Upload a Build Artifact

Stale

actions/upload-artifact · MIT

★ 4.2k starsLast commit 3 months agoLatest v7.0.1

/ 100

Security signals

OpenSSF Scorecard5.2 / 10

SECURITY.md presentNo

Immutable releasesNot enabled

Known vulnerabilitiesNone on record

How to use it safely

Recommended: pin to commit SHA

uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1

Mutable tags like v7.0.1 can be rewritten to point at malicious commits. Pinning to the full commit SHA is the only reference GitHub guarantees immutable.

Full workflow example

steps:
  - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1

Score breakdown

Security (35%)51

Popularity (20%)68

Maintenance (30%)66

Reliability (15%)49