{"date":"2026-08-24","repo":{"name":"github.com/apache/skywalking","commit":"80c996b8bfcd999fb64c3b559b5b373c85bdaf48"},"scorecard":{"version":"v5.5.1-0.20260815060127-d1fab88f5463","commit":"d1fab88f54636ff366076edfc5c239f97b3c8e66"},"score":7,"checks":[{"name":"Code-Review","score":10,"reason":"all changesets reviewed","details":null,"documentation":{"url":"https://github.com/ossf/scorecard/blob/d1fab88f54636ff366076edfc5c239f97b3c8e66/docs/checks.md#code-review","short":"Determines if the project requires human code review before pull requests (aka merge requests) are merged."}},{"name":"Maintained","score":10,"reason":"30 commit(s) and 14 issue activity found in the last 90 days -- score normalized to 10","details":null,"documentation":{"url":"https://github.com/ossf/scorecard/blob/d1fab88f54636ff366076edfc5c239f97b3c8e66/docs/checks.md#maintained","short":"Determines if the project is \"actively maintained\"."}},{"name":"CII-Best-Practices","score":0,"reason":"no effort to earn an OpenSSF best practices badge detected","details":null,"documentation":{"url":"https://github.com/ossf/scorecard/blob/d1fab88f54636ff366076edfc5c239f97b3c8e66/docs/checks.md#cii-best-practices","short":"Determines if the project has an OpenSSF (formerly CII) Best Practices Badge."}},{"name":"Dangerous-Workflow","score":10,"reason":"no dangerous workflow patterns detected","details":null,"documentation":{"url":"https://github.com/ossf/scorecard/blob/d1fab88f54636ff366076edfc5c239f97b3c8e66/docs/checks.md#dangerous-workflow","short":"Determines if the project's GitHub Action workflows avoid dangerous patterns."}},{"name":"License","score":10,"reason":"license file detected","details":["Info: project has a license file: LICENSE:0","Info: FSF or OSI recognized license: Apache License 2.0: LICENSE:0"],"documentation":{"url":"https://github.com/ossf/scorecard/blob/d1fab88f54636ff366076edfc5c239f97b3c8e66/docs/checks.md#license","short":"Determines if the project has defined a license."}},{"name":"Token-Permissions","score":0,"reason":"detected GitHub workflow tokens with excessive permissions","details":["Info: jobLevel 'contents' permission set to 'read': .github/workflows/publish-docker-e2e-service.yaml:36","Info: jobLevel 'contents' permission set to 'read': .github/workflows/publish-docker.yaml:35","Info: topLevel 'contents' permission set to 'read': .github/workflows/codeql.yaml:35","Warn: topLevel 'security-events' permission set to 'write': .github/workflows/codeql.yaml:36","Info: topLevel 'actions' permission set to 'read': .github/workflows/codeql.yaml:34","Warn: no topLevel permission defined: .github/workflows/dead-link-checker.yaml:1","Warn: no topLevel permission defined: .github/workflows/publish-docker-e2e-service.yaml:1","Warn: no topLevel permission defined: .github/workflows/publish-docker.yaml:1","Warn: no topLevel permission defined: .github/workflows/skywalking.yaml:1","Info: no jobLevel write permissions found"],"documentation":{"url":"https://github.com/ossf/scorecard/blob/d1fab88f54636ff366076edfc5c239f97b3c8e66/docs/checks.md#token-permissions","short":"Determines if the project's workflows follow the principle of least privilege."}},{"name":"Branch-Protection","score":-1,"reason":"internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md","details":null,"documentation":{"url":"https://github.com/ossf/scorecard/blob/d1fab88f54636ff366076edfc5c239f97b3c8e66/docs/checks.md#branch-protection","short":"Determines if the default and release branches are protected with GitHub's branch protection settings."}},{"name":"Signed-Releases","score":-1,"reason":"no releases found","details":null,"documentation":{"url":"https://github.com/ossf/scorecard/blob/d1fab88f54636ff366076edfc5c239f97b3c8e66/docs/checks.md#signed-releases","short":"Determines if the project cryptographically signs release artifacts."