{"date":"2026-10-12","repo":{"name":"github.com/apache/spark","commit":"f19cad23c2a9b043cec660b744ed52812055d0d6"},"scorecard":{"version":"v5.6.0","commit":"61e84743356275f6ffca23b1b2f2cb945e19eb96"},"score":5.6,"checks":[{"name":"Maintained","score":10,"reason":"30 commit(s) and 2 issue activity found in the last 90 days -- score normalized to 10","details":null,"documentation":{"url":"https://github.com/ossf/scorecard/blob/61e84743356275f6ffca23b1b2f2cb945e19eb96/docs/checks.md#maintained","short":"Determines if the project is \"actively maintained\"."}},{"name":"Code-Review","score":0,"reason":"Found 0/30 approved changesets -- score normalized to 0","details":null,"documentation":{"url":"https://github.com/ossf/scorecard/blob/61e84743356275f6ffca23b1b2f2cb945e19eb96/docs/checks.md#code-review","short":"Determines if the project requires human code review before pull requests (aka merge requests) are merged."}},{"name":"Security-Policy","score":10,"reason":"security policy file detected","details":["Info: security policy file detected: SECURITY.md:1","Info: Found linked content: SECURITY.md:1","Info: Found disclosure, vulnerability, and/or timelines in security policy: SECURITY.md:1","Info: Found text in security policy: SECURITY.md:1"],"documentation":{"url":"https://github.com/ossf/scorecard/blob/61e84743356275f6ffca23b1b2f2cb945e19eb96/docs/checks.md#security-policy","short":"Determines if the project has published a security policy."}},{"name":"Dangerous-Workflow","score":10,"reason":"no dangerous workflow patterns detected","details":null,"documentation":{"url":"https://github.com/ossf/scorecard/blob/61e84743356275f6ffca23b1b2f2cb945e19eb96/docs/checks.md#dangerous-workflow","short":"Determines if the project's GitHub Action workflows avoid dangerous patterns."}},{"name":"CII-Best-Practices","score":0,"reason":"no effort to earn an OpenSSF best practices badge detected","details":null,"documentation":{"url":"https://github.com/ossf/scorecard/blob/61e84743356275f6ffca23b1b2f2cb945e19eb96/docs/checks.md#cii-best-practices","short":"Determines if the project has an OpenSSF (formerly CII) Best Practices Badge."}},{"name":"Token-Permissions","score":0,"reason":"detected GitHub workflow tokens with excessive permissions","details":["Warn: jobLevel 'actions' permission set to 'write': .github/workflows/branch35_scheduler.yml:44","Warn: jobLevel 'actions' permission set to 'write': .github/workflows/branch40_scheduler.yml:53","Warn: jobLevel 'actions' permission set to 'write': .github/workflows/branch41_scheduler.yml:57","Warn: jobLevel 'actions' permission set to 'write': .github/workflows/branch42_scheduler.yml:57","Warn: jobLevel 'actions' permission set to 'write': .github/workflows/branch43_scheduler.yml:57","Warn: jobLevel 'actions' permission set to 'write': .github/workflows/branch4x_scheduler.yml:57","Warn: jobLevel 'packages' permission set to 'write': .github/workflows/build_codegen_jdk.yml:38","Warn: jobLevel 'packages' permission set to 'write': .github/workflows/build_coverage.yml:30","Warn: jobLevel 'packages' permission set to 'write': .github/workflows/build_java17.yml:28","Warn: jobLevel 'packages' permission set to 'write': .github/workflows/build_java21.yml:30","Warn: jobLevel 'packages' permission set to 'write': .github/workflows/build_java25.yml:30","Warn: jobLevel 'packages' permission set to 'write': .github/workflows/build_main.yml:30","Warn: jobLevel 'packages' permission set to 'write': .github/workflows/build_maven.yml:30","Warn: jobLevel 'packages' permission set to 'write': .github/workflows/build_maven_java21.yml:30","Warn: jobLevel 'packages' permission set to 'write': .github/workflows/build_maven_java21_arm.yml:30","Warn: jobLevel 'packages' permission set to 'write': .github/workflows/build_maven_java21_macos26.yml:30","Warn: jobLevel 'packages' permission set to 'write': .github/workflows/build_maven_java25.yml:30","Warn: jobLevel 'packages' permission set to 'write': .github/workflows/build_non_ansi.yml:30","Warn: jobLevel 'packages' permission set to 'write': .github/workflows/build_python_3.11.yml:30","Warn: jobLevel 'packages' permission set to 'write': .github/workflows/build_python_3.12_arm.yml:30","Warn: jobLevel 'packages' permission set to 'write': .github/workflows/build_python_3.12_classic_only.yml:30","Warn: jobLevel 'packages' permission set to 'write': .github/workflows/build_python_3.12_macos26.yml:30","Warn: jobLevel 'packages' permission set to 'write': .github/workflows/build_python_3.12_pandas_3.yml:30","Warn: jobLevel 'packages' permission set to 'write': .github/workflows/build_python_3.13.yml:30","Warn: jobLevel 'packages' permission set to 'write': .github/workflows/build_python_3.14.yml:30","Warn: jobLevel 'packages' permission set to 'write': .github/workflows/build_python_3.14_nogil.yml:30","Warn: jobLevel 'packages' permission set to 'write': .github/workflows/build_python_minimum.yml:30","Warn: jobLevel 'packages' permission set to 'write': .github/workflows/build_rockdb_as_ui_backend.yml:30","Warn: jobLevel 'packages' permission set to 'write': .github/workflows/build_uds.yml:30","Info: jobLevel 'actions' permission set to 'read': .github/workflows/notify_test_workflow.yml:35","Warn: jobLevel 'checks' permission set to 'write': .github/workflows/notify_test_workflow.yml:36","Info: jobLevel 'actions' permission set to 'read': .github/workflows/test_report.yml:34","Warn: jobLevel 'checks' permission set to 'write': .github/workflows/test_report.yml:35","Info: jobLevel 'contents' permission set to 'read': .github/workflows/test_report.yml:36","Info: jobLevel 'actions' permission set to 'read': .github/workflows/update_build_status.yml:31","Warn: jobLevel 'checks' permission set to 'write': .github/workflows/update_build_status.yml:32","Warn: no topLevel permission defined: .github/workflows/benchmark.yml:1","Warn: no topLevel permission defined: .github/workflows/branch35_scheduler.yml:1","Warn: no topLevel permission defined: .github/workflows/branch40_scheduler.yml:1","Warn: no topLevel permission defined: .github/workflows/branch41_scheduler.yml:1","Warn: no topLevel permission defined: .github/workflows/branch42_scheduler.yml:1","Warn: no topLevel permission defined: .github/workflows/branch43_scheduler.yml:1","Warn: no topLevel permission defined: .github/workflows/branch4x_scheduler.yml:1","Warn: no topLevel permission defined: .github/workflows/build_and_test.yml:1","Warn: no topLevel permission defined: .github/workflows/build_codegen_jdk.yml:1","Warn: no topLevel permission defined: .github/workflows/build_coverage.yml:1","Warn: no topLevel permission defined: .github/workflows/build_infra_images_cache.yml:1","Warn: no topLevel permission defined: .github/workflows/build_java17.yml:1","Warn: no topLevel permission defined: .github/workflows/build_java21.yml:1","Warn: no topLevel permission defined: .github/workflows/build_java25.yml:1","Warn: no topLevel permission defined: .github/workflows/build_main.yml:1","Warn: no topLevel permission defined: .github/workflows/build_maven.yml:1","Warn: no topLevel permission defined: .github/workflows/build_maven_java21.yml:1","Warn: no topLevel permission defined: .github/workflows/build_maven_java21_arm.yml:1","Warn: no topLevel permission defined: .github/workflows/build_maven_java21_macos26.yml:1","Warn: no topLevel permission defined: .github/workflows/build_maven_java25.yml:1","Warn: no topLevel permission defined: .github/workflows/build_non_ansi.yml:1","Warn: no topLevel permission defined: .github/workflows/build_python_3.11.yml:1","Warn: no topLevel permission defined: .github/workflows/build_python_3.12_arm.yml:1","Warn: no topLevel permission defined: .github/workflows/build_python_3.12_classic_only.yml:1","Warn: no topLevel permission defined: .github/workflows/build_python_3.12_macos26.yml:1","Warn: no topLevel permission defined: .github/workflows/build_python_3.12_pandas_3.yml:1","Warn: no topLevel permission defined: .github/workflows/build_python_3.13.yml:1","Warn: no topLevel permission defined: .github/workflows/build_python_3.14.yml:1","Warn: no topLevel permission defined: .github/workflows/build_python_3.14_nogil.yml:1","Warn: no topLevel permission defined: .github/workflows/build_python_3.9.yml:1","Warn: no topLevel permission defined: .github/workflows/build_python_connect.yml:1","Warn: no topLevel permission defined: .github/workflows/build_python_connect40.yml:1","Warn: no topLevel permission defined: .github/workflows/build_python_minimum.yml:1","Warn: no topLevel permission defined: .github/workflows/build_python_pypy3.10.yml:1","Warn: no topLevel permission defined: .github/workflows/build_rockdb_as_ui_backend.yml:1","Warn: no topLevel permission defined: .github/workflows/build_scala213.yml:1","Warn: no topLevel permission defined: .github/workflows/build_sparkr_window.yml:1","Warn: no topLevel permission defined: .github/workflows/build_uds.yml:1","Warn: no topLevel permission defined: .github/workflows/maven_test.yml:1","Warn: no topLevel permission defined: .github/workflows/notify_test_workflow.yml:1","Warn: no topLevel permission defined: .github/workflows/pages.yml:1","Warn: no topLevel permission defined: .github/workflows/publish_snapshot.yml:1","Warn: no topLevel permission defined: .github/workflows/python_hosted_runner_test.yml:1","Warn: no topLevel permission defined: .github/workflows/release.yml:1","Warn: no topLevel permission defined: .github/workflows/stale.yml:1","Warn: no topLevel permission defined: .github/workflows/test_report.yml:1","Warn: no topLevel permission defined: .github/workflows/update_build_status.yml:1"],"documentation":{"url":"https://github.com/ossf/scorecard/blob/61e84743356275f6ffca23b1b2f2cb945e19eb96/docs/checks.md#token-permissions","short":"Determines if the project's workflows follow the principle of least privilege."}},{"name":"License","score":10,"reason":"license file detected","details":["Info: project has a license file: LICENSE:0","Info: FSF or OSI recognized license: Apache License 2.0: LICENSE:0"],"documentation":{"url":"https://github.com/ossf/scorecard/blob/61e84743356275f6ffca23b1b2f2cb945e19eb96/docs/checks.md#license","short":"Determines if the project has defined a license."}},{"name":"Signed-Releases","score":-1,"reason":"no releases found","details":null,"documentation":{"url":"https://github.com/ossf/scorecard/blob/61e84743356275f6ffca23b1b2f2cb945e19eb96/docs/checks.md#signed-releases","short":"Determines if the project cryptographically signs release artifacts."