ActionRank
Check your actions

Docker Metadata action

Actively maintained

docker/metadata-action · Apache-2.0

GitHub Action to extract metadata (tags, labels) from Git reference and GitHub events for Docker

★ 1.1k starsLast commit 23 days agoLatest v6.2.0
B
79
/ 100
Security 82Maintenance 100Popularity 58Reliability 58

Security signals

OpenSSF Scorecard8.6 / 10
SECURITY.md presentNo
Immutable releasesEnabled
Known vulnerabilitiesNone on record

How to use it safely

Recommended: pin to commit SHA
uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0

Mutable tags like v6.2.0 can be rewritten to point at malicious commits. Pinning to the full commit SHA is the only reference GitHub guarantees immutable.

Full workflow example
steps:
  - uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0

Score breakdown

Security (35%)82
Popularity (20%)58
Maintenance (30%)100
Reliability (15%)58