{"date":"2026-10-12","repo":{"name":"github.com/PaddlePaddle/Paddle","commit":"19745a0160f61bd0b4d7174ee150a63eacfa6a3f"},"scorecard":{"version":"v5.6.0","commit":"61e84743356275f6ffca23b1b2f2cb945e19eb96"},"score":6.2,"checks":[{"name":"Code-Review","score":10,"reason":"all changesets reviewed","details":null,"documentation":{"url":"https://github.com/ossf/scorecard/blob/61e84743356275f6ffca23b1b2f2cb945e19eb96/docs/checks.md#code-review","short":"Determines if the project requires human code review before pull requests (aka merge requests) are merged."}},{"name":"Maintained","score":10,"reason":"30 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10","details":null,"documentation":{"url":"https://github.com/ossf/scorecard/blob/61e84743356275f6ffca23b1b2f2cb945e19eb96/docs/checks.md#maintained","short":"Determines if the project is \"actively maintained\"."}},{"name":"Security-Policy","score":10,"reason":"security policy file detected","details":["Info: security policy file detected: SECURITY.md:1","Info: Found linked content: SECURITY.md:1","Info: Found disclosure, vulnerability, and/or timelines in security policy: SECURITY.md:1","Info: Found text in security policy: SECURITY.md:1"],"documentation":{"url":"https://github.com/ossf/scorecard/blob/61e84743356275f6ffca23b1b2f2cb945e19eb96/docs/checks.md#security-policy","short":"Determines if the project has published a security policy."}},{"name":"CII-Best-Practices","score":0,"reason":"no effort to earn an OpenSSF best practices badge detected","details":null,"documentation":{"url":"https://github.com/ossf/scorecard/blob/61e84743356275f6ffca23b1b2f2cb945e19eb96/docs/checks.md#cii-best-practices","short":"Determines if the project has an OpenSSF (formerly CII) Best Practices Badge."}},{"name":"Dangerous-Workflow","score":10,"reason":"no dangerous workflow patterns detected","details":null,"documentation":{"url":"https://github.com/ossf/scorecard/blob/61e84743356275f6ffca23b1b2f2cb945e19eb96/docs/checks.md#dangerous-workflow","short":"Determines if the project's GitHub Action workflows avoid dangerous patterns."}},{"name":"Token-Permissions","score":0,"reason":"detected GitHub workflow tokens with excessive permissions","details":["Info: jobLevel 'contents' permission set to 'read': .github/workflows/CheckPRTemplate.yml:27","Info: jobLevel 'contents' permission set to 'read': .github/workflows/check-bypass-slice.yml:21","Info: jobLevel 'contents' permission set to 'read': .github/workflows/check-bypass.yml:21","Info: topLevel permissions set to 'read-all': .github/workflows/Api-Benchmark-baseline.yml:22","Warn: no topLevel permission defined: .github/workflows/Approval.yml:1","Info: topLevel permissions set to 'read-all': .github/workflows/CI-Build.yml:8","Info: topLevel permissions set to 'read-all': .github/workflows/CI.yml:8","Warn: no topLevel permission defined: .github/workflows/CheckPRTemplate.yml:1","Warn: no topLevel permission defined: .github/workflows/Codestyle-Check.yml:1","Info: topLevel permissions set to 'read-all': .github/workflows/Coverage.yml:8","Info: topLevel permissions set to 'read-all': .github/workflows/H-Coverage.yml:8","Info: topLevel permissions set to 'read-all': .github/workflows/Night_ALL_Coverage.yml:7","Info: topLevel permissions set to 'read-all': .github/workflows/Slice-baseline.yml:15","Info: topLevel permissions set to 'read-all': .github/workflows/Slice-torch.yml:8","Warn: no topLevel permission defined: .github/workflows/_Api-Benchmark.yml:1","Warn: no topLevel permission defined: .github/workflows/_Auto-Parallel.yml:1","Warn: no