ActionRank
Check your actions

Dependencies license compliance checker

Stale

pilosus/action-pip-license-checker · MIT

GitHub Action for license compliance: Python, JavaScript, iOS, Android and more.

★ 56 starsLast commit 6 months agoLatest v3.1.0
D
42
/ 100
Security 45Maintenance 35Popularity 28Reliability 70

Security signals

OpenSSF Scorecard4.2 / 10
SECURITY.md presentNo
Immutable releasesNot enabled
Known vulnerabilitiesNone on record

How to use it safely

Recommended: pin to commit SHA
uses: pilosus/action-pip-license-checker@e909b0226ff49d3235c99c4585bc617f49fff16a # v3.1.0

Mutable tags like v3.1.0 can be rewritten to point at malicious commits. Pinning to the full commit SHA is the only reference GitHub guarantees immutable.

Full workflow example
steps:
  - uses: pilosus/action-pip-license-checker@e909b0226ff49d3235c99c4585bc617f49fff16a # v3.1.0

Score breakdown

Security (35%)45
Popularity (20%)28
Maintenance (30%)35
Reliability (15%)70