{"date":"2026-08-17","repo":{"name":"github.com/ray-project/ray","commit":"c1bac99054888db5cee921d4c2f294e43c579291"},"scorecard":{"version":"v5.5.1-0.20260815060127-d1fab88f5463","commit":"d1fab88f54636ff366076edfc5c239f97b3c8e66"},"score":5.7,"checks":[{"name":"Code-Review","score":9,"reason":"Found 27/30 approved changesets -- score normalized to 9","details":null,"documentation":{"short":"Determines if the project requires human code review before pull requests (aka merge requests) are merged.","url":"https://github.com/ossf/scorecard/blob/d1fab88f54636ff366076edfc5c239f97b3c8e66/docs/checks.md#code-review"}},{"name":"Maintained","score":10,"reason":"30 commit(s) and 3 issue activity found in the last 90 days -- score normalized to 10","details":null,"documentation":{"short":"Determines if the project is \"actively maintained\".","url":"https://github.com/ossf/scorecard/blob/d1fab88f54636ff366076edfc5c239f97b3c8e66/docs/checks.md#maintained"}},{"name":"Security-Policy","score":3,"reason":"security policy file detected","details":["Info: security policy file detected: SECURITY.md:1","Warn: no linked content found","Warn: One or no descriptive hints of disclosure, vulnerability, and/or timelines in security policy","Info: Found text in security policy: SECURITY.md:1"],"documentation":{"short":"Determines if the project has published a security policy.","url":"https://github.com/ossf/scorecard/blob/d1fab88f54636ff366076edfc5c239f97b3c8e66/docs/checks.md#security-policy"}},{"name":"Packaging","score":-1,"reason":"packaging workflow not detected","details":["Warn: no GitHub/GitLab publishing workflow detected."],"documentation":{"short":"Determines if the project is published as a package that others can easily download, install, easily update, and uninstall.","url":"https://github.com/ossf/scorecard/blob/d1fab88f54636ff366076edfc5c239f97b3c8e66/docs/checks.md#packaging"}},{"name":"Dangerous-Workflow","score":10,"reason":"no dangerous workflow patterns detected","details":null,"documentation":{"short":"Determines if the project's GitHub Action workflows avoid dangerous patterns.","url":"https://github.com/ossf/scorecard/blob/d1fab88f54636ff366076edfc5c239f97b3c8e66/docs/checks.md#dangerous-workflow"}},{"name":"Token-Permissions","score":0,"reason":"detected GitHub workflow tokens with excessive permissions","details":["Warn: topLevel 'contents' permission set to 'write': .github/workflows/dependabot_recompile_deps.yml:20","Warn: no topLevel permission defined: .github/workflows/on_auto_merge.yaml:1","Warn: no topLevel permission defined: .github/workflows/on_pull_request_synchronized.yml:1","Warn: no topLevel permission defined: .github/workflows/stale_pull_request.yaml:1","Info: no jobLevel write permissions found"],"documentation":{"short":"Determines if the project's workflows follow the principle of least privilege.","url":"https://github.com/ossf/scorecard/blob/d1fab88f54636ff366076edfc5c239f97b3c8e66/docs/checks.md#token-permissions"}},{"name":"CII-Best-Practices","score":5,"reason":"badge detected: Passing","details":null,"documentation":{"short":"Determines if the project has an OpenSSF (formerly CII) Best Practices Badge.","url":"https://github.com/ossf/scorecard/blob/d1fab88f54636ff366076edfc5c239f97b3c8e66/docs/checks.md#cii-best-practices"}},{"name":"License","score":10,"reason":"license file detected","details":["Info: project has a license file: LICENSE:0","Info: FSF or OSI recognized license: Apache License 2.0: LICENSE:0"],"documentation":{"short":"Determines if the project has defined a license.","url":"https://github.com/ossf/scorecard/blob/d1fab88f54636ff366076edfc5c239f97b3c8e66/docs/checks.md#license"}},{"name":"Signed-Releases","score":-1,"reason":"no releases found","details":null,"documentation":{"short":"Determines if the project cryptographically signs release artifacts.","url":"https://github.com/ossf/scorecard/blob/d1fab88f54636ff366076edfc5c239f97b3c8e66/docs/checks.md#signed-releases"}},{"name":"SAST","score":0,"reason":"SAST tool is not run on all commits -- score normalized to 0","details":["Warn: 0 commits out of 30 are checked with a SAST tool"],"documentation":{"short":"Determines