{"date":"2026-08-17","repo":{"name":"github.com/PaddlePaddle/PaddleOCR","commit":"2661c7c0ef5c613e8f93c6e93b2e052399f0f854"},"scorecard":{"version":"v5.5.1-0.20260815060127-d1fab88f5463","commit":"d1fab88f54636ff366076edfc5c239f97b3c8e66"},"score":5,"checks":[{"name":"Code-Review","score":5,"reason":"Found 17/30 approved changesets -- score normalized to 5","details":null,"documentation":{"short":"Determines if the project requires human code review before pull requests (aka merge requests) are merged.","url":"https://github.com/ossf/scorecard/blob/d1fab88f54636ff366076edfc5c239f97b3c8e66/docs/checks.md#code-review"}},{"name":"Maintained","score":10,"reason":"30 commit(s) and 7 issue activity found in the last 90 days -- score normalized to 10","details":null,"documentation":{"short":"Determines if the project is \"actively maintained\".","url":"https://github.com/ossf/scorecard/blob/d1fab88f54636ff366076edfc5c239f97b3c8e66/docs/checks.md#maintained"}},{"name":"Dangerous-Workflow","score":10,"reason":"no dangerous workflow patterns detected","details":null,"documentation":{"short":"Determines if the project's GitHub Action workflows avoid dangerous patterns.","url":"https://github.com/ossf/scorecard/blob/d1fab88f54636ff366076edfc5c239f97b3c8e66/docs/checks.md#dangerous-workflow"}},{"name":"CII-Best-Practices","score":0,"reason":"no effort to earn an OpenSSF best practices badge detected","details":null,"documentation":{"short":"Determines if the project has an OpenSSF (formerly CII) Best Practices Badge.","url":"https://github.com/ossf/scorecard/blob/d1fab88f54636ff366076edfc5c239f97b3c8e66/docs/checks.md#cii-best-practices"}},{"name":"Token-Permissions","score":0,"reason":"detected GitHub workflow tokens with excessive permissions","details":["Warn: topLevel 'contents' permission set to 'write': .github/workflows/build_publish_develop_docs.yml:8","Warn: topLevel 'contents' permission set to 'write': .github/workflows/build_publish_release_docs.yml:8","Warn: no topLevel permission defined: .github/workflows/close_inactive_issues.yml:1","Warn: no topLevel permission defined: .github/workflows/codestyle.yml:1","Warn: no topLevel permission defined: .github/workflows/docs_anchor_check.yml:1","Warn: no topLevel permission defined: .github/workflows/link_check.yml:1","Info: topLevel 'contents' permission set to 'read': .github/workflows/python_publish.yml:16","Info: topLevel 'contents' permission set to 'read': .github/workflows/test_gpu.yml:19","Info: topLevel 'contents' permission set to 'read': .github/workflows/tests.yml:10","Info: no jobLevel write permissions found"],"documentation":{"short":"Determines if the project's workflows follow the principle of least privilege.","url":"https://github.com/ossf/scorecard/blob/d1fab88f54636ff366076edfc5c239f97b3c8e66/docs/checks.md#token-permissions"}},{"name":"Security-Policy","score":0,"reason":"security policy file not detected","details":["Warn: no security policy file detected","Warn: no security file to analyze","Warn: no security file to analyze","Warn: no security file to analyze"],"documentation":{"short":"Determines if the project has published a security