Download workflow artifact
Actively maintaineddawidd6/action-download-artifact · MIT
A GitHub Action to download an artifact associated with given workflow and commit or other criteria
★ 832 starsLast commit 20 days agoLatest v21
C
60
/ 100
Security signals
OpenSSF Scorecard4.1 / 10
SECURITY.md presentNo
Immutable releasesEnabled
Known vulnerabilities1 advisory(ies)
- GHSA-5xr6-xhww-33m4high
Artifact poisoning vulnerability in action-download-artifact v5 and earlier
Published Nov 25, 2024
How to use it safely
Recommended: pin to commit SHA
uses: dawidd6/action-download-artifact@b6e2e70617bc3265edd6dab6c906732b2f1ae151 # v21Mutable tags like v21 can be rewritten to point at malicious commits. Pinning to the full commit SHA is the only reference GitHub guarantees immutable.
Full workflow example
steps: - uses: dawidd6/action-download-artifact@b6e2e70617bc3265edd6dab6c906732b2f1ae151 # v21
Score breakdown
Security (35%)41
Popularity (20%)60
Maintenance (30%)92
Reliability (15%)39