{"date":"2026-10-12","repo":{"name":"github.com/m3db/m3","commit":"177b4102d4c4fa850ef7fcd7889d58801a0ed1bf"},"scorecard":{"version":"v5.6.0","commit":"61e84743356275f6ffca23b1b2f2cb945e19eb96"},"score":3.4,"checks":[{"name":"Maintained","score":10,"reason":"30 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 10","details":null,"documentation":{"url":"https://github.com/ossf/scorecard/blob/61e84743356275f6ffca23b1b2f2cb945e19eb96/docs/checks.md#maintained","short":"Determines if the project is \"actively maintained\"."}},{"name":"Code-Review","score":1,"reason":"Found 5/29 approved changesets -- score normalized to 1","details":null,"documentation":{"url":"https://github.com/ossf/scorecard/blob/61e84743356275f6ffca23b1b2f2cb945e19eb96/docs/checks.md#code-review","short":"Determines if the project requires human code review before pull requests (aka merge requests) are merged."}},{"name":"Packaging","score":-1,"reason":"packaging workflow not detected","details":["Warn: no GitHub/GitLab publishing workflow detected."],"documentation":{"url":"https://github.com/ossf/scorecard/blob/61e84743356275f6ffca23b1b2f2cb945e19eb96/docs/checks.md#packaging","short":"Determines if the project is published as a package that others can easily download, install, easily update, and uninstall."}},{"name":"Dangerous-Workflow","score":-1,"reason":"no workflows found","details":null,"documentation":{"url":"https://github.com/ossf/scorecard/blob/61e84743356275f6ffca23b1b2f2cb945e19eb96/docs/checks.md#dangerous-workflow","short":"Determines if the project's GitHub Action workflows avoid dangerous patterns."}},{"name":"Token-Permissions","score":-1,"reason":"No tokens found","details":null,"documentation":{"url":"https://github.com/ossf/scorecard/blob/61e84743356275f6ffca23b1b2f2cb945e19eb96/docs/checks.md#token-permissions","short":"Determines if the project's workflows follow the principle of least privilege."}},{"name":"CII-Best-Practices","score":0,"reason":"no effort to earn an OpenSSF best practices badge detected","details":null,"documentation":{"url":"https://github.com/ossf/scorecard/blob/61e84743356275f6ffca23b1b2f2cb945e19eb96/docs/checks.md#cii-best-practices","short":"Determines if the project has an OpenSSF (formerly CII) Best Practices Badge."}},{"name":"Binary-Artifacts","score":10,"reason":"no binaries found in the repo","details":null,"documentation":{"url":"https://github.com/ossf/scorecard/blob/61e84743356275f6ffca23b1b2f2cb945e19eb96/docs/checks.md#binary-artifacts","short":"Determines if the project has generated executable (binary) artifacts in the source repository."}},{"name":"Security-Policy","score":0,"reason":"security policy file not detected","details":["Warn: no security policy file detected","Warn: no security file to analyze","Warn: no security file to analyze","Warn: no security file to analyze"],"documentation":{"url":"https://github.com/ossf/scorecard/blob/61e84743356275f6ffca23b1b2f2cb945e19eb96/docs/checks.md#security-policy","short":"Determines if the project has published a security policy."}},{"name":"License","score":10,"reason":"license file detected","details":["Info: project has a license file: LICENSE:0","Info: FSF or OSI recognized license: Apache License 2.0: LICENSE:0"],"documentation":{"url":"https://github.com/ossf/scorecard/blob/61e84743356275f6ffca23b1b2f2cb945e19eb96/docs/checks.md#license","short":"Determines if the project has defined a license."