if the project uses static code analysis.","url":"https://github.com/ossf/scorecard/blob/d1fab88f54636ff366076edfc5c239f97b3c8e66/docs/checks.md#sast"}},{"name":"Branch-Protection","score":8,"reason":"branch protection is not maximal on development and all release branches","details":["Info: 'allow deletion' disabled on branch 'master'","Info: 'allow deletion' disabled on branch 'releases/2.57.0'","Info: 'allow deletion' disabled on branch 'releases/2.56.1'","Info: 'allow deletion' disabled on branch 'releases/2.56.0'","Info: 'allow deletion' disabled on branch 'releases/2.54.1'","Info: 'allow deletion' disabled on branch 'releases/2.51.0'","Info: 'allow deletion' disabled on branch 'releases/2.50.1'","Info: 'allow deletion' disabled on branch 'releases/2.50.0'","Info: 'allow deletion' disabled on branch 'releases/2.49.2'","Info: 'allow deletion' disabled on branch 'releases/2.49.0'","Info: 'allow deletion' disabled on branch 'releases/2.48.0'","Info: 'allow deletion' disabled on branch 'releases/2.47.1'","Info: 'allow deletion' disabled on branch 'releases/2.46.0'","Info: 'allow deletion' disabled on branch 'releases/2.45.0'","Info: 'allow deletion' disabled on branch 'releases/2.44.1'","Info: 'allow deletion' disabled on branch 'releases/2.43.0'","Info: 'allow deletion' disabled on branch 'releases/2.42.0'","Info: 'allow deletion' disabled on branch 'releases/2.40.0'","Info: 'force pushes' disabled on branch 'master'","Info: 'force pushes' disabled on branch 'releases/2.57.0'","Info: 'force pushes' disabled on branch 'releases/2.56.1'","Info: 'force pushes' disabled on branch 'releases/2.56.0'","Info: 'force pushes' disabled on branch 'releases/2.54.1'","Info: 'force pushes' disabled on branch 'releases/2.51.0'","Info: 'force pushes' disabled on branch 'releases/2.50.1'","Info: 'force pushes' disabled on branch 'releases/2.50.0'","Info: 'force pushes' disabled on branch 'releases/2.49.2'","Info: 'force pushes' disabled on branch 'releases/2.49.0'","Info: 'force pushes' disabled on branch 'releases/2.48.0'","Info: 'force pushes' disabled on branch 'releases/2.47.1'","Info: 'force pushes' disabled on branch 'releases/2.46.0'","Info: 'force pushes' disabled on branch 'releases/2.45.0'","Info: 'force pushes' disabled on branch 'releases/2.44.1'","Info: 'force pushes' disabled on branch 'releases/2.43.0'","Info: 'force pushes' disabled on branch 'releases/2.42.0'","Info: 'force pushes' disabled on branch 'releases/2.40.0'","Warn: required approving review count is 1 on branch 'master'","Warn: required approving review count is 1 on branch 'releases/2.57.0'","Warn: required approving review count is 1 on branch 'releases/2.56.1'","Warn: required approving review count is 1 on branch 'releases/2.56.0'","Warn: required approving review count is 1 on branch 'releases/2.54.1'","Warn: required approving review count is 1 on branch 'releases/2.51.0'","Warn: required approving review count is 1 on branch 'releases/2.50.1'","Warn: required approving review count is 1 on branch 'releases/2.50.0'","Warn: required approving review count is 1 on branch 'releases/2.49.2'","Warn: required approving review count is 1 on branch 'releases/2.49.0'","Warn: required approving review count is 1 on branch 'releases/2.48.0'","Warn: required approving review count is 1 on branch 'releases/2.47.1'","Warn: required approving review count is 1 on branch 'releases/2.46.0'","Warn: required approving review count is 1 on branch 'releases/2.45.0'","Warn: required approving review count is 1 on branch 'releases/2.44.1'","Warn: required approving review count is 1 on branch 'releases/2.43.0'","Warn: required approving review count is 1 on branch 'releases/2.42.0'","Warn: required approving review count is 1 on branch 'releases/2.40.0'","Info: codeowner review is required on branch 'master'","Warn: codeowners review is not required on branch 'releases/2.57.0'","Warn: codeowners review is not required on branch 'releases/2.56.1'","Warn: codeowners review is not required on branch 'releases/2.56.0'","Warn: codeowners review is not required on branch 'releases/2.54.1'","Warn: codeowners review is not required on branch 'releases/2.51.0'","Warn: codeowners review is not required on branch 'releases/2.50.1'","Warn: codeowners review is not required on branch 'releases/2.50.0'","Warn: codeowners review is not required on branch 'releases/2.49.2'","Warn: codeowners review is not required on branch 'releases/2.49.0'","Warn: codeowners review is not required on branch 'releases/2.48.0'","Warn: codeowners review is not required on branch 'releases/2.47.1'","Warn: codeowners review is not required on branch 'releases/2.46.0'","Warn: codeowners review is not required on branch 'releases/2.45.0'","Warn: codeowners review is not required on branch 'releases/2.44.1'","Warn: codeowners review is not required on branch 'releases/2.43.0'","Warn: codeowners review is not required on branch 'releases/2.42.0'","Warn: codeowners review is not required on branch 'releases/2.40.0'","Info: status check found to merge onto on branch 'master'","Info: status check found to merge onto on branch 'releases/2.57.0'","Info: status check found to merge onto on branch 'releases/2.56.1'","Info: status check found to merge onto on branch 'releases/2.56.0'","Info: status check found to merge onto on branch 'releases/2.54.1'","Info: status check found to merge onto on branch 'releases/2.51.0'","Info: status check found to merge onto on branch 'releases/2.50.1'","Info: status check found to merge onto on branch 'releases/2.50.0'","Info: status check found to merge onto on branch 'releases/2.49.2'","Info: status check found to merge onto on branch 'releases/2.49.0'","Info: status check found to merge onto on branch 'releases/2.48.0'","Info: status check found to merge onto on branch 'releases/2.47.1'","Info: status check found to merge onto on branch 'releases/2.46.0'","Info: status check found to merge onto on branch 'releases/2.45.0'","Info: status check found to merge onto on branch 'releases/2.44.1'","Info: status check found to merge onto on branch 'releases/2.43.0'","Info: status check found to merge onto on branch 'releases/2.42.0'","Info: status check found to merge onto on branch 'releases/2.40.0'","Info: PRs are required in order to make changes on branch 'master'","Info: PRs are required in order to make changes on branch 'releases/2.57.0'","Info: PRs are required in order to make changes on branch 'releases/2.56.1'","Info: PRs are required in order to make changes on branch 'releases/2.56.0'","Info: PRs are required in order to make changes on branch 'releases/2.54.1'","Info: PRs are required in order to make changes on branch 'releases/2.51.0'","Info: PRs are required in order to make changes on branch 'releases/2.50.1'","Info: PRs are required in order to make changes on branch 'releases/2.50.0'","Info: PRs are required in order to make changes on branch 'releases/2.49.2'","Info: PRs are required in order to make changes on branch 'releases/2.49.0'","Info: PRs are required in order to make changes on branch 'releases/2.48.0'","Info: PRs are required in order to make changes on branch 'releases/2.47.1'","Info: PRs are required in order to make changes on branch 'releases/2.46.0'","Info: PRs are required in order to make changes on branch 'releases/2.45.0'","Info: PRs are required in order to make changes on branch 'releases/2.44.1'","Info: PRs are required in order to make changes on branch 'releases/2.43.0'","Info: PRs are required in order to make changes on branch 'releases/2.42.0'","Info: PRs are required in order to make changes on branch 'releases/2.40.0'"],"documentation":{"short":"Determines if the default and release branches are protected with GitHub's branch protection settings.","url":"https://github.com/ossf/scorecard/blob/d1fab88f54636ff366076edfc5c239f97b3c8e66/docs/checks.md#branch-protection"}},{"name":"Fuzzing","score":0,"reason":"project is not fuzzed","details":["Warn: no fuzzer integrations found"],"documentation":{"short":"Determines if the project uses fuzzing.","url":"https://github.com/ossf/scorecard/blob/d1fab88f54636ff366076edfc5c239f97b3c8e66/docs/checks.md#fuzzing"}},{"name":"Binary-Artifacts","score":8,"reason":"binaries present in source code","details":["Warn: binary detected: python/ray/dashboard/modules/job/tests/pip_install_test-0.5-py3-none-any.whl:1","Warn: binary detected: python/ray/tests/pip_install_test-0.5-py3-none-any.whl:1"],"documentation":{"short":"Determines if the project has generated executable (binary) artifacts in the source repository.","url":"https://github.com/ossf/scorecard/blob/d1fab88f54636ff366076edfc5c239f97b3c8e66/docs/checks.md#binary-artifacts"}},{"name":"Pinned-Dependencies","score":0,"reason":"dependency not pinned by hash detected -- score normalized to 0","details":["Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/dependabot_recompile_deps.yml:34: update your workflow using https://app.stepsecurity.io/secureworkflow/ray-project/ray/dependabot_recompile_deps.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/dependabot_recompile_deps.yml:54: update your workflow using https://app.stepsecurity.io/secureworkflow/ray-project/ray/dependabot_recompile_deps.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/on_auto_merge.yaml:11: update your workflow using https://app.stepsecurity.io/secureworkflow/ray-project/ray/on_auto_merge.yaml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/on_pull_request_synchronized.yml:13: update your workflow using https://app.stepsecurity.io/secureworkflow/ray-project/ray/on_pull_request_synchronized.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/stale_pull_request.yaml:16: update your workflow using https://app.stepsecurity.io/secureworkflow/ray-project/ray/stale_pull_request.yaml/master?enable=pin","Warn: containerImage not pinned by hash: .buildkite/release-automation/forge_arm64.Dockerfile:3: pin your Docker image by updating ubuntu:22.04 to ubuntu:22.04@sha256:2edbbc5dc405e9612ba3584ce95480277e3eb374407b5505fe26f17df77c7dbc","Warn: containerImage not pinned by hash: .buildkite/release-automation/forge_x86_64.Dockerfile:3: pin your Docker image by updating ubuntu:22.04 to ubuntu:22.04@sha256:2edbbc5dc405e9612ba3584ce95480277e3eb374407b5505fe26f17df77c7dbc","Warn: containerImage not pinned by hash: ci/docker/base.build.Dockerfile:2","Warn: containerImage not pinned by hash: ci/docker/base.gpu.Dockerfile:3","Warn: containerImage not pinned by hash: ci/docker/base.ml.Dockerfile:4","Warn: containerImage not pinned by hash: ci/docker/base.test.Dockerfile:3: pin your Docker image by updating ubuntu:jammy to ubuntu:jammy@sha256:2edbbc5dc405e9612ba3584ce95480277e3eb374407b5505fe26f17df77c7dbc","Warn: containerImage not pinned by hash: ci/docker/core.build.Dockerfile:2","Warn: containerImage not pinned by hash: ci/docker/custom-vllm-plugin.build.Dockerfile:5","Warn: containerImage not pinned by hash: ci/docker/data.build.Dockerfile:4","Warn: containerImage not pinned by hash: ci/docker/datatfds.build.Dockerfile:4","Warn: containerImage not pinned by hash: ci/docker/doc.build.Dockerfile:5","Warn: containerImage not pinned by hash: ci/docker/doc.build.Dockerfile:6","Warn: containerImage not pinned by hash: ci/docker/doc.build.Dockerfile:8","Warn: containerImage not pinned by hash: ci/docker/docgpu.build.Dockerfile:4","Warn: containerImage not pinned by hash: ci/docker/doctest.build.Dockerfile:2","Warn: containerImage not pinned by hash: ci/docker/forge.Dockerfile:3: pin your Docker image by updating ubuntu:22.04 to ubuntu:22.04@sha256:2edbbc5dc405e9612ba3584ce95480277e3eb374407b5505fe26f17df77c7dbc","Warn: containerImage not pinned by hash: ci/docker/fossa.Dockerfile:3","Warn: containerImage not pinned by hash: ci/docker/k8s.build.Dockerfile:3","Warn: containerImage not pinned by hash: ci/docker/llm.build.Dockerfile:4","Warn: containerImage not pinned by hash: ci/docker/manylinux-retag.Dockerfile:11","Warn: containerImage not pinned by hash: ci/docker/manylinux.Dockerfile:4","Warn: containerImage not pinned by hash: ci/docker/min.build.Dockerfile:5","Warn: containerImage not pinned by hash: ci/docker/ml.build.Dockerfile:4","Warn: containerImage not pinned by hash: ci/docker/ray-core.Dockerfile:5","Warn: containerImage not pinned by hash: ci/docker/ray-cpp-core.Dockerfile:10","Warn: containerImage not pinned by hash: ci/docker/ray-cpp-wheel.Dockerfile:17","Warn: containerImage not pinned by hash: ci/docker/ray-cpp-wheel.Dockerfile:18","Warn: containerImage not pinned