{"date":"2026-08-17","repo":{"name":"github.com/PaddlePaddle/Paddle","commit":"0dfb7859cd6dc7777ea5d0c6b481e928a9c12794"},"scorecard":{"version":"v5.5.1-0.20260815060127-d1fab88f5463","commit":"d1fab88f54636ff366076edfc5c239f97b3c8e66"},"score":4.6,"checks":[{"name":"Code-Review","score":10,"reason":"all changesets reviewed","details":null,"documentation":{"short":"Determines if the project requires human code review before pull requests (aka merge requests) are merged.","url":"https://github.com/ossf/scorecard/blob/d1fab88f54636ff366076edfc5c239f97b3c8e66/docs/checks.md#code-review"}},{"name":"Security-Policy","score":10,"reason":"security policy file detected","details":["Info: security policy file detected: SECURITY.md:1","Info: Found linked content: SECURITY.md:1","Info: Found disclosure, vulnerability, and/or timelines in security policy: SECURITY.md:1","Info: Found text in security policy: SECURITY.md:1"],"documentation":{"short":"Determines if the project has published a security policy.","url":"https://github.com/ossf/scorecard/blob/d1fab88f54636ff366076edfc5c239f97b3c8e66/docs/checks.md#security-policy"}},{"name":"Maintained","score":10,"reason":"30 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 10","details":null,"documentation":{"short":"Determines if the project is \"actively maintained\".","url":"https://github.com/ossf/scorecard/blob/d1fab88f54636ff366076edfc5c239f97b3c8e66/docs/checks.md#maintained"}},{"name":"CII-Best-Practices","score":0,"reason":"no effort to earn an OpenSSF best practices badge detected","details":null,"documentation":{"short":"Determines if the project has an OpenSSF (formerly CII) Best Practices Badge.","url":"https://github.com/ossf/scorecard/blob/d1fab88f54636ff366076edfc5c239f97b3c8e66/docs/checks.md#cii-best-practices"}},{"name":"License","score":10,"reason":"license file detected","details":["Info: project has a license file: LICENSE:0","Info: FSF or OSI recognized license: Apache License 2.0: LICENSE:0"],"documentation":{"short":"Determines if the project has defined a license.","url":"https://github.com/ossf/scorecard/blob/d1fab88f54636ff366076edfc5c239f97b3c8e66/docs/checks.md#license"}},{"name":"Dangerous-Workflow","score":0,"reason":"dangerous workflow patterns detected","details":["Warn: script injection with untrusted input ' github.head_ref ': .github/workflows/H-Coverage.yml:629","Warn: script injection with untrusted input ' github.head_ref ': .github/workflows/H-Coverage.yml:521"],"documentation":{"short":"Determines if the project's GitHub Action workflows avoid dangerous patterns.","url":"https://github.com/ossf/scorecard/blob/d1fab88f54636ff366076edfc5c239f97b3c8e66/docs/checks.md#dangerous-workflow"}},{"name":"Packaging","score":-1,"reason":"packaging workflow not detected","details":["Warn: no GitHub/GitLab publishing workflow detected."],"documentation":{"short":"Determines if the project is published as a package that others can easily download, install, easily update, and uninstall.","url":"https://github.com/ossf/scorecard/blob/d1fab88f54636ff366076edfc5c239f97b3c8e66/docs/checks.md#packaging"}},{"name":"Token-Permissions","score":0,"reason":"detected GitHub workflow tokens with excessive permissions","details":["Info: jobLevel 'actions' permission set to 'read': .github/workflows/CI-Build.yml:28","Info: jobLevel 'contents' permission set to 'read': .github/workflows/CI-Build.yml:27","Info: jobLevel 'contents' permission set to 'read': .github/workflows/CI-Windows.yml:26","Info: jobLevel 'contents' permission set to 'read': .github/workflows/CI.yml:26","Info: jobLevel 'contents' permission set to 'read': .github/workflows/CheckPRTemplate.yml:27","Info: jobLevel 'contents' permission set to 'read': .github/workflows/Coverage.yml:40","Info: jobLevel 'actions' permission set to 'read': .github/workflows/Coverage.yml:41","Info: jobLevel 'contents' permission set to 'read': .github/workflows/H-Coverage.yml:41","Info: jobLevel 'actions' permission set to 'read': .github/workflows/H-Coverage.yml:42","Info: jobLevel 'contents' permission set to 