}},{"name":"Binary-Artifacts","score":10,"reason":"no binaries found in the repo","details":null,"documentation":{"url":"https://github.com/ossf/scorecard/blob/61e84743356275f6ffca23b1b2f2cb945e19eb96/docs/checks.md#binary-artifacts","short":"Determines if the project has generated executable (binary) artifacts in the source repository."}},{"name":"SAST","score":0,"reason":"no SAST tool detected","details":["Warn: no pull requests merged into dev branch"],"documentation":{"url":"https://github.com/ossf/scorecard/blob/61e84743356275f6ffca23b1b2f2cb945e19eb96/docs/checks.md#sast","short":"Determines if the project uses static code analysis."}},{"name":"Fuzzing","score":0,"reason":"project is not fuzzed","details":["Warn: no fuzzer integrations found"],"documentation":{"url":"https://github.com/ossf/scorecard/blob/61e84743356275f6ffca23b1b2f2cb945e19eb96/docs/checks.md#fuzzing","short":"Determines if the project uses fuzzing."}},{"name":"Branch-Protection","score":-1,"reason":"internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md","details":null,"documentation":{"url":"https://github.com/ossf/scorecard/blob/61e84743356275f6ffca23b1b2f2cb945e19eb96/docs/checks.md#branch-protection","short":"Determines if the default and release branches are protected with GitHub's branch protection settings."}},{"name":"Packaging","score":10,"reason":"packaging workflow detected","details":["Info: Project packages its releases by way of GitHub Actions.: .github/workflows/build_infra_images_cache.yml:53"],"documentation":{"url":"https://github.com/ossf/scorecard/blob/61e84743356275f6ffca23b1b2f2cb945e19eb96/docs/checks.md#packaging","short":"Determines if the project is published as a package that others can easily download, install, easily update, and uninstall."}},{"name":"Pinned-Dependencies","score":3,"reason":"dependency not pinned by hash detected -- score normalized to 3","details":["Info: Possibly incomplete results: error parsing shell code: unclosed here-document `EOF`: dev/gen-protos.sh:0","Info: Possibly incomplete results: error parsing shell code: invalid parameter name: .github/workflows/benchmark.yml:203","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/benchmark.yml:92: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/spark/benchmark.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/benchmark.yml:102: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/spark/benchmark.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/benchmark.yml:110: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/spark/benchmark.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/benchmark.yml:120: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/spark/benchmark.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/benchmark.yml:152: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/spark/benchmark.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/benchmark.yml:179: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/spark/benchmark.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/benchmark.yml:223: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/spark/benchmark.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build_and_test.yml:1191: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/spark/build_and_test.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build_and_test.yml:1202: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/spark/build_and_test.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build_and_test.yml:1243: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/spark/build_and_test.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build_and_test.yml:535: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/spark/build_and_test.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build_and_test.yml:557: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/spark/build_and_test.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build_and_test.yml:100: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/spark/build_and_test.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build_and_test.yml:769: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/spark/build_and_test.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build_and_test.yml:781: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/spark/build_and_test.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build_and_test.yml:800: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/spark/build_and_test.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build_and_test.yml:821: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/spark/build_and_test.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build_and_test.yml:840: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/spark/build_and_test.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build_and_test.yml:1402: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/spark/build_and_test.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build_and_test.yml:1404: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/spark/build_and_test.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build_and_test.yml:635: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/spark/build_and_test.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build_and_test.yml:659: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/spark/build_and_test.