{"date":"2026-08-24","repo":{"name":"github.com/pytorch/serve","commit":"62c4d6a1fdc1d071dbcf758ebd756029af20bd5e"},"scorecard":{"version":"v5.5.1-0.20260815060127-d1fab88f5463","commit":"d1fab88f54636ff366076edfc5c239f97b3c8e66"},"score":4.6,"checks":[{"name":"Maintained","score":0,"reason":"project is archived","details":["Warn: Repository is archived."],"documentation":{"short":"Determines if the project is \"actively maintained\".","url":"https://github.com/ossf/scorecard/blob/d1fab88f54636ff366076edfc5c239f97b3c8e66/docs/checks.md#maintained"}},{"name":"Security-Policy","score":10,"reason":"security policy file detected","details":["Info: security policy file detected: SECURITY.md:1","Info: Found linked content: SECURITY.md:1","Info: Found disclosure, vulnerability, and/or timelines in security policy: SECURITY.md:1","Info: Found text in security policy: SECURITY.md:1"],"documentation":{"short":"Determines if the project has published a security policy.","url":"https://github.com/ossf/scorecard/blob/d1fab88f54636ff366076edfc5c239f97b3c8e66/docs/checks.md#security-policy"}},{"name":"Code-Review","score":9,"reason":"Found 25/26 approved changesets -- score normalized to 9","details":null,"documentation":{"short":"Determines if the project requires human code review before pull requests (aka merge requests) are merged.","url":"https://github.com/ossf/scorecard/blob/d1fab88f54636ff366076edfc5c239f97b3c8e66/docs/checks.md#code-review"}},{"name":"Dangerous-Workflow","score":10,"reason":"no dangerous workflow patterns detected","details":null,"documentation":{"short":"Determines if the project's GitHub Action workflows avoid dangerous patterns.","url":"https://github.com/ossf/scorecard/blob/d1fab88f54636ff366076edfc5c239f97b3c8e66/docs/checks.md#dangerous-workflow"}},{"name":"Packaging","score":-1,"reason":"packaging workflow not detected","details":["Warn: no GitHub/GitLab publishing workflow detected."],"documentation":{"short":"Determines if the project is published as a package that others can easily download, install, easily update, and uninstall.","url":"https://github.com/ossf/scorecard/blob/d1fab88f54636ff366076edfc5c239f97b3c8e66/docs/checks.md#packaging"}},{"name":"CII-Best-Practices","score":0,"reason":"no effort to earn an OpenSSF best practices badge detected","details":null,"documentation":{"short":"Determines if the project has an OpenSSF (formerly CII) Best Practices Badge.","url":"https://github.com/ossf/scorecard/blob/d1fab88f54636ff366076edfc5c239f97b3c8e66/docs/checks.md#cii-best-practices"}},{"name":"Token-Permissions","score":0,"reason":"detected GitHub workflow tokens with excessive permissions","details":["Info: jobLevel 'actions' permission set to 'read': .github/workflows/codeql.yml:25","Info: jobLevel 'contents' permission set to 'read': .github/workflows/codeql.yml:26","Warn: jobLevel 'contents' permission set to 'write': .github/workflows/doc-automation.yml:12","Warn: no topLevel permission defined: .github/workflows/benchmark_nightly.yml:1","Warn: no topLevel permission defined: .github/workflows/benchmark_torch_compile_nightly.yml:1","Warn: no topLevel permission defined: .github/workflows/ci-cpu-cpp.yml:1","Warn: no topLevel permission defined: .github/workflows/ci_cpu.yml:1","Warn: no topLevel permission defined: .github/workflows/ci_gpu.yml:1","Warn: no topLevel permission defined: .github/workflows/ci_graviton_cpu.yml:1","Warn: no topLevel permission defined: .github/workflows/codeql.yml:1","Warn: no topLevel permission defined: .github/workflows/doc-automation.yml:1","Warn: no topLevel permission defined: .github/workflows/docker-ci.yaml:1","Warn: no topLevel permission defined: .github/workflows/docker-nightly-build.yml:1","Warn: no topLevel permission defined: .github/workflows/kserve_cpu_tests.yml:1","Warn: no topLevel permission defined: .github/workflows/kserve_gpu_tests.yml:1","Warn: no topLevel permission defined: .github/workflows/kubernetes_tests.yml:1","Warn: no topLevel permission defined: .github/workflows/lint.yml:1","Warn: no topLevel permission defined: .github/workflows/official_release.yml:1","Warn: no topLevel permission