Methodology
Every score on ActionRank is computed from public data with the fixed formula documented on this page. No action can pay to change its score, and the same rules apply to every repository we track.
Scoring model
Each GitHub Action receives a composite score from 0 to 100, computed as the weighted sum of four dimensions. Each dimension is itself scored 0–100 from the signals listed below.
| Dimension | Weight | Signals measured |
|---|---|---|
| Security | 35% | OpenSSF Scorecard result, presence of a SECURITY.md policy, immutable releases enabled, and known-vulnerability (advisory) history. |
| Maintenance | 30% | Recency of the latest commit and release, release cadence, and commit volume over time. |
| Popularity | 20% | GitHub stars (log-normalized so mega-repos don't dominate) and number of contributors. |
| Reliability | 15% | Semantic-versioning compliance, use of the major-tag convention (e.g. v4), and frequency of breaking changes. |
The composite score maps to a letter grade using fixed bands:
| Grade | Score range |
|---|---|
| A | 85–100 |
| B | 70–84 |
| C | 55–69 |
| D | 40–54 |
| F | Below 40 |
Maintenance status
Separately from the score, every action gets a maintenance status based on how recently its repository showed activity (commits or releases):
| Status | Definition |
|---|---|
| Actively maintained | Repository activity within the last 90 days. |
| Stale | Last activity between 91 and 365 days ago. |
| Abandoned | No activity for more than 365 days, the repository is archived, or the owner account no longer exists. |
Data sources
ActionRank only uses publicly available data. Nothing is self-reported by maintainers.
| Source | What we use it for |
|---|---|
| GitHub REST & GraphQL API | Repository metadata, stars, contributors, commits, releases, tags, archive status and SECURITY.md detection. |
| OpenSSF Scorecard API | Automated supply-chain security checks. Scorecard data is used under its CC-BY license with attribution to the OpenSSF Scorecard project. |
| OSV.dev | Known vulnerability advisories affecting each action. |
Data freshness
Popular actions are refreshed daily. The full catalog goes through a complete refresh at least weekly. Every action page displays the date its underlying data was last updated, so you always know how current a score is.
How missing data is handled
Not every signal can be collected for every repository — for example, OpenSSF Scorecard may not cover a small repo. We never treat missing data as a bad result:
- If an individual signal is unavailable, it is excluded and the weights of the remaining signals in that dimension are renormalized.
- If an entire dimension is unavailable, it receives a neutral score of 50 and is explicitly marked “data unavailable” on the action page, so it neither rewards nor punishes the action.
Appeals & corrections
If you maintain an action and believe its data is wrong, use the Report an Issue form. We verify every report against the primary sources listed above: verified errors are corrected in the next data refresh, and when we stand by our data despite a dispute, we annotate the disputed data point on the page rather than silently ignoring the report.
Report a data issueDisclaimer. ActionRank is an independent project and is not affiliated with, endorsed by, or sponsored by GitHub, Inc. Scores are estimates derived from public data at a point in time; they are informational signals, not guarantees of security or quality. Always review an action's source code before using it in your workflows.
Frequently asked questions
How are ActionRank scores computed?
Each GitHub Action receives a 0–100 score from four weighted dimensions: Security (35%), Maintenance (30%), Popularity (20%) and Reliability (15%). The total maps to a letter grade: A is 85 or higher, B is 70–84, C is 55–69, D is 40–54, and F is below 40. All inputs are public signals from the GitHub API, OpenSSF Scorecard and OSV.dev.
How often is ActionRank data updated?
Popular actions are refreshed daily; the full catalog is refreshed at least weekly. Every page displays the date its underlying data was last updated.
Why does an action show "data unavailable"?
When an individual signal cannot be collected, it is excluded and the remaining weights in that dimension are renormalized. When an entire dimension is missing, it receives a neutral score of 50 and is explicitly marked "data unavailable" so it neither rewards nor punishes the action.
How do I appeal a score?
Maintainers can report incorrect data or appeal a score through the Report an Issue form at actionrank.dev/report-issue. Verified errors are corrected in the next data refresh; when we disagree with a dispute, we annotate the disputed data point rather than silently ignoring it.