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build_and_test.yml:730: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/spark/build_and_test.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build_and_test.yml:746: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/spark/build_and_test.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build_and_test.yml:358: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/spark/build_and_test.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build_and_test.yml:369: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/spark/build_and_test.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build_and_test.yml:383: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/spark/build_and_test.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build_and_test.yml:405: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/spark/build_and_test.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build_and_test.yml:420: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/spark/build_and_test.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build_and_test.yml:426: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/spark/build_and_test.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build_and_test.yml:1033: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/spark/build_and_test.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build_and_test.yml:1043: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/spark/build_and_test.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build_and_test.yml:1052: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/spark/build_and_test.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build_and_test.yml:1058: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/spark/build_and_test.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build_and_test.yml:1102: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/spark/build_and_test.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build_and_test.yml:1117: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/spark/build_and_test.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build_and_test.yml:1256: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/spark/build_and_test.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build_and_test.yml:1267: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/spark/build_and_test.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build_and_test.yml:1388: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/spark/build_and_test.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build_and_test.yml:451: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/spark/build_and_test.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build_and_test.yml:866: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/spark/build_and_test.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build_and_test.yml:973: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/spark/build_and_test.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build_and_test.yml:1016: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/spark/build_and_test.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build_and_test.yml:945: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/spark/build_and_test.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build_and_test.yml:946: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/spark/build_and_test.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build_and_test.yml:1138: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/spark/build_and_test.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build_and_test.yml:1148: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/spark/build_and_test.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build_and_test.yml:1163: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/spark/build_and_test.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build_and_test.yml:1178: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/spark/build_and_test.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build_infra_images_cache.yml:60: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/spark/build_infra_images_cache.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build_python_connect.yml:36: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/spark/build_python_connect.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build_python_connect.yml:42: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/spark/build_python_connect.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build_python_connect.yml:111: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/spark/build_python_connect.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build_python_connect.yml:119: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/spark/build_python_connect.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build_python_connect40.yml:36: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/spark/build_python_connect40.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build_python_connect40.yml:44: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/spark/build_python_connect40.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build_python_connect40.yml:91: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/spark/build_python_connect40.