Go module

github.com/liatrio/builder-images

v2.0.4+incompatible

Newer version available

Published

January 6, 2023

Links

Origin: https://pkg.go.dev/github.com/liatrio/builder-images@v2.0.4+incompatible
Repo: https://github.com/liatrio/builder-images

Projects

liatrio/builder-images

GitHub

Repo for Liatrio builder images

5 forks

2 stars

OpenSSF scorecard

The Open Source Security Foundation is a cross-industry collaboration to improve the security of open source software (OSS). The Scorecard provides security health metrics for open source projects.

View information about checks and how to fix failures.

Score

4.6/10

Scorecard as of March 24, 2025.

Maintained

0/10

Determines if the project is "actively maintained".

Reasoning

project is archived

Code-Review

8/10

Determines if the project requires human code review before pull requests (aka merge requests) are merged.

Reasoning

Found 23/26 approved changesets -- score normalized to 8

Dangerous-Workflow

10/10

Determines if the project's GitHub Action workflows avoid dangerous patterns.

Reasoning

no dangerous workflow patterns detected

Binary-Artifacts

10/10

Determines if the project has generated executable (binary) artifacts in the source repository.

Reasoning

no binaries found in the repo

Token-Permissions

0/10

Determines if the project's workflows follow the principle of least privilege.

Reasoning

detected GitHub workflow tokens with excessive permissions

CII-Best-Practices

0/10

Determines if the project has an OpenSSF (formerly CII) Best Practices Badge.

Reasoning

no effort to earn an OpenSSF best practices badge detected

Fuzzing

0/10

Determines if the project uses fuzzing.

Reasoning

project is not fuzzed

License

10/10

Determines if the project has defined a license.

Reasoning

license file detected

Security-Policy

0/10

Determines if the project has published a security policy.

Reasoning

security policy file not detected

SAST

0/10

Determines if the project uses static code analysis.

Reasoning

SAST tool is not run on all commits -- score normalized to 0

Pinned-Dependencies

0/10

Determines if the project has declared and pinned the dependencies of its build process.

Reasoning

dependency not pinned by hash detected -- score normalized to 0

Project metadata as of January 28, 2023.

This site uses cookies from Google to deliver its services and to analyze traffic.

Pinned-Dependencies

Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/push.yml:9: update your workflow using https://app.stepsecurity.io/secureworkflow/liatrio/builder-images/push.yml/master?enable=pin

Warn: third-party GitHubAction not pinned by hash: .github/workflows/push.yml:11: update your workflow using https://app.stepsecurity.io/secureworkflow/liatrio/builder-images/push.yml/master?enable=pin

Warn: third-party GitHubAction not pinned by hash: .github/workflows/push.yml:13: update your workflow using https://app.stepsecurity.io/secureworkflow/liatrio/builder-images/push.yml/master?enable=pin

Warn: third-party GitHubAction not pinned by hash: .github/workflows/push.yml:20: update your workflow using https://app.stepsecurity.io/secureworkflow/liatrio/builder-images/push.yml/master?enable=pin

Warn: containerImage not pinned by hash: atlantis-image/Dockerfile:1: pin your Docker image by updating ghcr.io/runatlantis/atlantis:v0.19.3 to ghcr.io/runatlantis/atlantis:v0.19.3@sha256:858ea510ac47aa4e73922d538a420c503b3d8560eb3930fe7700adb763084f98

Warn: containerImage not pinned by hash: builder-image-aws/Dockerfile:1: pin your Docker image by updating alpine:3.15 to alpine:3.15@sha256:19b4bcc4f60e99dd5ebdca0cbce22c503bbcff197549d7e19dab4f22254dc864

Warn: containerImage not pinned by hash: builder-image-azure-terraform/Dockerfile:1: pin your Docker image by updating ubuntu:22.04 to ubuntu:22.04@sha256:ed1544e454989078f5dec1bfdabd8c5cc9c48e0705d07b678ab6ae3fb61952d2

