{"date":"2026-10-12","repo":{"name":"github.com/apache/skywalking","commit":"217e2e65671adb6472702afd7baab3f87d7cf7ec"},"scorecard":{"version":"v5.6.0","commit":"61e84743356275f6ffca23b1b2f2cb945e19eb96"},"score":7,"checks":[{"name":"Code-Review","score":10,"reason":"all changesets reviewed","details":null,"documentation":{"url":"https://github.com/ossf/scorecard/blob/61e84743356275f6ffca23b1b2f2cb945e19eb96/docs/checks.md#code-review","short":"Determines if the project requires human code review before pull requests (aka merge requests) are merged."}},{"name":"Maintained","score":10,"reason":"30 commit(s) and 9 issue activity found in the last 90 days -- score normalized to 10","details":null,"documentation":{"url":"https://github.com/ossf/scorecard/blob/61e84743356275f6ffca23b1b2f2cb945e19eb96/docs/checks.md#maintained","short":"Determines if the project is \"actively maintained\"."}},{"name":"Dangerous-Workflow","score":10,"reason":"no dangerous workflow patterns detected","details":null,"documentation":{"url":"https://github.com/ossf/scorecard/blob/61e84743356275f6ffca23b1b2f2cb945e19eb96/docs/checks.md#dangerous-workflow","short":"Determines if the project's GitHub Action workflows avoid dangerous patterns."}},{"name":"Token-Permissions","score":0,"reason":"detected GitHub workflow tokens with excessive permissions","details":["Info: jobLevel 'contents' permission set to 'read': .github/workflows/publish-docker-e2e-service.yaml:36","Info: jobLevel 'contents' permission set to 'read': .github/workflows/publish-docker.yaml:35","Info: topLevel 'actions' permission set to 'read': .github/workflows/codeql.yaml:34","Info: topLevel 'contents' permission set to 'read': .github/workflows/codeql.yaml:35","Warn: topLevel 'security-events' permission set to 'write': .github/workflows/codeql.yaml:36","Warn: no topLevel permission defined: .github/workflows/dead-link-checker.yaml:1","Warn: no topLevel permission defined: .github/workflows/publish-docker-e2e-service.yaml:1","Warn: no topLevel permission defined: .github/workflows/publish-docker.yaml:1","Warn: no topLevel permission defined: .github/workflows/skywalking.yaml:1","Info: no jobLevel write permissions found"],"documentation":{"url":"https://github.com/ossf/scorecard/blob/61e84743356275f6ffca23b1b2f2cb945e19eb96/docs/checks.md#token-permissions","short":"Determines if the project's workflows follow the principle of least privilege."}},{"name":"CII-Best-Practices","score":0,"reason":"no effort to earn an OpenSSF best practices badge detected","details":null,"documentation":{"url":"https://github.com/ossf/scorecard/blob/61e84743356275f6ffca23b1b2f2cb945e19eb96/docs/checks.md#cii-best-practices","short":"Determines if the project has an OpenSSF (formerly CII) Best Practices Badge."}},{"name":"Binary-Artifacts","score":10,"reason":"no binaries found in the repo","details":null,"documentation":{"url":"https://github.com/ossf/scorecard/blob/61e84743356275f6ffca23b1b2f2cb945e19eb96/docs/checks.md#binary-artifacts","short":"Determines if the project has generated executable (binary) artifacts in the source repository."}},{"name":"License","score":10,"reason":"license file detected","details":["Info: project has a license file: LICENSE:0","Info: FSF or OSI recognized license: Apache License 2.0: LICENSE:0"],"documentation":{"url":"https://github.com/ossf/scorecard/blob/61e84743356275f6ffca23b1b2f2cb945e19eb96/docs/checks.md#license","short":"Determines if the project has defined a license."}},{"name":"Fuzzing","score":0,"reason":"project is not fuzzed","details":["Warn: no fuzzer integrations found"],"documentation":{"url":"https://github.com/ossf/scorecard/blob/61e84743356275f6ffca23b1b2f2cb945e19eb96/docs/checks.md#fuzzing","short":"Determines if the project uses fuzzing."}},{"name":"Signed-Releases","score":-1,"reason":"no releases found","details":null,"documentation":{"url":"https://github.com/ossf/scorecard/blob/61e84743356275f6ffca23b1b2f2cb945e19eb96/docs/checks.md#signed-releases","short":"Determines if the project cryptographically signs release artifacts."