ActionRank
Check your actions

Kubectl tool installer

Actively maintained

Azure/setup-kubectl · MIT

GitHub Action for installing Kubectl

★ 156 starsLast commit 2 days agoLatest v5.1.0
B
73
/ 100
Security 73Maintenance 87Popularity 48Reliability 76

Security signals

OpenSSF Scorecard7.1 / 10
SECURITY.md presentYes
Immutable releasesNot enabled
Known vulnerabilities1 advisory(ies)
  • CVE-2023-23939low

    Azure/setup-kubectl: Escalation of privilege vulnerability for v3 and lower

    Published Mar 7, 2023

How to use it safely

Recommended: pin to commit SHA
uses: Azure/setup-kubectl@829323503d1be3d00ca8346e5391ca0b07a9ab0d # v5.1.0

Mutable tags like v5.1.0 can be rewritten to point at malicious commits. Pinning to the full commit SHA is the only reference GitHub guarantees immutable.

Full workflow example
steps:
  - uses: Azure/setup-kubectl@829323503d1be3d00ca8346e5391ca0b07a9ab0d # v5.1.0

Score breakdown

Security (35%)73
Popularity (20%)48
Maintenance (30%)87
Reliability (15%)76