Anchore Container Scan
Actively maintainedanchore/scan-action · MIT
Anchore container analysis and scan provided as a GitHub Action
★ 286 starsLast commit 2 days agoLatest v7.4.0
B
76
/ 100
Security signals
OpenSSF Scorecard7.3 / 10
SECURITY.md presentNo
Immutable releasesEnabled
Known vulnerabilitiesNone on record
How to use it safely
Recommended: pin to commit SHA
uses: anchore/scan-action@e1165082ffb1fe366ebaf02d8526e7c4989ea9d2 # v7.4.0Mutable tags like v7.4.0 can be rewritten to point at malicious commits. Pinning to the full commit SHA is the only reference GitHub guarantees immutable.
Full workflow example
steps: - uses: anchore/scan-action@e1165082ffb1fe366ebaf02d8526e7c4989ea9d2 # v7.4.0
Score breakdown
Security (35%)74
Popularity (20%)53
Maintenance (30%)98
Reliability (15%)70