'read': .github/workflows/check-bypass-slice.yml:21","Info: jobLevel 'contents' permission set to 'read': .github/workflows/check-bypass.yml:21","Info: topLevel permissions set to 'read-all': .github/workflows/Api-Benchmark-baseline.yml:22","Warn: no topLevel permission defined: .github/workflows/Approval.yml:1","Info: topLevel permissions set to 'read-all': .github/workflows/CI-Build.yml:8","Info: topLevel permissions set to 'read-all': .github/workflows/CI-Windows.yml:8","Info: topLevel permissions set to 'read-all': .github/workflows/CI.yml:8","Warn: no topLevel permission defined: .github/workflows/CheckPRTemplate.yml:1","Warn: no topLevel permission defined: .github/workflows/Codestyle-Check.yml:1","Info: topLevel permissions set to 'read-all': .github/workflows/Coverage.yml:8","Info: topLevel permissions set to 'read-all': .github/workflows/H-Coverage.yml:8","Info: topLevel permissions set to 'read-all': .github/workflows/Night_ALL_Coverage.yml:7","Info: topLevel permissions set to 'read-all': .github/workflows/Slice-baseline.yml:15","Info: topLevel permissions set to 'read-all': .github/workflows/Slice-torch.yml:8","Warn: no topLevel permission defined: .github/workflows/_Api-Benchmark.yml:1","Warn: no topLevel permission defined: .github/workflows/_Auto-Parallel.yml:1","Warn: no topLevel permission defined: .github/workflows/_CE-CINN-Framework.yml:1","Warn: no topLevel permission defined: .github/workflows/_CE-Framework.yml:1","Info: topLevel permissions set to 'read-all': .github/workflows/_Clone-linux.yml:29","Info: topLevel permissions set to 'read-all': .github/workflows/_Clone-windows.yml:14","Warn: no topLevel permission defined: .github/workflows/_Deepmd-pd-test.yml:1","Warn: no topLevel permission defined: .github/workflows/_Distribute-stable-Formers.yml:1","Warn: no topLevel permission defined: .github/workflows/_Distribute-stable-Test.yml:1","Warn: no topLevel permission defined: .github/workflows/_Distribute-stable.yml:1","Warn: no topLevel permission defined: .github/workflows/_Doc-Preview.yml:1","Warn: no topLevel permission defined: .github/workflows/_Inference.yml:1","Warn: no topLevel permission defined: .github/workflows/_Linux-CPU.yml:1","Warn: no topLevel permission defined: .github/workflows/_Linux-DCU.yml:1","Warn: no topLevel permission defined: .github/workflows/_Linux-IXUCA.yml:1","Warn: no topLevel permission defined: .github/workflows/_Linux-NPU.yml:1","Warn: no topLevel permission defined: .github/workflows/_Linux-XPU.yml:1","Warn: no topLevel permission defined: .github/workflows/_Linux-build.yml:1","Warn: no topLevel permission defined: .github/workflows/_Mac.yml:1","Warn: no topLevel permission defined: .github/workflows/_SOT.yml:1","Warn: no topLevel permission defined: .github/workflows/_Slice.yml:1","Warn: no topLevel permission defined: .github/workflows/_Static-Check.yml:1","Info: topLevel permissions set to 'read-all': .github/workflows/_Windows-GPU.yml:11","Info: topLevel permissions set to 'read-all': .github/workflows/_Windows-Inference.yml:11","Info: topLevel permissions set to 'read-all': .github/workflows/_Windows-OPENBLAS.yml:11","Info: found token with 'none' permissions: .github/workflows/approval-review-signal.yml:1","Info: topLevel 'contents' permission set to 'read': .github/workflows/bot-approval-required.yml:13","Info: topLevel 'pull-requests' permission set to 'read': .github/workflows/bot-approval-required.yml:14","Info: topLevel permissions set to 'read-all': .github/workflows/cancel-CI-build.yml:8","Info: topLevel permissions set to 'read-all': .github/workflows/cancel-CI.yml:8","Info: topLevel permissions set to 'read-all': .github/workflows/cancel-coverage.yml:8","Info: topLevel permissions set to 'read-all': .github/workflows/cancel-windows.yml:8","Warn: no topLevel permission defined: .github/workflows/check-bypass-slice.yml:1","Warn: no topLevel permission defined: .github/workflows/check-bypass.yml:1","Warn: topLevel 'contents' permission set to 'write': .github/workflows/cherry-pick.yml:9","Warn: no topLevel permission defined: .github/workflows/cleanup-ccache.yml:1","Warn: no topLevel permission defined: .github/workflows/docker.yml:1","Warn: topLevel 'actions' permission set to 'write': .github/workflows/rerun.yml:11","Info: topLevel 'contents' permission set to 'read': .github/workflows/rerun.yml:12","Info: topLevel 'pull-requests' permission set to 'read': .github/workflows/rerun.yml:13","Warn: no topLevel permission defined: .github/workflows/validate-pir-versions.yml:1","Info: no jobLevel write permissions found"],"documentation":{"short":"Determines if the project's workflows follow the principle of least privilege.","url":"https://github.com/ossf/scorecard/blob/d1fab88f54636ff366076edfc5c239f97b3c8e66/docs/checks.md#token-permissions"}},{"name":"Branch-Protection","score":-1,"reason":"internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md","details":null,"documentation":{"short":"Determines if the default and release branches are protected with GitHub's branch protection settings.","url":"https://github.com/ossf/scorecard/blob/d1fab88f54636ff366076edfc5c239f97b3c8e66/docs/checks.md#branch-protection"}},{"name":"Signed-Releases","score":-1,"reason":"no releases found","details":null,"documentation":{"short":"Determines if the project cryptographically signs release artifacts.","url":"https://github.com/ossf/scorecard/blob/d1fab88f54636ff366076edfc5c239f97b3c8e66/docs/checks.md#signed-releases"}},{"name":"Binary-Artifacts","score":10,"reason":"no binaries found in the repo","details":null,"documentation":{"short":"Determines if the project has generated executable (binary) artifacts in the source repository.","url":"https://github.com/ossf/scorecard/blob/d1fab88f54636ff366076edfc5c239f97b3c8e66/docs/checks.md#binary-artifacts"}},{"name":"Fuzzing","score":0,"reason":"project is not fuzzed","details":["Warn: no fuzzer integrations found"],"documentation":{"short":"Determines if the project uses fuzzing.","url":"https://github.com/ossf/scorecard/blob/d1fab88f54636ff366076edfc5c239f97b3c8e66/docs/checks.md#fuzzing"}},{"name":"SAST","score":0,"reason":"SAST tool is not run on all commits -- score normalized to 0","details":["Warn: 0 commits out of 30 are checked with a SAST tool"],"documentation":{"short":"Determines if the project uses static code analysis.","url":"https://github.com/ossf/scorecard/blob/d1fab88f54636ff366076edfc5c239f97b3c8e66/docs/checks.md#sast"}},{"name":"Pinned-Dependencies","score":0,"reason":"dependency not pinned by hash detected -- score normalized to 0","details":["Info: Possibly incomplete results: error parsing shell code: \"foo(\" must be followed by ): test/ps/test_fl_ps.py:0","Info: Possibly incomplete results: error parsing shell code: a command can only contain words and redirects; encountered (: test/ps/test_gpubox_ps.py:0","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/Approval.yml:36: update your workflow using https://app.stepsecurity.io/secureworkflow/PaddlePaddle/Paddle/Approval.yml/develop?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/CI-Build.yml:36: update your workflow using https://app.stepsecurity.io/secureworkflow/PaddlePaddle/Paddle/CI-Build.yml/develop?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/CI-Windows.yml:34: update your workflow using https://app.stepsecurity.io/secureworkflow/PaddlePaddle/Paddle/CI-Windows.yml/develop?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/CI.yml:34: update your workflow using https://app.stepsecurity.io/secureworkflow/PaddlePaddle/Paddle/CI.yml/develop?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/CheckPRTemplate.yml:30: update your workflow using https://app.stepsecurity.io/secureworkflow/PaddlePaddle/Paddle/CheckPRTemplate.yml/develop?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/Codestyle-Check.yml:33: update your workflow using https://app.stepsecurity.io/secureworkflow/PaddlePaddle/Paddle/Codestyle-Check.yml/develop?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/Codestyle-Check.yml:44: update your workflow using https://app.stepsecurity.io/secureworkflow/PaddlePaddle/Paddle/Codestyle-Check.yml/develop?