Warn: containerImage not pinned by hash: builder-image-gitty-up/Dockerfile:1: pin your Docker image by updating alpine:3.15 to alpine:3.15@sha256:19b4bcc4f60e99dd5ebdca0cbce22c503bbcff197549d7e19dab4f22254dc864

Warn: containerImage not pinned by hash: builder-image-goreleaser/Dockerfile:1

Warn: containerImage not pinned by hash: builder-image-goreleaser/Dockerfile:8: pin your Docker image by updating golang:1.18-alpine to golang:1.18-alpine@sha256:77f25981bd57e60a510165f3be89c901aec90453fd0f1c5a45691f6cb1528807

Warn: containerImage not pinned by hash: builder-image-gradle/Dockerfile:1: pin your Docker image by updating gradle:7.4-jdk8 to gradle:7.4-jdk8@sha256:1b5ff6985e160f7dbb06ba0bb5b2ef3740ec95181fc7d8abb3235c30546c582a

Warn: containerImage not pinned by hash: builder-image-maven/Dockerfile:1: pin your Docker image by updating maven:3.8.5-jdk-8 to maven:3.8.5-jdk-8@sha256:0ad4f5c95ec62e9d2d2a830e734de0810816ef34af73e77e035bd3012e80e7b6

Warn: containerImage not pinned by hash: builder-image-openshift/Dockerfile:1: pin your Docker image by updating alpine:3.15 to alpine:3.15@sha256:19b4bcc4f60e99dd5ebdca0cbce22c503bbcff197549d7e19dab4f22254dc864

Warn: containerImage not pinned by hash: builder-image-ruby/Dockerfile:1: pin your Docker image by updating alpine:3.15 to alpine:3.15@sha256:19b4bcc4f60e99dd5ebdca0cbce22c503bbcff197549d7e19dab4f22254dc864

Warn: containerImage not pinned by hash: builder-image-skaffold/Dockerfile:1: pin your Docker image by updating docker:20.10-dind to docker:20.10-dind@sha256:af96c680a7e1f853ebdd50c1e0577e5df4089b033102546dd6417419564df3b5

Warn: containerImage not pinned by hash: builder-image-terraform/Dockerfile:1: pin your Docker image by updating alpine:3.15 to alpine:3.15@sha256:19b4bcc4f60e99dd5ebdca0cbce22c503bbcff197549d7e19dab4f22254dc864

Warn: containerImage not pinned by hash: builder-image-terratest/Dockerfile:2

Warn: containerImage not pinned by hash: builder-image-terratest/Dockerfile:19

Warn: containerImage not pinned by hash: builder-image-terratest/Dockerfile:32: pin your Docker image by updating alpine:3.11 to alpine:3.11@sha256:bcae378eacedab83da66079d9366c8f5df542d7ed9ab23bf487e3e1a8481375d

Warn: containerImage not pinned by hash: jenkins-image/Dockerfile:1: pin your Docker image by updating jenkins/jenkins:2.348 to jenkins/jenkins:2.348@sha256:66a20d42ab60debc56202ae9a719d7e3c658eace0fc5d199f56235f6d2b57afa

Warn: containerImage not pinned by hash: runner-image-lead-terraform/Dockerfile:1: pin your Docker image by updating summerwind/actions-runner:v2.291.1-ubuntu-20.04-3ca1152 to summerwind/actions-runner:v2.291.1-ubuntu-20.04-3ca1152@sha256:8eea313a912d63d5e02fd276e4c7434eef1246ad3ef452556579ba4634c9351d

Warn: pipCommand not pinned by hash: builder-image-aws/Dockerfile:10

Warn: pipCommand not pinned by hash: builder-image-skaffold/Dockerfile:20-21

Info: 0 out of 1 GitHub-owned GitHubAction dependencies pinned

Info: 0 out of 3 third-party GitHubAction dependencies pinned

Info: 0 out of 17 containerImage dependencies pinned

Info: 0 out of 2 pipCommand dependencies pinned