}},{"name":"Security-Policy","score":10,"reason":"security policy file detected","details":["Info: security policy file detected: github.com/apache/.github/.github/SECURITY.md:1","Info: Found linked content: github.com/apache/.github/.github/SECURITY.md:1","Info: Found disclosure, vulnerability, and/or timelines in security policy: github.com/apache/.github/.github/SECURITY.md:1","Info: Found text in security policy: github.com/apache/.github/.github/SECURITY.md:1"],"documentation":{"url":"https://github.com/ossf/scorecard/blob/d1fab88f54636ff366076edfc5c239f97b3c8e66/docs/checks.md#security-policy","short":"Determines if the project has published a security policy."}},{"name":"Packaging","score":10,"reason":"packaging workflow detected","details":["Info: Project packages its releases by way of GitHub Actions.: .github/workflows/publish-docker-e2e-service.yaml:32"],"documentation":{"url":"https://github.com/ossf/scorecard/blob/d1fab88f54636ff366076edfc5c239f97b3c8e66/docs/checks.md#packaging","short":"Determines if the project is published as a package that others can easily download, install, easily update, and uninstall."}},{"name":"Binary-Artifacts","score":10,"reason":"no binaries found in the repo","details":null,"documentation":{"url":"https://github.com/ossf/scorecard/blob/d1fab88f54636ff366076edfc5c239f97b3c8e66/docs/checks.md#binary-artifacts","short":"Determines if the project has generated executable (binary) artifacts in the source repository."}},{"name":"Fuzzing","score":0,"reason":"project is not fuzzed","details":["Warn: no fuzzer integrations found"],"documentation":{"url":"https://github.com/ossf/scorecard/blob/d1fab88f54636ff366076edfc5c239f97b3c8e66/docs/checks.md#fuzzing","short":"Determines if the project uses fuzzing."}},{"name":"Pinned-Dependencies","score":1,"reason":"dependency not pinned by hash detected -- score normalized to 1","details":["Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/codeql.yaml:51: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/skywalking/codeql.yaml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/codeql.yaml:57: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/skywalking/codeql.yaml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/codeql.yaml:64: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/skywalking/codeql.yaml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/dead-link-checker.yaml:36: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/skywalking/dead-link-checker.yaml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/publish-docker-e2e-service.yaml:42: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/skywalking/publish-docker-e2e-service.yaml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/publish-docker-e2e-service.yaml:47: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/skywalking/publish-docker-e2e-service.yaml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/publish-docker.yaml:39: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/skywalking/publish-docker.yaml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/publish-docker.yaml:44: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/skywalking/publish-docker.yaml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/skywalking.yaml:70: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/skywalking/skywalking.yaml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/skywalking.yaml:74: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/skywalking/skywalking.yaml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/skywalking.yaml:80: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/skywalking/skywalking.yaml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/skywalking.yaml:118: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/skywalking/skywalking.yaml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/skywalking.yaml:165: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/skywalking/skywalking.yaml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/skywalking.yaml:169: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/skywalking/skywalking.yaml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/skywalking.yaml:182: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/skywalking/skywalking.yaml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/skywalking.yaml:1009: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/skywalking/skywalking.yaml/master?