{"date":"2026-10-12","repo":{"name":"github.com/apache/hudi","commit":"9a629fd8293ef62f5f036038c58d2eb5e8d1cb04"},"scorecard":{"version":"v5.6.0","commit":"61e84743356275f6ffca23b1b2f2cb945e19eb96"},"score":6.4,"checks":[{"name":"Code-Review","score":9,"reason":"Found 29/30 approved changesets -- score normalized to 9","details":null,"documentation":{"url":"https://github.com/ossf/scorecard/blob/61e84743356275f6ffca23b1b2f2cb945e19eb96/docs/checks.md#code-review","short":"Determines if the project requires human code review before pull requests (aka merge requests) are merged."}},{"name":"Maintained","score":10,"reason":"30 commit(s) and 12 issue activity found in the last 90 days -- score normalized to 10","details":null,"documentation":{"url":"https://github.com/ossf/scorecard/blob/61e84743356275f6ffca23b1b2f2cb945e19eb96/docs/checks.md#maintained","short":"Determines if the project is \"actively maintained\"."}},{"name":"Dangerous-Workflow","score":10,"reason":"no dangerous workflow patterns detected","details":null,"documentation":{"url":"https://github.com/ossf/scorecard/blob/61e84743356275f6ffca23b1b2f2cb945e19eb96/docs/checks.md#dangerous-workflow","short":"Determines if the project's GitHub Action workflows avoid dangerous patterns."}},{"name":"Token-Permissions","score":0,"reason":"detected GitHub workflow tokens with excessive permissions","details":["Info: jobLevel 'contents' permission set to 'read': .github/workflows/hudi_trino_compat.yml:30","Warn: jobLevel 'contents' permission set to 'write': .github/workflows/hudi_trino_compat.yml:157","Info: jobLevel 'contents' permission set to 'read': .github/workflows/hudi_trino_dependency_drift.yml:166","Info: jobLevel 'contents' permission set to 'read': .github/workflows/hudi_trino_dependency_drift.yml:47","Info: topLevel 'contents' permission set to 'read': .github/workflows/agent_gateway_ci.yml:41","Info: topLevel 'pull-requests' permission set to 'read': .github/workflows/azure_ci_check.yml:26","Info: topLevel 'issues' permission set to 'read': .github/workflows/azure_ci_check.yml:27","Warn: topLevel 'statuses' permission set to 'write': .github/workflows/azure_ci_check.yml:25","Warn: no topLevel permission defined: .github/workflows/bot.yml:1","Warn: no topLevel permission defined: .github/workflows/commit_coauthor_validation.yml:1","Warn: no topLevel permission defined: .github/workflows/hudi_trino_ci.yml:1","Info: topLevel 'contents' permission set to 'read': .github/workflows/hudi_trino_compat.yml:20","Info: topLevel 'contents' permission set to 'read': .github/workflows/hudi_trino_dependency_drift.yml:33","Warn: no topLevel permission defined: .github/workflows/hudi_trino_e2e.yml:1","Warn: no topLevel permission defined: .github/workflows/maven_artifact_validation.yml:1","Warn: no topLevel permission defined: .github/workflows/pr_compliance.yml:1","Warn: no topLevel permission defined: .github/workflows/pr_title_validation.yml:1","Warn: no topLevel permission defined: .github/workflows/release_candidate_validation.yml:1","Warn: topLevel 'statuses' permission set to 'write': .github/workflows/scheduled_workflow.yml:26","Info: topLevel 'issues' permission set to 'read': .github/workflows/scheduled_workflow.yml:28","Warn: topLevel 'actions' permission set to 'write': .github/workflows/scheduled_workflow.yml:29","Warn: no topLevel permission defined: .github/workflows/update_pr_compliance.yml:1"],"documentation":{"url":"https://github.com/ossf/scorecard/blob/61e84743356275f6ffca23b1b2f2cb945e19eb96/docs/checks.md#token-permissions","short":"Determines if the project's workflows follow the principle of least privilege."}},{"name":"CII-Best-Practices","score":0,"reason":"no effort to earn an OpenSSF best practices badge detected","details":null,"documentation":{"url":"https://github.com/ossf/scorecard/blob/61e84743356275f6ffca23b1b2f2cb945e19eb96/docs/checks.md#cii-best-practices","short":"Determines if the project has an OpenSSF (formerly CII) Best Practices Badge."}},{"name":"Binary-Artifacts","score":10,"reason":"no binaries found in the repo","details":null,"documentation":{"url":"https://github.com/ossf/scorecard/blob/61e84743356275f6ffca23b1b2f2cb945e19eb96/docs/checks.md#binary-artifacts","short":"Determines if the project has generated executable (binary) artifacts in the source repository."