defined: .github/workflows/official_release_docker.yml:1","Warn: no topLevel permission defined: .github/workflows/regression_tests_cpu.yml:1","Warn: no topLevel permission defined: .github/workflows/regression_tests_cpu_binaries.yml:1","Warn: no topLevel permission defined: .github/workflows/regression_tests_docker.yml:1","Warn: no topLevel permission defined: .github/workflows/regression_tests_gpu.yml:1","Warn: no topLevel permission defined: .github/workflows/regression_tests_gpu_binaries.yml:1","Warn: no topLevel permission defined: .github/workflows/regression_tests_graviton_cpu.yml:1","Warn: no topLevel permission defined: .github/workflows/torchserve-nightly-build.yml:1"],"documentation":{"short":"Determines if the project's workflows follow the principle of least privilege.","url":"https://github.com/ossf/scorecard/blob/d1fab88f54636ff366076edfc5c239f97b3c8e66/docs/checks.md#token-permissions"}},{"name":"Binary-Artifacts","score":7,"reason":"binaries present in source code","details":["Warn: binary detected: frontend/gradle/wrapper/gradle-wrapper.jar:1","Warn: binary detected: plugins/gradle/wrapper/gradle-wrapper.jar:1","Warn: binary detected: serving-sdk/.mvn/wrapper/maven-wrapper.jar:1"],"documentation":{"short":"Determines if the project has generated executable (binary) artifacts in the source repository.","url":"https://github.com/ossf/scorecard/blob/d1fab88f54636ff366076edfc5c239f97b3c8e66/docs/checks.md#binary-artifacts"}},{"name":"License","score":10,"reason":"license file detected","details":["Info: project has a license file: LICENSE:0","Info: FSF or OSI recognized license: Apache License 2.0: LICENSE:0"],"documentation":{"short":"Determines if the project has defined a license.","url":"https://github.com/ossf/scorecard/blob/d1fab88f54636ff366076edfc5c239f97b3c8e66/docs/checks.md#license"}},{"name":"Fuzzing","score":0,"reason":"project is not fuzzed","details":["Warn: no fuzzer integrations found"],"documentation":{"short":"Determines if the project uses fuzzing.","url":"https://github.com/ossf/scorecard/blob/d1fab88f54636ff366076edfc5c239f97b3c8e66/docs/checks.md#fuzzing"}},{"name":"Branch-Protection","score":-1,"reason":"internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md","details":null,"documentation":{"short":"Determines if the default and release branches are protected with GitHub's branch protection settings.","url":"https://github.com/ossf/scorecard/blob/d1fab88f54636ff366076edfc5c239f97b3c8e66/docs/checks.md#branch-protection"}},{"name":"Signed-Releases","score":0,"reason":"Project has not signed or included provenance with any releases.","details":["Warn: release artifact v0.12.0 not signed: https://api.github.com/repos/pytorch/serve/releases/177137525","Warn: release artifact v0.11.1 not signed: https://api.github.com/repos/pytorch/serve/releases/165902110","Warn: release artifact v0.11.0 not signed: https://api.github.com/repos/pytorch/serve/releases/156196476","Warn: release artifact v0.10.0 not signed: https://api.github.com/repos/pytorch/serve/releases/146164376","Warn: release artifact v0.9.0 not signed: https://api.github.com/repos/pytorch/serve/releases/124894767","Warn: release artifact v0.12.0 does not have provenance: https://api.github.com/repos/pytorch/serve/releases/177137525","Warn: release artifact v0.11.1 does not have provenance: https://api.github.com/repos/pytorch/serve/releases/165902110","Warn: release artifact v0.11.0 does not have provenance: https://api.github.com/repos/pytorch/serve/releases/156196476","Warn: release artifact v0.10.0 does not have provenance: https://api.github.com/repos/pytorch/serve/releases/146164376","Warn: release artifact v0.9.0 does not have provenance: https://api.github.com/repos/pytorch/serve/releases/124894767"],"documentation":{"short":"Determines if the project cryptographically signs release artifacts.","url":"https://github.com/ossf/scorecard/blob/d1fab88f54636ff366076edfc5c239f97b3c8e66/docs/checks.md#signed-releases"}},{"name":"SAST","score":7,"reason":"SAST tool detected but not run on all commits","details":["Info: SAST configuration detected: CodeQL","Warn: 0 commits out of 30 are checked with a SAST tool"],"documentation":{"short":"Determines if the project uses static code analysis.","url":"https://github.com/ossf/scorecard/blob/d1fab88f54636ff366076edfc5c239f97b3c8e66/docs/checks.md#sast"}},{"name":"Pinned-Dependencies","score":0,"reason":"dependency not pinned by hash detected -- score normalized to 0","details":["Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/benchmark_nightly.yml:28: update your workflow using https://app.stepsecurity.io/secureworkflow/pytorch/serve/benchmark_nightly.