Download workflow artifact
Actively maintaineddawidd6/action-download-artifact · MIT
GitHub Action for downloading artifacts associated with given criteria
★ 832 starsLast commit yesterdayLatest v24
C
62
/ 100
Security signals
OpenSSF Scorecard4.5 / 10
SECURITY.md presentNo
Immutable releasesEnabled
Known vulnerabilities1 advisory(ies)
- GHSA-5xr6-xhww-33m4high
Artifact poisoning vulnerability in action-download-artifact v5 and earlier
Published Nov 25, 2024
How to use it safely
Recommended: pin to commit SHA
uses: dawidd6/action-download-artifact@d63b86af1b34672e53c440b1b83979861906bad7 # v24Mutable tags like v24 can be rewritten to point at malicious commits. Pinning to the full commit SHA is the only reference GitHub guarantees immutable.
Full workflow example
steps: - uses: dawidd6/action-download-artifact@d63b86af1b34672e53c440b1b83979861906bad7 # v24
Score breakdown
Security (35%)43
Popularity (20%)60
Maintenance (30%)96
Reliability (15%)39
Add this badge to your README
Markdown
[](https://actionrank.dev/actions/dawidd6-action-download-artifact)HTML version
HTML
<a href="https://actionrank.dev/actions/dawidd6-action-download-artifact"><img src="https://actionrank.dev/api/badge/dawidd6-action-download-artifact" alt="ActionRank score"></a>Free to use, no attribution required — the badge updates itself as the score changes. How badges work