}},{"name":"License","score":10,"reason":"license file detected","details":["Info: project has a license file: LICENSE:0","Info: FSF or OSI recognized license: Apache License 2.0: LICENSE:0"],"documentation":{"url":"https://github.com/ossf/scorecard/blob/61e84743356275f6ffca23b1b2f2cb945e19eb96/docs/checks.md#license","short":"Determines if the project has defined a license."}},{"name":"Fuzzing","score":0,"reason":"project is not fuzzed","details":["Warn: no fuzzer integrations found"],"documentation":{"url":"https://github.com/ossf/scorecard/blob/61e84743356275f6ffca23b1b2f2cb945e19eb96/docs/checks.md#fuzzing","short":"Determines if the project uses fuzzing."}},{"name":"Branch-Protection","score":-1,"reason":"internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md","details":null,"documentation":{"url":"https://github.com/ossf/scorecard/blob/61e84743356275f6ffca23b1b2f2cb945e19eb96/docs/checks.md#branch-protection","short":"Determines if the default and release branches are protected with GitHub's branch protection settings."}},{"name":"Signed-Releases","score":-1,"reason":"no releases found","details":null,"documentation":{"url":"https://github.com/ossf/scorecard/blob/61e84743356275f6ffca23b1b2f2cb945e19eb96/docs/checks.md#signed-releases","short":"Determines if the project cryptographically signs release artifacts."}},{"name":"Security-Policy","score":10,"reason":"security policy file detected","details":["Info: security policy file detected: github.com/apache/.github/.github/SECURITY.md:1","Info: Found linked content: github.com/apache/.github/.github/SECURITY.md:1","Info: Found disclosure, vulnerability, and/or timelines in security policy: github.com/apache/.github/.github/SECURITY.md:1","Info: Found text in security policy: github.com/apache/.github/.github/SECURITY.md:1"],"documentation":{"url":"https://github.com/ossf/scorecard/blob/61e84743356275f6ffca23b1b2f2cb945e19eb96/docs/checks.md#security-policy","short":"Determines if the project has published a security policy."}},{"name":"Packaging","score":10,"reason":"packaging workflow detected","details":["Info: Project packages its releases by way of GitHub Actions.: .github/workflows/bot.yml:1254"],"documentation":{"url":"https://github.com/ossf/scorecard/blob/61e84743356275f6ffca23b1b2f2cb945e19eb96/docs/checks.md#packaging","short":"Determines if the project is published as a package that others can easily download, install, easily update, and uninstall."}},{"name":"SAST","score":0,"reason":"SAST tool is not run on all commits -- score normalized to 0","details":["Warn: 0 commits out of 29 are checked with a SAST tool"],"documentation":{"url":"https://github.com/ossf/scorecard/blob/61e84743356275f6ffca23b1b2f2cb945e19eb96/docs/checks.md#sast","short":"Determines if the project uses static code analysis."}},{"name":"Pinned-Dependencies","score":1,"reason":"dependency not pinned by hash detected -- score normalized to 1","details":["Info: Possibly incomplete results: error parsing shell code: a command can only contain words and redirects; encountered `(`: hudi-lakehouse/local-dev/scripts/smoke-test.sh:32","Info: Possibly incomplete results: error parsing shell code: a command can only contain words and redirects; encountered `(`: hudi-lakehouse/local-dev/scripts/smoke-test.sh:41","Info: Possibly incomplete results: error parsing shell code: a command can only contain words and redirects; encountered `(`: hudi-lakehouse/scripts/quickstart.sh:144","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/agent_gateway_ci.yml:55: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/hudi/agent_gateway_ci.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/agent_gateway_ci.yml:56: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/hudi/agent_gateway_ci.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/agent_gateway_ci.yml:95: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/hudi/agent_gateway_ci.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/agent_gateway_ci.yml:96: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/hudi/agent_gateway_ci.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/agent_gateway_ci.yml:112: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/hudi/agent_gateway_ci.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/azure_ci_check.yml:37: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/hudi/azure_ci_check.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/azure_ci_check.yml:41: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/hudi/azure_ci_check.