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/benchmark_nightly.yml:33: update your workflow using https://app.stepsecurity.io/secureworkflow/pytorch/serve/benchmark_nightly.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/benchmark_nightly.yml:38: update your workflow using https://app.stepsecurity.io/secureworkflow/pytorch/serve/benchmark_nightly.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/benchmark_nightly.yml:58: update your workflow using https://app.stepsecurity.io/secureworkflow/pytorch/serve/benchmark_nightly.yml/master?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/benchmark_nightly.yml:63: update your workflow using https://app.stepsecurity.io/secureworkflow/pytorch/serve/benchmark_nightly.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/benchmark_nightly.yml:75: update your workflow using https://app.stepsecurity.io/secureworkflow/pytorch/serve/benchmark_nightly.yml/master?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/benchmark_nightly.yml:81: update your workflow using https://app.stepsecurity.io/secureworkflow/pytorch/serve/benchmark_nightly.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/benchmark_torch_compile_nightly.yml:24: update your workflow using https://app.stepsecurity.io/secureworkflow/pytorch/serve/benchmark_torch_compile_nightly.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/benchmark_torch_compile_nightly.yml:29: update your workflow using https://app.stepsecurity.io/secureworkflow/pytorch/serve/benchmark_torch_compile_nightly.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/benchmark_torch_compile_nightly.yml:34: update your workflow using https://app.stepsecurity.io/secureworkflow/pytorch/serve/benchmark_torch_compile_nightly.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci-cpu-cpp.yml:28: update your workflow using https://app.stepsecurity.io/secureworkflow/pytorch/serve/ci-cpu-cpp.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci-cpu-cpp.yml:33: update your workflow using https://app.stepsecurity.io/secureworkflow/pytorch/serve/ci-cpu-cpp.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci-cpu-cpp.yml:38: update your workflow using https://app.stepsecurity.io/secureworkflow/pytorch/serve/ci-cpu-cpp.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci_cpu.yml:28: update your workflow using https://app.stepsecurity.io/secureworkflow/pytorch/serve/ci_cpu.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci_cpu.yml:34: update your workflow using https://app.stepsecurity.io/secureworkflow/pytorch/serve/ci_cpu.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci_cpu.yml:39: update your workflow using https://app.stepsecurity.io/secureworkflow/pytorch/serve/ci_cpu.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci_cpu.yml:44: update your workflow using https://app.stepsecurity.io/secureworkflow/pytorch/serve/ci_cpu.yml/master?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/ci_cpu.yml:53: update your workflow using https://app.stepsecurity.io/secureworkflow/pytorch/serve/ci_cpu.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci_gpu.yml:31: update your workflow using https://app.stepsecurity.io/secureworkflow/pytorch/serve/ci_gpu.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci_gpu.yml:36: update your workflow using https://app.stepsecurity.io/secureworkflow/pytorch/serve/ci_gpu.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci_gpu.yml:41: update your workflow using https://app.stepsecurity.io/secureworkflow/pytorch/serve/ci_gpu.yml/master?