by hash: ci/docker/ray-cpp-wheel.Dockerfile:19","Warn: containerImage not pinned by hash: ci/docker/ray-cpp-wheel.Dockerfile:20","Warn: containerImage not pinned by hash: ci/docker/ray-cpp-wheel.Dockerfile:23","Warn: containerImage not pinned by hash: ci/docker/ray-dashboard.Dockerfile:3","Warn: containerImage not pinned by hash: ci/docker/ray-image.Dockerfile:16","Warn: containerImage not pinned by hash: ci/docker/ray-image.Dockerfile:17","Warn: containerImage not pinned by hash: ci/docker/ray-java.Dockerfile:5","Warn: containerImage not pinned by hash: ci/docker/ray-wheel.Dockerfile:18","Warn: containerImage not pinned by hash: ci/docker/ray-wheel.Dockerfile:23","Warn: containerImage not pinned by hash: ci/docker/rllib.build.Dockerfile:4","Warn: containerImage not pinned by hash: ci/docker/runtime_env_container/Dockerfile:2","Warn: containerImage not pinned by hash: ci/docker/serve.build.Dockerfile:4","Warn: containerImage not pinned by hash: ci/docker/windows.build.Dockerfile:2","Warn: containerImage not pinned by hash: ci/ray_ci/tests.env.Dockerfile:8","Warn: containerImage not pinned by hash: ci/ray_ci/tests.env.Dockerfile:9","Warn: containerImage not pinned by hash: ci/ray_ci/tests.env.Dockerfile:10","Warn: containerImage not pinned by hash: ci/ray_ci/tests.env.Dockerfile:12","Warn: containerImage not pinned by hash: ci/ray_ci/windows/tests.env.Dockerfile:2","Warn: containerImage not pinned by hash: doc/source/templates/05_dreambooth_finetuning/configs/Dockerfile:2: pin your Docker image by updating anyscale/ray:latest-py39-cu118 to anyscale/ray:latest-py39-cu118@sha256:ddcf98e5d9e70db18cadf4da27c600da336631d91988617db366ac9bea1181b8","Warn: containerImage not pinned by hash: doc/source/templates/testing/docker/03_serving_stable_diffusion/Dockerfile:2: pin your Docker image by updating anyscale/ray:latest-py39-cu118 to anyscale/ray:latest-py39-cu118@sha256:ddcf98e5d9e70db18cadf4da27c600da336631d91988617db366ac9bea1181b8","Warn: containerImage not pinned by hash: doc/source/templates/testing/docker/04_finetuning_llms_with_deepspeed/Dockerfile:2: pin your Docker image by updating anyscale/ray:2.9.0-py310-cu121 to anyscale/ray:2.9.0-py310-cu121@sha256:c97f6fa0d57b03b75c5167f7045cde446b683dbbe8c3d04979e3b64f5662406f","Warn: containerImage not pinned by hash: docker/base-deps/Dockerfile:8","Warn: containerImage not pinned by hash: docker/base-extra/Dockerfile:5","Warn: containerImage not pinned by hash: docker/base-slim/Dockerfile:7","Warn: containerImage not pinned by hash: docker/ray-llm/Dockerfile:4","Warn: containerImage not pinned by hash: docker/ray-ml/Dockerfile:5","Warn: containerImage not pinned by hash: docker/ray-torch/Dockerfile:5","Warn: containerImage not pinned by hash: docker/ray/Dockerfile:5","Warn: containerImage not pinned by hash: python/ray/tests/kuberay/Dockerfile:2: pin your Docker image by updating rayproject/ray:nightly-py310 to rayproject/ray:nightly-py310@sha256:2986efbf68dc617dbc4771406118edc5d3c711490286b3a9b706e99c21e93698","Warn: containerImage not pinned by hash: release/ray_release/byod/byod.Dockerfile:5","Warn: downloadThenRun not pinned by hash: .buildkite/release-automation/forge_arm64.Dockerfile:20-61","Warn: downloadThenRun not pinned by hash: .buildkite/release-automation/forge_x86_64.Dockerfile:25-76","Warn: pipCommand not pinned by hash: ci/docker/custom-vllm-plugin.build.Dockerfile:10","Warn: pipCommand not pinned by hash: ci/docker/doc.build.Dockerfile:25-36","Warn: downloadThenRun not pinned by hash: ci/docker/forge.Dockerfile:35-161","Warn: npmCommand not pinned by hash: ci/docker/forge.Dockerfile:104-230","Warn: pipCommand not pinned by hash: ci/docker/k8s.build.Dockerfile:16-27","Warn: pipCommand not pinned by hash: ci/docker/k8s.build.Dockerfile:19-30","Warn: pipCommand not pinned by hash: ci/docker/llm.build.Dockerfile:21-58","Warn: pipCommand not pinned by hash: ci/docker/min.build.Dockerfile:34-81","Warn: pipCommand not pinned by hash: ci/docker/min.build.Dockerfile:53-100","Warn: pipCommand not pinned by hash: ci/docker/ml.build.Dockerfile:33-73","Warn: pipCommand not pinned by hash: ci/docker/ml.build.Dockerfile:37-77","Warn: pipCommand not pinned by hash: ci/docker/runtime_env_container/Dockerfile:6","Warn: pipCommand not pinned by hash: ci/ray_ci/tests.env.Dockerfile:143-275","Warn: pipCommand not pinned by hash: ci/ray_ci/tests.env.Dockerfile:146-278","Warn: pipCommand not pinned by hash: ci/ray_ci/tests.env.Dockerfile:151-283","Warn: pipCommand not pinned by hash: ci/ray_ci/tests.env.Dockerfile:155-287","Warn: pipCommand not pinned by hash: ci/ray_ci/tests.env.Dockerfile:160-292","Warn: pipCommand not pinned by hash: ci/ray_ci/tests.env.Dockerfile:165-297","Warn: pipCommand not pinned by hash: ci/ray_ci/tests.env.Dockerfile:169-301","Warn: pipCommand not pinned by hash: doc/source/templates/05_dreambooth_finetuning/configs/Dockerfile:6","Warn: pipCommand not pinned by hash: doc/source/templates/testing/docker/03_serving_stable_diffusion/Dockerfile:6","Warn: pipCommand not pinned by hash: doc/source/templates/testing/docker/04_finetuning_llms_with_deepspeed/Dockerfile:9","Warn: pipCommand not pinned by hash: doc/source/templates/testing/docker/04_finetuning_llms_with_deepspeed/Dockerfile:11","Warn: pipCommand not pinned by hash: doc/source/templates/testing/docker/04_finetuning_llms_with_deepspeed/Dockerfile:12","Warn: pipCommand not pinned by hash: doc/source/templates/testing/docker/04_finetuning_llms_with_deepspeed/Dockerfile:13","Warn: pipCommand not pinned by hash: doc/source/templates/testing/docker/04_finetuning_llms_with_deepspeed/Dockerfile:14","Warn: downloadThenRun not pinned by hash: docker/base-deps/Dockerfile:98-152","Warn: downloadThenRun not pinned by hash: docker/ray-llm/Dockerfile:89-169","Warn: downloadThenRun not pinned by hash: docker/ray-llm/Dockerfile:93-173","Warn: pipCommand not pinned by hash: .buildkite/release-automation/verify-linux-wheels.sh:24","Warn: pipCommand not pinned by hash: .buildkite/release-automation/verify-macos-wheels.sh:42","Warn: downloadThenRun not pinned by hash: .buildkite/release/custom-image-build-and-test-init.sh:44","Warn: pipCommand not pinned by hash: ci/ci.sh:35","Warn: pipCommand not pinned by hash: ci/ci.sh:40","Warn: pipCommand not pinned by hash: ci/ci.sh:170","Warn: pipCommand not pinned by hash: ci/ci.sh:209","Warn: pipCommand not pinned by hash: ci/ci.sh:216","Warn: pipCommand not pinned by hash: ci/env/install-core-prerelease-dependencies.sh:8","Warn: pipCommand not pinned by hash: ci/env/install-dependencies.sh:96","Warn: downloadThenRun not pinned by hash: ci/env/install-dependencies.sh:162","Warn: pipCommand not pinned by hash: ci/env/install-dependencies.sh:332","Warn: pipCommand not pinned by hash: ci/env/install-dependencies.sh:339","Warn: pipCommand not pinned by hash: ci/env/install-dependencies.sh:348","Warn: pipCommand not pinned by hash: ci/env/install-dependencies.sh:394","Warn: pipCommand not pinned by hash: ci/env/install-dependencies.sh:415","Warn: downloadThenRun not pinned by hash: ci/env/install-hdfs.sh:38","Warn: pipCommand not pinned by hash: ci/env/install-horovod.sh:5","Warn: pipCommand not pinned by hash: ci/install_pypi_proxy.sh:19","Warn: pipCommand not pinned by hash: ci/lint/lint.sh:9","Warn: pipCommand not pinned by hash: ci/lint/lint.sh:16","Warn: pipCommand not pinned by hash: ci/lint/lint.sh:52","Warn: pipCommand not pinned by hash: ci/lint/lint.sh:57","Warn: pipCommand not pinned by hash: ci/lint/lint.sh:62","Warn: pipCommand not pinned by hash: ci/lint/lint.sh:68","Warn: pipCommand not pinned by hash: ci/lint/lint.sh:92","Warn: pipCommand not pinned by hash: ci/lint/pyrefly-check.sh:5","Warn: pipCommand not pinned by hash: ci/ray_ci/macos/macos_ci.sh:137","Warn: pipCommand not pinned by hash: ci/ray_ci/windows/build_base.sh:32","Warn: pipCommand not pinned by hash: ci/ray_ci/windows/build_ray.sh:28","Warn: pipCommand not pinned by hash: ci/ray_ci/windows/install_tools.sh:9","Warn: pipCommand not pinned by hash: ci/ray_ci/windows/install_tools.sh:17","Warn: downloadThenRun not pinned by hash: doc/source/ray-core/examples/lm/preprocess.sh:16","Warn: downloadThenRun not pinned by hash: doc/source/ray-core/examples/lm/preprocess.sh:16","Warn: downloadThenRun not pinned by hash: doc/source/ray-core/examples/lm/preprocess.sh:16","Warn: pipCommand not pinned by hash: doc/source/serve/tutorials/video-analysis/ci/build.sh:6","Warn: downloadThenRun not pinned by hash: python/build-wheel-macos.sh:18","Warn: downloadThenRun not pinned by hash: python/build-wheel-macos.sh:21","Warn: downloadThenRun not pinned by hash: python/build-wheel-macos.sh:23","Warn: chocoCommand not pinned by hash: python/build-wheel-windows.sh:58","Warn: npmCommand not pinned by hash: python/build-wheel-windows.sh:62","Warn: pipCommand not pinned by hash: python/ray/dashboard/modules/job/tests/backwards_compatibility_scripts/test_backwards_compatibility.sh:46","Warn: pipCommand not pinned by hash: python/ray/dashboard/modules/job/tests/backwards_compatibility_scripts/test_backwards_compatibility.sh:50","Warn: npmCommand not pinned by hash: python/ray/dashboard/tests/run_ui_tests.sh:24","Warn: npmCommand not pinned by hash: python/ray/dashboard/tests/run_ui_tests.sh:26","Warn: pipCommand not pinned by hash: release/ml_user_tests/horovod/driver_setup_latest.sh:7","Warn: pipCommand not pinned by hash: release/ml_user_tests/horovod/driver_setup_latest.sh:9","Warn: pipCommand not pinned by hash: release/ml_user_tests/horovod/driver_setup_latest.sh:12","Warn: pipCommand not pinned by hash: release/ml_user_tests/horovod/driver_setup_master.sh:7","Warn: pipCommand not pinned by hash: release/ml_user_tests/horovod/driver_setup_master.sh:9","Warn: pipCommand not pinned by hash: release/ml_user_tests/horovod/driver_setup_master.sh:11","Warn: pipCommand not pinned by hash: release/ml_user_tests/train/driver_setup.sh:5","Warn: pipCommand not pinned by hash: release/ray_release/byod/byod_asynchronous_inference.sh:6","Warn: pipCommand not pinned by hash: release/ray_release/byod/byod_azure_cluster_launcher.sh:6","Warn: pipCommand not pinned by hash: release/ray_release/byod/byod_data_pipelined_test.sh:7","Warn: pipCommand not pinned by hash: release/ray_release/byod/byod_data_pipelined_test.sh:8","Warn: pipCommand not pinned by hash: release/ray_release/byod/byod_dolly_test.sh:7","Warn: pipCommand not pinned by hash: release/ray_release/byod/byod_dolly_test.sh:10","Warn: pipCommand not pinned by hash: release/ray_release/byod/byod_dolly_test.sh:12","Warn: pipCommand not pinned by hash: release/ray_release/byod/byod_e2e_audio.sh:6","Warn: pipCommand not pinned by hash: release/ray_release/byod/byod_e2e_multimodal_ai_workloads.sh:6","Warn: pipCommand not pinned by hash: release/ray_release/byod/byod_e2e_rag.sh:11","Warn: pipCommand not pinned by hash: release/ray_release/byod/byod_e2e_timeseries.sh:10","Warn: pipCommand not pinned by hash: release/ray_release/byod/byod_e2e_xgboost.sh:5","Warn: pipCommand not pinned by hash: release/ray_release/byod/byod_finetune_llvms.sh:7","Warn: pipCommand not pinned by hash: release/ray_release/byod/byod_finetune_llvms.sh:22","Warn: pipCommand not pinned by hash: release/ray_release/byod/byod_gptj_test.sh:5","Warn: pipCommand not pinned by hash: release/ray_release/byod/byod_gptj_test.sh:7","Warn: pipCommand not pinned by hash: release/ray_release/byod/byod_horovod_master_test.sh:7","Warn: pipCommand not pinned by hash: release/ray_release/byod/byod_horovod_master_test.sh:13","Warn: pipCommand not pinned by hash: release/ray_release/byod/byod_horovod_test.sh:7","Warn: pipCommand not pinned by hash: release/ray_release/byod/byod_horovod_test.sh:13","Warn: pipCommand not pinned by hash: release/ray_release/byod/byod_huggingface_trl.sh:8","Warn: pipCommand not pinned by hash: release/ray_release/byod/byod_huggingface_trl.sh:9","Warn: pipCommand not pinned by hash: release/ray_release/byod/byod_huggingface_trl.sh:11","Warn: pipCommand not pinned by hash: release/ray_release/byod/byod_install_deltalake.sh:5","Warn: pipCommand not pinned by hash: release/ray_release/byod/byod_install_mosaicml.sh:6","Warn: pipCommand not pinned by hash: release/ray_release/byod/byod_install_pyiceberg.sh:6","Warn: pipCommand not pinned by hash: release/ray_release/byod/byod_install_text_embedding.sh:6","Warn: pipCommand not pinned by hash: release/ray_release/byod/byod_install_torchrec.sh:6","Warn: pipCommand not pinned by hash: release/ray_release/byod/byod_langchain_agent_ray_serve.sh:6","Warn: pipCommand