - uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0

Score breakdown

Security (35%)60
Popularity (20%)71
Maintenance (30%)58
Reliability (15%)75