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build_python_connect40.yml:99: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/spark/build_python_connect40.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build_sparkr_window.yml:34: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/spark/build_sparkr_window.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build_sparkr_window.yml:41: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/spark/build_sparkr_window.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build_sparkr_window.yml:43: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/spark/build_sparkr_window.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build_sparkr_window.yml:50: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/spark/build_sparkr_window.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build_sparkr_window.yml:68: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/spark/build_sparkr_window.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/maven_test.yml:74: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/spark/maven_test.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/maven_test.yml:108: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/spark/maven_test.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/maven_test.yml:195: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/spark/maven_test.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/maven_test.yml:208: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/spark/maven_test.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/maven_test.yml:225: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/spark/maven_test.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/maven_test.yml:309: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/spark/maven_test.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/maven_test.yml:317: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/spark/maven_test.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/notify_test_workflow.yml:39: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/spark/notify_test_workflow.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/pages.yml:50: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/spark/pages.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/pages.yml:60: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/spark/pages.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/pages.yml:81: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/spark/pages.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/pages.yml:83: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/spark/pages.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/pages.yml:88: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/spark/pages.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/publish_snapshot.yml:45: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/spark/publish_snapshot.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/publish_snapshot.yml:49: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/spark/publish_snapshot.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/publish_snapshot.yml:57: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/spark/publish_snapshot.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/publish_snapshot.yml:63: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/spark/publish_snapshot.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/python_hosted_runner_test.yml:78: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/spark/python_hosted_runner_test.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/python_hosted_runner_test.yml:101: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/spark/python_hosted_runner_test.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/python_hosted_runner_test.yml:157: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/spark/python_hosted_runner_test.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/python_hosted_runner_test.yml:168: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/spark/python_hosted_runner_test.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/python_hosted_runner_test.yml:185: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/spark/python_hosted_runner_test.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/python_hosted_runner_test.yml:211: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/spark/python_hosted_runner_test.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/python_hosted_runner_test.yml:220: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/spark/python_hosted_runner_test.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release.yml:118: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/spark/release.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release.yml:314: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/spark/release.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release.yml:320: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/spark/release.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/stale.yml:31: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/spark/stale.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/test_report.yml:39: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/spark/test_report.