policy.","url":"https://github.com/ossf/scorecard/blob/d1fab88f54636ff366076edfc5c239f97b3c8e66/docs/checks.md#security-policy"}},{"name":"Binary-Artifacts","score":8,"reason":"binaries present in source code","details":["Warn: binary detected: deploy/android_demo/gradle/wrapper/gradle-wrapper.jar:1","Warn: binary detected: deploy/ppocr-android/gradle/wrapper/gradle-wrapper.jar:1"],"documentation":{"short":"Determines if the project has generated executable (binary) artifacts in the source repository.","url":"https://github.com/ossf/scorecard/blob/d1fab88f54636ff366076edfc5c239f97b3c8e66/docs/checks.md#binary-artifacts"}},{"name":"License","score":10,"reason":"license file detected","details":["Info: project has a license file: LICENSE:0","Info: FSF or OSI recognized license: Apache License 2.0: LICENSE:0"],"documentation":{"short":"Determines if the project has defined a license.","url":"https://github.com/ossf/scorecard/blob/d1fab88f54636ff366076edfc5c239f97b3c8e66/docs/checks.md#license"}},{"name":"Packaging","score":10,"reason":"packaging workflow detected","details":["Info: Project packages its releases by way of GitHub Actions.: .github/workflows/python_publish.yml:19"],"documentation":{"short":"Determines if the project is published as a package that others can easily download, install, easily update, and uninstall.","url":"https://github.com/ossf/scorecard/blob/d1fab88f54636ff366076edfc5c239f97b3c8e66/docs/checks.md#packaging"}},{"name":"Branch-Protection","score":-1,"reason":"internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md","details":null,"documentation":{"short":"Determines if the default and release branches are protected with GitHub's branch protection settings.","url":"https://github.com/ossf/scorecard/blob/d1fab88f54636ff366076edfc5c239f97b3c8e66/docs/checks.md#branch-protection"}},{"name":"Signed-Releases","score":-1,"reason":"no releases found","details":null,"documentation":{"short":"Determines if the project cryptographically signs release artifacts.","url":"https://github.com/ossf/scorecard/blob/d1fab88f54636ff366076edfc5c239f97b3c8e66/docs/checks.md#signed-releases"}},{"name":"Fuzzing","score":0,"reason":"project is not fuzzed","details":["Warn: no fuzzer integrations found"],"documentation":{"short":"Determines if the project uses fuzzing.","url":"https://github.com/ossf/scorecard/blob/d1fab88f54636ff366076edfc5c239f97b3c8e66/docs/checks.md#fuzzing"}},{"name":"SAST","score":0,"reason":"SAST tool is not run on all commits -- score normalized to 0","details":["Warn: 0 commits out of 27 are checked with a SAST tool"],"documentation":{"short":"Determines if the project uses static code analysis.","url":"https://github.com/ossf/scorecard/blob/d1fab88f54636ff366076edfc5c239f97b3c8e66/docs/checks.md#sast"}},{"name":"Pinned-Dependencies","score":0,"reason":"dependency not pinned by hash detected -- score normalized to 0","details":["Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build_publish_develop_docs.yml:13: update your workflow using https://app.stepsecurity.io/secureworkflow/PaddlePaddle/PaddleOCR/build_publish_develop_docs.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build_publish_develop_docs.yml:18: update your workflow using https://app.stepsecurity.io/secureworkflow/PaddlePaddle/PaddleOCR/build_publish_develop_docs.