{"date":"2026-08-24","repo":{"name":"github.com/m3db/m3","commit":"2e397f7fb58204e1da8fcc622851ca4ff9cb3fd9"},"scorecard":{"version":"v5.5.1-0.20260815060127-d1fab88f5463","commit":"d1fab88f54636ff366076edfc5c239f97b3c8e66"},"score":3.3,"checks":[{"name":"Maintained","score":0,"reason":"0 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0","details":null,"documentation":{"url":"https://github.com/ossf/scorecard/blob/d1fab88f54636ff366076edfc5c239f97b3c8e66/docs/checks.md#maintained","short":"Determines if the project is \"actively maintained\"."}},{"name":"Dangerous-Workflow","score":-1,"reason":"no workflows found","details":null,"documentation":{"url":"https://github.com/ossf/scorecard/blob/d1fab88f54636ff366076edfc5c239f97b3c8e66/docs/checks.md#dangerous-workflow","short":"Determines if the project's GitHub Action workflows avoid dangerous patterns."}},{"name":"Packaging","score":-1,"reason":"packaging workflow not detected","details":["Warn: no GitHub/GitLab publishing workflow detected."],"documentation":{"url":"https://github.com/ossf/scorecard/blob/d1fab88f54636ff366076edfc5c239f97b3c8e66/docs/checks.md#packaging","short":"Determines if the project is published as a package that others can easily download, install, easily update, and uninstall."}},{"name":"Code-Review","score":10,"reason":"all changesets reviewed","details":null,"documentation":{"url":"https://github.com/ossf/scorecard/blob/d1fab88f54636ff366076edfc5c239f97b3c8e66/docs/checks.md#code-review","short":"Determines if the project requires human code review before pull requests (aka merge requests) are merged."}},{"name":"Token-Permissions","score":-1,"reason":"No tokens found","details":null,"documentation":{"url":"https://github.com/ossf/scorecard/blob/d1fab88f54636ff366076edfc5c239f97b3c8e66/docs/checks.md#token-permissions","short":"Determines if the project's workflows follow the principle of least privilege."}},{"name":"CII-Best-Practices","score":0,"reason":"no effort to earn an OpenSSF best practices badge detected","details":null,"documentation":{"url":"https://github.com/ossf/scorecard/blob/d1fab88f54636ff366076edfc5c239f97b3c8e66/docs/checks.md#cii-best-practices","short":"Determines if the project has an OpenSSF (formerly CII) Best Practices Badge."}},{"name":"Security-Policy","score":0,"reason":"security policy file not detected","details":["Warn: no security policy file detected","Warn: no security file to analyze","Warn: no security file to analyze","Warn: no security file to analyze"],"documentation":{"url":"https://github.com/ossf/scorecard/blob/d1fab88f54636ff366076edfc5c239f97b3c8e66/docs/checks.md#security-policy","short":"Determines if the project has published a security policy."}},{"name":"Binary-Artifacts","score":10,"reason":"no binaries found in the repo","details":null,"documentation":{"url":"https://github.com/ossf/scorecard/blob/d1fab88f54636ff366076edfc5c239f97b3c8e66/docs/checks.md#binary-artifacts","short":"Determines if the project has generated executable (binary) artifacts in the source repository."}},{"name":"License","score":10,"reason":"license file detected","details":["Info: project has a license file: LICENSE:0","Info: FSF or OSI recognized license: Apache License 2.0: LICENSE:0"],"documentation":{"url":"https://github.com/ossf/scorecard/blob/d1fab88f54636ff366076edfc5c239f97b3c8e66/docs/checks.md#license","short":"Determines if the project has defined a license."