}},{"name":"Fuzzing","score":0,"reason":"project is not fuzzed","details":["Warn: no fuzzer integrations found"],"documentation":{"url":"https://github.com/ossf/scorecard/blob/61e84743356275f6ffca23b1b2f2cb945e19eb96/docs/checks.md#fuzzing","short":"Determines if the project uses fuzzing."}},{"name":"Branch-Protection","score":-1,"reason":"internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md","details":null,"documentation":{"url":"https://github.com/ossf/scorecard/blob/61e84743356275f6ffca23b1b2f2cb945e19eb96/docs/checks.md#branch-protection","short":"Determines if the default and release branches are protected with GitHub's branch protection settings."}},{"name":"Signed-Releases","score":0,"reason":"Project has not signed or included provenance with any releases.","details":["Warn: release artifact v1.6.0 not signed: https://api.github.com/repos/m3db/m3/releases/396926416","Warn: release artifact v1.5.0 not signed: https://api.github.com/repos/m3db/m3/releases/63922676","Warn: release artifact v1.4.2 not signed: https://api.github.com/repos/m3db/m3/releases/57496220","Warn: release artifact v1.4.1 not signed: https://api.github.com/repos/m3db/m3/releases/53776987","Warn: release artifact v1.4.0 not signed: https://api.github.com/repos/m3db/m3/releases/53756345","Warn: release artifact v1.6.0 does not have provenance: https://api.github.com/repos/m3db/m3/releases/396926416","Warn: release artifact v1.5.0 does not have provenance: https://api.github.com/repos/m3db/m3/releases/63922676","Warn: release artifact v1.4.2 does not have provenance: https://api.github.com/repos/m3db/m3/releases/57496220","Warn: release artifact v1.4.1 does not have provenance: https://api.github.com/repos/m3db/m3/releases/53776987","Warn: release artifact v1.4.0 does not have provenance: https://api.github.com/repos/m3db/m3/releases/53756345"],"documentation":{"url":"https://github.com/ossf/scorecard/blob/61e84743356275f6ffca23b1b2f2cb945e19eb96/docs/checks.md#signed-releases","short":"Determines if the project cryptographically signs release artifacts."}},{"name":"SAST","score":0,"reason":"SAST tool is not run on all commits -- score normalized to 0","details":["Warn: 0 commits out of 30 are checked with a SAST tool"],"documentation":{"url":"https://github.com/ossf/scorecard/blob/61e84743356275f6ffca23b1b2f2cb945e19eb96/docs/checks.md#sast","short":"Determines if the project uses static code analysis."}},{"name":"Pinned-Dependencies","score":1,"reason":"dependency not pinned by hash detected -- score normalized to 1","details":["Info: Possibly incomplete results: error parsing shell code: not a valid arithmetic operator: `run`: scripts/docker-integration-tests/aggregator/test.sh:0","Info: Possibly incomplete results: error parsing shell code: not a valid arithmetic operator: `run`: scripts/docker-integration-tests/coordinator_config_rules/test.sh:0","Info: Possibly incomplete results: error parsing shell code: not a valid arithmetic operator: `run`: scripts/docker-integration-tests/prometheus/test.sh:0","Info: Possibly incomplete results: error parsing shell code: not a valid arithmetic operator: `run`: scripts/docker-integration-tests/prometheus_replication/test.sh:0","Info: Possibly incomplete results: error parsing shell code: not a valid arithmetic operator: `run`: scripts/docker-integration-tests/simple_v2_batch_apis/test.sh:0","Warn: containerImage not pinned by hash: Dockerfile:1: pin your Docker image by updating golang:1.26.0-bookworm to golang:1.26.0-bookworm@sha256:2a0ba12e116687098780d3ce700f9ce3cb340783779646aafbabed748fa6677c","Warn: containerImage not pinned