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build_publish_develop_docs.yml:22: update your workflow using https://app.stepsecurity.io/secureworkflow/PaddlePaddle/PaddleOCR/build_publish_develop_docs.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build_publish_release_docs.yml:13: update your workflow using https://app.stepsecurity.io/secureworkflow/PaddlePaddle/PaddleOCR/build_publish_release_docs.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build_publish_release_docs.yml:18: update your workflow using https://app.stepsecurity.io/secureworkflow/PaddlePaddle/PaddleOCR/build_publish_release_docs.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build_publish_release_docs.yml:22: update your workflow using https://app.stepsecurity.io/secureworkflow/PaddlePaddle/PaddleOCR/build_publish_release_docs.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/close_inactive_issues.yml:13: update your workflow using https://app.stepsecurity.io/secureworkflow/PaddlePaddle/PaddleOCR/close_inactive_issues.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/codestyle.yml:15: update your workflow using https://app.stepsecurity.io/secureworkflow/PaddlePaddle/PaddleOCR/codestyle.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/codestyle.yml:21: update your workflow using https://app.stepsecurity.io/secureworkflow/PaddlePaddle/PaddleOCR/codestyle.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/codestyle.yml:27: update your workflow using https://app.stepsecurity.io/secureworkflow/PaddlePaddle/PaddleOCR/codestyle.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/docs_anchor_check.yml:15: update your workflow using https://app.stepsecurity.io/secureworkflow/PaddlePaddle/PaddleOCR/docs_anchor_check.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/docs_anchor_check.yml:19: update your workflow using https://app.stepsecurity.io/secureworkflow/PaddlePaddle/PaddleOCR/docs_anchor_check.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/docs_anchor_check.yml:23: update your workflow using https://app.stepsecurity.io/secureworkflow/PaddlePaddle/PaddleOCR/docs_anchor_check.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/link_check.yml:16: update your workflow using https://app.stepsecurity.io/secureworkflow/PaddlePaddle/PaddleOCR/link_check.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/link_check.yml:18: update your workflow using https://app.stepsecurity.io/secureworkflow/PaddlePaddle/PaddleOCR/link_check.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/python_publish.yml:24: update your workflow using https://app.stepsecurity.io/secureworkflow/PaddlePaddle/PaddleOCR/python_publish.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/python_publish.yml:26: update your workflow using https://app.stepsecurity.io/secureworkflow/PaddlePaddle/PaddleOCR/python_publish.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/test_gpu.yml:27: update your workflow using https://app.stepsecurity.io/secureworkflow/PaddlePaddle/PaddleOCR/test_gpu.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/tests.yml:18: update your workflow using https://app.stepsecurity.io/secureworkflow/PaddlePaddle/PaddleOCR/tests.