topLevel permission defined: .github/workflows/_CE-CINN-Framework.yml:1","Warn: no topLevel permission defined: .github/workflows/_CE-Framework.yml:1","Info: topLevel permissions set to 'read-all': .github/workflows/_Clone-linux.yml:29","Warn: no topLevel permission defined: .github/workflows/_Deepmd-pd-test.yml:1","Warn: no topLevel permission defined: .github/workflows/_Distribute-stable-Formers.yml:1","Warn: no topLevel permission defined: .github/workflows/_Distribute-stable-Test.yml:1","Warn: no topLevel permission defined: .github/workflows/_Distribute-stable.yml:1","Warn: no topLevel permission defined: .github/workflows/_Doc-Preview.yml:1","Warn: no topLevel permission defined: .github/workflows/_Inference.yml:1","Warn: no topLevel permission defined: .github/workflows/_Linux-CPU.yml:1","Warn: no topLevel permission defined: .github/workflows/_Linux-DCU.yml:1","Warn: no topLevel permission defined: .github/workflows/_Linux-IXUCA.yml:1","Warn: no topLevel permission defined: .github/workflows/_Linux-NPU.yml:1","Warn: no topLevel permission defined: .github/workflows/_Linux-XPU.yml:1","Warn: no topLevel permission defined: .github/workflows/_Linux-build.yml:1","Warn: no topLevel permission defined: .github/workflows/_Mac.yml:1","Warn: no topLevel permission defined: .github/workflows/_SOT.yml:1","Warn: no topLevel permission defined: .github/workflows/_Slice.yml:1","Warn: no topLevel permission defined: .github/workflows/_Static-Check.yml:1","Info: found token with 'none' permissions: .github/workflows/approval-review-signal.yml:1","Info: topLevel 'contents' permission set to 'read': .github/workflows/bot-approval-required.yml:13","Info: topLevel 'pull-requests' permission set to 'read': .github/workflows/bot-approval-required.yml:14","Info: topLevel permissions set to 'read-all': .github/workflows/cancel-CI-build.yml:8","Info: topLevel permissions set to 'read-all': .github/workflows/cancel-CI.yml:8","Info: topLevel permissions set to 'read-all': .github/workflows/cancel-coverage.yml:8","Warn: no topLevel permission defined: .github/workflows/check-bypass-slice.yml:1","Warn: no topLevel permission defined: .github/workflows/check-bypass.yml:1","Warn: topLevel 'contents' permission set to 'write': .github/workflows/cherry-pick.yml:9","Warn: no topLevel permission defined: .github/workflows/cleanup-ccache.yml:1","Info: topLevel permissions set to 'read-all': .github/workflows/code_sync.yml:7","Warn: no topLevel permission defined: .github/workflows/docker.yml:1","Info: topLevel 'pull-requests' permission set to 'read': .github/workflows/rerun.yml:13","Warn: topLevel 'actions' permission set to 'write': .github/workflows/rerun.yml:11","Info: topLevel 'contents' permission set to 'read': .github/workflows/rerun.yml:12","Warn: no topLevel permission defined: .github/workflows/validate-pir-versions.yml:1","Info: no jobLevel write permissions found"],"documentation":{"url":"https://github.com/ossf/scorecard/blob/61e84743356275f6ffca23b1b2f2cb945e19eb96/docs/checks.md#token-permissions","short":"Determines if the project's workflows follow the principle of least privilege."}},{"name":"Packaging","score":-1,"reason":"packaging workflow not detected","details":["Warn: no GitHub/GitLab publishing workflow detected."],"documentation":{"url":"https://github.com/ossf/scorecard/blob/61e84743356275f6ffca23b1b2f2cb945e19eb96/docs/checks.md#packaging","short":"Determines if the project is published as a package that others can easily download, install, easily update, and uninstall."