ActionRank
Check your actions

pkgx/setup

Actively maintained

pkgxdev/setup · Apache-2.0

GitHub Action and `curl pkgx.sh | sh`

★ 143 starsLast commit 4 days agoLatest v5.0.0
C
63
/ 100
Security 50Maintenance 86Popularity 44Reliability 70

Security signals

OpenSSF ScorecardNo data
SECURITY.md presentNo
Immutable releasesNot enabled
Known vulnerabilitiesNone on record

How to use it safely

Recommended: pin to commit SHA
uses: pkgxdev/setup@4d4ae97af87ccb39ab8be4e073dea697fef2c6f7 # v5.0.0

Mutable tags like v5.0.0 can be rewritten to point at malicious commits. Pinning to the full commit SHA is the only reference GitHub guarantees immutable.

Full workflow example
steps:
  - uses: pkgxdev/setup@4d4ae97af87ccb39ab8be4e073dea697fef2c6f7 # v5.0.0

Score breakdown

Security (35%)50
Popularity (20%)44
Maintenance (30%)86
Reliability (15%)70