ActionRank
Check your actions

HashiCorp - Setup Terraform

Actively maintained

hashicorp/setup-terraform · MPL-2.0

Sets up Terraform CLI in your GitHub Actions workflow.

★ 1.6k starsLast commit 11 days agoLatest v4.0.1
B
70
/ 100
Security 58Maintenance 88Popularity 63Reliability 70

Security signals

OpenSSF Scorecard6.4 / 10
SECURITY.md presentNo
Immutable releasesNot enabled
Known vulnerabilitiesNone on record

How to use it safely

Recommended: pin to commit SHA
uses: hashicorp/setup-terraform@dfe3c3f87815947d99a8997f908cb6525fc44e9e # v4.0.1

Mutable tags like v4.0.1 can be rewritten to point at malicious commits. Pinning to the full commit SHA is the only reference GitHub guarantees immutable.

Full workflow example
steps:
  - uses: hashicorp/setup-terraform@dfe3c3f87815947d99a8997f908cb6525fc44e9e # v4.0.1

Score breakdown

Security (35%)58
Popularity (20%)63
Maintenance (30%)88
Reliability (15%)70