Codecov

Actively maintained

codecov/codecov-action · MIT

GitHub Action that uploads coverage to Codecov

★ 1.7k starsLast commit 1 months agoLatest v5.5.5

/ 100

Security signals

OpenSSF Scorecard8.2 / 10

SECURITY.md presentNo

Immutable releasesEnabled

Known vulnerabilitiesNone on record

How to use it safely

Recommended: pin to commit SHA

uses: codecov/codecov-action@0fb7174895f61a3b6b78fc075e0cd60383518dac # v5.5.5

Mutable tags like v5.5.5 can be rewritten to point at malicious commits. Pinning to the full commit SHA is the only reference GitHub guarantees immutable.

Full workflow example

steps:
  - uses: codecov/codecov-action@0fb7174895f61a3b6b78fc075e0cd60383518dac # v5.5.5

Score breakdown

Security (35%)79

Popularity (20%)66

Maintenance (30%)87

Reliability (15%)49