nektos / act
Repository health
Security, maintenance, dependencies and license for nektos/act.
Security
4 dependencies checked (4 direct), npm, via deps.dev. Findings apply only to the packages and versions checked.
OpenSSF Scorecard · 3.9/10
Checks sorted from strongest to weakest.
- No risky CI workflowsNo dangerous workflow patterns detected10/10
- No binaries in the repositoryNo binaries found in the repo10/10
- License fileLicense file detected10/10
- Published through a build pipelinePackaging workflow detected10/10
- Pinned dependenciesDependency not pinned by hash detected5/10
- Code review before mergeFound 10/23 approved changesets4/10
- Recent activity0 commits and 0 issue activity found in the last 90 days0/10
- Least-privilege CI tokensDetected GitHub workflow tokens with excessive permissions0/10
- OpenSSF best-practices badgeNo effort to earn an OpenSSF best practices badge detected0/10
- Fuzz testingProject is not fuzzed0/10
- Security policySecurity policy file not detected0/10
- Signed releasesProject has not signed or included provenance with any releases.0/10
- Static analysis on commitsSAST tool is not run on all commits0/10
- Branch protectionScorecard could not run this check.not scored
Maintenance
Outside contributions: 1 of 82 external pull requests merged (7% of those decided), median 1.2 days to merge.From the 82 most recently updated pull requests, bots excluded.
Pull requests
- Open
- 28
- 4 stale (60+ days, no update in 30)
- Merged
- 0
- of the 30 latest
- Median time to merge
- Unknown
- From bots
- 1
- not listed below
Open
- #6045 add `--lenient-env-parsing` flag, so new lines are treated as continuation from the env var, and not discarded with error.Propfend · opened 210 days ago
- #6206 fix(artifacts): sign v4 URLs with an expiry that parses on Windowsdmrgrg-techloop · opened 7 days ago
- #6205 fix(server): artifact/cache server 默认绑定 127.0.0.1 而非 LAN 地址JasonMetal · opened 9 days ago
- #6204 fix(artifacts): require runtime token, randomize v4 signing key, reject base-dir run idsTastyHeadphones · opened 9 days ago
- #6203 fix: check the requested platform in ImageExistsLocally on multi-platform tagsTastyHeadphones · opened 10 days ago
Recently merged
None from people in recent pull requests.
The 30 most recently updated pull requests.
Top contributors
- ChristopherHX32 commits · 57%
- jsoref5 commits · 9%
- cplee4 commits · 7%
- panekj4 commits · 7%
- stephenwithav2 commits · 4%
Of the 56 most recent commits.
Issues
- Open
- 398
- issues and pull requests, as GitHub counts them
- Median time to close
- 2 days
- from 3 closed of the 30 latest
- Awaiting first reply
- 11
- of 27 open among the 30 latest
- Oldest open
- 6.7 years
Most wanted
- #2768 astral-sh/setup-uv@v5 fails13 reactions · 7 comments
- #6124 Add support for concurrent steps execution8 reactions · 1 comment
- #900 Issue: act fails to marshall continue-on-error tags 4 reactions · 2 comments
Rates come from the 30 most recently updated issues; the open count and oldest issue cover the whole repository.
Dependencies
Checked packages and import counts
These are the packages checked for known security issues, which may not be all of them. External imports are counted from the source code.
Packages pulled in by these were not checked.
License compatibility
Repo license: MIT · 4 deps checked · 0 potential conflicts.