}},{"name":"License","score":10,"reason":"license file detected","details":["Info: project has a license file: LICENSE:0","Info: FSF or OSI recognized license: Apache License 2.0: LICENSE:0"],"documentation":{"url":"https://github.com/ossf/scorecard/blob/61e84743356275f6ffca23b1b2f2cb945e19eb96/docs/checks.md#license","short":"Determines if the project has defined a license."}},{"name":"Branch-Protection","score":-1,"reason":"internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md","details":null,"documentation":{"url":"https://github.com/ossf/scorecard/blob/61e84743356275f6ffca23b1b2f2cb945e19eb96/docs/checks.md#branch-protection","short":"Determines if the default and release branches are protected with GitHub's branch protection settings."}},{"name":"Binary-Artifacts","score":10,"reason":"no binaries found in the repo","details":null,"documentation":{"url":"https://github.com/ossf/scorecard/blob/61e84743356275f6ffca23b1b2f2cb945e19eb96/docs/checks.md#binary-artifacts","short":"Determines if the project has generated executable (binary) artifacts in the source repository."}},{"name":"Signed-Releases","score":-1,"reason":"no releases found","details":null,"documentation":{"url":"https://github.com/ossf/scorecard/blob/61e84743356275f6ffca23b1b2f2cb945e19eb96/docs/checks.md#signed-releases","short":"Determines if the project cryptographically signs release artifacts."}},{"name":"Fuzzing","score":0,"reason":"project is not fuzzed","details":["Warn: no fuzzer integrations found"],"documentation":{"url":"https://github.com/ossf/scorecard/blob/61e84743356275f6ffca23b1b2f2cb945e19eb96/docs/checks.md#fuzzing","short":"Determines if the project uses fuzzing."}},{"name":"SAST","score":0,"reason":"SAST tool is not run on all commits -- score normalized to 0","details":["Warn: 0 commits out of 30 are checked with a SAST tool"],"documentation":{"url":"https://github.com/ossf/scorecard/blob/61e84743356275f6ffca23b1b2f2cb945e19eb96/docs/checks.md#sast","short":"Determines if the project uses static code analysis."}},{"name":"Pinned-Dependencies","score":0,"reason":"dependency not pinned by hash detected -- score normalized to 0","details":["Info: Possibly incomplete results: error parsing shell code: `foo(` must be followed by `)`: test/ps/test_fl_ps.py:0","Info: Possibly incomplete results: error parsing shell code: a command can only contain words and redirects; encountered `(`: test/ps/test_gpubox_ps.py:0","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/Approval.yml:36: update your workflow using https://app.stepsecurity.io/secureworkflow/PaddlePaddle/Paddle/Approval.yml/develop?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/CheckPRTemplate.yml:30: update your workflow using https://app.stepsecurity.io/secureworkflow/PaddlePaddle/Paddle/CheckPRTemplate.yml/develop?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/Codestyle-Check.yml:33: update your workflow using https://app.stepsecurity.io/secureworkflow/PaddlePaddle/Paddle/Codestyle-Check.yml/develop?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/Codestyle-Check.yml:44: update your workflow using https://app.stepsecurity.io/secureworkflow/PaddlePaddle/Paddle/Codestyle-Check.yml/develop?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/Coverage.yml:371: update your workflow using https://app.stepsecurity.io/secureworkflow/PaddlePaddle/Paddle/Coverage.yml/develop?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/_Clone-linux.yml:91: update your workflow using https://app.stepsecurity.io/secureworkflow/PaddlePaddle/Paddle/_Clone-linux.yml/develop?