ActionRank
Check your actions

setup-gradle

Abandoned

gradle/gradle-build-action · MIT · archived

Execute your Gradle build and trigger dependency submission

★ 685 starsLast commit 1 year agoLatest v3.5.0
F
25
/ 100
Security 40Maintenance 0Popularity 55Reliability 0

Security signals

OpenSSF Scorecard3.4 / 10
SECURITY.md presentNo
Immutable releasesNot enabled
Known vulnerabilities1 advisory(ies)
  • CVE-2023-30853high

    Data written to GitHub Actions Cache may expose secrets

    Published May 1, 2023

How to use it safely

Recommended: pin to commit SHA
uses: gradle/gradle-build-action@ac2d340dc04d9e1113182899e983b5400c17cda1 # v3.5.0

Mutable tags like v3.5.0 can be rewritten to point at malicious commits. Pinning to the full commit SHA is the only reference GitHub guarantees immutable.

Full workflow example
steps:
  - uses: gradle/gradle-build-action@ac2d340dc04d9e1113182899e983b5400c17cda1 # v3.5.0

Score breakdown

Security (35%)40
Popularity (20%)55
Maintenance (30%)0
Reliability (15%)0