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/azure_ci_check.yml:67: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/hudi/azure_ci_check.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/bot.yml:136: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/hudi/bot.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/bot.yml:139: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/hudi/bot.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/bot.yml:282: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/hudi/bot.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/bot.yml:285: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/hudi/bot.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/bot.yml:1365: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/hudi/bot.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/bot.yml:1368: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/hudi/bot.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/bot.yml:79: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/hudi/bot.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/bot.yml:81: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/hudi/bot.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/bot.yml:218: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/hudi/bot.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/bot.yml:221: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/hudi/bot.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/bot.yml:966: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/hudi/bot.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/bot.yml:969: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/hudi/bot.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/bot.yml:1033: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/hudi/bot.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/bot.yml:1036: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/hudi/bot.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/bot.yml:1474: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/hudi/bot.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/bot.yml:1477: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/hudi/bot.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/bot.yml:825: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/hudi/bot.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/bot.yml:828: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/hudi/bot.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/bot.yml:704: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/hudi/bot.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/bot.yml:707: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/hudi/bot.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/bot.yml:1288: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/hudi/bot.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/bot.yml:1291: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/hudi/bot.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/bot.yml:899: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/hudi/bot.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/bot.yml:902: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/hudi/bot.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/bot.yml:1162: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/hudi/bot.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/bot.yml:1165: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/hudi/bot.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/bot.yml:766: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/hudi/bot.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/bot.yml:769: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/hudi/bot.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/bot.yml:1102: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/hudi/bot.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/bot.yml:1105: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/hudi/bot.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/hudi_trino_ci.yml:109: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/hudi/hudi_trino_ci.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/hudi_trino_ci.yml:130: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/hudi/hudi_trino_ci.