{"date":"2026-10-12","repo":{"name":"github.com/litmuschaos/litmus","commit":"153f338ce7be1f6d39316c43131b9d30c0a264bc"},"scorecard":{"version":"v5.6.0","commit":"61e84743356275f6ffca23b1b2f2cb945e19eb96"},"score":8,"checks":[{"name":"Maintained","score":10,"reason":"30 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10","details":null,"documentation":{"url":"https://github.com/ossf/scorecard/blob/61e84743356275f6ffca23b1b2f2cb945e19eb96/docs/checks.md#maintained","short":"Determines if the project is \"actively maintained\"."}},{"name":"Code-Review","score":9,"reason":"Found 28/30 approved changesets -- score normalized to 9","details":null,"documentation":{"url":"https://github.com/ossf/scorecard/blob/61e84743356275f6ffca23b1b2f2cb945e19eb96/docs/checks.md#code-review","short":"Determines if the project requires human code review before pull requests (aka merge requests) are merged."}},{"name":"Packaging","score":-1,"reason":"packaging workflow not detected","details":["Warn: no GitHub/GitLab publishing workflow detected."],"documentation":{"url":"https://github.com/ossf/scorecard/blob/61e84743356275f6ffca23b1b2f2cb945e19eb96/docs/checks.md#packaging","short":"Determines if the project is published as a package that others can easily download, install, easily update, and uninstall."}},{"name":"Dangerous-Workflow","score":10,"reason":"no dangerous workflow patterns detected","details":null,"documentation":{"url":"https://github.com/ossf/scorecard/blob/61e84743356275f6ffca23b1b2f2cb945e19eb96/docs/checks.md#dangerous-workflow","short":"Determines if the project's GitHub Action workflows avoid dangerous patterns."}},{"name":"Security-Policy","score":10,"reason":"security policy file detected","details":["Info: security policy file detected: SECURITY.md:1","Info: Found linked content: SECURITY.md:1","Info: Found disclosure, vulnerability, and/or timelines in security policy: SECURITY.md:1","Info: Found text in security policy: SECURITY.md:1"],"documentation":{"url":"https://github.com/ossf/scorecard/blob/61e84743356275f6ffca23b1b2f2cb945e19eb96/docs/checks.md#security-policy","short":"Determines if the project has published a security policy."}},{"name":"Token-Permissions","score":10,"reason":"GitHub workflow tokens follow principle of least privilege","details":["Info: jobLevel 'pull-requests' permission set to 'read': .github/workflows/build.yml:18","Info: jobLevel 'contents' permission set to 'read': .github/workflows/codeql-analysis.yml:31","Info: jobLevel 'actions' permission set to 'read': .github/workflows/codeql-analysis.yml:30","Warn: jobLevel 'contents' permission set to 'write': .github/workflows/create-new-release.yml:18","Info: jobLevel 'pull-requests' permission set to 'read': .github/workflows/e2e.yml:18","Info: topLevel 'contents' permission set to 'read': .github/workflows/build.yml:9","Info: found token with 'none' permissions: .github/workflows/cifuzz.yml:1","Info: found token with 'none' permissions: .github/workflows/codeql-analysis.yml:1","Info: topLevel 'contents' permission set to 'read': .github/workflows/create-new-release.yml:12","Info: topLevel 'contents' permission set to 'read': .github/workflows/docker-lint.yml:10","Info: topLevel 'contents' permission set to 'read': .github/workflows/e2e.yml:10","Info: topLevel 'contents' permission set to 'read': .github/workflows/gh-pages.yaml:9","Info: topLevel 'contents' permission set to 'read': .github/workflows/push.yml:17"],"documentation":{"url":"https://github.com/ossf/scorecard/blob/61e84743356275f6ffca23b1b2f2cb945e19eb96/docs/checks.md#token-permissions","short":"Determines if the project's workflows follow the principle of least privilege."}},{"name":"Binary-Artifacts","score":10,"reason":"no binaries found in the repo","details":null,"documentation":{"url":"https://github.com/ossf/scorecard/blob/61e84743356275f6ffca23b1b2f2cb945e19eb96/docs/checks.md#binary-artifacts","short":"Determines if the project has generated executable (binary) artifacts in the source repository."