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/check-bypass-slice.yml:32: update your workflow using https://app.stepsecurity.io/secureworkflow/PaddlePaddle/Paddle/check-bypass-slice.yml/develop?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/check-bypass.yml:33: update your workflow using https://app.stepsecurity.io/secureworkflow/PaddlePaddle/Paddle/check-bypass.yml/develop?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/cherry-pick.yml:33: update your workflow using https://app.stepsecurity.io/secureworkflow/PaddlePaddle/Paddle/cherry-pick.yml/develop?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/code_sync.yml:27: update your workflow using https://app.stepsecurity.io/secureworkflow/PaddlePaddle/Paddle/code_sync.yml/develop?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/code_sync.yml:40: update your workflow using https://app.stepsecurity.io/secureworkflow/PaddlePaddle/Paddle/code_sync.yml/develop?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/remove-skip-ci-labels.yml:22: update your workflow using https://app.stepsecurity.io/secureworkflow/PaddlePaddle/Paddle/remove-skip-ci-labels.yml/develop?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/remove-skip-ci-labels.yml:42: update your workflow using https://app.stepsecurity.io/secureworkflow/PaddlePaddle/Paddle/remove-skip-ci-labels.yml/develop?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/rerun.yml:25: update your workflow using https://app.stepsecurity.io/secureworkflow/PaddlePaddle/Paddle/rerun.yml/develop?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/rerun.yml:346: update your workflow using https://app.stepsecurity.io/secureworkflow/PaddlePaddle/Paddle/rerun.yml/develop?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/validate-pir-versions.yml:17: update your workflow using https://app.stepsecurity.io/secureworkflow/PaddlePaddle/Paddle/validate-pir-versions.yml/develop?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/validate-pir-versions.yml:48: update your workflow using https://app.stepsecurity.io/secureworkflow/PaddlePaddle/Paddle/validate-pir-versions.yml/develop?enable=pin","Warn: containerImage not pinned by hash: paddle/scripts/musl_build/Dockerfile:16: pin your Docker image by updating python:3.7-alpine3.11 to python:3.7-alpine3.11@sha256:0ddccce8820c89f39cde6c482b3ba8bcad9e6652a060c329b7b963112df0b8e7","Warn: containerImage not pinned by hash: r/Dockerfile:1: pin your Docker image by updating ubuntu:18.04 to ubuntu:18.04@sha256:152dc042452c496007f07ca9127571cb9c29697f42acbfad72324b2bb2e43c98","Warn: containerImage not pinned by hash: tools/dockerfile/Dockerfile.develop.dtk:3: pin your Docker image by updating sugonhub/kylin:v10-dev to sugonhub/kylin:v10-dev@sha256:239b03d75464f210601174db1d5bd7903c5e573c23342ea8cbcb92979526762a","Warn: containerImage not pinned by hash: tools/dockerfile/Dockerfile.develop.npu:3: pin your Docker image by updating registry.baidubce.com/device/paddle-cpu:ubuntu20-npu-base-x86_64-gcc84 to registry.baidubce.com/device/paddle-cpu:ubuntu20-npu-base-x86_64-gcc84@sha256:537aa0610ec1a0c54e3bc803db2a9485270d1ed3e85cba970778eb07ac9b076f","Warn: containerImage not pinned by hash: tools/dockerfile/Dockerfile.develop.xre:3: pin your Docker image by updating ubuntu:20.04 to ubuntu:20.04@sha256:8feb4d8ca5354def3d8fce243717141ce31e2c428701f6682bd2fafe15388214","Warn: containerImage not pinned by hash: tools/dockerfile/Dockerfile.develop.xre.ubuntu22:3: pin your Docker image by updating ubuntu:22.04 to ubuntu:22.04@sha256:5ec03bb3441e8b0bf3b4f9cd4629a1ae763010dc3035bb8da3ae6cf026486401","Warn: containerImage not pinned by hash: tools/dockerfile/Dockerfile.doc:2: pin your Docker image by updating registry.baidubce.com/paddleopen/fluiddoc-sphinx:20230828-py310-cuda11.8.0-cudnn8-runtime-ubuntu20.04-v3 to registry.baidubce.com/paddleopen/fluiddoc-sphinx:20230828-py310-cuda11.8.0-cudnn8-runtime-ubuntu20.04-v3@sha256:be499f64b23326485b388bd3d08b31cf6034967d0c4be2d06e4fbee7a25dae0b","Warn: containerImage not pinned by hash: tools/dockerfile/Dockerfile.ipu:9","Warn: containerImage not pinned by hash: tools/dockerfile/Dockerfile.release.ubuntu20:4","Warn: containerImage not pinned by hash: tools/dockerfile/Dockerfile.ubuntu20:4","Warn: containerImage not pinned by hash: tools/dockerfile/Dockerfile.ubuntu22:4","Warn: containerImage not pinned by hash: tools/dockerfile/Dockerfile.ubuntu24:4","Warn: containerImage not pinned by hash: tools/dockerfile/Dockerfile.ubuntu24.arm.py312:7: pin your Docker image by updating nvcr.io/nvidia/cuda:13.0.2-cudnn-devel-ubuntu24.04 to nvcr.io/nvidia/cuda:13.0.2-cudnn-devel-ubuntu24.04@sha256:e071e85c52ad91fc9ea24158ff5330876b2d1a5c4ac83ccc6066976835873c01","Warn: containerImage not pinned by hash: tools/dockerfile/Dockerfile.ubuntu24.arm.py313:7: pin your Docker image by updating nvcr.io/nvidia/cuda:13.0.2-cudnn-devel-ubuntu24.04 to nvcr.io/nvidia/cuda:13.0.2-cudnn-devel-ubuntu24.04@sha256:e071e85c52ad91fc9ea24158ff5330876b2d1a5c4ac83ccc6066976835873c01","Warn: containerImage not pinned by hash: tools/dockerfile/manylinux/Dockerfile:3: pin your Docker image by updating amd64/almalinux:8 to amd64/almalinux:8@sha256:1542c00488f8519f0d3d121c55e571d4405fc1058ad3c699b82bdf0ffc26fdfd","Warn: containerImage not pinned by hash: tools/dockerfile/manylinux/Dockerfile:46","Warn: containerImage not pinned by hash: tools/dockerfile/manylinux/Dockerfile:51","Warn: containerImage not pinned by hash: tools/dockerfile/manylinux/Dockerfile:56","Warn: containerImage not pinned by hash: tools/dockerfile/manylinux/Dockerfile:61","Warn: containerImage not pinned by hash: tools/dockerfile/manylinux/Dockerfile:68","Warn: containerImage not pinned by hash: tools/dockerfile/manylinux/Dockerfile:78","Warn: containerImage not pinned by hash: tools/dockerfile/manylinux/Dockerfile:83","Warn: containerImage not pinned by hash: tools/dockerfile/manylinux/Dockerfile:88","Warn: containerImage not pinned by hash: tools/dockerfile/manylinux/Dockerfile:93","Warn: containerImage not pinned by hash: tools/dockerfile/manylinux/Dockerfile:100","Warn: containerImage not pinned by hash: tools/dockerfile/manylinux/Dockerfile:123","Warn: containerImage not pinned by hash: tools/dockerfile/manylinux/Dockerfile-128:7: pin your Docker image by updating nvidia/cuda:12.8.1-cudnn-devel-ubuntu22.04 to nvidia/cuda:12.8.1-cudnn-devel-ubuntu22.04@sha256:ad6d59a3bbf3e82c1c849c9ac09cfc2a3e0bbb8655042fd899be6681b3fe2a85","Warn: containerImage not pinned by hash: tools/dockerfile/manylinux/Dockerfile-129:7: pin your Docker image by updating nvidia/cuda:12.9.0-cudnn-devel-ubuntu22.04 to nvidia/cuda:12.9.0-cudnn-devel-ubuntu22.04@sha256:67d62b0967a91447f4f1ef22453dac317724e64cd7b29f4ad790216e5e2c3541","Warn: containerImage not pinned by hash: tools/dockerfile/manylinux/Dockerfile-130:7: pin your Docker image by updating nvcr.io/nvidia/cuda:13.0.1-cudnn-devel-ubuntu22.04 to nvcr.io/nvidia/cuda:13.0.1-cudnn-devel-ubuntu22.04@sha256:6ff9753ccda37b8f8d711831310d661afd310254148c35ea29f0cca141c499d7","Warn: containerImage not pinned by hash: tools/dockerfile/manylinux/Dockerfile-132:7: pin your Docker image by updating nvcr.io/nvidia/cuda:13.2.0-cudnn-devel-ubuntu24.04 to