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/update_build_status.yml:35: update your workflow using https://app.stepsecurity.io/secureworkflow/apache/spark/update_build_status.yml/master?enable=pin","Warn: containerImage not pinned by hash: binder/Dockerfile:18: pin your Docker image by updating python:3.11-slim to python:3.11-slim@sha256:e88e9763f943ec1834f992a4b51e0f24500486803e8bc534e5767af9ea65f6ce","Warn: containerImage not pinned by hash: dev/create-release/spark-rm/Dockerfile:23","Warn: containerImage not pinned by hash: dev/create-release/spark-rm/Dockerfile.base:30: pin your Docker image by updating ubuntu:jammy-20250819 to ubuntu:jammy-20250819@sha256:4e0171b9275e12d375863f2b3ae9ce00a4c53ddda176bd55868df97ac6f21a6e","Warn: containerImage not pinned by hash: dev/spark-test-image/connect-gen-protos/Dockerfile:19: pin your Docker image by updating ubuntu:noble to ubuntu:noble@sha256:534baea6a22c03a63003dbc8dbe78fe34bc0d7e595d9a9dc9834884ff530eb55","Warn: containerImage not pinned by hash: dev/spark-test-image/docs/Dockerfile:20: pin your Docker image by updating ubuntu:noble to ubuntu:noble@sha256:534baea6a22c03a63003dbc8dbe78fe34bc0d7e595d9a9dc9834884ff530eb55","Warn: containerImage not pinned by hash: dev/spark-test-image/lint/Dockerfile:20: pin your Docker image by updating ubuntu:noble to ubuntu:noble@sha256:534baea6a22c03a63003dbc8dbe78fe34bc0d7e595d9a9dc9834884ff530eb55","Warn: containerImage not pinned by hash: dev/spark-test-image/python-311/Dockerfile:20: pin your Docker image by updating ubuntu:noble to ubuntu:noble@sha256:534baea6a22c03a63003dbc8dbe78fe34bc0d7e595d9a9dc9834884ff530eb55","Warn: containerImage not pinned by hash: dev/spark-test-image/python-312-classic-only/Dockerfile:20: pin your Docker image by updating ubuntu:noble to ubuntu:noble@sha256:534baea6a22c03a63003dbc8dbe78fe34bc0d7e595d9a9dc9834884ff530eb55","Warn: containerImage not pinned by hash: dev/spark-test-image/python-312-pandas-3/Dockerfile:23: pin your Docker image by updating ubuntu:noble to ubuntu:noble@sha256:534baea6a22c03a63003dbc8dbe78fe34bc0d7e595d9a9dc9834884ff530eb55","Warn: containerImage not pinned by hash: dev/spark-test-image/python-312/Dockerfile:20: pin your Docker image by updating ubuntu:noble to ubuntu:noble@sha256:534baea6a22c03a63003dbc8dbe78fe34bc0d7e595d9a9dc9834884ff530eb55","Warn: containerImage not pinned by hash: dev/spark-test-image/python-313/Dockerfile:20: pin your Docker image by updating ubuntu:noble to ubuntu:noble@sha256:534baea6a22c03a63003dbc8dbe78fe34bc0d7e595d9a9dc9834884ff530eb55","Warn: containerImage not pinned by hash: dev/spark-test-image/python-314-nogil/Dockerfile:20: pin your Docker image by updating ubuntu:noble to ubuntu:noble@sha256:534baea6a22c03a63003dbc8dbe78fe34bc0d7e595d9a9dc9834884ff530eb55","Warn: containerImage not pinned by hash: dev/spark-test-image/python-314/Dockerfile:20: pin your Docker image by updating ubuntu:noble to ubuntu:noble@sha256:534baea6a22c03a63003dbc8dbe78fe34bc0d7e595d9a9dc9834884ff530eb55","Warn: containerImage not pinned by hash: dev/spark-test-image/python-minimum/Dockerfile:20: pin your Docker image by updating ubuntu:noble to ubuntu:noble@sha256:534baea6a22c03a63003dbc8dbe78fe34bc0d7e595d9a9dc9834884ff530eb55","Warn: containerImage not pinned by hash: dev/spark-test-image/sparkr/Dockerfile:20: pin your Docker image by updating ubuntu:noble to ubuntu:noble@sha256:534baea6a22c03a63003dbc8dbe78fe34bc0d7e595d9a9dc9834884ff530eb55","Warn: containerImage not pinned by hash: resource-managers/kubernetes/docker/src/main/dockerfiles/spark/Dockerfile:20: pin your Docker image by updating eclipse-temurin:25-jre to eclipse-temurin:25-jre@sha256:fcd7fd7b387f94bb2ac461478a7436ad8e349924c374ea8313919624dceae636","Warn: containerImage not pinned by hash: resource-managers/kubernetes/docker/src/main/dockerfiles/spark/bindings/R/Dockerfile:20","Warn: containerImage not pinned by hash: resource-managers/kubernetes/docker/src/main/dockerfiles/spark/bindings/python/Dockerfile:20","Warn: pipCommand not pinned by hash: binder/Dockerfile:20","Warn: pipCommand not pinned by hash: binder/postBuild:40","Warn: pipCommand not pinned by hash: dev/run-pip-tests:72","Warn: pipCommand not pinned by hash: sql/create-docs.sh:37","Warn: npmCommand not pinned by hash: .github/workflows/build_and_test.yml:1411","Warn: pipCommand not pinned by hash: .github/workflows/build_python_connect.yml:56","Warn: pipCommand not pinned by hash: .github/workflows/build_python_connect.yml:57","Warn: pipCommand not pinned by hash: .github/workflows/build_python_connect40.yml:53","Warn: pipCommand not pinned by hash: .github/workflows/build_python_connect40.yml:56","Warn: pipCommand not pinned by hash: .github/workflows/build_python_connect40.yml:59","Info:   0 out of  93 GitHub-owned GitHubAction dependencies pinned","Info:  35 out of  35 third-party GitHubAction dependencies pinned","Info:   0 out of  18 containerImage dependencies pinned","Info:   0 out of   9 pipCommand dependencies pinned","Info:   1 out of   2 npmCommand dependencies pinned"],"documentation":{"url":"https://github.com/ossf/scorecard/blob/61e84743356275f6ffca23b1b2f2cb945e19eb96/docs/checks.md#pinned-dependencies","short":"Determines if the project has declared and pinned the dependencies of its build process."}}]}