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/ci_gpu.yml:48: update your workflow using https://app.stepsecurity.io/secureworkflow/pytorch/serve/ci_gpu.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci_graviton_cpu.yml:23: update your workflow using https://app.stepsecurity.io/secureworkflow/pytorch/serve/ci_graviton_cpu.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci_graviton_cpu.yml:28: update your workflow using https://app.stepsecurity.io/secureworkflow/pytorch/serve/ci_graviton_cpu.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci_graviton_cpu.yml:33: update your workflow using https://app.stepsecurity.io/secureworkflow/pytorch/serve/ci_graviton_cpu.yml/master?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/ci_graviton_cpu.yml:40: update your workflow using https://app.stepsecurity.io/secureworkflow/pytorch/serve/ci_graviton_cpu.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/codeql.yml:36: update your workflow using https://app.stepsecurity.io/secureworkflow/pytorch/serve/codeql.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/codeql.yml:41: update your workflow using https://app.stepsecurity.io/secureworkflow/pytorch/serve/codeql.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/codeql.yml:46: update your workflow using https://app.stepsecurity.io/secureworkflow/pytorch/serve/codeql.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/codeql.yml:53: update your workflow using https://app.stepsecurity.io/secureworkflow/pytorch/serve/codeql.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/codeql.yml:66: update your workflow using https://app.stepsecurity.io/secureworkflow/pytorch/serve/codeql.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/doc-automation.yml:15: update your workflow using https://app.stepsecurity.io/secureworkflow/pytorch/serve/doc-automation.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/doc-automation.yml:20: update your workflow using https://app.stepsecurity.io/secureworkflow/pytorch/serve/doc-automation.yml/master?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/doc-automation.yml:30: update your workflow using https://app.stepsecurity.io/secureworkflow/pytorch/serve/doc-automation.yml/master?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/doc-automation.yml:38: update your workflow using https://app.stepsecurity.io/secureworkflow/pytorch/serve/doc-automation.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/docker-ci.yaml:19: update your workflow using https://app.stepsecurity.io/secureworkflow/pytorch/serve/docker-ci.yaml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/docker-nightly-build.yml:21: update your workflow using https://app.stepsecurity.io/secureworkflow/pytorch/serve/docker-nightly-build.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/docker-nightly-build.yml:26: update your workflow using https://app.stepsecurity.io/secureworkflow/pytorch/serve/docker-nightly-build.yml/master?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/docker-nightly-build.yml:46: update your workflow using https://app.stepsecurity.io/secureworkflow/pytorch/serve/docker-nightly-build.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/kserve_cpu_tests.yml:28: update your workflow using https://app.stepsecurity.io/secureworkflow/pytorch/serve/kserve_cpu_tests.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/kserve_cpu_tests.yml:37: update your workflow using https://app.stepsecurity.io/secureworkflow/pytorch/serve/kserve_cpu_tests.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/kserve_cpu_tests.yml:39: update your workflow using https://app.stepsecurity.io/secureworkflow/pytorch/serve/kserve_cpu_tests.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/kserve_gpu_tests.yml:28: update your workflow using https://app.stepsecurity.io/secureworkflow/pytorch/serve/kserve_gpu_tests.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/kserve_gpu_tests.yml:37: update your workflow using https://app.stepsecurity.io/secureworkflow/pytorch/serve/kserve_gpu_tests.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/kserve_gpu_tests.yml:39: update your workflow using https://app.stepsecurity.io/secureworkflow/pytorch/serve/kserve_gpu_tests.