nvcr.io/nvidia/cuda:13.2.0-cudnn-devel-ubuntu24.04@sha256:9a8b00be0596b5a2a088249ef1d5ed8e5cdd45bc662a4e6937e57af0cc495d1f","Warn: pipCommand not pinned by hash: paddle/scripts/musl_build/Dockerfile:48-68","Warn: pipCommand not pinned by hash: paddle/scripts/musl_build/Dockerfile:48-68","Warn: downloadThenRun not pinned by hash: tools/dockerfile/Dockerfile.develop.dtk:25-28","Warn: downloadThenRun not pinned by hash: tools/dockerfile/Dockerfile.develop.xre:25-28","Warn: pipCommand not pinned by hash: tools/dockerfile/Dockerfile.doc:21-24","Warn: pipCommand not pinned by hash: tools/dockerfile/Dockerfile.doc:21-24","Warn: pipCommand not pinned by hash: tools/dockerfile/Dockerfile.doc:21-24","Warn: pipCommand not pinned by hash: tools/dockerfile/Dockerfile.doc:21-24","Warn: downloadThenRun not pinned by hash: tools/dockerfile/Dockerfile.ipu:63","Warn: pipCommand not pinned by hash: tools/dockerfile/Dockerfile.ipu:72","Warn: pipCommand not pinned by hash: tools/dockerfile/Dockerfile.ipu:76-77","Warn: pipCommand not pinned by hash: tools/dockerfile/Dockerfile.ipu:80","Warn: pipCommand not pinned by hash: tools/dockerfile/Dockerfile.ubuntu24.arm.py312:86-89","Warn: pipCommand not pinned by hash: tools/dockerfile/Dockerfile.ubuntu24.arm.py312:86-89","Warn: pipCommand not pinned by hash: tools/dockerfile/Dockerfile.ubuntu24.arm.py312:86-89","Warn: pipCommand not pinned by hash: tools/dockerfile/Dockerfile.ubuntu24.arm.py313:88-91","Warn: pipCommand not pinned by hash: tools/dockerfile/Dockerfile.ubuntu24.arm.py313:88-91","Warn: pipCommand not pinned by hash: tools/dockerfile/Dockerfile.ubuntu24.arm.py313:88-91","Warn: pipCommand not pinned by hash: tools/dockerfile/manylinux/Dockerfile:103-107","Warn: pipCommand not pinned by hash: tools/dockerfile/manylinux/Dockerfile:103-107","Warn: pipCommand not pinned by hash: tools/dockerfile/manylinux/Dockerfile:103-107","Warn: pipCommand not pinned by hash: tools/dockerfile/manylinux/Dockerfile:103-107","Warn: pipCommand not pinned by hash: tools/dockerfile/manylinux/Dockerfile:103-107","Warn: pipCommand not pinned by hash: tools/dockerfile/manylinux/Dockerfile:109-113","Warn: pipCommand not pinned by hash: tools/dockerfile/manylinux/Dockerfile:109-113","Warn: pipCommand not pinned by hash: tools/dockerfile/manylinux/Dockerfile:109-113","Warn: pipCommand not pinned by hash: tools/dockerfile/manylinux/Dockerfile:109-113","Warn: pipCommand not pinned by hash: tools/dockerfile/manylinux/Dockerfile:109-113","Warn: goCommand not pinned by hash: tools/dockerfile/manylinux/Dockerfile:114","Warn: pipCommand not pinned by hash: tools/dockerfile/manylinux/Dockerfile-128:69-71","Warn: pipCommand not pinned by hash: tools/dockerfile/manylinux/Dockerfile-128:69-71","Warn: pipCommand not pinned by hash: tools/dockerfile/manylinux/Dockerfile-129:69-71","Warn: pipCommand not pinned by hash: tools/dockerfile/manylinux/Dockerfile-129:69-71","Warn: pipCommand not pinned by hash: tools/dockerfile/manylinux/Dockerfile-130:69-71","Warn: pipCommand not pinned by hash: tools/dockerfile/manylinux/Dockerfile-130:69-71","Warn: pipCommand not pinned by hash: tools/dockerfile/manylinux/Dockerfile-132:63-79","Warn: pipCommand not pinned by hash: tools/dockerfile/manylinux/Dockerfile-132:107-110","Warn: pipCommand not pinned by hash: tools/dockerfile/manylinux/Dockerfile-132:107-110","Warn: pipCommand not pinned by hash: ci/auto_parallel/ci_auto_parallel.sh:34","Warn: pipCommand not pinned by hash: ci/auto_parallel/ci_distributed_stable.sh:27","Warn: pipCommand not pinned by hash: ci/coverage_test.sh:63","Warn: pipCommand not pinned by