}},{"name":"Fuzzing","score":0,"reason":"project is not fuzzed","details":["Warn: no fuzzer integrations found"],"documentation":{"url":"https://github.com/ossf/scorecard/blob/d1fab88f54636ff366076edfc5c239f97b3c8e66/docs/checks.md#fuzzing","short":"Determines if the project uses fuzzing."}},{"name":"Signed-Releases","score":0,"reason":"Project has not signed or included provenance with any releases.","details":["Warn: release artifact v1.5.0 not signed: https://api.github.com/repos/m3db/m3/releases/63922676","Warn: release artifact v1.4.2 not signed: https://api.github.com/repos/m3db/m3/releases/57496220","Warn: release artifact v1.4.1 not signed: https://api.github.com/repos/m3db/m3/releases/53776987","Warn: release artifact v1.4.0 not signed: https://api.github.com/repos/m3db/m3/releases/53756345","Warn: release artifact v1.3.0 not signed: https://api.github.com/repos/m3db/m3/releases/51098376","Warn: release artifact v1.5.0 does not have provenance: https://api.github.com/repos/m3db/m3/releases/63922676","Warn: release artifact v1.4.2 does not have provenance: https://api.github.com/repos/m3db/m3/releases/57496220","Warn: release artifact v1.4.1 does not have provenance: https://api.github.com/repos/m3db/m3/releases/53776987","Warn: release artifact v1.4.0 does not have provenance: https://api.github.com/repos/m3db/m3/releases/53756345","Warn: release artifact v1.3.0 does not have provenance: https://api.github.com/repos/m3db/m3/releases/51098376"],"documentation":{"url":"https://github.com/ossf/scorecard/blob/d1fab88f54636ff366076edfc5c239f97b3c8e66/docs/checks.md#signed-releases","short":"Determines if the project cryptographically signs release artifacts."}},{"name":"Branch-Protection","score":-1,"reason":"internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md","details":null,"documentation":{"url":"https://github.com/ossf/scorecard/blob/d1fab88f54636ff366076edfc5c239f97b3c8e66/docs/checks.md#branch-protection","short":"Determines if the default and release branches are protected with GitHub's branch protection settings."}},{"name":"SAST","score":0,"reason":"SAST tool is not run on all commits -- score normalized to 0","details":["Warn: 0 commits out of 30 are checked with a SAST tool"],"documentation":{"url":"https://github.com/ossf/scorecard/blob/d1fab88f54636ff366076edfc5c239f97b3c8e66/docs/checks.md#sast","short":"Determines if the project uses static code analysis."}},{"name":"Pinned-Dependencies","score":1,"reason":"dependency not pinned by hash detected -- score normalized to 1","details":["Info: Possibly incomplete results: error parsing shell code: not a valid arithmetic operator: run: scripts/docker-integration-tests/aggregator/test.sh:0","Info: Possibly incomplete results: error parsing shell code: not a valid arithmetic operator: run: scripts/docker-integration-tests/coordinator_config_rules/test.sh:0","Info: Possibly incomplete results: error parsing shell code: not a valid arithmetic operator: run: scripts/docker-integration-tests/prometheus/test.sh:0","Info: Possibly incomplete results: error parsing shell code: not a valid arithmetic operator: run: scripts/docker-integration-tests/prometheus_replication/test.sh:0","Info: Possibly incomplete results: error parsing shell code: not a valid arithmetic operator: run: scripts/docker-integration-tests/simple_v2_batch_apis/test.sh:0","Warn: containerImage not pinned by hash: Dockerfile:1: pin your Docker image by updating golang:1.22-bullseye