release-downloader

Actively maintained

robinraju/release-downloader · MIT

Github action to download release assets from private or public repositories

★ 241 starsLast commit 5 days agoLatest v1.13

/ 100

Security signals

OpenSSF Scorecard6.2 / 10

SECURITY.md presentNo

Immutable releasesNot enabled

Known vulnerabilitiesNone on record

How to use it safely

Recommended: pin to commit SHA

uses: robinraju/release-downloader@28fc21f50d76778e7023361aa1f863e717d3d56f # v1.13

Mutable tags like v1.13 can be rewritten to point at malicious commits. Pinning to the full commit SHA is the only reference GitHub guarantees immutable.

Full workflow example

steps:
  - uses: robinraju/release-downloader@28fc21f50d76778e7023361aa1f863e717d3d56f # v1.13

Score breakdown

Security (35%)57

Popularity (20%)48

Maintenance (30%)88

Reliability (15%)30