}},{"name":"CII-Best-Practices","score":5,"reason":"badge detected: Passing","details":null,"documentation":{"url":"https://github.com/ossf/scorecard/blob/61e84743356275f6ffca23b1b2f2cb945e19eb96/docs/checks.md#cii-best-practices","short":"Determines if the project has an OpenSSF (formerly CII) Best Practices Badge."}},{"name":"License","score":10,"reason":"license file detected","details":["Info: project has a license file: LICENSE:0","Info: FSF or OSI recognized license: Apache License 2.0: LICENSE:0"],"documentation":{"url":"https://github.com/ossf/scorecard/blob/61e84743356275f6ffca23b1b2f2cb945e19eb96/docs/checks.md#license","short":"Determines if the project has defined a license."}},{"name":"Fuzzing","score":10,"reason":"project is fuzzed","details":["Info: OSSFuzz integration found","Info: GoBuiltInFuzzer integration found: chaoscenter/authentication/pkg/utils/utils_fuzz_test.go:8","Info: GoBuiltInFuzzer integration found: chaoscenter/graphql/server/pkg/authorization/authorization_fuzz_test.go:60","Info: GoBuiltInFuzzer integration found: chaoscenter/graphql/server/pkg/chaos_experiment/handler/fuzz_tests/handler_fuzz_test.go:65","Info: GoBuiltInFuzzer integration found: chaoscenter/graphql/server/pkg/chaos_experiment/handler/fuzz_tests/handler_fuzz_test.go:105","Info: GoBuiltInFuzzer integration found: chaoscenter/graphql/server/pkg/chaos_experiment/handler/fuzz_tests/handler_fuzz_test.go:146","Info: GoBuiltInFuzzer integration found: chaoscenter/graphql/server/pkg/chaos_experiment/handler/fuzz_tests/handler_fuzz_test.go:183","Info: GoBuiltInFuzzer integration found: chaoscenter/graphql/server/pkg/chaos_experiment/handler/fuzz_tests/handler_fuzz_test.go:228","Info: GoBuiltInFuzzer integration found: chaoscenter/graphql/server/pkg/chaos_experiment/handler/fuzz_tests/handler_fuzz_test.go:260","Info: GoBuiltInFuzzer integration found: chaoscenter/graphql/server/pkg/chaos_experiment/handler/fuzz_tests/handler_fuzz_test.go:285","Info: GoBuiltInFuzzer integration found: chaoscenter/graphql/server/pkg/chaos_experiment_run/fuzz_tests/service_fuzz_test.go:49","Info: GoBuiltInFuzzer integration found: chaoscenter/graphql/server/pkg/chaos_experiment_run/fuzz_tests/service_fuzz_test.go:84","Info: GoBuiltInFuzzer integration found: chaoscenter/graphql/server/pkg/chaos_experiment_run/handler/fuzz_tests/handler_fuzz_test.go:71","Info: GoBuiltInFuzzer integration found: chaoscenter/graphql/server/pkg/chaos_experiment_run/handler/fuzz_tests/handler_fuzz_test.go:137","Info: GoBuiltInFuzzer integration found: chaoscenter/graphql/server/pkg/chaos_experiment_run/handler/fuzz_tests/handler_fuzz_test.go:176","Info: GoBuiltInFuzzer integration found: chaoscenter/graphql/server/pkg/chaos_experiment_run/handler/fuzz_tests/handler_fuzz_test.go:211","Info: GoBuiltInFuzzer integration found: chaoscenter/graphql/server/pkg/chaos_infrastructure/fuzz/fuzz_test.go:69","Info: GoBuiltInFuzzer integration found: chaoscenter/graphql/server/pkg/chaos_infrastructure/fuzz/fuzz_test.go:107","Info: GoBuiltInFuzzer integration found: chaoscenter/graphql/server/pkg/chaos_infrastructure/fuzz/fuzz_test.go:139","Info: GoBuiltInFuzzer integration found: chaoscenter/graphql/server/pkg/chaos_infrastructure/fuzz/fuzz_test.go:197","Info: GoBuiltInFuzzer integration found: chaoscenter/graphql/server/pkg/chaos_infrastructure/fuzz/fuzz_test.go:262","Info: GoBuiltInFuzzer integration found: chaoscenter/graphql/server/pkg/chaos_infrastructure/fuzz/fuzz_test.go:325","Info: GoBuiltInFuzzer integration found: chaoscenter/graphql/server/pkg/chaos_infrastructure/fuzz/fuzz_test.go:375","Info: GoBuiltInFuzzer integration found: chaoscenter/graphql/server/pkg/chaos_infrastructure/fuzz/fuzz_test.go:402","Info: GoBuiltInFuzzer integration found: chaoscenter/graphql/server/pkg/chaos_infrastructure/fuzz/fuzz_test.go:431","Info: GoBuiltInFuzzer integration found: chaoscenter/graphql/server/pkg/chaos_infrastructure/fuzz/fuzz_test.go:460","Info: GoBuiltInFuzzer integration found: chaoscenter/graphql/server/pkg/chaos_infrastructure/fuzz/fuzz_test.go:489","Info: GoBuiltInFuzzer integration found: chaoscenter/graphql/server/pkg/chaos_infrastructure/fuzz/fuzz_test.go:538","Info: GoBuiltInFuzzer integration found: chaoscenter/graphql/server/pkg/chaos_infrastructure/fuzz/fuzz_test.go:572","Info: GoBuiltInFuzzer integration found: chaoscenter/graphql/server/pkg/chaos_infrastructure/fuzz/fuzz_test.go:606","Info: GoBuiltInFuzzer integration found: chaoscenter/graphql/server/pkg/chaos_infrastructure/fuzz/fuzz_test.go:632","Info: GoBuiltInFuzzer integration found: chaoscenter/graphql/server/pkg/chaoshub/handler/handler_fuzz_test.go:16","Info: GoBuiltInFuzzer integration found: chaoscenter/graphql/server/pkg/chaoshub/handler/handler_fuzz_test.go:44","Info: GoBuiltInFuzzer integration found: chaoscenter/graphql/server/pkg/chaoshub/handler/handler_fuzz_test.go:89","Info: GoBuiltInFuzzer integration found: chaoscenter/graphql/server/pkg/chaoshub/handler/handler_fuzz_test.go:131","Info: GoBuiltInFuzzer integration found: chaoscenter/graphql/server/pkg/chaoshub/handler/handler_fuzz_test.go:184","Info: GoBuiltInFuzzer integration found: chaoscenter/graphql/server/pkg/chaoshub/ops/gitops_fuzz_test.go:11","Info: GoBuiltInFuzzer integration found: chaoscenter/graphql/server/pkg/chaoshub/ops/gitops_fuzz_test.go:36","Info: GoBuiltInFuzzer integration found: chaoscenter/graphql/server/pkg/chaoshub/ops/gitops_fuzz_test.go:76","Info: GoBuiltInFuzzer integration found: chaoscenter/graphql/server/pkg/database/mongodb/chaos_experiment/fuzz_tests/operations_fuzz_test.go:22","Info: GoBuiltInFuzzer integration found: chaoscenter/graphql/server/pkg/database/mongodb/chaos_experiment/fuzz_tests/operations_fuzz_test.go:52","Info: GoBuiltInFuzzer integration found: chaoscenter/graphql/server/pkg/database/mongodb/chaos_experiment/fuzz_tests/operations_fuzz_test.go:88","Info: GoBuiltInFuzzer integration found: chaoscenter/graphql/server/pkg/database/mongodb/chaos_experiment/fuzz_tests/operations_fuzz_test.go:123","Info: GoBuiltInFuzzer integration found: chaoscenter/graphql/server/pkg/database/mongodb/chaos_experiment/fuzz_tests/operations_fuzz_test.go:145","Info: GoBuiltInFuzzer integration found: chaoscenter/graphql/server/pkg/database/mongodb/chaos_experiment/fuzz_tests/operations_fuzz_test.go:180","Info: GoBuiltInFuzzer integration found: chaoscenter/graphql/server/pkg/database/mongodb/chaos_experiment/fuzz_tests/operations_fuzz_test.go:215","Info: GoBuiltInFuzzer integration found: chaoscenter/graphql/server/pkg/database/mongodb/chaos_experiment/fuzz_tests/operations_fuzz_test.go:250","Info: GoBuiltInFuzzer integration found: chaoscenter/graphql/server/pkg/database/mongodb/chaos_experiment_run/fuzz_tests/operator_fuzz_test.go:30","Info: GoBuiltInFuzzer integration found: chaoscenter/graphql/server/pkg/database/mongodb/chaos_experiment_run/fuzz_tests/operator_fuzz_test.go:58","Info: GoBuiltInFuzzer integration found: chaoscenter/graphql/server/pkg/database/mongodb/chaos_experiment_run/fuzz_tests/operator_fuzz_test.go:86","Info: GoBuiltInFuzzer integration found: chaoscenter/graphql/server/pkg/database/mongodb/chaos_experiment_run/fuzz_tests/operator_fuzz_test.go:114","Info: GoBuiltInFuzzer integration found: chaoscenter/graphql/server/pkg/database/mongodb/chaos_experiment_run/fuzz_tests/operator_fuzz_test.go:148","Info: GoBuiltInFuzzer integration found: chaoscenter/graphql/server/pkg/database/mongodb/chaos_experiment_run/fuzz_tests/operator_fuzz_test.go:180","Info: GoBuiltInFuzzer integration found: chaoscenter/graphql/server/pkg/database/mongodb/chaos_experiment_run/fuzz_tests/operator_fuzz_test.go:212","Info: GoBuiltInFuzzer integration found: chaoscenter/graphql/server/pkg/database/mongodb/chaos_experiment_run/fuzz_tests/operator_fuzz_test.go:240","Info: GoBuiltInFuzzer integration found: chaoscenter/graphql/server/pkg/environment/handler/fuzz_tests/handler_fuzz_test.go:46","Info: GoBuiltInFuzzer integration found: chaoscenter/graphql/server/pkg/environment/handler/fuzz_tests/handler_fuzz_test.go:76","Info: GoBuiltInFuzzer integration found: chaoscenter/graphql/server/pkg/environment/handler/fuzz_tests/handler_fuzz_test.go:118","Info: GoBuiltInFuzzer integration found: chaoscenter/graphql/server/utils/fuzz_test.go:24","Info: GoBuiltInFuzzer integration found: chaoscenter/graphql/server/utils/fuzz_test.go:42","Info: GoBuiltInFuzzer integration found: chaoscenter/subscriber/pkg/events/utils_fuzz_test.go:15","Info: GoBuiltInFuzzer integration found: chaoscenter/subscriber/pkg/events/utils_fuzz_test.go:36","Info: GoBuiltInFuzzer integration found: chaoscenter/subscriber/pkg/events/utils_fuzz_test.go:51","Info: GoBuiltInFuzzer integration found: chaoscenter/subscriber/pkg/graphql/operations_fuzz_test.go:10","Info: GoBuiltInFuzzer integration found: chaoscenter/subscriber/pkg/k8s/labels_fuzz_test.go:11","Info: GoBuiltInFuzzer integration found: chaoscenter/subscriber/pkg/k8s/labels_fuzz_test.go:66"],"documentation":{"url":"https://github.com/ossf/scorecard/blob/61e84743356275f6ffca23b1b2f2cb945e19eb96/docs/checks.md#fuzzing","short":"Determines if the project uses fuzzing."}},{"name":"Signed-Releases","score":0,"reason":"Project has not signed or included provenance with any releases.","details":["Warn: release artifact 3.32.0 not signed: https://api.github.com/repos/litmuschaos/litmus/releases/390453916","Warn: release artifact 3.31.0 not signed: https://api.github.com/repos/litmuschaos/litmus/releases/354236396","Warn: release artifact 3.30.0 not signed: https://api.github.com/repos/litmuschaos/litmus/releases/340605207","Warn: release artifact 3.29.0 not signed: https://api.github.com/repos/litmuschaos/litmus/releases/324367394","Warn: release artifact 3.28.0 not signed: https://api.github.com/repos/litmuschaos/litmus/releases/309335392","Warn: release artifact 3.32.0 does not have provenance: https://api.github.com/repos/litmuschaos/litmus/releases/390453916","Warn: release artifact 3.31.0 does not have provenance: https://api.github.com/repos/litmuschaos/litmus/releases/354236396","Warn: release artifact 3.30.0 does not have provenance: https://api.github.com/repos/litmuschaos/litmus/releases/340605207","Warn: release artifact 3.29.0 does not have provenance: https://api.github.com/repos/litmuschaos/litmus/releases/324367394","Warn: release artifact 3.28.0 does not have provenance: https://api.github.com/repos/litmuschaos/litmus/releases/309335392"],"documentation":{"url":"https://github.com/ossf/scorecard/blob/61e84743356275f6ffca23b1b2f2cb945e19eb96/docs/checks.md#signed-releases","short":"Determines if the project cryptographically signs release artifacts."}},{"name":"Branch-Protection","score":-1,"reason":"internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md","details":null,"documentation":{"url":"https://github.com/ossf/scorecard/blob/61e84743356275f6ffca23b1b2f2cb945e19eb96/docs/checks.md#branch-protection","short":"Determines if the default and release branches are protected with GitHub's branch protection settings."}},{"name":"Pinned-Dependencies","score":0,"reason":"dependency not pinned by hash detected -- score normalized to 0","details":["Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build.yml:289: update your workflow using https://app.stepsecurity.io/secureworkflow/litmuschaos/litmus/build.yml/master?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/build.yml:298: update your workflow using https://app.stepsecurity.io/secureworkflow/litmuschaos/litmus/build.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build.yml:70: update your workflow using https://app.stepsecurity.io/secureworkflow/litmuschaos/litmus/build.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build.yml:71: update your workflow using https://app.stepsecurity.io/secureworkflow/litmuschaos/litmus/build.yml/master?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/build.yml:76: update your workflow using https://app.stepsecurity.io/secureworkflow/litmuschaos/litmus/build.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build.yml:92: update your workflow using https://app.stepsecurity.io/secureworkflow/litmuschaos/litmus/build.