not pinned by hash: release/ray_release/byod/byod_llamafactory_llm_fine_tune.sh:6","Warn: pipCommand not pinned by hash: release/ray_release/byod/byod_llm_batch_inference_vision.sh:6","Warn: pipCommand not pinned by hash: release/ray_release/byod/byod_llm_kv_router_test.sh:7","Warn: pipCommand not pinned by hash: release/ray_release/byod/byod_llm_lmcache_test.sh:7","Warn: pipCommand not pinned by hash: release/ray_release/byod/byod_llm_ner.sh:9","Warn: pipCommand not pinned by hash: release/ray_release/byod/byod_llm_pin_cupy_cuda12x.sh:9","Warn: pipCommand not pinned by hash: release/ray_release/byod/byod_llm_sglang_test.sh:9","Warn: pipCommand not pinned by hash: release/ray_release/byod/byod_llm_sglang_test.sh:151","Warn: pipCommand not pinned by hash: release/ray_release/byod/byod_mcp-ray-serve.sh:6","Warn: pipCommand not pinned by hash: release/ray_release/byod/byod_multi_agent_a2a.sh:4","Warn: pipCommand not pinned by hash: release/ray_release/byod/byod_object_detection.sh:8","Warn: pipCommand not pinned by hash: release/ray_release/byod/byod_pytorch_lightning_test.sh:9","Warn: pipCommand not pinned by hash: release/ray_release/byod/byod_ray_lightning_master_test.sh:7","Warn: pipCommand not pinned by hash: release/ray_release/byod/byod_ray_lightning_master_test.sh:9","Warn: pipCommand not pinned by hash: release/ray_release/byod/byod_ray_lightning_master_test.sh:10","Warn: pipCommand not pinned by hash: release/ray_release/byod/byod_ray_lightning_master_test.sh:11","Warn: pipCommand not pinned by hash: release/ray_release/byod/byod_ray_lightning_test.sh:7","Warn: pipCommand not pinned by hash: release/ray_release/byod/byod_ray_lightning_test.sh:8","Warn: pipCommand not pinned by hash: release/ray_release/byod/byod_ray_lightning_test.sh:9","Warn: pipCommand not pinned by hash: release/ray_release/byod/byod_ray_train_workloads.sh:9","Warn: pipCommand not pinned by hash: release/ray_release/byod/byod_rllib.sh:7","Warn: pipCommand not pinned by hash: release/ray_release/byod/byod_rllib.sh:13","Warn: pipCommand not pinned by hash: release/ray_release/byod/byod_serve_video_analysis.sh:6","Warn: pipCommand not pinned by hash: release/ray_release/byod/byod_stable_diffusion.sh:7","Warn: pipCommand not pinned by hash: release/ray_release/byod/byod_tensor_parallel_autotp.sh:5","Warn: pipCommand not pinned by hash: release/ray_release/byod/byod_tensor_parallel_autotp.sh:6","Warn: pipCommand not pinned by hash: release/ray_release/byod/byod_train_benchmark_deepspeed.sh:15","Warn: pipCommand not pinned by hash: release/ray_release/byod/byod_train_benchmark_deepspeed.sh:19","Warn: pipCommand not pinned by hash: release/ray_release/byod/byod_train_persistence_test.sh:7","Warn: pipCommand not pinned by hash: release/ray_release/byod/byod_tune_pytorch_asha.sh:4","Warn: pipCommand not pinned by hash: release/ray_release/byod/byod_unstructured_data_ingestion.sh:10","Warn: pipCommand not pinned by hash: release/ray_release/byod/byod_unstructured_data_ingestion.sh:11","Warn: pipCommand not pinned by hash: release/ray_release/byod/byod_vicuna_test.sh:15","Warn: pipCommand not pinned by hash: release/ray_release/byod/byod_vicuna_test.sh:18","Warn: pipCommand not pinned by hash: release/ray_release/byod/byod_vicuna_test.sh:20","Warn: pipCommand not pinned by hash: release/run_release_test.sh:53","Warn: pipCommand not pinned by hash: release/util/sanity_check_windows.sh:30","Warn: pipCommand not pinned by hash: release/util/sanity_check_windows.sh:49","Warn: downloadThenRun not pinned by hash: .github/workflows/dependabot_recompile_deps.yml:41","Info:   0 out of   5 GitHub-owned GitHubAction dependencies pinned","Info:   0 out of  57 containerImage dependencies pinned","Info:   0 out of  16 downloadThenRun dependencies pinned","Info:   5 out of 135 pipCommand dependencies pinned","Info:   7 out of  11 npmCommand dependencies pinned","Info:   0 out of   1 chocoCommand dependencies pinned"],"documentation":{"short":"Determines if the project has declared and pinned the dependencies of its build process.","url":"https://github.com/ossf/scorecard/blob/d1fab88f54636ff366076edfc5c239f97b3c8e66/docs/checks.md#pinned-dependencies"}}]}