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/kubernetes_tests.yml:28: update your workflow using https://app.stepsecurity.io/secureworkflow/pytorch/serve/kubernetes_tests.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/kubernetes_tests.yml:33: update your workflow using https://app.stepsecurity.io/secureworkflow/pytorch/serve/kubernetes_tests.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/lint.yml:18: update your workflow using https://app.stepsecurity.io/secureworkflow/pytorch/serve/lint.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/lint.yml:23: update your workflow using https://app.stepsecurity.io/secureworkflow/pytorch/serve/lint.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/lint.yml:45: update your workflow using https://app.stepsecurity.io/secureworkflow/pytorch/serve/lint.yml/master?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/lint.yml:56: update your workflow using https://app.stepsecurity.io/secureworkflow/pytorch/serve/lint.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/lint.yml:81: update your workflow using https://app.stepsecurity.io/secureworkflow/pytorch/serve/lint.yml/master?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/lint.yml:90: update your workflow using https://app.stepsecurity.io/secureworkflow/pytorch/serve/lint.yml/master?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/official_release.yml:13: update your workflow using https://app.stepsecurity.io/secureworkflow/pytorch/serve/official_release.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/official_release.yml:23: update your workflow using https://app.stepsecurity.io/secureworkflow/pytorch/serve/official_release.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/official_release.yml:29: update your workflow using https://app.stepsecurity.io/secureworkflow/pytorch/serve/official_release.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/official_release_docker.yml:29: update your workflow using https://app.stepsecurity.io/secureworkflow/pytorch/serve/official_release_docker.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/official_release_docker.yml:34: update your workflow using https://app.stepsecurity.io/secureworkflow/pytorch/serve/official_release_docker.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/regression_tests_cpu.yml:27: update your workflow using https://app.stepsecurity.io/secureworkflow/pytorch/serve/regression_tests_cpu.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/regression_tests_cpu.yml:33: update your workflow using https://app.stepsecurity.io/secureworkflow/pytorch/serve/regression_tests_cpu.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/regression_tests_cpu.yml:38: update your workflow using https://app.stepsecurity.io/secureworkflow/pytorch/serve/regression_tests_cpu.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/regression_tests_cpu.yml:43: update your workflow using https://app.stepsecurity.io/secureworkflow/pytorch/serve/regression_tests_cpu.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/regression_tests_cpu_binaries.yml:30: update your workflow using https://app.stepsecurity.io/secureworkflow/pytorch/serve/regression_tests_cpu_binaries.yml/master?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/regression_tests_cpu_binaries.yml:34: update your workflow using https://app.stepsecurity.io/secureworkflow/pytorch/serve/regression_tests_cpu_binaries.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/regression_tests_cpu_binaries.yml:40: update your workflow using https://app.stepsecurity.io/secureworkflow/pytorch/serve/regression_tests_cpu_binaries.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/regression_tests_cpu_binaries.yml:45: update your workflow using https://app.stepsecurity.io/secureworkflow/pytorch/serve/regression_tests_cpu_binaries.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/regression_tests_docker.yml:34: update your workflow using https://app.stepsecurity.io/secureworkflow/pytorch/serve/regression_tests_docker.yml/master?