by hash: docker/docs/Dockerfile:4: pin your Docker image by updating python:3.5-alpine to python:3.5-alpine@sha256:179992e913f024340db6347446966f69c153de72ad440b72bf7418c940c8692a","Warn: containerImage not pinned by hash: docker/grafana/Dockerfile:1: pin your Docker image by updating grafana/grafana:latest to grafana/grafana:latest@sha256:dbbc38ea21103cefb50396340cd88afec779c7e070b0a7bf5a75b4ce46651d3f","Warn: containerImage not pinned by hash: docker/m3aggregator/Dockerfile:4: pin your Docker image by updating golang:1.26.0-alpine3.22 to golang:1.26.0-alpine3.22@sha256:169d3991a4f795124a88b33c73549955a3d856e26e8504b5530c30bd245f9f1b","Warn: containerImage not pinned by hash: docker/m3aggregator/Dockerfile:22: pin your Docker image by updating alpine:3.20 to alpine:3.20@sha256:d9e853e87e55526f6b2917df91a2115c36dd7c696a35be12163d44e6e2a4b6bc","Warn: containerImage not pinned by hash: docker/m3aggregator/debug.Dockerfile:1: pin your Docker image by updating golang:1.26.0-alpine3.22 to golang:1.26.0-alpine3.22@sha256:169d3991a4f795124a88b33c73549955a3d856e26e8504b5530c30bd245f9f1b","Warn: containerImage not pinned by hash: docker/m3aggregator/debug.Dockerfile:8: pin your Docker image by updating alpine:3.11 to alpine:3.11@sha256:bcae378eacedab83da66079d9366c8f5df542d7ed9ab23bf487e3e1a8481375d","Warn: containerImage not pinned by hash: docker/m3aggregator/development.Dockerfile:1: pin your Docker image by updating alpine:3.11 to alpine:3.11@sha256:bcae378eacedab83da66079d9366c8f5df542d7ed9ab23bf487e3e1a8481375d","Warn: containerImage not pinned by hash: docker/m3coordinator/Dockerfile:4: pin your Docker image by updating golang:1.26.0-alpine3.22 to golang:1.26.0-alpine3.22@sha256:169d3991a4f795124a88b33c73549955a3d856e26e8504b5530c30bd245f9f1b","Warn: containerImage not pinned by hash: docker/m3coordinator/Dockerfile:22: pin your Docker image by updating alpine:3.20 to alpine:3.20@sha256:d9e853e87e55526f6b2917df91a2115c36dd7c696a35be12163d44e6e2a4b6bc","Warn: containerImage not pinned by hash: docker/m3coordinator/development.Dockerfile:1: pin your Docker image by updating alpine:3.11 to alpine:3.11@sha256:bcae378eacedab83da66079d9366c8f5df542d7ed9ab23bf487e3e1a8481375d","Warn: containerImage not pinned by hash: docker/m3dbnode/Dockerfile:4: pin your Docker image by updating golang:1.26.0-alpine3.22 to golang:1.26.0-alpine3.22@sha256:169d3991a4f795124a88b33c73549955a3d856e26e8504b5530c30bd245f9f1b","Warn: containerImage not pinned by hash: docker/m3dbnode/Dockerfile:22: pin your Docker image by updating alpine:3.20 to alpine:3.20@sha256:d9e853e87e55526f6b2917df91a2115c36dd7c696a35be12163d44e6e2a4b6bc","Warn: containerImage not pinned by hash: docker/m3dbnode/Dockerfile-setcap:4: pin your Docker image by updating golang:1.26.0-alpine3.22 to golang:1.26.0-alpine3.22@sha256:169d3991a4f795124a88b33c73549955a3d856e26e8504b5530c30bd245f9f1b","Warn: containerImage not pinned by hash: docker/m3dbnode/Dockerfile-setcap:22: pin your Docker image by updating alpine:3.20 to alpine:3.20@sha256:d9e853e87e55526f6b2917df91a2115c36dd7c696a35be12163d44e6e2a4b6bc","Warn: containerImage not pinned by hash: docker/m3dbnode/development.Dockerfile:1: pin your Docker image by updating alpine:3.11 to alpine:3.11@sha256:bcae378eacedab83da66079d9366c8f5df542d7ed9ab23bf487e3e1a8481375d","Warn: containerImage not pinned by hash: docker/m3query/Dockerfile:4: pin your Docker image by updating golang:1.26.0-alpine3.22 to golang:1.26.0-alpine3.22@sha256:169d3991a4f795124a88b33c73549955a3d856e26e8504b5530c30bd245f9f1b","Warn: containerImage not pinned by hash: docker/m3query/Dockerfile:22: pin your Docker image by updating alpine:3.20 to alpine:3.20@sha256:d9e853e87e55526f6b2917df91a2115c36dd7c696a35be12163d44e6e2a4b6bc","Warn: containerImage not pinned by hash: docker/m3query/development.Dockerfile:1: pin your Docker image by updating alpine:3.11 to alpine:3.11@sha256:bcae378eacedab83da66079d9366c8f5df542d7ed9ab23bf487e3e1a8481375d","Warn: containerImage not pinned by hash: docker/sysctl-setter/Dockerfile:1: pin your Docker image by updating alpine:3.11 to alpine:3.11@sha256:bcae378eacedab83da66079d9366c8f5df542d7ed9ab23bf487e3e1a8481375d","Warn: containerImage not pinned by hash: scripts/comparator/grafana/grafana.Dockerfile:1: pin your Docker image by updating grafana/grafana:latest to grafana/grafana:latest@sha256:dbbc38ea21103cefb50396340cd88afec779c7e070b0a7bf5a75b4ce46651d3f","Warn: containerImage not pinned by hash: scripts/comparator/m3comparator.Dockerfile:1: pin your Docker image by updating alpine:latest to alpine:latest@sha256:294b683cb724975bec92580e1e685676bd4b50bda910ddb8c51d4cabeaec77e6","Warn: containerImage not pinned by hash: scripts/comparator/m3query.Dockerfile:1: pin your Docker image by updating alpine:latest to alpine:latest@sha256:294b683cb724975bec92580e1e685676bd4b50bda910ddb8c51d4cabeaec77e6","Warn: containerImage not pinned by hash: scripts/comparator/prometheus.Dockerfile:4: pin your Docker image by updating prom/prometheus:v2.31.2 to prom/prometheus:v2.31.2@sha256:05128da5ddc760fef7760b93da9883611426658b0dd707ee8d7886923487b472","Warn: containerImage not pinned by hash: scripts/development/m3_consumer_service/Dockerfile:1: pin your Docker image by updating alpine:latest to alpine:latest@sha256:294b683cb724975bec92580e1e685676bd4b50bda910ddb8c51d4cabeaec77e6","Warn: containerImage not pinned by hash: scripts/docker-integration-tests/m3aggregator.Dockerfile:1: pin your Docker image by updating alpine:latest to alpine:latest@sha256:294b683cb724975bec92580e1e685676bd4b50bda910ddb8c51d4cabeaec77e6","Warn: containerImage not pinned by hash: scripts/docker-integration-tests/m3coordinator.Dockerfile:1: pin your Docker image by updating alpine:latest to alpine:latest@sha256:294b683cb724975bec92580e1e685676bd4b50bda910ddb8c51d4cabeaec77e6","Warn: containerImage not pinned by hash: scripts/docker-integration-tests/m3dbnode.Dockerfile:1: pin your Docker image by updating alpine:latest to alpine:latest@sha256:294b683cb724975bec92580e1e685676bd4b50bda910ddb8c51d4cabeaec77e6","Warn: containerImage not pinned by hash: scripts/thriftgen.Dockerfile:4: pin your Docker image by updating golang:1.25.5-alpine3.22 to golang:1.25.5-alpine3.22@sha256:3587db7cc96576822c606d119729370dbf581931c5f43ac6d3fa03ab4ed85a10","Warn: containerImage not pinned by hash: scripts/thriftgen.Dockerfile:19: pin your Docker image by updating thrift:0.10.0 to thrift:0.10.0@sha256:d64f9113aa9e9f2aef76d549706a7225582fb67d5135011291ee61b9d2b80549","Warn: pipCommand not pinned by hash: docker/docs/Dockerfile:12-15","Warn: goCommand not pinned by hash: scripts/thriftgen.Dockerfile:14-16","Info:   4 out of   5 goCommand dependencies pinned","Info:   0 out of  30 containerImage dependencies pinned","Info:   0 out of   1 pipCommand dependencies pinned"],"documentation":{"url":"https://github.com/ossf/scorecard/blob/61e84743356275f6ffca23b1b2f2cb945e19eb96/docs/checks.md#pinned-dependencies","short":"Determines if the project has declared and pinned the dependencies of its build process."}}]}