}},{"name":"Security-Policy","score":10,"reason":"security policy file detected","details":["Info: security policy file detected: github.com/apache/.github/.github/SECURITY.md:1","Info: Found linked content: github.com/apache/.github/.github/SECURITY.md:1","Info: Found disclosure, vulnerability, and/or timelines in security policy: github.com/apache/.github/.github/SECURITY.md:1","Info: Found text in security policy: github.com/apache/.github/.github/SECURITY.md:1"],"documentation":{"url":"https://github.com/ossf/scorecard/blob/61e84743356275f6ffca23b1b2f2cb945e19eb96/docs/checks.md#security-policy","short":"Determines if the project has published a security policy."}},{"name":"Branch-Protection","score":-1,"reason":"internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md","details":null,"documentation":{"url":"https://github.com/ossf/scorecard/blob/61e84743356275f6ffca23b1b2f2cb945e19eb96/docs/checks.md#branch-protection","short":"Determines if the default and release branches are protected with GitHub's branch protection settings."}},{"name":"Packaging","score":10,"reason":"packaging workflow detected","details":["Info: Project packages its releases by way of GitHub Actions.: .github/workflows/publish-docker-e2e-service.yaml:32"],"documentation":{"url":"https://github.com/ossf/scorecard/blob/61e84743356275f6ffca23b1b2f2cb945e19eb96/docs/checks.md#packaging","short":"Determines if the project is published as a package that others can easily download, install, easily update, and uninstall."}},{"name":"Pinned-Dependencies","score":1,"reason":"dependency not pinned by hash detected -- score normalized to 1","details":["Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/codeql.yaml:51: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/skywalking/codeql.yaml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/codeql.yaml:57: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/skywalking/codeql.yaml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/codeql.yaml:64: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/skywalking/codeql.yaml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/dead-link-checker.yaml:36: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/skywalking/dead-link-checker.yaml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/publish-docker-e2e-service.yaml:42: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/skywalking/publish-docker-e2e-service.yaml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/publish-docker-e2e-service.yaml:48: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/skywalking/publish-docker-e2e-service.yaml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/publish-docker-e2e-service.yaml:53: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/skywalking/publish-docker-e2e-service.yaml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/publish-docker.yaml:39: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/skywalking/publish-docker.yaml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/publish-docker.yaml:44: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/skywalking/publish-docker.yaml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/skywalking.yaml:70: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/skywalking/skywalking.yaml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/skywalking.yaml:74: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/skywalking/skywalking.yaml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/skywalking.yaml:80: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/skywalking/skywalking.yaml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/skywalking.yaml:165: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/skywalking/skywalking.yaml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/skywalking.yaml:169: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/skywalking/skywalking.yaml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/skywalking.yaml:182: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/skywalking/skywalking.yaml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/skywalking.yaml:200: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/skywalking/skywalking.yaml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/skywalking.yaml:204: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/skywalking/skywalking.yaml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/skywalking.yaml:210: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/skywalking/skywalking.yaml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/skywalking.yaml:221: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/skywalking/skywalking.yaml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/skywalking.yaml:988: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/skywalking/skywalking.yaml/master?