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/tests.yml:33: update your workflow using https://app.stepsecurity.io/secureworkflow/PaddlePaddle/PaddleOCR/tests.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/tests.yml:35: update your workflow using https://app.stepsecurity.io/secureworkflow/PaddlePaddle/PaddleOCR/tests.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/tests.yml:40: update your workflow using https://app.stepsecurity.io/secureworkflow/PaddlePaddle/PaddleOCR/tests.yml/main?enable=pin","Warn: containerImage not pinned by hash: deploy/docker/hubserving/cpu/Dockerfile:2: pin your Docker image by updating registry.baidubce.com/paddlepaddle/paddle:2.0.0 to registry.baidubce.com/paddlepaddle/paddle:2.0.0@sha256:f33d1b340bf7680a5c2eec57b932934cb8afc5656cf4e8596941674c827ec309","Warn: containerImage not pinned by hash: deploy/docker/hubserving/gpu/Dockerfile:2: pin your Docker image by updating registry.baidubce.com/paddlepaddle/paddle:2.0.0-gpu-cuda10.1-cudnn7 to registry.baidubce.com/paddlepaddle/paddle:2.0.0-gpu-cuda10.1-cudnn7@sha256:0b099b511d69f6cea151e848251aa1292407b8083edf8878d309045c01421b8c","Warn: containerImage not pinned by hash: deploy/paddleocr_vl_docker/accelerators/amd-gpu/pipeline.Dockerfile:1: pin your Docker image by updating vivienfanghua/vllm_paddle:base to vivienfanghua/vllm_paddle:base@sha256:0af2fa03bb2c6dc6b26a0d5f3aa2ee26660f35145014c69d983e48858ecb1b28","Warn: containerImage not pinned by hash: deploy/paddleocr_vl_docker/accelerators/amd-gpu/vlm.Dockerfile:4: pin your Docker image by updating rocm/vllm-dev:nightly_main_20260125 to rocm/vllm-dev:nightly_main_20260125@sha256:910daee77eac7c178070109f892955fb6974f39ee351490a83c47f62e76b1e9b","Warn: containerImage not pinned by hash: deploy/paddleocr_vl_docker/accelerators/amd-gpu/vlm.Dockerfile:7","Warn: containerImage not pinned by hash: deploy/paddleocr_vl_docker/accelerators/huawei-npu/pipeline.Dockerfile:6: pin your Docker image by updating ccr-2vdh3abv-pub.cnc.bj.baidubce.com/device/paddle-npu:cann800-ubuntu20-npu-910b-base-x86_64-gcc84 to ccr-2vdh3abv-pub.cnc.bj.baidubce.com/device/paddle-npu:cann800-ubuntu20-npu-910b-base-x86_64-gcc84@sha256:eb81c58a22ddc1fc6ba4c54784575a97b3fb5928e6bbaa371288d5dcc4905268","Warn: containerImage not pinned by hash: deploy/paddleocr_vl_docker/accelerators/huawei-npu/pipeline.Dockerfile:12: pin your Docker image by updating ccr-2vdh3abv-pub.cnc.bj.baidubce.com/device/paddle-npu:cann800-ubuntu20-npu-910b-base-aarch64-gcc84 to ccr-2vdh3abv-pub.cnc.bj.baidubce.com/device/paddle-npu:cann800-ubuntu20-npu-910b-base-aarch64-gcc84@sha256:9bbc08c1bed9c064f0775da4a7bd1c857fa33d0d51bcd705e6829f4cbcf86911","Warn: containerImage not pinned by hash: deploy/paddleocr_vl_docker/accelerators/huawei-npu/pipeline.Dockerfile:18","Warn: containerImage not pinned by hash: deploy/paddleocr_vl_docker/accelerators/huawei-npu/vlm.Dockerfile:6: pin your Docker image by updating ccr-2vdh3abv-pub.cnc.bj.baidubce.com/paddlepaddle/paddlex-vllm-huawei-npu:0.12.0rc1 to ccr-2vdh3abv-pub.cnc.bj.baidubce.com/paddlepaddle/paddlex-vllm-huawei-npu:0.12.0rc1@sha256:fc752b59bfbfe5665b2cd2ec2c7321d8ee749f0cc86dc6b8a56c416a15ce556c","Warn: containerImage not pinned by hash: deploy/paddleocr_vl_docker/accelerators/huawei-npu/vlm.Dockerfile:9","Warn: containerImage not pinned by hash: deploy/paddleocr_vl_docker/accelerators/hygon-dcu/pipeline.Dockerfile:3: pin your Docker image by updating ccr-2vdh3abv-pub.cnc.bj.baidubce.com/paddlepaddle/paddle-dcu:dtk24.04.1-kylinv10-gcc82 to ccr-2vdh3abv-pub.cnc.bj.baidubce.com/paddlepaddle/paddle-dcu:dtk24.04.1-kylinv10-gcc82@sha256:a22380ebb538b44571acc54d6db58e28a72fa3d31692286a9f42a111ac7a6b52","Warn: containerImage not pinned by hash: deploy/paddleocr_vl_docker/accelerators/hygon-dcu/vlm.Dockerfile:6: pin your Docker image by updating image.sourcefind.cn:5000/dcu/admin/base/vllm:0.9.2-ubuntu22.04-dtk25.04.2-py3.10 to image.sourcefind.cn:5000/dcu/admin/base/vllm:0.9.2-ubuntu22.04-dtk25.04.2-py3.10@sha256:b4f64f1e50e37e8f505271cdc7038dcf6d2bf4ce5e6c6542e72486385847bebd","Warn: containerImage not pinned by hash: deploy/paddleocr_vl_docker/accelerators/hygon-dcu/vlm.Dockerfile:9","Warn: containerImage not pinned by hash: deploy/paddleocr_vl_docker/accelerators/iluvatar-gpu/pipeline.Dockerfile:3: pin your Docker image by updating ccr-2vdh3abv-pub.cnc.bj.baidubce.com/device/paddle-ixuca:3.3.0 to ccr-2vdh3abv-pub.cnc.bj.baidubce.com/device/paddle-ixuca:3.3.0@sha256:c7d5dfca3db1255fb541247cfb3dff84e8cef7df21f155a7c18a22673aa82110","Warn: containerImage not pinned by hash: deploy/paddleocr_vl_docker/accelerators/iluvatar-gpu/vlm.Dockerfile:6: pin your Docker image by updating ccr-2vdh3abv-pub.cnc.bj.baidubce.com/device/paddle-ixuca:paddle-ocr-vl-1107 to ccr-2vdh3abv-pub.cnc.bj.baidubce.com/device/paddle-ixuca:paddle-ocr-vl-1107@sha256:a057708458b3b30cfb49dd205f401dfe3f055a9b0cc55f2fd2b645a3d4753557","Warn: containerImage not pinned by hash: deploy/paddleocr_vl_docker/accelerators/iluvatar-gpu/vlm.Dockerfile:12","Warn: containerImage not pinned by hash: deploy/paddleocr_vl_docker/accelerators/intel-gpu/pipeline.Dockerfile:1: pin your Docker image by updating intel/llm-scaler-vllm:0.11.1-b7 to intel/llm-scaler-vllm:0.11.1-b7@sha256:02d5f2c93483204256337b3a48d799dda186c017b8abe9fd4eb9a0b956b38664","Warn: containerImage not pinned by hash: deploy/paddleocr_vl_docker/accelerators/intel-gpu/vlm.Dockerfile:4: pin your Docker image by updating intel/llm-scaler-vllm:0.11.1-b7 to intel/llm-scaler-vllm:0.11.1-b7@sha256:02d5f2c93483204256337b3a48d799dda186c017b8abe9fd4eb9a0b956b38664","Warn: containerImage not pinned by hash: deploy/paddleocr_vl_docker/accelerators/intel-gpu/vlm.Dockerfile:7","Warn: containerImage not pinned by hash: deploy/paddleocr_vl_docker/accelerators/kunlunxin-xpu/pipeline.Dockerfile:3: pin your Docker image by updating ccr-2vdh3abv-pub.cnc.bj.baidubce.com/device/paddle-xpu:ubuntu20-x86_64-gcc84-py310 to ccr-2vdh3abv-pub.cnc.bj.baidubce.com/device/paddle-xpu:ubuntu20-x86_64-gcc84-py310@sha256:f1053c5e00649bc050a1b43a32f9c8d15ce00c066a3a27531c53e842e4fdb615","Warn: containerImage not pinned by hash: deploy/paddleocr_vl_docker/accelerators/kunlunxin-xpu/vlm.Dockerfile:6: pin your Docker image by updating ccr-2vdh3abv-pub.cnc.bj.baidubce.com/paddlepaddle/fastdeploy-xpu:2.3.0 to