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/skywalking.yaml:1014: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/skywalking/skywalking.yaml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/skywalking.yaml:1017: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/skywalking/skywalking.yaml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/skywalking.yaml:1026: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/skywalking/skywalking.yaml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/skywalking.yaml:1031: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/skywalking/skywalking.yaml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/skywalking.yaml:200: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/skywalking/skywalking.yaml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/skywalking.yaml:204: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/skywalking/skywalking.yaml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/skywalking.yaml:210: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/skywalking/skywalking.yaml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/skywalking.yaml:221: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/skywalking/skywalking.yaml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/skywalking.yaml:246: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/skywalking/skywalking.yaml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/skywalking.yaml:251: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/skywalking/skywalking.yaml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/skywalking.yaml:256: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/skywalking/skywalking.yaml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/skywalking.yaml:312: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/skywalking/skywalking.yaml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/skywalking.yaml:317: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/skywalking/skywalking.yaml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/skywalking.yaml:322: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/skywalking/skywalking.yaml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/skywalking.yaml:880: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/skywalking/skywalking.yaml/master?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/skywalking.yaml:885: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/skywalking/skywalking.yaml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/skywalking.yaml:888: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/skywalking/skywalking.yaml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/skywalking.yaml:916: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/skywalking/skywalking.yaml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/skywalking.yaml:952: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/skywalking/skywalking.yaml/master?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/skywalking.yaml:957: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/skywalking/skywalking.yaml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/skywalking.yaml:960: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/skywalking/skywalking.yaml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/skywalking.yaml:988: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/skywalking/skywalking.yaml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/skywalking.yaml:1063: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/skywalking/skywalking.yaml/master?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/skywalking.yaml:1068: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/skywalking/skywalking.yaml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/skywalking.yaml:1071: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/skywalking/skywalking.yaml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/skywalking.yaml:1080: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/skywalking/skywalking.yaml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/skywalking.yaml:1092: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/skywalking/skywalking.yaml