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/regression_tests_docker.yml:64: update your workflow using https://app.stepsecurity.io/secureworkflow/pytorch/serve/regression_tests_docker.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/regression_tests_gpu.yml:34: update your workflow using https://app.stepsecurity.io/secureworkflow/pytorch/serve/regression_tests_gpu.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/regression_tests_gpu.yml:39: update your workflow using https://app.stepsecurity.io/secureworkflow/pytorch/serve/regression_tests_gpu.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/regression_tests_gpu.yml:44: update your workflow using https://app.stepsecurity.io/secureworkflow/pytorch/serve/regression_tests_gpu.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/regression_tests_gpu_binaries.yml:30: update your workflow using https://app.stepsecurity.io/secureworkflow/pytorch/serve/regression_tests_gpu_binaries.yml/master?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/regression_tests_gpu_binaries.yml:33: update your workflow using https://app.stepsecurity.io/secureworkflow/pytorch/serve/regression_tests_gpu_binaries.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/regression_tests_gpu_binaries.yml:38: update your workflow using https://app.stepsecurity.io/secureworkflow/pytorch/serve/regression_tests_gpu_binaries.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/regression_tests_gpu_binaries.yml:45: update your workflow using https://app.stepsecurity.io/secureworkflow/pytorch/serve/regression_tests_gpu_binaries.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/regression_tests_graviton_cpu.yml:21: update your workflow using https://app.stepsecurity.io/secureworkflow/pytorch/serve/regression_tests_graviton_cpu.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/regression_tests_graviton_cpu.yml:26: update your workflow using https://app.stepsecurity.io/secureworkflow/pytorch/serve/regression_tests_graviton_cpu.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/regression_tests_graviton_cpu.yml:31: update your workflow using https://app.stepsecurity.io/secureworkflow/pytorch/serve/regression_tests_graviton_cpu.yml/master?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/torchserve-nightly-build.yml:13: update your workflow using https://app.stepsecurity.io/secureworkflow/pytorch/serve/torchserve-nightly-build.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/torchserve-nightly-build.yml:21: update your workflow using https://app.stepsecurity.io/secureworkflow/pytorch/serve/torchserve-nightly-build.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/torchserve-nightly-build.yml:29: update your workflow using https://app.stepsecurity.io/secureworkflow/pytorch/serve/torchserve-nightly-build.yml/master?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/torchserve-nightly-build.yml:45: update your workflow using https://app.stepsecurity.io/secureworkflow/pytorch/serve/torchserve-nightly-build.yml/master?enable=pin","Warn: containerImage not pinned by hash: docker/Dockerfile:30: pin your Docker image by updating ubuntu:rolling to ubuntu:rolling@sha256:2260313b31c8c011cd2eebe728008efac1b3982be73eb71348ea2648d2c0e09b","Warn: containerImage not pinned by hash: docker/Dockerfile:110: pin your Docker image by updating ubuntu:rolling to ubuntu:rolling@sha256:2260313b31c8c011cd2eebe728008efac1b3982be73eb71348ea2648d2c0e09b","Warn: containerImage not pinned by hash: docker/Dockerfile:155: pin your Docker image by updating ubuntu:rolling to ubuntu:rolling@sha256:2260313b31c8c011cd2eebe728008efac1b3982be73eb71348ea2648d2c0e09b","Warn: containerImage not pinned by hash: docker/Dockerfile:200: pin your Docker image by updating ubuntu:rolling to ubuntu:rolling@sha256:2260313b31c8c011cd2eebe728008efac1b3982be73eb71348ea2648d2c0e09b","Warn: containerImage not pinned by hash: docker/Dockerfile.dev:15: pin your Docker image by updating ubuntu:rolling to ubuntu:rolling@sha256:2260313b31c8c011cd2eebe728008efac1b3982be73eb71348ea2648d2c0e09b","Warn: containerImage not pinned by hash: docker/Dockerfile.dev:62","Warn: containerImage not pinned by hash: docker/Dockerfile.dev:93","Warn: containerImage not pinned by