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/skywalking.yaml:993: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/skywalking/skywalking.yaml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/skywalking.yaml:996: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/skywalking/skywalking.yaml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/skywalking.yaml:1024: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/skywalking/skywalking.yaml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/skywalking.yaml:1099: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/skywalking/skywalking.yaml/master?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/skywalking.yaml:1104: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/skywalking/skywalking.yaml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/skywalking.yaml:1107: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/skywalking/skywalking.yaml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/skywalking.yaml:1116: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/skywalking/skywalking.yaml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/skywalking.yaml:1128: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/skywalking/skywalking.yaml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/skywalking.yaml:1195: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/skywalking/skywalking.yaml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/skywalking.yaml:54: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/skywalking/skywalking.yaml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/skywalking.yaml:916: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/skywalking/skywalking.yaml/master?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/skywalking.yaml:921: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/skywalking/skywalking.yaml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/skywalking.yaml:924: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/skywalking/skywalking.yaml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/skywalking.yaml:952: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/skywalking/skywalking.yaml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/skywalking.yaml:1045: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/skywalking/skywalking.yaml/master?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/skywalking.yaml:1050: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/skywalking/skywalking.yaml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/skywalking.yaml:1053: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/skywalking/skywalking.yaml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/skywalking.yaml:1062: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/skywalking/skywalking.yaml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/skywalking.yaml:1067: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/skywalking/skywalking.yaml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/skywalking.yaml:118: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/skywalking/skywalking.yaml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/skywalking.yaml:246: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/skywalking/skywalking.yaml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/skywalking.yaml:251: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/skywalking/skywalking.yaml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/skywalking.yaml:256: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/skywalking/skywalking.yaml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/skywalking.yaml:275: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