ccr-2vdh3abv-pub.cnc.bj.baidubce.com/paddlepaddle/fastdeploy-xpu:2.3.0@sha256:f332a2fcde86c1d98878877cc23dd95b96498dbabee9785aef4fcbc30fc2f4e8","Warn: containerImage not pinned by hash: deploy/paddleocr_vl_docker/accelerators/kunlunxin-xpu/vlm.Dockerfile:9","Warn: containerImage not pinned by hash: deploy/paddleocr_vl_docker/accelerators/metax-gpu/pipeline.Dockerfile:3: pin your Docker image by updating ccr-2vdh3abv-pub.cnc.bj.baidubce.com/paddlepaddle/paddlex-paddle-metax-gpu:3.3.0 to ccr-2vdh3abv-pub.cnc.bj.baidubce.com/paddlepaddle/paddlex-paddle-metax-gpu:3.3.0@sha256:a6901d9f31deaf67e395ff36569c6a7329ec8b2a2d88f3a14c9a472b61355d5c","Warn: containerImage not pinned by hash: deploy/paddleocr_vl_docker/accelerators/metax-gpu/vlm.Dockerfile:6: pin your Docker image by updating ccr-2vdh3abv-pub.cnc.bj.baidubce.com/paddlepaddle/paddlex-fastdeploy-metax-gpu:2.3.0 to ccr-2vdh3abv-pub.cnc.bj.baidubce.com/paddlepaddle/paddlex-fastdeploy-metax-gpu:2.3.0@sha256:26fd8667ac70d6850f9b54cf9084298464712da0e19093442b64077c36656c8c","Warn: containerImage not pinned by hash: deploy/paddleocr_vl_docker/accelerators/metax-gpu/vlm.Dockerfile:9","Warn: containerImage not pinned by hash: deploy/paddleocr_vl_docker/accelerators/nvidia-gpu-sm120/pipeline.Dockerfile:1: pin your Docker image by updating python:3.10 to python:3.10@sha256:7592f66a25f37c4e88ac9d1eee26b0fd7b6d5d56ace531ffa6aaf3a5317cde27","Warn: containerImage not pinned by hash: deploy/paddleocr_vl_docker/accelerators/nvidia-gpu-sm120/vlm.Dockerfile:4: pin your Docker image by updating ccr-2vdh3abv-pub.cnc.bj.baidubce.com/paddlepaddle/paddlex-genai-vllm-server:latest-sm120 to ccr-2vdh3abv-pub.cnc.bj.baidubce.com/paddlepaddle/paddlex-genai-vllm-server:latest-sm120@sha256:0bf80278a86e8f2c911ec02f2ef298f6699a85a2db8fe84bc337e5d8fddf3c8d","Warn: containerImage not pinned by hash: deploy/paddleocr_vl_docker/accelerators/nvidia-gpu-sm120/vlm.Dockerfile:7","Warn: containerImage not pinned by hash: deploy/paddleocr_vl_docker/accelerators/nvidia-gpu/pipeline.Dockerfile:1: pin your Docker image by updating python:3.10 to python:3.10@sha256:7592f66a25f37c4e88ac9d1eee26b0fd7b6d5d56ace531ffa6aaf3a5317cde27","Warn: containerImage not pinned by hash: deploy/paddleocr_vl_docker/accelerators/nvidia-gpu/vlm.Dockerfile:4: pin your Docker image by updating ccr-2vdh3abv-pub.cnc.bj.baidubce.com/paddlepaddle/paddlex-genai-vllm-server:latest to ccr-2vdh3abv-pub.cnc.bj.baidubce.com/paddlepaddle/paddlex-genai-vllm-server:latest@sha256:18defea8c4e2d829d6b9db3a616ad6023ad12ae2d8a243a4a6fae9c750814603","Warn: containerImage not pinned by hash: deploy/paddleocr_vl_docker/accelerators/nvidia-gpu/vlm.Dockerfile:7: pin your Docker image by updating ccr-2vdh3abv-pub.cnc.bj.baidubce.com/paddlepaddle/fastdeploy-cuda-12.6:2.3.0 to ccr-2vdh3abv-pub.cnc.bj.baidubce.com/paddlepaddle/fastdeploy-cuda-12.6:2.3.0@sha256:ead5d79d9ff6a1d9a8d0b1024b7816d265b1648bfc5aa937d60e19a65bafb16a","Warn: containerImage not pinned by hash: deploy/paddleocr_vl_docker/accelerators/nvidia-gpu/vlm.Dockerfile:10","Warn: containerImage not pinned by hash: deploy/paddleocr_vl_docker/hps/gateway.Dockerfile:1: pin your Docker image by updating python:3.10-slim to python:3.10-slim@sha256:a78e4529630cfe8c5199cafd6e0c28ee1579a13f86274396d8b6b2d80367aa3a","Warn: containerImage not pinned by hash: deploy/paddleocr_vl_docker/hps/pipeline.Dockerfile:4: pin your Docker image by updating ccr-2vdh3abv-pub.cnc.bj.baidubce.com/paddlex/hps:paddlex3.6-gpu to ccr-2vdh3abv-pub.cnc.bj.baidubce.com/paddlex/hps:paddlex3.6-gpu@sha256:033e882c841cc6ef772b06b4b34d60f86140a33d189680cc8f9a14d7c35b979d","Warn: pipCommand not pinned by hash: deploy/paddleocr_vl_docker/accelerators/amd-gpu/pipeline.Dockerfile:25-26","Warn: pipCommand not pinned by hash: deploy/paddleocr_vl_docker/accelerators/amd-gpu/vlm.Dockerfile:11-12","Warn: pipCommand not pinned by hash: deploy/paddleocr_vl_docker/accelerators/huawei-npu/pipeline.Dockerfile:38-40","Warn: pipCommand not pinned by hash: deploy/paddleocr_vl_docker/accelerators/huawei-npu/pipeline.Dockerfile:38-40","Warn: pipCommand not pinned by hash: deploy/paddleocr_vl_docker/accelerators/huawei-npu/pipeline.Dockerfile:44-45","Warn: pipCommand not pinned by hash: deploy/paddleocr_vl_docker/accelerators/huawei-npu/pipeline.Dockerfile:47-48","Warn: pipCommand not pinned by hash: deploy/paddleocr_vl_docker/accelerators/huawei-npu/vlm.Dockerfile:17-18","Warn: pipCommand not pinned by hash: deploy/paddleocr_vl_docker/accelerators/hygon-dcu/pipeline.Dockerfile:27-29","Warn: pipCommand not pinned by hash: deploy/paddleocr_vl_docker/accelerators/hygon-dcu/pipeline.Dockerfile:27-29","Warn: pipCommand not pinned by hash: deploy/paddleocr_vl_docker/accelerators/hygon-dcu/pipeline.Dockerfile:33-34","Warn: pipCommand not pinned by hash: deploy/paddleocr_vl_docker/accelerators/hygon-dcu/vlm.Dockerfile:13-14","Warn: pipCommand not pinned by hash: deploy/paddleocr_vl_docker/accelerators/iluvatar-gpu/pipeline.Dockerfile:21-23","Warn: pipCommand not pinned by hash: deploy/paddleocr_vl_docker/accelerators/iluvatar-gpu/pipeline.Dockerfile:21-23","Warn: pipCommand not pinned by hash: deploy/paddleocr_vl_docker/accelerators/iluvatar-gpu/pipeline.Dockerfile:27-28","Warn: pipCommand not pinned by hash: deploy/paddleocr_vl_docker/accelerators/iluvatar-gpu/vlm.Dockerfile:8-9","Warn: pipCommand not pinned by hash: deploy/paddleocr_vl_docker/accelerators/iluvatar-gpu/vlm.Dockerfile:16-17","Warn: pipCommand not pinned by hash: deploy/paddleocr_vl_docker/accelerators/intel-gpu/pipeline.Dockerfile:19-20","Warn: pipCommand not pinned by hash: deploy/paddleocr_vl_docker/accelerators/intel-gpu/pipeline.Dockerfile:24-25","Warn: pipCommand not pinned by hash: deploy/paddleocr_vl_docker/accelerators/intel-gpu/vlm.Dockerfile:11-12","Warn: pipCommand not pinned by hash: deploy/paddleocr_vl_docker/accelerators/kunlunxin-xpu/pipeline.Dockerfile:21-22","Warn: pipCommand not pinned by hash: deploy/paddleocr_vl_docker/accelerators/kunlunxin-xpu/pipeline.Dockerfile:26-27","Warn: pipCommand not pinned by hash: deploy/paddleocr_vl_docker/accelerators/kunlunxin-xpu/vlm.Dockerfile:17-18","Warn: pipCommand not pinned by hash: deploy/paddleocr_vl_docker/accelerators/metax-gpu/pipeline.Dockerfile:23-24","Warn: pipCommand not pinned by hash: deploy/paddleocr_vl_docker/accelerators/metax-gpu/vlm.Dockerfile:13-14","Warn: pipCommand not pinned by hash: deploy/paddleocr_vl_docker/accelerators/nvidia-gpu-sm120/pipeline.Dockerfile:20-21","Warn: pipCommand not pinned by hash: deploy/paddleocr_vl_docker/accelerators/nvidia-gpu-sm120/pipeline.Dockerfile:25-26","Warn: pipCommand not pinned by hash: deploy/paddleocr_vl_docker/accelerators/nvidia-gpu-sm120/vlm.Dockerfile:11-12","Warn: pipCommand not pinned by hash: deploy/paddleocr_vl_docker/accelerators/nvidia-gpu/pipeline.Dockerfile:20-21","Warn: pipCommand not pinned by hash: deploy/paddleocr_vl_docker/accelerators/nvidia-gpu/pipeline.Dockerfile:25-26","Warn: pipCommand not pinned by hash: deploy/paddleocr_vl_docker/accelerators/nvidia-gpu/vlm.Dockerfile:14-15","Warn: pipCommand not pinned by hash: deploy/paddleocr_vl_docker/hps/gateway.Dockerfile:16-19","Warn: pipCommand not pinned by hash: deploy/paddleocr_vl_docker/hps/gateway.Dockerfile:16-19","Warn: pipCommand not pinned by hash: .clang_format.hook:16","Warn: pipCommand not pinned by hash: .clang_format.hook:17","Warn: pipCommand not pinned by hash: benchmark/run_det.sh:6","Warn: pipCommand not pinned by hash: deploy/avh/configure_avh.sh:78","Warn: pipCommand not pinned by hash: deploy/avh/run_demo.sh:47","Warn: pipCommand not pinned by hash: test_tipc/build_server.sh:37","Warn: pipCommand not pinned by hash: test_tipc/build_server.sh:67","Warn: pipCommand not pinned by hash: test_tipc/prepare_lite_cpp.sh:44","Warn: pipCommand not pinned by hash: .github/workflows/build_publish_develop_docs.yml:29","Warn: pipCommand not pinned by hash: .github/workflows/build_publish_release_docs.yml:29","Warn: pipCommand not pinned by hash: .github/workflows/codestyle.yml:36","Warn: pipCommand not pinned by hash: .github/workflows/codestyle.yml:37","Warn: pipCommand not pinned by hash: .github/workflows/docs_anchor_check.yml:32","Warn: pipCommand not pinned by hash: .github/workflows/python_publish.yml:31","Warn: pipCommand not pinned by hash: .github/workflows/python_publish.yml:32","Warn: pipCommand not pinned by hash: .github/workflows/test_gpu.yml:72","Warn: pipCommand not pinned by hash: .github/workflows/test_gpu.yml:75","Warn: pipCommand not pinned by hash: .github/workflows/test_gpu.yml:76","Warn: pipCommand not pinned by hash: .github/workflows/test_gpu.yml:84","Warn: pipCommand not pinned by hash: .github/workflows/tests.yml:52","Warn: pipCommand not pinned by hash: .github/workflows/tests.yml:53","Warn: pipCommand not pinned by hash: .github/workflows/tests.yml:54","Warn: pipCommand not pinned by hash: .github/workflows/tests.yml:59","Warn: pipCommand not pinned by hash: .github/workflows/tests.yml:62","Warn: pipCommand not pinned by hash: .github/workflows/tests.yml:71","Warn: pipCommand not pinned by hash: .github/workflows/tests.yml:74","Info:   0 out of  22 GitHub-owned GitHubAction dependencies pinned","Info:   4 out of   4 third-party GitHubAction dependencies pinned","Info:   0 out of  34 containerImage dependencies pinned","Info:   3 out of  61 pipCommand dependencies pinned","Info:   4 out of   4 goCommand dependencies pinned"],"documentation":{"short":"Determines if the project has declared and pinned the dependencies of its build process.","url":"https://github.com/ossf/scorecard/blob/d1fab88f54636ff366076edfc5c239f97b3c8e66/docs/checks.md#pinned-dependencies"}}]}