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/hudi_trino_ci.yml:142: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/hudi/hudi_trino_ci.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/hudi_trino_ci.yml:157: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/hudi/hudi_trino_ci.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/hudi_trino_ci.yml:165: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/hudi/hudi_trino_ci.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/hudi_trino_compat.yml:37: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/hudi/hudi_trino_compat.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/hudi_trino_compat.yml:41: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/hudi/hudi_trino_compat.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/hudi_trino_compat.yml:58: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/hudi/hudi_trino_compat.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/hudi_trino_compat.yml:69: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/hudi/hudi_trino_compat.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/hudi_trino_compat.yml:113: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/hudi/hudi_trino_compat.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/hudi_trino_compat.yml:122: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/hudi/hudi_trino_compat.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/hudi_trino_compat.yml:160: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/hudi/hudi_trino_compat.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/hudi_trino_dependency_drift.yml:53: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/hudi/hudi_trino_dependency_drift.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/hudi_trino_dependency_drift.yml:72: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/hudi/hudi_trino_dependency_drift.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/hudi_trino_dependency_drift.yml:82: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/hudi/hudi_trino_dependency_drift.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/hudi_trino_dependency_drift.yml:93: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/hudi/hudi_trino_dependency_drift.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/hudi_trino_dependency_drift.yml:153: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/hudi/hudi_trino_dependency_drift.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/hudi_trino_dependency_drift.yml:170: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/hudi/hudi_trino_dependency_drift.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/hudi_trino_dependency_drift.yml:175: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/hudi/hudi_trino_dependency_drift.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/hudi_trino_e2e.yml:74: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/hudi/hudi_trino_e2e.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/hudi_trino_e2e.yml:104: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/hudi/hudi_trino_e2e.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/hudi_trino_e2e.yml:117: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/hudi/hudi_trino_e2e.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/hudi_trino_e2e.yml:129: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/hudi/hudi_trino_e2e.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/hudi_trino_e2e.yml:204: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/hudi/hudi_trino_e2e.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/maven_artifact_validation.yml:55: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/hudi/maven_artifact_validation.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/maven_artifact_validation.yml:57: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/hudi/maven_artifact_validation.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/pr_compliance.yml:20: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/hudi/pr_compliance.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/pr_compliance.yml:21: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/hudi/pr_compliance.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release_candidate_validation.yml:43: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/hudi/release_candidate_validation.