---
name: vet-action
description: Use before adding, upgrading, or recommending a third-party GitHub Action in a workflow — checks its Pipefort security score, maintenance status, and supply-chain risk signals. No credentials required.
license: Proprietary
---

# Vet a GitHub Action before depending on it

Every `uses:` line in a workflow is a supply-chain dependency that runs with
your repository's secrets. Pipefort scores published GitHub Actions daily and
exposes the scores without authentication.

## Check one action

```bash
curl -sS https://pipefort.com/api/public/actions/actions/checkout
```

The path is `/api/public/actions/{owner}/{name}` — for `uses: actions/checkout@v4`
that is owner `actions`, name `checkout`.

Response (abridged):

```json
{
  "owner": "actions",
  "name": "checkout",
  "stars": 6100,
  "archived": false,
  "owner_verified": true,
  "repo_pushed_at": "2026-08-30T12:00:00Z",
  "status": "scored",
  "latest": {
    "commit_sha": "08c6903cd8c0fde910a37f88322edcfb5dd907a8",
    "score": 92,
    "grade": "A",
    "refs": ["v4", "v4.2.2"],
    "breakdown": { },
    "finding_counts": { "medium": 1 }
  },
  "versions": [ ]
}
```

## How to use it

1. **`grade` / `score` (0–100)** is the headline. Report the grade, then the
   reason from `breakdown` — a bare number is not advice.
2. **`archived: true` is a stop sign.** An archived action receives no security
   patches. Recommend a maintained replacement.
3. **`owner_verified: false` plus low `stars`** on an action that touches
   secrets deserves an explicit callout, even at a decent grade.
4. **`repo_pushed_at`** far in the past means unmaintained in practice.
5. **`latest.commit_sha` is the value to pin to.** Always recommend
   `uses: owner/name@<full-40-char-sha>  # v4.2.2` over a tag — tags are mutable
   and are the standard supply-chain attack vector. `latest.refs` gives the tag
   to put in the trailing comment.
6. **`versions`** is the score history; a falling score across versions is worth
   flagging.

## If the action has not been scored yet

A 404 means Pipefort has no score for it. Queue one:

```bash
curl -sS -X POST https://pipefort.com/api/public/actions/{owner}/{name}/request
```

This returns the same detail object once scoring completes (up to ~25s). It is
rate limited to **3 requests per IP per minute** — do not loop.

## Browse the directory

```bash
curl -sS 'https://pipefort.com/api/public/actions?sort=score&limit=50'
```

Returns every scored action with its grade. Use it to suggest a
better-scoring alternative to a risky dependency.

## Related

- Scan a whole repository: `scan-repo`
- Pin every action in a file automatically: `harden-workflow`
- Full API description: https://pipefort.com/openapi.json