ActionRank
Check your actions

bump-everywhere

Abandoned

undergroundwires/bump-everywhere · Apache-2.0

🚀 Automate versioning, changelog creation, README updates and GitHub releases using GitHub Actions,npm, docker or bash.

★ 76 starsLast commit 1 year agoLatest 1.4.0
F
33
/ 100
Security 37Maintenance 12Popularity 30Reliability 70

Security signals

OpenSSF Scorecard2.9 / 10
SECURITY.md presentNo
Immutable releasesNot enabled
Known vulnerabilitiesNone on record

How to use it safely

Recommended: pin to commit SHA
uses: undergroundwires/bump-everywhere@5d9c038bc3ecc5648eadbf49ca6c66c6f67b0cf6 # 1.4.0

Mutable tags like 1.4.0 can be rewritten to point at malicious commits. Pinning to the full commit SHA is the only reference GitHub guarantees immutable.

Full workflow example
steps:
  - uses: undergroundwires/bump-everywhere@5d9c038bc3ecc5648eadbf49ca6c66c6f67b0cf6 # 1.4.0

Score breakdown

Security (35%)37
Popularity (20%)30
Maintenance (30%)12
Reliability (15%)70