ActionRank
Check your actions

GitHub Slug Action

Actively maintained

rlespinasse/github-slug-action · MIT

GitHub Action to expose slug value of GitHub environment variables inside your GitHub workflow

★ 334 starsLast commit 18 days agoLatest v5.7.0
B
70
/ 100
Security 63Maintenance 92Popularity 47Reliability 70

Security signals

OpenSSF Scorecard5.5 / 10
SECURITY.md presentYes
Immutable releasesNot enabled
Known vulnerabilities2 advisory(ies)
  • CVE-2023-27581high

    github-slug-action vulnerable to arbitrary code execution

    Published Mar 13, 2023
  • GHSA-7f32-hm4h-w77qmoderate

    github-slug-action use of `set-env` Runner commands which are processed via stdout

    Published Feb 3, 2024

How to use it safely

Recommended: pin to commit SHA
uses: rlespinasse/github-slug-action@ef93b2ea4b6405d06fd8684fc3ff795d262ecae8 # v5.7.0

Mutable tags like v5.7.0 can be rewritten to point at malicious commits. Pinning to the full commit SHA is the only reference GitHub guarantees immutable.

Full workflow example
steps:
  - uses: rlespinasse/github-slug-action@ef93b2ea4b6405d06fd8684fc3ff795d262ecae8 # v5.7.0

Score breakdown

Security (35%)63
Popularity (20%)47
Maintenance (30%)92
Reliability (15%)70