hash: docker/Dockerfile.dev:113","Warn: containerImage not pinned by hash: docker/Dockerfile.neuron.dev:20: pin your Docker image by updating ubuntu:rolling to ubuntu:rolling@sha256:2260313b31c8c011cd2eebe728008efac1b3982be73eb71348ea2648d2c0e09b","Warn: containerImage not pinned by hash: docker/Dockerfile.neuron.dev:67","Warn: containerImage not pinned by hash: docker/Dockerfile.neuron.dev:93","Warn: containerImage not pinned by hash: docker/Dockerfile.neuron.dev:113","Warn: containerImage not pinned by hash: docker/Dockerfile.rocm:29: pin your Docker image by updating ubuntu:24.04 to ubuntu:24.04@sha256:33ceb71981b602c1a7443a53469e4dba065f7503eab3078a2d7a57a2ab987517","Warn: containerImage not pinned by hash: docker/Dockerfile.rocm:109: pin your Docker image by updating ubuntu:24.04 to ubuntu:24.04@sha256:33ceb71981b602c1a7443a53469e4dba065f7503eab3078a2d7a57a2ab987517","Warn: containerImage not pinned by hash: docker/Dockerfile.rocm:172: pin your Docker image by updating ubuntu:24.04 to ubuntu:24.04@sha256:33ceb71981b602c1a7443a53469e4dba065f7503eab3078a2d7a57a2ab987517","Warn: containerImage not pinned by hash: docker/Dockerfile.rocm:233: pin your Docker image by updating ubuntu:24.04 to ubuntu:24.04@sha256:33ceb71981b602c1a7443a53469e4dba065f7503eab3078a2d7a57a2ab987517","Warn: containerImage not pinned by hash: docker/Dockerfile.vllm:1: pin your Docker image by updating pytorch/torchserve-nightly:latest-gpu to pytorch/torchserve-nightly:latest-gpu@sha256:c8258cbcce6c289928a4ce566aa88ee1b821d8949704b9cb1ca1fb7e7d537869","Warn: containerImage not pinned by hash: examples/LLM/llama/chat_app/docker/Dockerfile:3","Warn: containerImage not pinned by hash: examples/usecases/llm_diffusion_serving_app/docker/Dockerfile:3","Warn: containerImage not pinned by hash: kubernetes/kserve/Dockerfile:14: pin your Docker image by updating pytorch/torchserve:latest to pytorch/torchserve:latest@sha256:50e189492f630a56214dce45ec6fd8db3ad45845890c0e8c26b469c6b06ca4fe","Warn: containerImage not pinned by hash: kubernetes/kserve/Dockerfile.dev:15: pin your Docker image by updating ubuntu:20.04 to ubuntu:20.04@sha256:8feb4d8ca5354def3d8fce243717141ce31e2c428701f6682bd2fafe15388214","Warn: containerImage not pinned by hash: kubernetes/kserve/Dockerfile.dev:55","Warn: containerImage not pinned by hash: kubernetes/kserve/Dockerfile.dev:84","Warn: containerImage not pinned by hash: kubernetes/kserve/Dockerfile.dev:104","Warn: containerImage not pinned by hash: kubernetes/kserve/examples/gpt_fast/Dockerfile:1: pin your Docker image by updating pytorch/torchserve-kfs-nightly:latest-gpu to pytorch/torchserve-kfs-nightly:latest-gpu@sha256:a0b47fbe265de5c37ba0338974a96260be591c1e876512cd63501d09b7a98967","Warn: containerImage not pinned by hash: kubernetes/kserve/image_transformer/transformer.Dockerfile:1: pin your Docker image by updating python:3.8.18-slim to python:3.8.18-slim@sha256:e796941013b10bb53a0924d8705485a1afe654bbbc6fe71d32509101e44b6414","Warn: containerImage not pinned by hash: kubernetes/tests/docker/Dockerfile:1: pin your Docker image by updating pytorch/torchserve-nightly:latest-gpu to pytorch/torchserve-nightly:latest-gpu@sha256:c8258cbcce6c289928a4ce566aa88ee1b821d8949704b9cb1ca1fb7e7d537869","Warn: pipCommand not pinned by hash: docker/Dockerfile:64","Warn: pipCommand not pinned by hash: docker/Dockerfile:99-107","Warn: pipCommand not pinned by hash: docker/Dockerfile:99-107","Warn: pipCommand not pinned by hash: docker/Dockerfile:99-107","Warn: npmCommand not pinned by hash: docker/Dockerfile:161-184","Warn: pipCommand not pinned by hash: docker/Dockerfile:191","Warn: pipCommand not pinned by hash: docker/Dockerfile:247-257","Warn: pipCommand not pinned by hash: docker/Dockerfile:247-257","Warn: pipCommand not pinned by hash: docker/Dockerfile.dev:72-83","Warn: pipCommand not pinned by hash: docker/Dockerfile.dev:72-83","Warn: pipCommand not pinned by hash: docker/Dockerfile.neuron.dev:53","Warn: pipCommand not pinned by hash: docker/Dockerfile.neuron.dev:70-83","Warn: pipCommand not pinned by hash: docker/Dockerfile.rocm:151-155","Warn: npmCommand not pinned by hash: