Automated tests, static analysis, and a clear MIT license provide solid project hygiene. Pinning is weak because all 24 workflow action references are unpinned, while the organization-backed repository remains active enough to avoid abandonment concerns.
62%
Total Score
75
93
The package has made no release in the last 12 months, with the latest release on March 20, 2025, despite a roughly 3-year history. This lowers confidence in ongoing maintenance, although the release history shows prior development rather than immediate abandonment.
There were no commits from any active maintainer in the last 3 months. The repository was pushed more recently, but the observed short-term commit inactivity still weakens evidence of active maintenance.
All 24 analyzed action references are unpinned, which leaves workflow dependencies less reproducible. The audit found no untrusted checkout, script injection, excessive token permissions, or other reported findings, limiting this to a hygiene concern.
We didn't find any vulnerabilities for this package.
No direct dependencies.
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.