ActionRank
Check your actions

Setup JFrog CLI

Actively maintained

jfrog/setup-jfrog-cli · Apache-2.0

Set up JFrog CLI in your GitHub Actions workflow

★ 266 starsLast commit 1 months agoLatest v5.1.0
C
58
/ 100
Security 36Maintenance 89Popularity 51Reliability 58

Security signals

OpenSSF Scorecard2.7 / 10
SECURITY.md presentNo
Immutable releasesNot enabled
Known vulnerabilitiesNone on record

How to use it safely

Recommended: pin to commit SHA
uses: jfrog/setup-jfrog-cli@deda456d982fc5e9a7a020b63eb0d2968aedd33e # v5.1.0

Mutable tags like v5.1.0 can be rewritten to point at malicious commits. Pinning to the full commit SHA is the only reference GitHub guarantees immutable.

Full workflow example
steps:
  - uses: jfrog/setup-jfrog-cli@deda456d982fc5e9a7a020b63eb0d2968aedd33e # v5.1.0

Score breakdown

Security (35%)36
Popularity (20%)51
Maintenance (30%)89
Reliability (15%)58