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build.yml:93: update your workflow using https://app.stepsecurity.io/secureworkflow/litmuschaos/litmus/build.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build.yml:127: update your workflow using https://app.stepsecurity.io/secureworkflow/litmuschaos/litmus/build.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build.yml:128: update your workflow using https://app.stepsecurity.io/secureworkflow/litmuschaos/litmus/build.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build.yml:146: update your workflow using https://app.stepsecurity.io/secureworkflow/litmuschaos/litmus/build.yml/master?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/build.yml:155: update your workflow using https://app.stepsecurity.io/secureworkflow/litmuschaos/litmus/build.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build.yml:175: update your workflow using https://app.stepsecurity.io/secureworkflow/litmuschaos/litmus/build.yml/master?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/build.yml:184: update your workflow using https://app.stepsecurity.io/secureworkflow/litmuschaos/litmus/build.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build.yml:202: update your workflow using https://app.stepsecurity.io/secureworkflow/litmuschaos/litmus/build.yml/master?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/build.yml:211: update your workflow using https://app.stepsecurity.io/secureworkflow/litmuschaos/litmus/build.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build.yml:230: update your workflow using https://app.stepsecurity.io/secureworkflow/litmuschaos/litmus/build.yml/master?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/build.yml:243: update your workflow using https://app.stepsecurity.io/secureworkflow/litmuschaos/litmus/build.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build.yml:55: update your workflow using https://app.stepsecurity.io/secureworkflow/litmuschaos/litmus/build.yml/master?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/build.yml:30: update your workflow using https://app.stepsecurity.io/secureworkflow/litmuschaos/litmus/build.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build.yml:110: update your workflow using https://app.stepsecurity.io/secureworkflow/litmuschaos/litmus/build.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build.yml:111: update your workflow using https://app.stepsecurity.io/secureworkflow/litmuschaos/litmus/build.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build.yml:262: update your workflow using https://app.stepsecurity.io/secureworkflow/litmuschaos/litmus/build.yml/master?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/build.yml:271: update your workflow using https://app.stepsecurity.io/secureworkflow/litmuschaos/litmus/build.yml/master?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/cifuzz.yml:21: update your workflow using https://app.stepsecurity.io/secureworkflow/litmuschaos/litmus/cifuzz.yml/master?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/cifuzz.yml:27: update your workflow using https://app.stepsecurity.io/secureworkflow/litmuschaos/litmus/cifuzz.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/cifuzz.yml:35: update your workflow using https://app.stepsecurity.io/secureworkflow/litmuschaos/litmus/cifuzz.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/cifuzz.yml:42: update your workflow using https://app.stepsecurity.io/secureworkflow/litmuschaos/litmus/cifuzz.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/codeql-analysis.yml:44: update your workflow using https://app.stepsecurity.io/secureworkflow/litmuschaos/litmus/codeql-analysis.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/codeql-analysis.yml:48: update your workflow using https://app.stepsecurity.io/secureworkflow/litmuschaos/litmus/codeql-analysis.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/codeql-analysis.yml:59: update your workflow using https://app.stepsecurity.io/secureworkflow/litmuschaos/litmus/codeql-analysis.