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/skywalking.yaml:1159: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/skywalking/skywalking.yaml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/skywalking.yaml:54: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/skywalking/skywalking.yaml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/skywalking.yaml:275: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/skywalking/skywalking.yaml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/skywalking.yaml:280: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/skywalking/skywalking.yaml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/skywalking.yaml:285: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/skywalking/skywalking.yaml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/skywalking.yaml:771: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/skywalking/skywalking.yaml/master?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/skywalking.yaml:776: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/skywalking/skywalking.yaml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/skywalking.yaml:779: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/skywalking/skywalking.yaml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/skywalking.yaml:788: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/skywalking/skywalking.yaml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/skywalking.yaml:800: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/skywalking/skywalking.yaml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/skywalking.yaml:838: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/skywalking/skywalking.yaml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/skywalking.yaml:41: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/skywalking/skywalking.yaml/master?enable=pin","Warn: containerImage not pinned by hash: docker/data-generator/Dockerfile:19","Warn: containerImage not pinned by hash: docker/oap/Dockerfile:19","Warn: containerImage not pinned by hash: test/e2e-v2/cases/airflow/mock/Dockerfile.mock-sender:17: pin your Docker image by updating python:3.11-slim to python:3.11-slim@sha256:9c900dea9e8fb7e16277c179b555cc72d29a352dbc33cff48ad5a0412fd5bfc7","Warn: containerImage not pinned by hash: test/e2e-v2/cases/browser/docker/Dockerfile.generate-traffic:16: pin your Docker image by updating python:3.10 to python:3.10@sha256:7592f66a25f37c4e88ac9d1eee26b0fd7b6d5d56ace531ffa6aaf3a5317cde27","Warn: containerImage not pinned by hash: test/e2e-v2/cases/browser/docker/Dockerfile.provider:16: pin your Docker image by updating python:3.10 to python:3.10@sha256:7592f66a25f37c4e88ac9d1eee26b0fd7b6d5d56ace531ffa6aaf3a5317cde27","Warn: containerImage not pinned by hash: test/e2e-v2/cases/browser/docker/Dockerfile.test-ui:16: pin your Docker image by updating node:10.23 to node:10.23@sha256:4fafd9b63fdfb15112775847a10b2917760c720c8c28cef5167ff40f36b3cd93","Warn: containerImage not pinned by hash: test/e2e-v2/cases/browser/docker/Dockerfile.test-ui:47: pin your Docker image by updating nginx:1.19 to nginx:1.19@sha256:df13abe416e37eb3db4722840dd479b00ba193ac6606e7902331dcea50f4f1f2","Warn: containerImage not pinned by hash: test/e2e-v2/cases/dsl-debugging/lal-block/log-emitter/Dockerfile:16: pin your Docker image by updating python:3.11-slim to python:3.11-slim@sha256:9c900dea9e8fb7e16277c179b555cc72d29a352dbc33cff48ad5a0412fd5bfc7","Warn: containerImage not pinned by hash: test/e2e-v2/cases/dsl-debugging/lal-statement/log-emitter/Dockerfile:16: pin your Docker image by updating python:3.11-slim to python:3.11-slim@sha256:9c900dea9e8fb7e16277c179b555cc72d29a352dbc33cff48ad5a0412fd5bfc7","Warn: containerImage not pinned by hash: test/e2e-v2/cases/go/service/Dockerfile:17","Warn: containerImage not pinned by hash: test/e2e-v2/cases/go/service/Dockerfile:27: pin your Docker image by updating alpine:3.10 to alpine:3.10@sha256:451eee8bedcb2f029756dc3e9d73bab0e7943c1ac55cff3a4861c52a0fdd3e98","Warn: containerImage not pinned by hash: test/e2e-v2/cases/kafka/Dockerfile.provider:19","Warn: containerImage not pinned by hash: test/e2e-v2/cases/kafka/kafka-monitoring/Dockerfile:17: pin your Docker image by updating bitnamilegacy/kafka:2.4.1 to bitnamilegacy/kafka:2.4.1@sha256:5828c6695930e68039d739c90e68c912a2adc8c162a556d9003e76a0b97be675","Warn: containerImage not pinned by hash: test/e2e-v2/cases/kafka/log/Dockerfile.fluentd:16: pin your Docker image by updating bitnamilegacy/fluentd:1.12.1 to bitnamilegacy/fluentd:1.12.1@sha256:762b6371e25075172d950c21194ea11a6bbdfbcbd55efcebb0a830b7c727739d","Warn: containerImage not pinned by hash: test/e2e-v2/cases/kafka/log/Dockerfile.satellite:17","Warn: containerImage not pinned by hash: test/e2e-v2/cases/kafka/log/Dockerfile.satellite:19: pin your Docker image by updating alpine:3.10 to alpine:3.10@sha256:451eee8bedcb2f029756dc3e9d73bab0e7943c1ac55cff3a4861c52a0fdd3e98","Warn: containerImage not pinned by hash: test/e2e-v2/cases/lua/Dockerfile.nginx:16: pin your Docker image by updating openresty/openresty:1.17.8.2-5-alpine-fat to openresty/openresty:1.17.8.2-5-alpine-fat@sha256:d16404a7ea1fed5cd47c6f4e8bf501518b1fa20198f4156199b689aae4e049f9","Warn: containerImage not pinned by hash: test/e2e-v2/cases/nginx/Dockerfile.nginx:16: pin your Docker image by updating openresty/openresty:1.17.8.2-5-alpine-fat to openresty/openresty:1.17.8.2-5-alpine-fat@sha256:d16404a7ea1fed5cd47c6f4e8bf501518b1fa20198f4156199b689aae4e049f9","Warn: containerImage not pinned by hash: test/e2e-v2/cases/nodejs/Dockerfile.nodejs:16: pin your Docker image by updating node:20 to node:20@sha256:8f693eaa7e0a8e71560c9a82b55fd54c2ae920a2ba5d2cde28bac7d1c01c9ba5","Warn: containerImage not pinned by hash: test/e2e-v2/cases/php/Dockerfile.php:16: pin your Docker image by updating php:8.1-fpm-bullseye to php:8.1-fpm-bullseye@sha256:bf963a103241b5f9db812bacc101022d3af7584054e865c9cc13f597f3a3e252","Warn: containerImage not pinned by hash: test/e2e-v2/cases/php/Dockerfile.php:43: pin your Docker image by updating php:8.1-fpm-bullseye to php:8.1-fpm-bullseye@sha256:bf963a103241b5f9db812bacc101022d3af7584054e865c9cc13f597f3a3e252","Warn: containerImage not pinned by hash: test/e2e-v2/cases/profiling/ebpf/continuous/Dockerfile.sqrt:17: pin your Docker image by updating golang:1.17 to golang:1.17@sha256:87262e4a4c7db56158a80a18fefdc4fee5accc41b59cde821e691d05541bbb18","Warn: containerImage not pinned by hash: test/e2e-v2/cases/profiling/ebpf/network/Dockerfile.service:21: pin your Docker image by updating ghcr.io/apache/skywalking-go/skywalking-go:754482220284b9c59d9e48c7f3cf943362eec41d-go1.26 to ghcr.io/apache/skywalking-go/skywalking-go:754482220284b9c59d9e48c7f3cf943362eec41d-go1.26@sha256:cef1a38a09e4d7e45f7b647c3aaaa5ab41cd64226752afe1fe76b2840234f69b","Warn: containerImage not pinned by hash: test/e2e-v2/cases/profiling/ebpf/network/Dockerfile.service:31: pin your Docker image by updating alpine:3.10 to alpine:3.10@sha256:451eee8bedcb2f029756dc3e9d73bab0e7943c1ac55cff3a4861c52a0fdd3e98","Warn: containerImage not pinned by hash: test/e2e-v2/cases/profiling/ebpf/offcpu/Dockerfile.file:17: pin your Docker image by updating golang:1.17 to golang:1.17@sha256:87262e4a4c7db56158a80a18fefdc4fee5accc41b59cde821e691d05541bbb18","Warn: containerImage not pinned by hash: test/e2e-v2/cases/profiling/ebpf/oncpu/Dockerfile.sqrt:17: pin your Docker image by updating golang:1.17 to golang:1.17@sha256:87262e4a4c7db56158a80a18fefdc4fee5accc41b59cde821e691d05541bbb18","Warn: containerImage not pinned by hash: test/e2e-v2/cases/python/Dockerfile.python:16: pin your Docker image by updating python:3.10 to python:3.10@sha256:7592f66a25f37c4e88ac9d1eee26b0fd7b6d5d56ace531ffa6aaf3a5317cde27","Warn: containerImage not pinned by hash: test/e2e-v2/cases/runtime-rule/lal/log-emitter/Dockerfile:16: pin your Docker image by updating python:3.11-slim to python:3.11-slim@sha256:9c900dea9e8fb7e16277c179b555cc72d29a352dbc33cff48ad5a0412fd5bfc7","Warn: containerImage not pinned by hash: test/e2e-v2/cases/runtime-rule/mal-storage/otlp-emitter/Dockerfile:16: pin your Docker image by updating python:3.11-slim to python:3.11-slim@sha256:9c900dea9e8fb7e16277c179b555cc72d29a352dbc33cff48ad5a0412fd5bfc7","Warn: containerImage not pinned by hash: test/e2e-v2/cases/satellite/Dockerfile.satellite:17","Warn: containerImage not pinned by hash: test/e2e-v2/cases/satellite/Dockerfile.satellite:19: pin your Docker image by updating alpine:3.10 to alpine:3.10@sha256:451eee8bedcb2f029756dc3e9d73bab0e7943c1ac55cff3a4861c52a0fdd3e98","Warn: containerImage not pinned by hash: test/e2e-v2/cases/virtual-genai/Dockerfile.provider:19: pin your Docker image by updating eclipse-temurin:17-jdk to eclipse-temurin:17-jdk@sha256:a27c79d44326d5f689668df5fedfee487652066d2a91e172747056cc7fbee6fc","Warn: containerImage not pinned by hash: test/e2e-v2/cases/virtual-genai/Dockerfile.provider:33","Warn: containerImage not pinned by hash: test/e2e-v2/cases/vm/prometheus-node-exporter/Dockerfile.nodeExporter:16: pin your Docker image by updating ubuntu:latest to ubuntu:latest@sha256:2260313b31c8c011cd2eebe728008efac1b3982be73eb71348ea2648d2c0e09b","Warn: containerImage not pinned by hash: test/e2e-v2/java-test-service/Dockerfile:18","Warn: containerImage not pinned by hash: test/e2e-v2/script/dockerfile/Dockerfile-openai.python:16: pin your Docker image by updating python:3.10-slim to python:3.10-slim@sha256:a78e4529630cfe8c5199cafd6e0c28ee1579a13f86274396d8b6b2d80367aa3a","Warn: pipCommand not pinned by hash: test/e2e-v2/cases/airflow/mock/Dockerfile.mock-sender:26","Warn: pipCommand not pinned by hash: test/e2e-v2/cases/browser/docker/Dockerfile.generate-traffic:20","Warn: pipCommand not pinned by hash: test/e2e-v2/cases/browser/docker/Dockerfile.provider:26-29","Warn: pipCommand not pinned by hash: test/e2e-v2/cases/browser/docker/Dockerfile.provider:27-30","Warn: npmCommand not pinned by hash: test/e2e-v2/cases/browser/docker/Dockerfile.test-ui:42-45","Warn: pipCommand not pinned by hash: test/e2e-v2/cases/dsl-debugging/lal-block/log-emitter/Dockerfile:17-20","Warn: pipCommand not pinned by hash: test/e2e-v2/cases/dsl-debugging/lal-statement/log-emitter/Dockerfile:17-20","Warn: npmCommand not pinned by hash: test/e2e-v2/cases/nodejs/Dockerfile.nodejs:29","Warn: npmCommand not pinned by hash: test/e2e-v2/cases/nodejs/Dockerfile.nodejs:31","Warn: downloadThenRun not pinned by hash: test/e2e-v2/cases/php/Dockerfile.php:26-32","Warn: pipCommand not pinned by hash: test/e2e-v2/cases/python/Dockerfile.python:26-29","Warn: pipCommand not pinned by hash: test/e2e-v2/cases/python/Dockerfile.python:27-30","Warn: pipCommand not pinned by hash: test/e2e-v2/cases/python/Dockerfile.python:32","Warn: pipCommand not pinned by hash: test/e2e-v2/cases/runtime-rule/lal/log-emitter/Dockerfile:17-20","Warn: pipCommand not pinned by hash: test/e2e-v2/cases/runtime-rule/mal-storage/otlp-emitter/Dockerfile:17-19","Warn: pipCommand not pinned by hash: test/e2e-v2/script/dockerfile/Dockerfile-openai.python:24-33","Warn: pipCommand not pinned by hash: test/e2e-v2/script/dockerfile/Dockerfile-openai.python:24-33","Warn: downloadThenRun not pinned by hash: benchmarks/envs-setup/istio-cluster_oap-banyandb/setup.sh:143","Warn: downloadThenRun not pinned by hash: test/e2e-v2/script/prepare/setup-e2e-shell/install-istioctl.sh:27","Warn: npmCommand not pinned by hash: .github/workflows/dead-link-checker.yaml:38","Info:   0 out of  50 GitHub-owned GitHubAction dependencies pinned","Info:  17 out of  22 third-party GitHubAction dependencies pinned","Info:   0 out of   4 npmCommand dependencies pinned","Info:   0 out of   3 downloadThenRun dependencies pinned","Info:   1 out of   1 goCommand dependencies pinned","Info:   0 out of  36 containerImage dependencies pinned","Info:   0 out of  13 pipCommand dependencies pinned"],"documentation":{"url":"https://github.com/ossf/scorecard/blob/d1fab88f54636ff366076edfc5c239f97b3c8e66/docs/checks.md#pinned-dependencies","short":"Determines if the project has declared and pinned the dependencies of its build process."}},{"name":"SAST","score":7,"reason":"SAST tool detected but not run on all commits","details":["Info: SAST configuration detected: CodeQL","Warn: 0 commits out of 30 are checked with a SAST tool"],"documentation":{"url":"https://github.com/ossf/scorecard/blob/d1fab88f54636ff366076edfc5c239f97b3c8e66/docs/checks.md#sast","short":"Determines if the project uses static code analysis."}}]}