PMD

Abandoned

pmd/pmd-github-action · MIT

GitHub Action for PMD

★ 52 starsLast commit 2 years agoLatest v2.0.0

/ 100

Security signals

OpenSSF Scorecard3.0 / 10

SECURITY.md presentNo

Immutable releasesNot enabled

Known vulnerabilitiesNone on record

How to use it safely

Recommended: pin to commit SHA

uses: pmd/pmd-github-action@d9c1f3c5940cbf5923f1354e83fa858b4496ebaa # v2.0.0

Mutable tags like v2.0.0 can be rewritten to point at malicious commits. Pinning to the full commit SHA is the only reference GitHub guarantees immutable.

Full workflow example

steps:
  - uses: pmd/pmd-github-action@d9c1f3c5940cbf5923f1354e83fa858b4496ebaa # v2.0.0

Score breakdown

Security (35%)38

Popularity (20%)30

Maintenance (30%)4

Reliability (15%)70