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/codeql-analysis.yml:73: update your workflow using https://app.stepsecurity.io/secureworkflow/litmuschaos/litmus/codeql-analysis.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/create-new-release.yml:22: update your workflow using https://app.stepsecurity.io/secureworkflow/litmuschaos/litmus/create-new-release.yml/master?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/create-new-release.yml:146: update your workflow using https://app.stepsecurity.io/secureworkflow/litmuschaos/litmus/create-new-release.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/docker-lint.yml:19: update your workflow using https://app.stepsecurity.io/secureworkflow/litmuschaos/litmus/docker-lint.yml/master?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/e2e.yml:22: update your workflow using https://app.stepsecurity.io/secureworkflow/litmuschaos/litmus/e2e.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/e2e.yml:45: update your workflow using https://app.stepsecurity.io/secureworkflow/litmuschaos/litmus/e2e.yml/master?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/e2e.yml:50: update your workflow using https://app.stepsecurity.io/secureworkflow/litmuschaos/litmus/e2e.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/e2e.yml:71: update your workflow using https://app.stepsecurity.io/secureworkflow/litmuschaos/litmus/e2e.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/e2e.yml:84: update your workflow using https://app.stepsecurity.io/secureworkflow/litmuschaos/litmus/e2e.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/e2e.yml:97: update your workflow using https://app.stepsecurity.io/secureworkflow/litmuschaos/litmus/e2e.yml/master?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/e2e.yml:103: update your workflow using https://app.stepsecurity.io/secureworkflow/litmuschaos/litmus/e2e.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/e2e.yml:120: update your workflow using https://app.stepsecurity.io/secureworkflow/litmuschaos/litmus/e2e.yml/master?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/e2e.yml:151: update your workflow using https://app.stepsecurity.io/secureworkflow/litmuschaos/litmus/e2e.yml/master?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/e2e.yml:172: update your workflow using https://app.stepsecurity.io/secureworkflow/litmuschaos/litmus/e2e.yml/master?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/e2e.yml:189: update your workflow using https://app.stepsecurity.io/secureworkflow/litmuschaos/litmus/e2e.yml/master?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/e2e.yml:201: update your workflow using https://app.stepsecurity.io/secureworkflow/litmuschaos/litmus/e2e.yml/master?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/e2e.yml:213: update your workflow using https://app.stepsecurity.io/secureworkflow/litmuschaos/litmus/e2e.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/gh-pages.yaml:15: update your workflow using https://app.stepsecurity.io/secureworkflow/litmuschaos/litmus/gh-pages.yaml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/gh-pages.yaml:17: update your workflow using https://app.stepsecurity.io/secureworkflow/litmuschaos/litmus/gh-pages.yaml/master?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/gh-pages.yaml:26: update your workflow using https://app.stepsecurity.io/secureworkflow/litmuschaos/litmus/gh-pages.yaml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/push.yml:29: update your workflow using https://app.stepsecurity.io/secureworkflow/litmuschaos/litmus/push.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/push.yml:61: update your workflow using https://app.stepsecurity.io/secureworkflow/litmuschaos/litmus/push.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/push.yml:72: update your workflow using https://app.stepsecurity.io/secureworkflow/litmuschaos/litmus/push.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/push.yml:77: update your workflow using https://app.stepsecurity.io/secureworkflow/litmuschaos/litmus/push.yml/master?