docker/Dockerfile.rocm:179-201","Warn: pipCommand not pinned by hash: docker/Dockerfile.rocm:218-222","Warn: npmCommand not pinned by hash: docker/Dockerfile.rocm:244-273","Warn: pipCommand not pinned by hash: docker/Dockerfile.rocm:297-301","Warn: pipCommand not pinned by hash: docker/Dockerfile.vllm:6","Warn: pipCommand not pinned by hash: examples/LLM/llama/chat_app/docker/Dockerfile:15","Warn: pipCommand not pinned by hash: examples/LLM/llama/chat_app/docker/Dockerfile:18-21","Warn: pipCommand not pinned by hash: examples/usecases/llm_diffusion_serving_app/docker/Dockerfile:29","Warn: pipCommand not pinned by hash: examples/usecases/llm_diffusion_serving_app/docker/Dockerfile:34","Warn: pipCommand not pinned by hash: kubernetes/kserve/Dockerfile:18","Warn: pipCommand not pinned by hash: kubernetes/kserve/Dockerfile:22","Warn: pipCommand not pinned by hash: kubernetes/kserve/Dockerfile.dev:52","Warn: pipCommand not pinned by hash: kubernetes/kserve/Dockerfile.dev:58-75","Warn: pipCommand not pinned by hash: kubernetes/kserve/Dockerfile.dev:58-75","Warn: pipCommand not pinned by hash: kubernetes/kserve/examples/gpt_fast/Dockerfile:4","Warn: pipCommand not pinned by hash: kubernetes/kserve/examples/gpt_fast/Dockerfile:4","Warn: pipCommand not pinned by hash: kubernetes/kserve/image_transformer/transformer.Dockerfile:8","Warn: pipCommand not pinned by hash: kubernetes/kserve/image_transformer/transformer.Dockerfile:10","Warn: pipCommand not pinned by hash: benchmarks/benchmark_model_dependencies.sh:6","Warn: pipCommand not pinned by hash: benchmarks/install_dependencies.sh:36","Warn: pipCommand not pinned by hash: benchmarks/install_dependencies.sh:37","Warn: pipCommand not pinned by hash: benchmarks/install_dependencies.sh:40","Warn: pipCommand not pinned by hash: benchmarks/install_dependencies.sh:44","Warn: pipCommand not pinned by hash: examples/LLM/llama/chat_app/package_llama.sh:16","Warn: pipCommand not pinned by hash: examples/LLM/llama/chat_app/package_llama.sh:24","Warn: pipCommand not pinned by hash: examples/asr_rnnt_emformer/00_save_jit_model.sh:6","Warn: pipCommand not pinned by hash: examples/large_models/segment_anything_fast/install_segment_anything_fast.sh:4","Warn: pipCommand not pinned by hash: examples/large_models/segment_anything_fast/install_segment_anything_fast.sh:9","Warn: pipCommand not pinned by hash: examples/nmt_transformer/create_mar.sh:20","Warn: pipCommand not pinned by hash: examples/text_to_speech_synthesizer/SpeechT5/setup.sh:6","Warn: pipCommand not pinned by hash: ts_scripts/install_utils:36","Warn: pipCommand not pinned by hash: ts_scripts/install_utils:42","Warn: pipCommand not pinned by hash: ts_scripts/install_utils:47","Warn: pipCommand not pinned by hash: ts_scripts/install_utils:162","Warn: pipCommand not pinned by hash: ts_scripts/install_utils:169","Warn: pipCommand not pinned by hash: ts_scripts/install_utils:183","Warn: npmCommand not pinned by hash: ts_scripts/mac_npm_deps:16","Warn: pipCommand not pinned by hash: .github/workflows/benchmark_nightly.yml:45","Warn: pipCommand not pinned by hash: .github/workflows/benchmark_torch_compile_nightly.yml:41","Warn: pipCommand not pinned by hash: .github/workflows/doc-automation.yml:23","Warn: pipCommand not pinned by hash: .github/workflows/lint.yml:26","Warn: pipCommand not pinned by hash: .github/workflows/lint.yml:51","Warn: pipCommand not pinned by hash: .github/workflows/lint.yml:86","Warn: pipCommand not pinned by hash: .github/workflows/official_release.yml:27","Warn: pipCommand not pinned by hash: .github/workflows/torchserve-nightly-build.yml:27","Info:   0 out of  66 GitHub-owned GitHubAction dependencies pinned","Info:   0 out of  16 third-party GitHubAction dependencies pinned","Info:   0 out of  27 containerImage dependencies pinned","Info:   0 out of  54 pipCommand dependencies pinned","Info:   0 out of   4 npmCommand dependencies pinned"],"documentation":{"short":"Determines if the project has declared and pinned the dependencies of its build process.","url":"https://github.com/ossf/scorecard/blob/d1fab88f54636ff366076edfc5c239f97b3c8e66/docs/checks.md#pinned-dependencies"}}]}