A
Controls enabled 21/22
- Release workflows must not restore an untrusted cache
- Workflows must include required actionsoff by default
- Actions must come from authorized sources
- Actions must not carry known CVEs
- Actions must not execute mutable remote code
- Actions must not reference archived repositories
- Actions must not use ambiguous tag/branch refs
- Branch must be protected
- Container images must not use forbidden tags
- Job must not run with write-all permissions
- Pinned Upstream Actions must exist
- Pipeline must not enable debug trace
- Reusable workflow must not use `secrets: inherit`
- Security jobs must not be weakened
- Third-party actions must be pinned by commit SHA
- Workflow must not execute unverified scripts
- Workflow must not inline user input into shell scripts
- Workflow must not use Docker-in-Docker
- Workflow must not use dangerous triggers
- Workflow must not write untrusted content to $GITHUB_ENV
- Workflow permissions must be declared
- Workflows must not expose all secrets at once
- pull_request_target must not check out the PR head
This is a custom Plumber score, computed from this repository's own Plumber configuration, not an official Plumber-validated score.