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/push.yml:84: update your workflow using https://app.stepsecurity.io/secureworkflow/litmuschaos/litmus/push.yml/master?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/push.yml:89: update your workflow using https://app.stepsecurity.io/secureworkflow/litmuschaos/litmus/push.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/push.yml:111: update your workflow using https://app.stepsecurity.io/secureworkflow/litmuschaos/litmus/push.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/push.yml:116: update your workflow using https://app.stepsecurity.io/secureworkflow/litmuschaos/litmus/push.yml/master?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/push.yml:123: update your workflow using https://app.stepsecurity.io/secureworkflow/litmuschaos/litmus/push.yml/master?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/push.yml:128: update your workflow using https://app.stepsecurity.io/secureworkflow/litmuschaos/litmus/push.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/push.yml:150: update your workflow using https://app.stepsecurity.io/secureworkflow/litmuschaos/litmus/push.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/push.yml:155: update your workflow using https://app.stepsecurity.io/secureworkflow/litmuschaos/litmus/push.yml/master?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/push.yml:162: update your workflow using https://app.stepsecurity.io/secureworkflow/litmuschaos/litmus/push.yml/master?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/push.yml:167: update your workflow using https://app.stepsecurity.io/secureworkflow/litmuschaos/litmus/push.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/push.yml:189: update your workflow using https://app.stepsecurity.io/secureworkflow/litmuschaos/litmus/push.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/push.yml:194: update your workflow using https://app.stepsecurity.io/secureworkflow/litmuschaos/litmus/push.yml/master?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/push.yml:201: update your workflow using https://app.stepsecurity.io/secureworkflow/litmuschaos/litmus/push.yml/master?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/push.yml:206: update your workflow using https://app.stepsecurity.io/secureworkflow/litmuschaos/litmus/push.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/push.yml:241: update your workflow using https://app.stepsecurity.io/secureworkflow/litmuschaos/litmus/push.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/push.yml:246: update your workflow using https://app.stepsecurity.io/secureworkflow/litmuschaos/litmus/push.yml/master?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/push.yml:253: update your workflow using https://app.stepsecurity.io/secureworkflow/litmuschaos/litmus/push.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/push.yml:257: update your workflow using https://app.stepsecurity.io/secureworkflow/litmuschaos/litmus/push.yml/master?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/push.yml:266: update your workflow using https://app.stepsecurity.io/secureworkflow/litmuschaos/litmus/push.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/push.yml:291: update your workflow using https://app.stepsecurity.io/secureworkflow/litmuschaos/litmus/push.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/push.yml:296: update your workflow using https://app.stepsecurity.io/secureworkflow/litmuschaos/litmus/push.yml/master?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/push.yml:303: update your workflow using https://app.stepsecurity.io/secureworkflow/litmuschaos/litmus/push.yml/master?