git-cliff - Changelog Generator

Actively maintained

orhun/git-cliff-action · Apache-2.0

GitHub action to generate a changelog based on the Git history

★ 211 starsLast commit 12 days agoLatest v4.8.0

/ 100

Security signals

OpenSSF Scorecard4.0 / 10

SECURITY.md presentNo

Immutable releasesNot enabled

Known vulnerabilitiesNone on record

How to use it safely

Recommended: pin to commit SHA

uses: orhun/git-cliff-action@f50e11560dce63f7c33227798f90b924471a88b5 # v4.8.0

Mutable tags like v4.8.0 can be rewritten to point at malicious commits. Pinning to the full commit SHA is the only reference GitHub guarantees immutable.

Full workflow example

steps:
  - uses: orhun/git-cliff-action@f50e11560dce63f7c33227798f90b924471a88b5 # v4.8.0

Score breakdown

Security (35%)44

Popularity (20%)47

Maintenance (30%)92

Reliability (15%)70