ActionRank
Check your actions

uppt

Actively maintained

danielroe/uppt

A composite GitHub Action that turns conventional commits into a draft release PR, tags the PR on merge, and stages publishing to npm via OIDC trusted publishing.

★ 168 starsLast commit 3 days agoLatest v0.5.5
B
84
/ 100
Security 100Maintenance 100Popularity 41Reliability 70

Security signals

OpenSSF ScorecardNo data
SECURITY.md presentYes
Immutable releasesEnabled
Known vulnerabilitiesNone on record

How to use it safely

Recommended: pin to commit SHA
uses: danielroe/uppt@7bcfb5397c37202ef882363f755423130419d28a # v0.5.5

Mutable tags like v0.5.5 can be rewritten to point at malicious commits. Pinning to the full commit SHA is the only reference GitHub guarantees immutable.

Full workflow example
steps:
  - uses: danielroe/uppt@7bcfb5397c37202ef882363f755423130419d28a # v0.5.5

Score breakdown

Security (35%)100
Popularity (20%)41
Maintenance (30%)100
Reliability (15%)70