ActionRank
Check your actions

Automate pull request generation and tagging for releases using tagpr

Actively maintained

Songmu/tagpr · MIT

automatically creates and updates a pull request for unreleased items, tag them when they are merged, and create releases.

★ 307 starsLast commit 11 days agoLatest v1.20.1
B
73
/ 100
Security 62Maintenance 100Popularity 53Reliability 70

Security signals

OpenSSF Scorecard5.4 / 10
SECURITY.md presentNo
Immutable releasesEnabled
Known vulnerabilitiesNone on record

How to use it safely

Recommended: pin to commit SHA
uses: Songmu/tagpr@d1b8138b7a31075141b6cd64103de9485ced7ac9 # v1.20.1

Mutable tags like v1.20.1 can be rewritten to point at malicious commits. Pinning to the full commit SHA is the only reference GitHub guarantees immutable.

Full workflow example
steps:
  - uses: Songmu/tagpr@d1b8138b7a31075141b6cd64103de9485ced7ac9 # v1.20.1

Score breakdown

Security (35%)62
Popularity (20%)53
Maintenance (30%)100
Reliability (15%)70