ActionRank
Check your actions

Publish VS Code Extension

Abandoned

HaaLeo/publish-vscode-extension · MIT

GitHub action to publish your VS Code Extension to the Open VSX Registry or Visual Studio Marketplace.

★ 262 starsLast commit 1 year agoLatest v2.0.0
D
42
/ 100
Security 38Maintenance 20Popularity 43Reliability 92

Security signals

OpenSSF Scorecard3.0 / 10
SECURITY.md presentNo
Immutable releasesNot enabled
Known vulnerabilitiesNone on record

How to use it safely

Recommended: pin to commit SHA
uses: HaaLeo/publish-vscode-extension@ca5561daa085dee804bf9f37fe0165785a9b14db # v2.0.0

Mutable tags like v2.0.0 can be rewritten to point at malicious commits. Pinning to the full commit SHA is the only reference GitHub guarantees immutable.

Full workflow example
steps:
  - uses: HaaLeo/publish-vscode-extension@ca5561daa085dee804bf9f37fe0165785a9b14db # v2.0.0

Score breakdown

Security (35%)38
Popularity (20%)43
Maintenance (30%)20
Reliability (15%)92