/skywalking/skywalking.yaml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/skywalking.yaml:280: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/skywalking/skywalking.yaml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/skywalking.yaml:285: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/skywalking/skywalking.yaml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/skywalking.yaml:312: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/skywalking/skywalking.yaml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/skywalking.yaml:317: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/skywalking/skywalking.yaml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/skywalking.yaml:322: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/skywalking/skywalking.yaml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/skywalking.yaml:801: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/skywalking/skywalking.yaml/master?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/skywalking.yaml:806: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/skywalking/skywalking.yaml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/skywalking.yaml:809: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/skywalking/skywalking.yaml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/skywalking.yaml:818: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/skywalking/skywalking.yaml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/skywalking.yaml:831: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/skywalking/skywalking.yaml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/skywalking.yaml:836: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/skywalking/skywalking.yaml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/skywalking.yaml:874: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/skywalking/skywalking.yaml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/skywalking.yaml:41: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/skywalking/skywalking.yaml/master?enable=pin","Warn: containerImage not pinned by hash: docker/data-generator/Dockerfile:19","Warn: containerImage not pinned by hash: docker/oap/Dockerfile:19","Warn: containerImage not pinned by hash: test/e2e-v2/cases/airflow/mock/Dockerfile.mock-sender:17: pin your Docker image by updating python:3.11-slim to python:3.11-slim@sha256:e88e9763f943ec1834f992a4b51e0f24500486803e8bc534e5767af9ea65f6ce","Warn: containerImage not pinned by hash: test/e2e-v2/cases/browser/docker/Dockerfile.generate-traffic:16: pin your Docker image by updating python:3.10 to python:3.10@sha256:c10791e6f69086d5216f7b5d3b839929c454e24305867ed9bc5152f0355b5423","Warn: containerImage not pinned by hash: test/e2e-v2/cases/browser/docker/Dockerfile.provider:16: pin your Docker image by updating python:3.10 to python:3.10@sha256:c10791e6f69086d5216f7b5d3b839929c454e24305867ed9bc5152f0355b5423","Warn: containerImage not pinned by hash: test/e2e-v2/cases/browser/docker/Dockerfile.test-ui:16: pin your Docker image by updating node:10.23 to node:10.23@sha256:4fafd9b63fdfb15112775847a10b2917760c720c8c28cef5167ff40f36b3cd93","Warn: containerImage not pinned by hash: test/e2e-v2/cases/browser/docker/Dockerfile.test-ui:47: pin your Docker image by updating nginx:1.19 to nginx:1.19@sha256:df13abe416e37eb3db4722840dd479b00ba193ac6606e7902331dcea50f4f1f2","Warn: containerImage not pinned by hash: test/e2e-v2/cases/dsl-debugging/lal-block/log-emitter/Dockerfile:16: pin your Docker image by updating python:3.11-slim to python:3.11-slim@sha256:e88e9763f943ec1834f992a4b51e0f24500486803e8bc534e5767af9ea65f6ce","Warn: containerImage not pinned by hash: test/e2e-v2/cases/dsl-debugging/lal-statement/log-emitter/Dockerfile:16: pin your Docker image by updating python:3.11-slim to python:3.11-slim@sha256:e88e9763f943ec1834f992a4b51e0f24500486803e8bc534e5767af9ea65f6ce","Warn: containerImage not pinned by hash: test/e2e-v2/cases/go/service/Dockerfile:17","Warn: containerImage not pinned by hash: test/e2e-v2/cases/go/service/Dockerfile:27: pin your Docker image by updating alpine:3.10 to alpine:3.10@sha256:451eee8bedcb2f029756dc3e9d73bab0e7943c1ac55cff3a4861c52a0fdd3e98","Warn: containerImage not pinned by hash: test/e2e-v2/cases/kafka/Dockerfile.provider:19","Warn: containerImage not pinned by hash: test/e2e-v2/cases/kafka/kafka-monitoring/Dockerfile:17: pin your Docker image by updating bitnamilegacy/kafka:2.4.1 to bitnamilegacy/kafka:2.4.1@sha256:5828c6695930e68039d739c90e68c912a2adc8c162a556d9003e76a0b97be675","Warn: containerImage not pinned by hash: test/e2e-v2/cases/kafka/log/Dockerfile.fluentd:16: pin your Docker image by updating bitnamilegacy/fluentd:1.12.1 to bitnamilegacy/fluentd:1.12.1@sha256:762b6371e25075172d950c21194ea11a6bbdfbcbd55efcebb0a830b7c727739d","Warn: containerImage not pinned by hash: test/e2e-v2/cases/kafka/log/Dockerfile.satellite:17","Warn: containerImage not pinned by hash: test/e2e-v2/cases/kafka/log/Dockerfile.satellite:19: pin your Docker image by updating alpine:3.10 to alpine:3.10@sha256:451eee8bedcb2f029756dc3e9d73bab0e7943c1ac55cff3a4861c52a0fdd3e98","Warn: containerImage not pinned by hash: test/e2e-v2/cases/lua/Dockerfile.nginx:16: pin your Docker image by updating openresty/openresty:1.17.8.2-5-alpine-fat to openresty/openresty:1.17.8.2-5-alpine-fat@sha256:d16404a7ea1fed5cd47c6f4e8bf501518b1fa20198f4156199b689aae4e049f9","Warn: containerImage not pinned by hash: test/e2e-v2/cases/nginx/Dockerfile.nginx:16: pin your Docker image by updating openresty/openresty:1.17.8.2-5-alpine-fat to openresty/openresty:1.17.8.2-5-alpine-fat@sha256:d16404a7ea1fed5cd47c6f4e8bf501518b1fa20198f4156199b689aae4e049f9","Warn: containerImage not pinned by hash: test/e2e-v2/cases/nodejs/Dockerfile.nodejs:16: pin your Docker image by updating node:20 to node:20@sha256:8f693eaa7e0a8e71560c9a82b55fd54c2ae920a2ba5d2cde28bac7d1c01c9ba5","Warn: containerImage not pinned by hash: test/e2e-v2/cases/php/Dockerfile.php:16: pin your Docker image by updating php:8.1-fpm-bookworm to php:8.1-fpm-bookworm@sha256:e3893eeb8f6fb719b6efa7e011e76a65cb1322054226250cedac1138b406aba4","Warn: containerImage not pinned by hash: test/e2e-v2/cases/php/Dockerfile.php:44: pin your Docker image by updating php:8.1-fpm-bookworm to php:8.1-fpm-bookworm@sha256:e3893eeb8f6fb719b6efa7e011e76a65cb1322054226250cedac1138b406aba4","Warn: containerImage not pinned by hash: test/e2e-v2/cases/profiling/ebpf/continuous/Dockerfile.sqrt:17: pin your Docker image by updating golang:1.17 to golang:1.17@sha256:87262e4a4c7db56158a80a18fefdc4fee5accc41b59cde821e691d05541bbb18","Warn: containerImage not pinned by hash: test/e2e-v2/cases/profiling/ebpf/network/Dockerfile.service:21: pin your Docker image by updating ghcr.io/apache/skywalking-go/skywalking-go:754482220284b9c59d9e48c7f3cf943362eec41d-go1.26 to ghcr.io/apache/skywalking-go/skywalking-go:754482220284b9c59d9e48c7f3cf943362eec41d-go1.26@sha256:cef1a38a09e4d7e45f7b647c3aaaa5ab41cd64226752afe1fe76b2840234f69b","Warn: containerImage not pinned by hash: test/e2e-v2/cases/profiling/ebpf/network/Dockerfile.service:31: pin your Docker image by updating alpine:3.10 to alpine:3.10@sha256:451eee8bedcb2f029756dc3e9d73bab0e7943c1ac55cff3a4861c52a0fdd3e98","Warn: containerImage not pinned by hash: test/e2e-v2/cases/profiling/ebpf/offcpu/Dockerfile.file:17: pin your Docker image by updating golang:1.17 to golang:1.17@sha256:87262e4a4c7db56158a80a18fefdc4fee5accc41b59cde821e691d05541bbb18","Warn: containerImage not pinned by hash: test/e2e-v2/cases/profiling/ebpf/oncpu/Dockerfile.sqrt:17: pin your Docker image by updating golang:1.17 to golang:1.17@sha256:87262e4a4c7db56158a80a18fefdc4fee5accc41b59cde821e691d05541bbb18","Warn: containerImage not pinned by hash: test/e2e-v2/cases/python/Dockerfile.python:16: pin your Docker image by updating python:3.10 to python:3.10@sha256:c10791e6f69086d5216f7b5d3b839929c454e24305867ed9bc5152f0355b5423","Warn: containerImage not pinned by hash: test/e2e-v2/cases/runtime-rule/lal/log-emitter/Dockerfile:16: pin your Docker image by updating python:3.11-slim to python:3.11-slim@sha256:e88e9763f943ec1834f992a4b51e0f24500486803e8bc534e5767af9ea65f6ce","Warn: containerImage not pinned by hash: test/e2e-v2/cases/runtime-rule/mal-storage/otlp-emitter/Dockerfile:16: pin your Docker image by updating python:3.11-slim to