Issues

• Release v2.5.0 tracking

  ossf/scorecard-action#1710 · Filter by author justaugustus opened on Oct 11, 2026 · v2.5.0

• Add support for immutable releases and actions lock files to detect "pinned" actions

  ossf/scorecard-action#1705 · Filter by author jessehouwing opened on Sep 12, 2026

• Provide ARM64 docker image

  ossf/scorecard-action#1697 · Filter by author Stormheg opened on Aug 14, 2026

• action.yaml references the runtime image by mutable tag, SHA-pinning the action does not pin the executed code

  bug
  ossf/scorecard-action#1676 · Filter by author thomasboni opened on Jul 3, 2026
  1

• Allow merge_group events when publish_results is false

  enhancement
  ossf/scorecard-action#1647 · Filter by author thomasqueirozb opened on Apr 3, 2026

• Upload fails if schedule:timezone is used in a workflow

  bug
  ossf/scorecard-action#1645 · Filter by author martincostello opened on Mar 30, 2026
  1

• Please accept ref as an action input

  enhancement
  ossf/scorecard-action#1620 · Filter by author gilescope opened on Dec 15, 2025
  1

• Using Scorecard-action with two non-default branches

  enhancement
  ossf/scorecard-action#1605 · Filter by author AdamKorcz opened on Nov 17, 2025
  1

• Question: disable a specific ScoreCard check?

  question
  ossf/scorecard-action#1581 · Filter by author tarilabs opened on Sep 19, 2025

• Default behavior for forks of this workflow is frustrating

  enhancement
  ossf/scorecard-action#1502 · Filter by author jsoref opened on Feb 4, 2025
  6

• Publish as immutable action

  enhancement
  ossf/scorecard-action#1485 · Filter by author JamieMagee opened on Dec 17, 2024
  3

• Are read-all permissions necessary?

  question
  ossf/scorecard-action#1461 · Filter by author funnelfiasco opened on Nov 7, 2024
  7

• Show openssf results in for private repos as a github issue

  enhancement
  ossf/scorecard-action#1441 · Filter by author nitrocode opened on Sep 4, 2024
  2

• Running under a matrix strategy

  question
  ossf/scorecard-action#1419 · Filter by author leonsparrowJM opened on Jul 30, 2024
  6

• Bug: Token-Permissions alert contains broken link

  bug
  ossf/scorecard-action#1386 · Filter by author jasonkarns opened on Jun 2, 2024
  4

• Detect jvm/kotlin fuzzing by detecting import

  enhancement
  ossf/scorecard-action#1378 · Filter by author fab1an opened on May 10, 2024

• Bug: SAST is calculated incorrectly

  bug
  ossf/scorecard-action#1231 · Filter by author eustas opened on Jul 13, 2023
  3

• Using a few OSSF scorecard checks to show more information to Actions consumers

  enhancement
  ossf/scorecard-action#1107 · Filter by author svemu opened on Mar 2, 2023
  24

• doc: update doc on use of PAT for private repositories

  documentation
  ossf/scorecard-action#1020 · Filter by author laurentsimon opened on Nov 23, 2022
  6

• Feature request: add official support for on: pull_request

  enhancement
  ossf/scorecard-action#1019 · Filter by author pnacht opened on Nov 22, 2022
  17

• (Feedback) Unclear value proposition for Action

  question
  ossf/scorecard-action#1017 · Filter by author joycebrum opened on Nov 21, 2022
  11

• Replace cosign

  enhancementgo
  ossf/scorecard-action#1008 · Filter by author naveensrinivasan opened on Nov 13, 2022
  5

• [1.1.2] Token Permissions - High warnings for SLSA generation

  bug
  ossf/scorecard-action#850 · Filter by author dbaileychess opened on Sep 2, 2022
  3

• Feature: Give links to dependency packages in the Dependency-diff Visualization markdown result

  enhancement
  ossf/scorecard-action#772 · Filter by author aidenwang9867 opened on Jul 21, 2022
  2

• Customization of results

  enhancement
  ossf/scorecard-action#729 · Filter by author laurentsimon opened on Jul 7, 2022
  21