ActionRank
Check your actions

Frogbot by JFrog

Actively maintained

jfrog/frogbot · Apache-2.0

🐸 Scans your Git repository with JFrog Xray & JFrog advanced security for security vulnerabilities. 🤖

★ 370 starsLast commit 5 days agoLatest v3.3.2
C
65
/ 100
Security 44Maintenance 100Popularity 52Reliability 58

Security signals

OpenSSF Scorecard4.0 / 10
SECURITY.md presentNo
Immutable releasesNot enabled
Known vulnerabilitiesNone on record

How to use it safely

Recommended: pin to commit SHA
uses: jfrog/frogbot@4efe5f243086276f1ed990e7bfc68b16a8cb5bf8 # v3.3.2

Mutable tags like v3.3.2 can be rewritten to point at malicious commits. Pinning to the full commit SHA is the only reference GitHub guarantees immutable.

Full workflow example
steps:
  - uses: jfrog/frogbot@4efe5f243086276f1ed990e7bfc68b16a8cb5bf8 # v3.3.2

Score breakdown

Security (35%)44
Popularity (20%)52
Maintenance (30%)100
Reliability (15%)58