ActionRank
Check your actions

Composer (php-actions)

Stale

php-actions/composer

Use the Composer CLI in your Github Actions.

★ 198 starsLast commit 5 months agoLatest v6.1.2
D
42
/ 100
Security 36Maintenance 27Popularity 49Reliability 76

Security signals

OpenSSF Scorecard2.6 / 10
SECURITY.md presentNo
Immutable releasesNot enabled
Known vulnerabilitiesNone on record

How to use it safely

Recommended: pin to commit SHA
uses: php-actions/composer@8a65f0d3c6a1d17ca4800491a40b5756a4c164f3 # v6.1.2

Mutable tags like v6.1.2 can be rewritten to point at malicious commits. Pinning to the full commit SHA is the only reference GitHub guarantees immutable.

Full workflow example
steps:
  - uses: php-actions/composer@8a65f0d3c6a1d17ca4800491a40b5756a4c164f3 # v6.1.2

Score breakdown

Security (35%)36
Popularity (20%)49
Maintenance (30%)27
Reliability (15%)76