python:3.11-slim@sha256:e88e9763f943ec1834f992a4b51e0f24500486803e8bc534e5767af9ea65f6ce","Warn: containerImage not pinned by hash: test/e2e-v2/cases/satellite/Dockerfile.satellite:17","Warn: containerImage not pinned by hash: test/e2e-v2/cases/satellite/Dockerfile.satellite:19: pin your Docker image by updating alpine:3.10 to alpine:3.10@sha256:451eee8bedcb2f029756dc3e9d73bab0e7943c1ac55cff3a4861c52a0fdd3e98","Warn: containerImage not pinned by hash: test/e2e-v2/cases/vm/otel-hostmetrics/Dockerfile.otelcol:18","Warn: containerImage not pinned by hash: test/e2e-v2/cases/vm/otel-hostmetrics/Dockerfile.otelcol:20: pin your Docker image by updating alpine:3.22 to alpine:3.22@sha256:5291449c3df73caf6ed85e649dec1b9e818b39a5d8c871e97afc13e9cd5e8fa8","Warn: containerImage not pinned by hash: test/e2e-v2/cases/vm/prometheus-node-exporter/Dockerfile.nodeExporter:16: pin your Docker image by updating ubuntu:latest to ubuntu:latest@sha256:f144425ff09be612d6d9ad965196e9cdc23dae1f42110a8a11a3e9a8198759f7","Warn: containerImage not pinned by hash: test/e2e-v2/java-test-service/Dockerfile:18","Warn: containerImage not pinned by hash: test/e2e-v2/script/dockerfile/Dockerfile-openai.python:16: pin your Docker image by updating python:3.10-slim to python:3.10-slim@sha256:6ff506466f8b1e981719b468cc0023b8ef000b983cdec0eafe119d01f379e31d","Warn: pipCommand not pinned by hash: test/e2e-v2/cases/airflow/mock/Dockerfile.mock-sender:26","Warn: pipCommand not pinned by hash: test/e2e-v2/cases/browser/docker/Dockerfile.generate-traffic:20","Warn: pipCommand not pinned by hash: test/e2e-v2/cases/browser/docker/Dockerfile.provider:26-29","Warn: pipCommand not pinned by hash: test/e2e-v2/cases/browser/docker/Dockerfile.provider:27-30","Warn: npmCommand not pinned by hash: test/e2e-v2/cases/browser/docker/Dockerfile.test-ui:42-45","Warn: pipCommand not pinned by hash: test/e2e-v2/cases/dsl-debugging/lal-block/log-emitter/Dockerfile:17-20","Warn: pipCommand not pinned by hash: test/e2e-v2/cases/dsl-debugging/lal-statement/log-emitter/Dockerfile:17-20","Warn: npmCommand not pinned by hash: test/e2e-v2/cases/nodejs/Dockerfile.nodejs:29","Warn: npmCommand not pinned by hash: test/e2e-v2/cases/nodejs/Dockerfile.nodejs:31","Warn: pipCommand not pinned by hash: test/e2e-v2/cases/python/Dockerfile.python:26-29","Warn: pipCommand not pinned by hash: test/e2e-v2/cases/python/Dockerfile.python:27-30","Warn: pipCommand not pinned by hash: test/e2e-v2/cases/python/Dockerfile.python:32","Warn: pipCommand not pinned by hash: test/e2e-v2/cases/runtime-rule/lal/log-emitter/Dockerfile:17-20","Warn: pipCommand not pinned by hash: test/e2e-v2/cases/runtime-rule/mal-storage/otlp-emitter/Dockerfile:17-19","Warn: pipCommand not pinned by hash: test/e2e-v2/script/dockerfile/Dockerfile-openai.python:24-33","Warn: pipCommand not pinned by hash: test/e2e-v2/script/dockerfile/Dockerfile-openai.python:24-33","Warn: downloadThenRun not pinned by hash: benchmarks/envs-setup/istio-cluster_oap-banyandb/setup.sh:143","Warn: downloadThenRun not pinned by hash: test/e2e-v2/script/prepare/setup-e2e-shell/install-istioctl.sh:27","Warn: npmCommand not pinned by hash: .github/workflows/dead-link-checker.yaml:38","Info:   0 out of  52 GitHub-owned GitHubAction dependencies pinned","Info:  17 out of  22 third-party GitHubAction dependencies pinned","Info:   1 out of   1 goCommand dependencies pinned","Info:   0 out of  36 containerImage dependencies pinned","Info:   0 out of  13 pipCommand dependencies pinned","Info:   0 out of   4 npmCommand dependencies pinned","Info:   0 out of   2 downloadThenRun dependencies pinned"],"documentation":{"url":"https://github.com/ossf/scorecard/blob/61e84743356275f6ffca23b1b2f2cb945e19eb96/docs/checks.md#pinned-dependencies","short":"Determines if the project has declared and pinned the dependencies of its build process."}},{"name":"SAST","score":7,"reason":"SAST tool detected but not run on all commits","details":["Info: SAST configuration detected: CodeQL","Warn: 0 commits out of 30 are checked with a SAST tool"],"documentation":{"url":"https://github.com/ossf/scorecard/blob/61e84743356275f6ffca23b1b2f2cb945e19eb96/docs/checks.md#sast","short":"Determines if the project uses static code analysis."}}]}