ActionRank
Check your actions

Codecov

Actively maintained

codecov/codecov-action · MIT

GitHub Action that uploads coverage to Codecov :open_umbrella:

★ 1.7k starsLast commit 1 months agoLatest v5.5.5
B
74
/ 100
Security 79Maintenance 87Popularity 66Reliability 49

Security signals

OpenSSF Scorecard8.2 / 10
SECURITY.md presentNo
Immutable releasesEnabled
Known vulnerabilitiesNone on record

How to use it safely

Recommended: pin to commit SHA
uses: codecov/codecov-action@0fb7174895f61a3b6b78fc075e0cd60383518dac # v5.5.5

Mutable tags like v5.5.5 can be rewritten to point at malicious commits. Pinning to the full commit SHA is the only reference GitHub guarantees immutable.

Full workflow example
steps:
  - uses: codecov/codecov-action@0fb7174895f61a3b6b78fc075e0cd60383518dac # v5.5.5

Score breakdown

Security (35%)79
Popularity (20%)66
Maintenance (30%)87
Reliability (15%)49