ActionRank
Check your actions

gh-action-sigstore-python

Actively maintained

sigstore/gh-action-sigstore-python · Apache-2.0

A GitHub Action for sigstore-python

★ 70 starsLast commit yesterdayLatest v3.5.0
B
73
/ 100
Security 72Maintenance 100Popularity 39Reliability 66

Security signals

OpenSSF Scorecard8.6 / 10
SECURITY.md presentNo
Immutable releasesNot enabled
Known vulnerabilitiesNone on record

How to use it safely

Recommended: pin to commit SHA
uses: sigstore/gh-action-sigstore-python@790bc6befb9d733738f18d8f895854b453640ec9 # v3.5.0

Mutable tags like v3.5.0 can be rewritten to point at malicious commits. Pinning to the full commit SHA is the only reference GitHub guarantees immutable.

Full workflow example
steps:
  - uses: sigstore/gh-action-sigstore-python@790bc6befb9d733738f18d8f895854b453640ec9 # v3.5.0

Score breakdown

Security (35%)72
Popularity (20%)39
Maintenance (30%)100
Reliability (15%)66