CLA assistant lite
Abandonedcontributor-assistant/github-action · Apache-2.0 · archived
CLA Assistant GitHub Action
★ 346 starsLast commit 4 months agoLatest v2.6.1
F
30
/ 100
Security signals
OpenSSF Scorecard4.2 / 10
SECURITY.md presentYes
Immutable releasesNot enabled
Known vulnerabilitiesNone on record
How to use it safely
Recommended: pin to commit SHA
uses: contributor-assistant/github-action@ca4a40a7d1004f18d9960b404b97e5f30a505a08 # v2.6.1Mutable tags like v2.6.1 can be rewritten to point at malicious commits. Pinning to the full commit SHA is the only reference GitHub guarantees immutable.
Full workflow example
steps: - uses: contributor-assistant/github-action@ca4a40a7d1004f18d9960b404b97e5f30a505a08 # v2.6.1
Score breakdown
Security (35%)55
Popularity (20%)53
Maintenance (30%)0
Reliability (15%)0