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release_candidate_validation.yml:45: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/hudi/release_candidate_validation.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release_candidate_validation.yml:90: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/hudi/release_candidate_validation.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release_candidate_validation.yml:92: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/hudi/release_candidate_validation.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release_candidate_validation.yml:129: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/hudi/release_candidate_validation.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release_candidate_validation.yml:131: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/hudi/release_candidate_validation.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/scheduled_workflow.yml:59: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/hudi/scheduled_workflow.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/scheduled_workflow.yml:67: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/hudi/scheduled_workflow.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/update_pr_compliance.yml:20: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/hudi/update_pr_compliance.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/update_pr_compliance.yml:21: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/hudi/update_pr_compliance.yml/master?enable=pin","Warn: containerImage not pinned by hash: Dockerfile:22: pin your Docker image by updating apachehudi/hudi-ci-bundle-validation-base:azure_ci_test_base_java11 to apachehudi/hudi-ci-bundle-validation-base:azure_ci_test_base_java11@sha256:b76f29237ba134c603df5d3ea2337b8487db29f1d6211c10dd0ea044f6e531dc","Warn: containerImage not pinned by hash: docker/hoodie/hadoop/base/Dockerfile:18: pin your Docker image by updating openjdk:8u342-jdk-slim-bullseye to openjdk:8u342-jdk-slim-bullseye@sha256:19578a1e13b7a1e4cab9b227fb7b5d80e14665cf4024c6407d72ba89842a97ed","Warn: containerImage not pinned by hash: docker/hoodie/hadoop/base_java11/Dockerfile:18: pin your Docker image by updating eclipse-temurin:11-jdk-jammy to eclipse-temurin:11-jdk-jammy@sha256:0ab919c546b23b2da000376778ce947596d1f92d18a32fd69342743bd0e1e431","Warn: containerImage not pinned by hash: docker/hoodie/hadoop/base_java17/Dockerfile:19: pin your Docker image by updating eclipse-temurin:17-jre-jammy to eclipse-temurin:17-jre-jammy@sha256:8993f1aed8b25fcea7a7047a7949c1866fa558fc6830d938c22c4f13b26be9d7","Warn: containerImage not pinned by hash: docker/hoodie/hadoop/base_java17/Dockerfile:34: pin your Docker image by updating eclipse-temurin:17-jre-jammy to eclipse-temurin:17-jre-jammy@sha256:8993f1aed8b25fcea7a7047a7949c1866fa558fc6830d938c22c4f13b26be9d7","Warn: containerImage not pinned by hash: docker/hoodie/hadoop/datanode/Dockerfile:21: pin your Docker image by updating apachehudi/hudi-hadoop_3.3.4-base-java11:latest to apachehudi/hudi-hadoop_3.3.4-base-java11:latest@sha256:1387119cda9c6f026a03362ed9b2fbd4645348434dca132d2a9044b272a25a04","Warn: containerImage not pinned by hash: docker/hoodie/hadoop/historyserver/Dockerfile:21: pin your Docker image by updating apachehudi/hudi-hadoop_3.3.4-base-java11:latest to apachehudi/hudi-hadoop_3.3.4-base-java11:latest@sha256:1387119cda9c6f026a03362ed9b2fbd4645348434dca132d2a9044b272a25a04","Warn: containerImage not pinned by hash: docker/hoodie/hadoop/hive_base/Dockerfile:20: pin your Docker image by updating apachehudi/hudi-hadoop_3.3.4-base-java11:latest to apachehudi/hudi-hadoop_3.3.4-base-java11:latest@sha256:1387119cda9c6f026a03362ed9b2fbd4645348434dca132d2a9044b272a25a04","Warn: containerImage not pinned by hash: docker/hoodie/hadoop/namenode/Dockerfile:21: pin your Docker image by updating apachehudi/hudi-hadoop_3.3.4-base-java11:latest to apachehudi/hudi-hadoop_3.3.4-base-java11:latest@sha256:1387119cda9c6f026a03362ed9b2fbd4645348434dca132d2a9044b272a25a04","Warn: containerImage not pinned by hash: docker/hoodie/hadoop/prestobase/Dockerfile:24: pin your Docker image by updating apachehudi/hudi-hadoop_2.8.4-base-java11:latest to apachehudi/hudi-hadoop_2.8.4-base-java11:latest@sha256:e0ea90ad47653901f62bdc67cb672395b6d37309ab054efc289265d50f595157","Warn: containerImage not pinned by hash: docker/hoodie/hadoop/spark_base/Dockerfile:20: pin your Docker image by updating