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/Coverage.yml:397: update your workflow using https://app.stepsecurity.io/secureworkflow/PaddlePaddle/Paddle/Coverage.yml/develop?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/Coverage.yml:49: update your workflow using https://app.stepsecurity.io/secureworkflow/PaddlePaddle/Paddle/Coverage.yml/develop?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/H-Coverage.yml:50: update your workflow using https://app.stepsecurity.io/secureworkflow/PaddlePaddle/Paddle/H-Coverage.yml/develop?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/_Clone-linux.yml:89: update your workflow using https://app.stepsecurity.io/secureworkflow/PaddlePaddle/Paddle/_Clone-linux.yml/develop?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/_Clone-windows.yml:45: update your workflow using https://app.stepsecurity.io/secureworkflow/PaddlePaddle/Paddle/_Clone-windows.yml/develop?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/check-bypass-slice.yml:32: update your workflow using https://app.stepsecurity.io/secureworkflow/PaddlePaddle/Paddle/check-bypass-slice.yml/develop?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/check-bypass.yml:33: update your workflow using https://app.stepsecurity.io/secureworkflow/PaddlePaddle/Paddle/check-bypass.yml/develop?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/cherry-pick.yml:33: update your workflow using https://app.stepsecurity.io/secureworkflow/PaddlePaddle/Paddle/cherry-pick.yml/develop?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/remove-skip-ci-labels.yml:22: update your workflow using https://app.stepsecurity.io/secureworkflow/PaddlePaddle/Paddle/remove-skip-ci-labels.yml/develop?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/remove-skip-ci-labels.yml:42: update your workflow using https://app.stepsecurity.io/secureworkflow/PaddlePaddle/Paddle/remove-skip-ci-labels.yml/develop?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/rerun.yml:25: update your workflow using https://app.stepsecurity.io/secureworkflow/PaddlePaddle/Paddle/rerun.yml/develop?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/rerun.yml:376: update your workflow using https://app.stepsecurity.io/secureworkflow/PaddlePaddle/Paddle/rerun.yml/develop?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/validate-pir-versions.yml:17: update your workflow using https://app.stepsecurity.io/secureworkflow/PaddlePaddle/Paddle/validate-pir-versions.yml/develop?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/validate-pir-versions.yml:48: update your workflow using https://app.stepsecurity.io/secureworkflow/PaddlePaddle/Paddle/validate-pir-versions.yml/develop?enable=pin","Warn: containerImage not pinned by hash: paddle/scripts/musl_build/Dockerfile:16: pin your Docker image by updating python:3.7-alpine3.11 to python:3.7-alpine3.11@sha256:0ddccce8820c89f39cde6c482b3ba8bcad9e6652a060c329b7b963112df0b8e7","Warn: containerImage not pinned by hash: r/Dockerfile:1: pin your Docker image by updating ubuntu:18.04 to ubuntu:18.04@sha256:152dc042452c496007f07ca9127571cb9c29697f42acbfad72324b2bb2e43c98","Warn: containerImage not pinned by hash: tools/dockerfile/Dockerfile.centos:6","Warn: containerImage not pinned by hash: tools/dockerfile/Dockerfile.develop.dtk:3: pin your Docker image by updating sugonhub/kylin:v10-dev to sugonhub/kylin:v10-dev@sha256:239b03d75464f210601174db1d5bd7903c5e573c23342ea8cbcb92979526762a","Warn: containerImage not pinned by hash: tools/dockerfile/Dockerfile.develop.npu:3: pin your Docker image by updating registry.baidubce.com/device/paddle-cpu:ubuntu20-npu-base-x86_64-gcc84 to registry.baidubce.com/device/paddle-cpu:ubuntu20-npu-base-x86_64-gcc84@sha256:537aa0610ec1a0c54e3bc803db2a9485270d1ed3e85cba970778eb07ac9b076f","Warn: containerImage not pinned by hash: tools/dockerfile/Dockerfile.develop.xre:3: pin your Docker image by updating ubuntu:20.04 to ubuntu:20.04@sha256:8feb4d8ca5354def3d8fce243717141ce31e2c428701f6682bd2fafe15388214","Warn: containerImage not pinned by hash: tools/dockerfile/Dockerfile.develop.xre.ubuntu22:3: pin your Docker image by updating ubuntu:22.04 to ubuntu:22.04@sha256:3b06811b2afd352be909dd088a004166d665dc76d38b13eada33522a9d915c6f","Warn: containerImage not pinned by hash: tools/dockerfile/Dockerfile.doc:2: pin your Docker image by updating registry.baidubce.com/paddleopen/fluiddoc-sphinx:20230828-py310-cuda11.8.0-cudnn8-runtime-ubuntu20.04-v3 to registry.baidubce.com/paddleopen/fluiddoc-sphinx:20230828-py310-cuda11.8.0-cudnn8-runtime-ubuntu20.04-v3@sha256:be499f64b23326485b388bd3d08b31cf6034967d0c4be2d06e4fbee7a25dae0b","Warn: containerImage not pinned by hash: tools/dockerfile/Dockerfile.ipu:9","Warn: containerImage not pinned by hash: tools/dockerfile/Dockerfile.release.ubuntu20:4","Warn: containerImage not pinned by hash: tools/dockerfile/Dockerfile.ubuntu20:4","Warn: containerImage not pinned by hash: tools/dockerfile/Dockerfile.ubuntu22:4","Warn: containerImage not pinned by hash: tools/dockerfile/Dockerfile.ubuntu24:4","Warn: containerImage not pinned by hash: tools/dockerfile/Dockerfile.ubuntu24.arm.py312:7: pin your Docker image by updating nvcr.io/nvidia/cuda:13.0.2-cudnn-devel-ubuntu24.04 to nvcr.io/nvidia/cuda:13.0.2-cudnn-devel-ubuntu24.04@sha256:e071e85c52ad91fc9ea24158ff5330876b2d1a5c4ac83ccc6066976835873c01","Warn: containerImage not pinned by hash: tools/dockerfile/Dockerfile.ubuntu24.arm.py313:7: pin your Docker image by updating nvcr.io/nvidia/cuda:13.0.2-cudnn-devel-ubuntu24.04 to nvcr.io/nvidia/cuda:13.0.2-cudnn-devel-ubuntu24.04@sha256:e071e85c52ad91fc9ea24158ff5330876b2d1a5c4ac83ccc6066976835873c01","Warn: containerImage not pinned by hash: tools/dockerfile/manylinux/Dockerfile:3: pin your Docker image by updating amd64/almalinux:8 to amd64/almalinux:8@sha256:46905e02b7204e44aa244756ec7dae8bdf649009765ae686b65b00950729e30f","Warn: containerImage not pinned by hash: tools/dockerfile/manylinux/Dockerfile:46","Warn: containerImage not pinned by hash: tools/dockerfile/manylinux/Dockerfile:51","Warn: containerImage not pinned by hash: tools/dockerfile/manylinux/Dockerfile:56","Warn: containerImage not pinned by hash: tools/dockerfile/manylinux/Dockerfile:61","Warn: containerImage not pinned by hash: tools/dockerfile/manylinux/Dockerfile:68","Warn: containerImage not pinned by hash: tools/dockerfile/manylinux/Dockerfile:78","Warn: containerImage not pinned by hash: tools/dockerfile/manylinux/Dockerfile:82","Warn: containerImage not pinned by hash: tools/dockerfile/manylinux/Dockerfile:86","Warn: containerImage not pinned by hash: tools/dockerfile/manylinux/Dockerfile:90","Warn: containerImage not pinned by hash: tools/dockerfile/manylinux/Dockerfile:94","Warn: containerImage not pinned by hash: tools/dockerfile/manylinux/Dockerfile:99","Warn: containerImage not pinned by hash: tools/dockerfile/manylinux/Dockerfile:104","Warn: containerImage not pinned by hash: tools/dockerfile/manylinux/Dockerfile:111","Warn: containerImage not pinned by hash: tools/dockerfile/manylinux/Dockerfile:134","Warn: containerImage not pinned by hash: tools/dockerfile/manylinux/Dockerfile-118:8: pin your Docker image by updating nvidia/cuda:11.8.0-cudnn8-devel-ubuntu22.04 to nvidia/cuda:11.8.0-cudnn8-devel-ubuntu22.04@sha256:8f9dd0d09d3ad3900357a1cf7f887888b5b74056636cd6ef03c160c3cd4b1d95","Warn: containerImage not pinned by hash: tools/dockerfile/manylinux/Dockerfile-126:8: pin your Docker image by updating nvidia/cuda:12.6.3-cudnn-devel-ubuntu22.04 to nvidia/cuda:12.6.3-cudnn-devel-ubuntu22.04@sha256:b3e7fba84d169f46939f00c25be7d016f712a8d651f4756d6a55e693d84d94f2","Warn: containerImage not pinned by hash: tools/dockerfile/manylinux/Dockerfile-129:7: pin your Docker image by updating nvidia/cuda:12.9.0-cudnn-devel-ubuntu22.04 to nvidia/cuda:12.9.0-cudnn-devel-ubuntu22.04@sha256:67d62b0967a91447f4f1ef22453dac317724e64cd7b29f4ad790216e5e2c3541","Warn: containerImage not pinned by hash: tools/dockerfile/manylinux/Dockerfile-130:7: pin your Docker image by updating nvcr.io/nvidia/cuda:13.0.1-cudnn-devel-ubuntu22.04 to nvcr.io/nvidia/cuda:13.0.1-cudnn-devel-ubuntu22.04@sha256:6ff9753ccda37b8f8d711831310d661afd310254148c35ea29f0cca141c499d7","Warn: containerImage not pinned by hash: tools/dockerfile/manylinux/Dockerfile-132:7: pin your Docker image by updating nvcr.io/nvidia/cuda:13.2.0-cudnn-devel-ubuntu24.04 to nvcr.io/nvidia/cuda:13.2.0-cudnn-devel-ubuntu24.04@sha256:9a8b00be0596b5a2a088249ef1d5ed8e5cdd45bc662a4e6937e57af0cc495d1f","Warn: pipCommand not pinned by hash: paddle/scripts/musl_build/Dockerfile:48-68","Warn: pipCommand not pinned by hash: paddle/scripts/musl_build/Dockerfile:48-68","Warn: pipCommand not pinned by hash: tools/dockerfile/Dockerfile.centos:48-50","Warn: pipCommand not pinned by hash: tools/dockerfile/Dockerfile.centos:48-50","Warn: pipCommand not pinned by hash: tools/dockerfile/Dockerfile.centos:48-50","Warn: pipCommand not pinned by hash: tools/dockerfile/Dockerfile.centos:52-56","Warn: pipCommand not pinned by hash: tools/dockerfile/Dockerfile.centos:52-56","Warn: pipCommand not pinned by hash: tools/dockerfile/Dockerfile.centos:52-56","Warn: goCommand not pinned by hash: tools/dockerfile/Dockerfile.centos:52-56","Warn: pipCommand not pinned by hash: tools/dockerfile/Dockerfile.centos:58-60","Warn: pipCommand not pinned by hash: tools/dockerfile/Dockerfile.centos:58-60","Warn: pipCommand not pinned by hash: tools/dockerfile/Dockerfile.centos:58-60","Warn: downloadThenRun not pinned by hash: tools/dockerfile/Dockerfile.develop.dtk:25-28","Warn: downloadThenRun not pinned by hash: tools/dockerfile/Dockerfile.develop.xre:25-28","Warn: pipCommand not pinned by hash: tools/dockerfile/Dockerfile.doc:21-24","Warn: pipCommand not pinned by hash: tools/dockerfile/Dockerfile.doc:21-24","Warn: pipCommand not pinned by hash: tools/dockerfile/Dockerfile.doc:21-24","Warn: pipCommand not pinned by hash: tools/dockerfile/Dockerfile.doc:21-24","Warn: downloadThenRun not pinned by hash: tools/dockerfile/Dockerfile.ipu:63","Warn: pipCommand not pinned by hash: tools/dockerfile/Dockerfile.ipu:72","Warn: pipCommand not pinned by hash: tools/dockerfile/Dockerfile.ipu:76-77","Warn: pipCommand not pinned by hash: tools/dockerfile/Dockerfile.ipu:80","Warn: pipCommand not pinned by hash: tools/dockerfile/Dockerfile.ubuntu24.arm.py312:86-89","Warn: pipCommand not pinned by hash: tools/dockerfile/Dockerfile.ubuntu24.arm.py312:86-89","Warn: pipCommand not pinned by hash: tools/dockerfile/Dockerfile.ubuntu24.arm.py312:86-89","Warn: pipCommand not pinned by hash: tools/dockerfile/Dockerfile.ubuntu24.arm.py313:88-91","Warn: pipCommand not pinned by hash: tools/dockerfile/Dockerfile.ubuntu24.arm.py313:88-91","Warn: pipCommand not pinned by hash: tools/dockerfile/Dockerfile.ubuntu24.arm.py313:88-91","Warn: pipCommand not pinned by hash: tools/dockerfile/manylinux/Dockerfile:114-118","Warn: pipCommand not pinned by hash: tools/dockerfile/manylinux/Dockerfile:114-118","Warn: pipCommand not pinned by hash: tools/dockerfile/manylinux/Dockerfile:114-118","Warn: pipCommand not pinned by hash: tools/dockerfile/manylinux/Dockerfile:114-118","Warn: pipCommand not pinned by hash: tools/dockerfile/manylinux/Dockerfile:114-118","Warn: pipCommand not pinned by hash: tools/dockerfile/manylinux/Dockerfile:120-124","Warn: pipCommand not pinned by hash: tools/dockerfile/manylinux/Dockerfile:120-124","Warn: pipCommand not pinned by hash: tools/dockerfile/manylinux/Dockerfile:120-124","Warn: pipCommand not pinned by hash: tools/dockerfile/manylinux/Dockerfile:120-124","Warn: pipCommand not pinned by hash: tools/dockerfile/manylinux/Dockerfile:120-124","Warn: goCommand not pinned by hash: tools/dockerfile/manylinux/Dockerfile:125","Warn: pipCommand not pinned by hash: tools/dockerfile/manylinux/Dockerfile-118:66-68","Warn: pipCommand not pinned by hash: tools/dockerfile/manylinux/Dockerfile-118:66-68","Warn: pipCommand not pinned by hash: tools/dockerfile/manylinux/Dockerfile-126:68-70","Warn: pipCommand not pinned by hash: tools/dockerfile/manylinux/Dockerfile-126:68-70","Warn: pipCommand not pinned by hash: tools/dockerfile/manylinux/Dockerfile-129:69-71","Warn: pipCommand not pinned by hash: tools/dockerfile/manylinux/Dockerfile-129:69-71","Warn: pipCommand not pinned by hash: tools/dockerfile/manylinux/Dockerfile-130:69-71","Warn: pipCommand not pinned by hash: tools/dockerfile/manylinux/Dockerfile-130:69-71","Warn: pipCommand not pinned by hash: tools/dockerfile/manylinux/Dockerfile-132:63-79","Warn: pipCommand not pinned by hash: tools/dockerfile/manylinux/Dockerfile-132:107-110","Warn: pipCommand not pinned by hash: tools/dockerfile/manylinux/Dockerfile-132:107-110","Warn: pipCommand not pinned by hash: ci/auto_parallel/ci_auto_parallel.sh:34","Warn: pipCommand not pinned by hash: ci/auto_parallel/ci_distributed_stable.sh:27","Warn: pipCommand not pinned by hash: ci/coverage_test.sh:63","Warn: pipCommand not pinned by hash: ci/coverage_test.sh:67","Warn: pipCommand not pinned by hash: ci/coverage_test.sh:68","Warn: pipCommand not pinned by hash: ci/coverage_test.sh:69","Warn: pipCommand not pinned by hash: ci/coverage_test.sh:78","Warn: pipCommand not pinned by hash: ci/coverage_test.sh:82","Warn: pipCommand not pinned by hash: ci/coverage_test.sh:85","Warn: pipCommand not pinned by hash: ci/dcu_test.sh:26","Warn: pipCommand not pinned by hash: ci/dcu_test.sh:77","Warn: pipCommand not pinned by hash: ci/dcu_test.sh:78","Warn: pipCommand not pinned by hash: ci/dcu_test.sh:79","Warn: pipCommand not pinned by hash: ci/dcu_test.sh:81","Warn: pipCommand not pinned by hash: ci/dcu_test.sh:84","Warn: pipCommand not pinned by hash: ci/distribute_test.sh:102","Warn: pipCommand not pinned by hash: ci/distribute_test.sh:103","Warn: pipCommand not pinned by hash: ci/distribute_test.sh:104","Warn: pipCommand not pinned by hash: ci/distribute_test.sh:109","Warn: pipCommand not pinned by hash: ci/distribute_test.sh:148","Warn: pipCommand not pinned by hash: ci/distribute_test.sh:149","Warn: pipCommand not pinned by hash: ci/distribute_test.sh:150","Warn: pipCommand not pinned by hash: ci/distribute_test.sh:151","Warn: pipCommand not pinned by hash: ci/h-test.sh:29","Warn: pipCommand not pinned by hash: ci/inference_build.sh:22","Warn: pipCommand not pinned by hash: ci/inference_build.sh:23","Warn: pipCommand not pinned by hash: ci/kunlun_test.sh:161","Warn: pipCommand not pinned by hash: ci/kunlun_test.sh:162","Warn: pipCommand not pinned by hash: ci/kunlun_test.sh:216","Warn: pipCommand not pinned by hash: ci/kunlun_test.sh:221","Warn: pipCommand not pinned by hash: ci/kunlun_test.sh:224","Warn: pipCommand not pinned by hash: ci/run_linux_cpu_test.sh:24","Warn: pipCommand not pinned by hash: ci/run_linux_cpu_test.sh:28","Warn: pipCommand not pinned by hash: ci/run_mac_test.sh:235","Warn: pipCommand not pinned by hash: ci/run_setup.sh:45","Warn: pipCommand not pinned by hash: ci/run_setup.sh:48","Warn: pipCommand not pinned by hash: ci/run_setup.sh:184","Warn: pipCommand not pinned by hash: ci/run_setup.sh:201","Warn: pipCommand not pinned by hash: ci/run_setup.sh:219","Warn: pipCommand not pinned by hash: ci/static_check.sh:22","Warn: pipCommand not pinned by hash: ci/static_check.sh:25","Warn: pipCommand not pinned by hash: ci/static_check.sh:46","Warn: pipCommand not pinned by hash: ci/static_check.sh:49","Warn: pipCommand not pinned by hash: ci/static_check.sh:179","Warn: pipCommand not pinned by hash: ci/static_check.sh:180","Warn: pipCommand not pinned by hash: ci/static_check.sh:181","Warn: pipCommand not pinned by hash: ci/static_check.sh:205","Warn: pipCommand not pinned by hash: ci/utils.sh:104","Warn: pipCommand not pinned by hash: ci/utils.sh:408","Warn: pipCommand not pinned by hash: ci/utils.sh:428","Warn: pipCommand not pinned by hash: ci/utils.sh:1193","Warn: pipCommand not pinned by hash: ci/utils.sh:1196","Warn: pipCommand not pinned by hash: ci/utils.sh:1198","Warn: pipCommand not pinned by hash: paddle/scripts/musl_build/build_inside.sh:56","Warn: pipCommand not pinned by hash: paddle/scripts/musl_build/build_inside.sh:93","Warn: pipCommand not pinned by hash: paddle/scripts/musl_build/build_inside.sh:97","Warn: pipCommand not pinned by hash: paddle/scripts/paddle_build.sh:189","Warn: pipCommand not pinned by hash: paddle/scripts/paddle_build.sh:209","Warn: pipCommand not pinned by hash: paddle/scripts/paddle_build.sh:367","Warn: pipCommand not pinned by hash: paddle/scripts/paddle_build.sh:780","Warn: pipCommand not pinned by hash: paddle/scripts/paddle_build.sh:782","Warn: pipCommand not pinned by hash: paddle/scripts/paddle_build.sh:1182","Warn: pipCommand not pinned by hash: paddle/scripts/paddle_build.sh:1185","Warn: pipCommand not pinned by hash: paddle/scripts/paddle_build.sh:1187","Warn: pipCommand not pinned by hash: paddle/scripts/paddle_build.sh:1459","Warn: pipCommand not pinned by hash: paddle/scripts/paddle_build.sh:2181","Warn: pipCommand not pinned by hash: paddle/scripts/paddle_build.sh:2290","Warn: pipCommand not pinned by hash: paddle/scripts/paddle_build.sh:2539","Warn: pipCommand not pinned by hash: paddle/scripts/paddle_build.sh:2767","Warn: pipCommand not pinned by hash: paddle/scripts/paddle_build.sh:3268","Warn: pipCommand not pinned by hash: paddle/scripts/paddle_build.sh:3270","Warn: pipCommand not pinned by hash: paddle/scripts/paddle_build.sh:3273","Warn: pipCommand not pinned by hash: paddle/scripts/paddle_build.sh:3716","Warn: pipCommand not pinned by hash: paddle/scripts/paddle_build.sh:3717","Warn: pipCommand not pinned by hash: paddle/scripts/paddle_build.sh:3718","Warn: pipCommand not pinned by hash: paddle/scripts/paddle_build.sh:3720","Warn: pipCommand not pinned by hash: paddle/scripts/paddle_build.sh:3776","Warn: pipCommand not pinned by hash: paddle/scripts/paddle_build.sh:3779","Warn: pipCommand not pinned by hash: paddle/scripts/paddle_build.sh:3799","Warn: pipCommand not pinned by hash: paddle/scripts/paddle_build.sh:3802","Warn: pipCommand not pinned by hash: paddle/scripts/paddle_build.sh:4204","Warn: pipCommand not pinned by hash: paddle/scripts/paddle_build.sh:4218","Warn: pipCommand not pinned by hash: paddle/scripts/paddle_build.sh:4233","Warn: pipCommand not pinned by hash: paddle/scripts/paddle_build.sh:4474","Warn: pipCommand not pinned by hash: paddle/scripts/paddle_build.sh:4494","Warn: pipCommand not pinned by hash: test/legacy_test/test_fleet_launch_elastic.sh:29","Warn: pipCommand not pinned by hash: tools/auto_parallel/ci_auto_parallel.sh:33","Warn: pipCommand not pinned by hash: tools/auto_parallel/ci_distributed_stable.sh:27","Warn: pipCommand not pinned by hash: tools/check_gpu_kernel_approval.sh:23","Warn: pipCommand not pinned by hash: tools/check_gpu_kernel_approval.sh:26","Warn: pipCommand not pinned by hash: tools/codestyle/pre_commit.sh:19","Warn: downloadThenRun not pinned by hash: tools/dockerfile/manylinux/common/install_cuda.sh:175","Warn: downloadThenRun not pinned by hash: tools/dockerfile/manylinux/common/install_cuda.sh:203","Warn: downloadThenRun not pinned by hash: tools/dockerfile/manylinux/common/install_cuda.sh:231","Warn: downloadThenRun not pinned by hash: tools/dockerfile/manylinux/common/install_cuda.sh:259","Warn: downloadThenRun not pinned by hash: tools/dockerfile/manylinux/common/install_cuda.sh:288","Warn: downloadThenRun not pinned by hash: tools/dockerfile/manylinux/common/install_cuda.sh:316","Warn: downloadThenRun not pinned by hash: tools/dockerfile/manylinux/common/install_cuda.sh:344","Warn: pipCommand not pinned by hash: tools/document_preview.sh:103","Warn: pipCommand not pinned by hash: tools/gpups_test.sh:29","Warn: pipCommand not pinned by hash: tools/op_benchmark.sh:201","Warn: downloadThenRun not pinned by hash: .github/workflows/_Linux-IXUCA.yml:156","Info:   0 out of  18 GitHub-owned GitHubAction dependencies pinned","Info:   0 out of   3 third-party GitHubAction dependencies pinned","Info:   0 out of  35 containerImage dependencies pinned","Info:   2 out of 141 pipCommand dependencies pinned","Info:   0 out of   2 goCommand dependencies pinned","Info:   0 out of  11 downloadThenRun dependencies pinned"],"documentation":{"short":"Determines if the project has declared and pinned the dependencies of its build process.","url":"https://github.com/ossf/scorecard/blob/d1fab88f54636ff366076edfc5c239f97b3c8e66/docs/checks.md#pinned-dependencies"}}]}