to golang:1.22-bullseye@sha256:c89d51959c480f13e7830a33fa0174480227c8a027d0e18066e79a03cde174c4","Warn: containerImage not pinned by hash: docker/docs/Dockerfile:4: pin your Docker image by updating python:3.5-alpine to python:3.5-alpine@sha256:179992e913f024340db6347446966f69c153de72ad440b72bf7418c940c8692a","Warn: containerImage not pinned by hash: docker/grafana/Dockerfile:1: pin your Docker image by updating grafana/grafana:latest to grafana/grafana:latest@sha256:3fd54ae1214669f8355f065ec9f6445d5279a3d77095ab048ca045685272429b","Warn: containerImage not pinned by hash: docker/m3aggregator/Dockerfile:2: pin your Docker image by updating golang:1.22-alpine3.20 to golang:1.22-alpine3.20@sha256:ffd1cc7cf6bd432b951db453439c546f388d8e63100b86b585d2432cbbfa4cea","Warn: containerImage not pinned by hash: docker/m3aggregator/Dockerfile:18: pin your Docker image by updating alpine:3.20 to alpine:3.20@sha256:d9e853e87e55526f6b2917df91a2115c36dd7c696a35be12163d44e6e2a4b6bc","Warn: containerImage not pinned by hash: docker/m3aggregator/debug.Dockerfile:1: pin your Docker image by updating golang:1.21-alpine to golang:1.21-alpine@sha256:2414035b086e3c42b99654c8b26e6f5b1b1598080d65fd03c7f499552ff4dc94","Warn: containerImage not pinned by hash: docker/m3aggregator/debug.Dockerfile:8: pin your Docker image by updating alpine:3.11 to alpine:3.11@sha256:bcae378eacedab83da66079d9366c8f5df542d7ed9ab23bf487e3e1a8481375d","Warn: containerImage not pinned by hash: docker/m3aggregator/development.Dockerfile:1: pin your Docker image by updating alpine:3.11 to alpine:3.11@sha256:bcae378eacedab83da66079d9366c8f5df542d7ed9ab23bf487e3e1a8481375d","Warn: containerImage not pinned by hash: docker/m3coordinator/Dockerfile:2: pin your Docker image by updating golang:1.22-alpine3.20 to golang:1.22-alpine3.20@sha256:ffd1cc7cf6bd432b951db453439c546f388d8e63100b86b585d2432cbbfa4cea","Warn: containerImage not pinned by hash: docker/m3coordinator/Dockerfile:18: pin your Docker image by updating alpine:3.14 to alpine:3.14@sha256:0f2d5c38dd7a4f4f733e688e3a6733cb5ab1ac6e3cb4603a5dd564e5bfb80eed","Warn: containerImage not pinned by hash: docker/m3coordinator/development.Dockerfile:1: pin your Docker image by updating alpine:3.11 to alpine:3.11@sha256:bcae378eacedab83da66079d9366c8f5df542d7ed9ab23bf487e3e1a8481375d","Warn: containerImage not pinned by hash: docker/m3dbnode/Dockerfile:2: pin your Docker image by updating golang:1.22-alpine3.20 to golang:1.22-alpine3.20@sha256:ffd1cc7cf6bd432b951db453439c546f388d8e63100b86b585d2432cbbfa4cea","Warn: containerImage not pinned by hash: docker/m3dbnode/Dockerfile:18: pin your Docker image by updating alpine:3.20 to alpine:3.20@sha256:d9e853e87e55526f6b2917df91a2115c36dd7c696a35be12163d44e6e2a4b6bc","Warn: containerImage not pinned by hash: docker/m3dbnode/Dockerfile-setcap:2: pin your Docker image by updating golang:1.22-alpine3.20 to golang:1.22-alpine3.20@sha256:ffd1cc7cf6bd432b951db453439c546f388d8e63100b86b585d2432cbbfa4cea","Warn: containerImage not pinned by hash: docker/m3dbnode/Dockerfile-setcap:18: pin your Docker image by updating alpine:3.20 to alpine:3.20@sha256:d9e853e87e55526f6b2917df91a2115c36dd7c696a35be12163d44e6e2a4b6bc","Warn: containerImage not pinned by hash: docker/m3dbnode/development.Dockerfile:1: pin your Docker image by updating alpine:3.11 to alpine:3.11@sha256:bcae378eacedab83da66079d9366c8f5df542d7ed9ab23bf487e3e1a8481375d","Warn: containerImage not pinned by hash: docker/m3query/Dockerfile:2: pin your Docker image by updating golang:1.22-alpine3.20 to golang:1.22-alpine3.20@sha256:ffd1cc7cf6bd432b951db453439c546f388d8e63100b86b585d2432cbbfa4cea","Warn: containerImage not pinned by hash: docker/m3query/Dockerfile:18: pin your Docker image by updating alpine:3.20 to alpine:3.20@sha256:d9e853e87e55526f6b2917df91a2115c36dd7c696a35be12163d44e6e2a4b6bc","Warn: containerImage not pinned by hash: docker/m3query/development.Dockerfile:1: pin your Docker image by updating alpine:3.11 to alpine:3.11@sha256:bcae378eacedab83da66079d9366c8f5df542d7ed9ab23bf487e3e1a8481375d","Warn: containerImage not pinned by hash: docker/sysctl-setter/Dockerfile:1: pin your Docker image by updating alpine:3.11 to alpine:3.11@sha256:bcae378eacedab83da66079d9366c8f5df542d7ed9ab23bf487e3e1a8481375d","Warn: containerImage not pinned by hash: scripts/comparator/grafana/grafana.Dockerfile:1: pin your Docker image by updating grafana/grafana:latest to grafana/grafana:latest@sha256:3fd54ae1214669f8355f065ec9f6445d5279a3d77095ab048ca045685272429b","Warn: containerImage not pinned by hash: scripts/comparator/m3comparator.Dockerfile:1: pin your Docker image by updating alpine:latest to alpine:latest@sha256:28bd5fe8b56d1bd048e5babf5b10710ebe0bae67db86916198a6eec434943f8b","Warn: containerImage not pinned by hash: scripts/comparator/m3query.Dockerfile:1: pin your Docker image by updating alpine:latest to alpine:latest@sha256:28bd5fe8b56d1bd048e5babf5b10710ebe0bae67db86916198a6eec434943f8b","Warn: containerImage not pinned by hash: scripts/development/m3_consumer_service/Dockerfile:1: pin your Docker image by updating alpine:latest to alpine:latest@sha256:28bd5fe8b56d1bd048e5babf5b10710ebe0bae67db86916198a6eec434943f8b","Warn: containerImage not pinned by hash: scripts/docker-integration-tests/m3aggregator.Dockerfile:1: pin your Docker image by updating alpine:latest to alpine:latest@sha256:28bd5fe8b56d1bd048e5babf5b10710ebe0bae67db86916198a6eec434943f8b","Warn: containerImage not pinned by hash: scripts/docker-integration-tests/m3coordinator.Dockerfile:1: pin your Docker image by updating alpine:latest to alpine:latest@sha256:28bd5fe8b56d1bd048e5babf5b10710ebe0bae67db86916198a6eec434943f8b","Warn: containerImage not pinned by hash: scripts/docker-integration-tests/m3dbnode.Dockerfile:1: pin your Docker image by updating alpine:latest to alpine:latest@sha256:28bd5fe8b56d1bd048e5babf5b10710ebe0bae67db86916198a6eec434943f8b","Warn: containerImage not pinned by hash: scripts/thriftgen.Dockerfile:4: pin your Docker image by updating golang:1.22-alpine3.20 to golang:1.22-alpine3.20@sha256:ffd1cc7cf6bd432b951db453439c546f388d8e63100b86b585d2432cbbfa4cea","Warn: containerImage not pinned by hash: scripts/thriftgen.Dockerfile:19: pin your Docker image by updating thrift:0.10.0 to thrift:0.10.0@sha256:d64f9113aa9e9f2aef76d549706a7225582fb67d5135011291ee61b9d2b80549","Warn: pipCommand not pinned by hash: docker/docs/Dockerfile:12-15","Warn: goCommand not pinned by hash: scripts/thriftgen.Dockerfile:14-16","Info:   0 out of  29 containerImage dependencies pinned","Info:   0 out of   1 pipCommand dependencies pinned","Info:   4 out of   5 goCommand dependencies pinned"],"documentation":{"url":"https://github.com/ossf/scorecard/blob/d1fab88f54636ff366076edfc5c239f97b3c8e66/docs/checks.md#pinned-dependencies","short":"Determines if the project has declared and pinned the dependencies of its build process."}}]}