apachehudi/hudi-hadoop_3.3.4-hive_3.1.3 to apachehudi/hudi-hadoop_3.3.4-hive_3.1.3@sha256:58d32b9de56eaa45de5f2955c9377b95f9e1e415e0f351d53d69d7e920e9c4f4","Warn: containerImage not pinned by hash: docker/hoodie/hadoop/sparkadhoc/Dockerfile:21: pin your Docker image by updating apachehudi/hudi-hadoop_3.3.4-hive_3.1.3-sparkbase_3.5.9 to apachehudi/hudi-hadoop_3.3.4-hive_3.1.3-sparkbase_3.5.9@sha256:3d14ce88f3f2f479d75f50eb65191787b58b7fd5e7aa0f23b31be27bf68889a0","Warn: containerImage not pinned by hash: docker/hoodie/hadoop/sparkmaster/Dockerfile:21: pin your Docker image by updating apachehudi/hudi-hadoop_3.3.4-hive_3.1.3-sparkbase_3.5.9 to apachehudi/hudi-hadoop_3.3.4-hive_3.1.3-sparkbase_3.5.9@sha256:3d14ce88f3f2f479d75f50eb65191787b58b7fd5e7aa0f23b31be27bf68889a0","Warn: containerImage not pinned by hash: docker/hoodie/hadoop/sparkworker/Dockerfile:21: pin your Docker image by updating apachehudi/hudi-hadoop_3.3.4-hive_3.1.3-sparkbase_3.5.9 to apachehudi/hudi-hadoop_3.3.4-hive_3.1.3-sparkbase_3.5.9@sha256:3d14ce88f3f2f479d75f50eb65191787b58b7fd5e7aa0f23b31be27bf68889a0","Warn: containerImage not pinned by hash: docker/trino/Dockerfile:23","Warn: containerImage not pinned by hash: hudi-agent-gateway/Dockerfile:18: pin your Docker image by updating python:3.12-slim to python:3.12-slim@sha256:a6e34c598f2467ed0e9a8d349809fcd8b5c603269512df273a0bb1784edc11b1","Warn: containerImage not pinned by hash: hudi-examples/hudi-examples-k8s/Dockerfile:20: pin your Docker image by updating flink:1.18 to flink:1.18@sha256:f0e9ffd07f3d43291dfaf7e0609eb2871462193275d452affbe5fac091017ae3","Warn: containerImage not pinned by hash: hudi-lakehouse/images/spark/Dockerfile:29: pin your Docker image by updating apache/spark:3.5.7-scala2.12-java17-python3-ubuntu to apache/spark:3.5.7-scala2.12-java17-python3-ubuntu@sha256:7897b9a69efa94caccc52579e310a2fe68fb75b88a3d55b97b31568e5e233176","Warn: containerImage not pinned by hash: hudi-lakehouse/images/trino/Dockerfile:25: pin your Docker image by updating trinodb/trino:472 to trinodb/trino:472@sha256:cc9cab2afd71637176e94c729a05862d1b2d07f5b13b109f1ae041d3e78428dd","Warn: containerImage not pinned by hash: hudi-notebooks/Dockerfile.hive:20","Warn: containerImage not pinned by hash: hudi-notebooks/Dockerfile.presto:19","Warn: containerImage not pinned by hash: hudi-notebooks/Dockerfile.spark:21","Warn: containerImage not pinned by hash: hudi-notebooks/Dockerfile.spark4:21","Warn: containerImage not pinned by hash: hudi-notebooks/Dockerfile.trino:19","Warn: containerImage not pinned by hash: packaging/bundle-validation/Dockerfile:19","Warn: containerImage not pinned by hash: packaging/bundle-validation/azure/Dockerfile:17: pin your Docker image by updating azul/zulu-openjdk-alpine:11 to azul/zulu-openjdk-alpine:11@sha256:b1d9f7c92aa14fb15a4d6db2ed0be613cb2d1498b504f78f965f9a133e827c21","Warn: containerImage not pinned by hash: packaging/bundle-validation/base-dev/Dockerfile:17: pin your Docker image by updating adoptopenjdk/openjdk8:alpine to adoptopenjdk/openjdk8:alpine@sha256:94a244e6b541e8111b3cba9c454b5764a303258012028a5e164225b993425d2d","Warn: containerImage not pinned by hash: packaging/bundle-validation/base/Dockerfile:17: pin your Docker image by updating adoptopenjdk/openjdk8:alpine to adoptopenjdk/openjdk8:alpine@sha256:94a244e6b541e8111b3cba9c454b5764a303258012028a5e164225b993425d2d","Warn: pipCommand not pinned by hash: hudi-agent-gateway/Dockerfile:28-31","Warn: pipCommand not pinned by hash: hudi-agent-gateway/Dockerfile:33","Warn: pipCommand not pinned by hash: hudi-notebooks/Dockerfile.spark:56-62","Warn: pipCommand not pinned by hash: hudi-notebooks/Dockerfile.spark:56-62","Warn: pipCommand not pinned by hash: hudi-notebooks/Dockerfile.spark4:55-62","Warn: pipCommand not pinned by hash: hudi-notebooks/Dockerfile.spark4:55-62","Warn: pipCommand not pinned by hash: .github/workflows/agent_gateway_ci.yml:63","Info:   0 out of  76 GitHub-owned GitHubAction dependencies pinned","Info:  13 out of  13 third-party GitHubAction dependencies pinned","Info:   0 out of  28 containerImage dependencies pinned","Info:   0 out of   7 pipCommand dependencies pinned"],"documentation":{"url":"https://github.com/ossf/scorecard/blob/61e84743356275f6ffca23b1b2f2cb945e19eb96/docs/checks.md#pinned-dependencies","short":"Determines if the project has declared and pinned the dependencies of its build process."}}]}