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/push.yml:308: update your workflow using https://app.stepsecurity.io/secureworkflow/litmuschaos/litmus/push.yml/master?enable=pin","Warn: containerImage not pinned by hash: chaoscenter/authentication/Dockerfile:2: pin your Docker image by updating golang:1.26 to golang:1.26@sha256:d7722066f0b60ceccb6c0643cbed1f5f9e15506ac237146c95333504d7805d89","Warn: containerImage not pinned by hash: chaoscenter/authentication/Dockerfile:19: pin your Docker image by updating registry.access.redhat.com/ubi10/ubi-minimal:10.1 to registry.access.redhat.com/ubi10/ubi-minimal:10.1@sha256:5af8e51abe2a81b4247f05219284a627d37fb9ccf1055b90528a246fac11bc4d","Warn: containerImage not pinned by hash: chaoscenter/dex-server/Dockerfile:1: pin your Docker image by updating ghcr.io/dexidp/dex:v2.43.0 to ghcr.io/dexidp/dex:v2.43.0@sha256:b08a58c9731c693b8db02154d7afda798e1888dc76db30d34c4a0d0b8a26d913","Warn: containerImage not pinned by hash: chaoscenter/event-tracker/Dockerfile:2: pin your Docker image by updating golang:1.25 to golang:1.25@sha256:699337d620559a59b4a2bb298ad59611e535d2ee755a34cf2d2a98f37578dc80","Warn: containerImage not pinned by hash: chaoscenter/event-tracker/Dockerfile:20: pin your Docker image by updating registry.access.redhat.com/ubi10/ubi-minimal:10.1 to registry.access.redhat.com/ubi10/ubi-minimal:10.1@sha256:5af8e51abe2a81b4247f05219284a627d37fb9ccf1055b90528a246fac11bc4d","Warn: containerImage not pinned by hash: chaoscenter/graphql/server/Dockerfile:2: pin your Docker image by updating golang:1.26 to golang:1.26@sha256:d7722066f0b60ceccb6c0643cbed1f5f9e15506ac237146c95333504d7805d89","Warn: containerImage not pinned by hash: chaoscenter/graphql/server/Dockerfile:20: pin your Docker image by updating registry.access.redhat.com/ubi10/ubi-minimal:10.1 to registry.access.redhat.com/ubi10/ubi-minimal:10.1@sha256:5af8e51abe2a81b4247f05219284a627d37fb9ccf1055b90528a246fac11bc4d","Warn: containerImage not pinned by hash: chaoscenter/subscriber/Dockerfile:2: pin your Docker image by updating golang:1.26 to golang:1.26@sha256:d7722066f0b60ceccb6c0643cbed1f5f9e15506ac237146c95333504d7805d89","Warn: containerImage not pinned by hash: chaoscenter/subscriber/Dockerfile:20: pin your Docker image by updating registry.access.redhat.com/ubi10/ubi-minimal:10.1 to registry.access.redhat.com/ubi10/ubi-minimal:10.1@sha256:5af8e51abe2a81b4247f05219284a627d37fb9ccf1055b90528a246fac11bc4d","Warn: containerImage not pinned by hash: chaoscenter/upgrade-agents/control-plane/Dockerfile:2: pin your Docker image by updating golang:1.26 to golang:1.26@sha256:d7722066f0b60ceccb6c0643cbed1f5f9e15506ac237146c95333504d7805d89","Warn: containerImage not pinned by hash: chaoscenter/upgrade-agents/control-plane/Dockerfile:21: pin your Docker image by updating litmuschaos/infra-alpine to litmuschaos/infra-alpine@sha256:0656d13646ba41e66cdb935aa7c7e24a3777cef10b3c84d45d50333599e7299b","Warn: containerImage not pinned by hash: chaoscenter/web/Dockerfile:1: pin your Docker image by updating registry.access.redhat.com/ubi10/nginx-126:10.1 to registry.access.redhat.com/ubi10/nginx-126:10.1@sha256:ae4674940af8ccff65eff09e49b88eac9fb02c551016b5b204ac61b11ec3f946","Warn: goCommand not pinned by hash: chaoscenter/fuzz_build.sh:24","Warn: goCommand not pinned by hash: chaoscenter/fuzz_build.sh:25","Warn: pipCommand not pinned by hash: .github/workflows/gh-pages.yaml:23","Info:   0 out of  45 GitHub-owned GitHubAction dependencies pinned","Info:   0 out of  32 third-party GitHubAction dependencies pinned","Info:   0 out of   2 goCommand dependencies pinned","Info:   0 out of   1 pipCommand dependencies pinned","Info:   0 out of  12 containerImage dependencies pinned"],"documentation":{"url":"https://github.com/ossf/scorecard/blob/61e84743356275f6ffca23b1b2f2cb945e19eb96/docs/checks.md#pinned-dependencies","short":"Determines if the project has declared and pinned the dependencies of its build process."}},{"name":"SAST","score":10,"reason":"SAST tool is run on all commits","details":["Info: SAST configuration detected: CodeQL","Info: all commits (28) are checked with a SAST tool"],"documentation":{"url":"https://github.com/ossf/scorecard/blob/61e84743356275f6ffca23b1b2f2cb945e19eb96/docs/checks.md#sast","short":"Determines if the project uses static code analysis."}}]}