hash: ci/coverage_test.sh:67","Warn: pipCommand not pinned by hash: ci/coverage_test.sh:68","Warn: pipCommand not pinned by hash: ci/coverage_test.sh:69","Warn: pipCommand not pinned by hash: ci/coverage_test.sh:78","Warn: pipCommand not pinned by hash: ci/coverage_test.sh:82","Warn: pipCommand not pinned by hash: ci/coverage_test.sh:85","Warn: pipCommand not pinned by hash: ci/dcu_test.sh:26","Warn: pipCommand not pinned by hash: ci/dcu_test.sh:77","Warn: pipCommand not pinned by hash: ci/dcu_test.sh:78","Warn: pipCommand not pinned by hash: ci/dcu_test.sh:79","Warn: pipCommand not pinned by hash: ci/dcu_test.sh:81","Warn: pipCommand not pinned by hash: ci/dcu_test.sh:84","Warn: pipCommand not pinned by hash: ci/distribute_test.sh:102","Warn: pipCommand not pinned by hash: ci/distribute_test.sh:103","Warn: pipCommand not pinned by hash: ci/distribute_test.sh:104","Warn: pipCommand not pinned by hash: ci/distribute_test.sh:109","Warn: pipCommand not pinned by hash: ci/distribute_test.sh:148","Warn: pipCommand not pinned by hash: ci/distribute_test.sh:149","Warn: pipCommand not pinned by hash: ci/distribute_test.sh:150","Warn: pipCommand not pinned by hash: ci/distribute_test.sh:151","Warn: pipCommand not pinned by hash: ci/h-test.sh:29","Warn: pipCommand not pinned by hash: ci/inference_build.sh:22","Warn: pipCommand not pinned by hash: ci/inference_build.sh:23","Warn: pipCommand not pinned by hash: ci/kunlun_test.sh:161","Warn: pipCommand not pinned by hash: ci/kunlun_test.sh:162","Warn: pipCommand not pinned by hash: ci/kunlun_test.sh:216","Warn: pipCommand not pinned by hash: ci/kunlun_test.sh:221","Warn: pipCommand not pinned by hash: ci/kunlun_test.sh:224","Warn: pipCommand not pinned by hash: ci/run_linux_cpu_test.sh:24","Warn: pipCommand not pinned by hash: ci/run_linux_cpu_test.sh:28","Warn: pipCommand not pinned by hash: ci/run_mac_test.sh:235","Warn: pipCommand not pinned by hash: ci/run_setup.sh:45","Warn: pipCommand not pinned by hash: ci/run_setup.sh:48","Warn: pipCommand not pinned by hash: ci/run_setup.sh:184","Warn: pipCommand not pinned by hash: ci/run_setup.sh:201","Warn: pipCommand not pinned by hash: ci/run_setup.sh:219","Warn: pipCommand not pinned by hash: ci/static_check.sh:22","Warn: pipCommand not pinned by hash: ci/static_check.sh:25","Warn: pipCommand not pinned by hash: ci/static_check.sh:46","Warn: pipCommand not pinned by hash: ci/static_check.sh:49","Warn: pipCommand not pinned by hash: ci/static_check.sh:179","Warn: pipCommand not pinned by hash: ci/static_check.sh:180","Warn: pipCommand not pinned by hash: ci/static_check.sh:181","Warn: pipCommand not pinned by hash: ci/static_check.sh:205","Warn: pipCommand not pinned by hash: ci/utils.sh:104","Warn: pipCommand not pinned by hash: ci/utils.sh:408","Warn: pipCommand not pinned by hash: ci/utils.sh:428","Warn: pipCommand not pinned by hash: ci/utils.sh:1193","Warn: pipCommand not pinned by hash: ci/utils.sh:1196","Warn: pipCommand not pinned by hash: ci/utils.sh:1198","Warn: pipCommand not pinned by hash: paddle/scripts/musl_build/build_inside.sh:56","Warn: pipCommand not pinned by hash: paddle/scripts/musl_build/build_inside.sh:93","Warn: pipCommand not pinned by hash: paddle/scripts/musl_build/build_inside.sh:97","Warn: pipCommand not pinned by hash: paddle/scripts/paddle_build.sh:189","Warn: pipCommand not pinned by hash: paddle/scripts/paddle_build.sh:209","Warn: pipCommand not pinned by hash: paddle/scripts/paddle_build.sh:367","Warn: pipCommand not pinned by hash: paddle/scripts/paddle_build.sh:780","Warn: pipCommand not pinned by hash: paddle/scripts/paddle_build.sh:782","Warn: pipCommand not pinned by hash: paddle/scripts/paddle_build.sh:1182","Warn: pipCommand not pinned by hash: paddle/scripts/paddle_build.sh:1185","Warn: pipCommand not pinned by hash: paddle/scripts/paddle_build.sh:1187","Warn: pipCommand not pinned by hash: paddle/scripts/paddle_build.sh:1459","Warn: pipCommand not pinned by hash: paddle/scripts/paddle_build.sh:2181","Warn: pipCommand not pinned by hash: paddle/scripts/paddle_build.sh:2290","Warn: pipCommand not pinned by hash: paddle/scripts/paddle_build.sh:2539","Warn: pipCommand not pinned by hash: paddle/scripts/paddle_build.sh:2767","Warn: pipCommand not pinned by hash: paddle/scripts/paddle_build.sh:3268","Warn: pipCommand not pinned by hash: paddle/scripts/paddle_build.sh:3270","Warn: pipCommand not pinned by hash: paddle/scripts/paddle_build.sh:3273","Warn: pipCommand not pinned by hash: paddle/scripts/paddle_build.sh:3716","Warn: pipCommand not pinned by hash: paddle/scripts/paddle_build.sh:3717","Warn: pipCommand not pinned by hash: paddle/scripts/paddle_build.sh:3718","Warn: pipCommand not pinned by hash: paddle/scripts/paddle_build.sh:3720","Warn: pipCommand not pinned by hash: paddle/scripts/paddle_build.sh:3776","Warn: pipCommand not pinned by hash: paddle/scripts/paddle_build.sh:3779","Warn: pipCommand not pinned by hash: paddle/scripts/paddle_build.sh:3799","Warn: pipCommand not pinned by hash: paddle/scripts/paddle_build.sh:3802","Warn: pipCommand not pinned by hash: paddle/scripts/paddle_build.sh:4204","Warn: pipCommand not pinned by hash: paddle/scripts/paddle_build.sh:4218","Warn: pipCommand not pinned by hash: paddle/scripts/paddle_build.sh:4233","Warn: pipCommand not pinned by hash: paddle/scripts/paddle_build.sh:4474","Warn: pipCommand not pinned by hash: paddle/scripts/paddle_build.sh:4494","Warn: pipCommand not pinned by hash: test/legacy_test/test_fleet_launch_elastic.sh:29","Warn: pipCommand not pinned by hash: tools/auto_parallel/ci_auto_parallel.sh:33","Warn: pipCommand not pinned by hash: tools/auto_parallel/ci_distributed_stable.sh:27","Warn: pipCommand not pinned by hash: tools/check_gpu_kernel_approval.sh:23","Warn: pipCommand not pinned by hash: tools/check_gpu_kernel_approval.sh:26","Warn: pipCommand not pinned by hash: tools/codestyle/pre_commit.sh:19","Warn: downloadThenRun not pinned by hash: tools/dockerfile/manylinux/common/install_cuda.sh:95","Warn: downloadThenRun not pinned by hash: tools/dockerfile/manylinux/common/install_cuda.sh:120","Warn: downloadThenRun not pinned by hash: tools/dockerfile/manylinux/common/install_cuda.sh:148","Warn: downloadThenRun not pinned by hash: tools/dockerfile/manylinux/common/install_cuda.sh:176","Warn: pipCommand not pinned by hash: tools/document_preview.sh:103","Warn: pipCommand not pinned by hash: tools/gpups_test.sh:29","Warn: pipCommand not pinned by hash: tools/op_benchmark.sh:201","Warn: downloadThenRun not pinned by hash: .github/workflows/_Linux-IXUCA.yml:156","Info:   0 out of  14 GitHub-owned GitHubAction dependencies pinned","Info:   0 out of   3 third-party GitHubAction dependencies pinned","Info:   2 out of 130 pipCommand dependencies pinned","Info:   0 out of   8 downloadThenRun dependencies pinned","Info:   0 out of   1 goCommand dependencies pinned","Info:   0 out of  30 containerImage dependencies pinned"],"documentation":{"url":"https://github.com/ossf/scorecard/blob/61e84743356275f6ffca23b1b2f2cb945e19eb96/docs/checks.md#pinned-dependencies","short":"Determines if the project has declared and pinned the dependencies of its build process."}}]}