Go module

github.com/triggermesh/knative-lambda-runtime

v1.24.2

Newer version available

Published

April 1, 2023

Links

Origin: https://pkg.go.dev/github.com/triggermesh/knative-lambda-runtime@v1.24.2
Repo: https://github.com/triggermesh/knative-lambda-runtime

Projects

triggermesh/knative-lambda-runtime

GitHub

Running AWS Lambda Functions on Knative/Kubernetes Clusters

22 forks

274 stars

OpenSSF scorecard

The Open Source Security Foundation is a cross-industry collaboration to improve the security of open source software (OSS). The Scorecard provides security health metrics for open source projects.

View information about checks and how to fix failures.

Score

3.6/10

Scorecard as of May 5, 2025.

Maintained

0/10

Determines if the project is "actively maintained".

Reasoning

project is archived

Dangerous-Workflow

10/10

Determines if the project's GitHub Action workflows avoid dangerous patterns.

Reasoning

no dangerous workflow patterns detected

CII-Best-Practices

0/10

Determines if the project has an OpenSSF (formerly CII) Best Practices Badge.

Reasoning

no effort to earn an OpenSSF best practices badge detected

Binary-Artifacts

0/10

Determines if the project has generated executable (binary) artifacts in the source repository.

Reasoning

binaries present in source code

Code-Review

8/10

Determines if the project requires human code review before pull requests (aka merge requests) are merged.

Reasoning

Found 13/15 approved changesets -- score normalized to 8

Token-Permissions

0/10

Determines if the project's workflows follow the principle of least privilege.

Reasoning

detected GitHub workflow tokens with excessive permissions

Security-Policy

0/10

Determines if the project has published a security policy.

Reasoning

security policy file not detected

Fuzzing

0/10

Determines if the project uses fuzzing.

Reasoning

project is not fuzzed

License

10/10

Determines if the project has defined a license.

Reasoning

license file detected

SAST

0/10

Determines if the project uses static code analysis.

Reasoning

SAST tool is not run on all commits -- score normalized to 0

Pinned-Dependencies

0/10

Determines if the project has declared and pinned the dependencies of its build process.

Reasoning

dependency not pinned by hash detected -- score normalized to 0

Project metadata as of August 17, 2024.

This site uses cookies from Google to deliver its services and to analyze traffic.

Pinned-Dependencies

Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build-and-release.yaml:35: update your workflow using https://app.stepsecurity.io/secureworkflow/triggermesh/knative-lambda-runtime/build-and-release.yaml/main?enable=pin

Warn: third-party GitHubAction not pinned by hash: .github/workflows/build-and-release.yaml:39: update your workflow using https://app.stepsecurity.io/secureworkflow/triggermesh/knative-lambda-runtime/build-and-release.yaml/main?enable=pin

Warn: third-party GitHubAction not pinned by hash: .github/workflows/build-and-release.yaml:42: update your workflow using https://app.stepsecurity.io/secureworkflow/triggermesh/knative-lambda-runtime/build-and-release.yaml/main?enable=pin

Warn: third-party GitHubAction not pinned by hash: .github/workflows/build-and-release.yaml:51: update your workflow using https://app.stepsecurity.io/secureworkflow/triggermesh/knative-lambda-runtime/build-and-release.yaml/main?enable=pin

Warn: third-party GitHubAction not pinned by hash: .github/workflows/build-and-release.yaml:59: update your workflow using https://app.stepsecurity.io/secureworkflow/triggermesh/knative-lambda-runtime/build-and-release.yaml/main?enable=pin

Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build-and-release.yaml:76: update your workflow using https://app.stepsecurity.io/secureworkflow/triggermesh/knative-lambda-runtime/build-and-release.yaml/main?enable=pin

Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build-and-release.yaml:79: update your workflow using https://app.stepsecurity.io/secureworkflow/triggermesh/knative-lambda-runtime/build-and-release.yaml/main?enable=pin

Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build-and-release.yaml:119: update your workflow using https://app.stepsecurity.io/secureworkflow/triggermesh/knative-lambda-runtime/build-and-release.yaml/main?enable=pin

Warn: third-party GitHubAction not pinned by hash: .github/workflows/build-and-release.yaml:128: update your workflow using https://app.stepsecurity.io/secureworkflow/triggermesh/knative-lambda-runtime/build-and-release.yaml/main?enable=pin

Warn: containerImage not pinned by hash: java8/Dockerfile:1

Warn: containerImage not pinned by hash: java8/Dockerfile:8: pin your Docker image by updating openjdk:8-jre-alpine to openjdk:8-jre-alpine@sha256:f362b165b870ef129cbe730f29065ff37399c0aa8bcab3e44b51c302938c9193

Warn: containerImage not pinned by hash: node10/Dockerfile:1

Warn: containerImage not pinned by hash: node10/Dockerfile:8: pin your Docker image by updating node:10-alpine to node:10-alpine@sha256:dc98dac24efd4254f75976c40bce46944697a110d06ce7fa47e7268470cf2e28

Warn: containerImage not pinned by hash: node18/Dockerfile:1

Warn: containerImage not pinned by hash: node18/Dockerfile:8: pin your Docker image by updating amazon/aws-lambda-nodejs:18 to amazon/aws-lambda-nodejs:18@sha256:c91cf1663a7290f150a63e758a0bafd112632c3680f321ca1cddb3fd40d92c86

Warn: containerImage not pinned by hash: node4/Dockerfile:1

Warn: containerImage not pinned by hash: node4/Dockerfile:8: pin your Docker image by updating node:4-alpine to node:4-alpine@sha256:0fab48331a2d36c8545d44b6181311c47b08a8ecd2f37863c5679b0cf86cb18b

Warn: containerImage not pinned by hash: python27/Dockerfile:1

Warn: containerImage not pinned by hash: python27/Dockerfile:8: pin your Docker image by updating python:2.7-alpine to python:2.7-alpine@sha256:724d0540eb56ffaa6dd770aa13c3bc7dfc829dec561d87cb36b2f5b9ff8a760a

Warn: containerImage not pinned by hash: python310/Dockerfile:1

Warn: containerImage not pinned by hash: python310/Dockerfile:9: pin your Docker image by updating amazon/aws-lambda-python:3.10 to amazon/aws-lambda-python:3.10@sha256:93a14034fc4e04e0de7f78f57a6f324aac004428b82ee2be66c6f883d1ad1e84

Warn: containerImage not pinned by hash: python37/Dockerfile:1

Warn: containerImage not pinned by hash: python37/Dockerfile:9: pin your Docker image by updating python:3.7-slim-stretch to python:3.7-slim-stretch@sha256:649b13bc3e6a70f7722d5eba4d78afbf4e9cec63193a29148271124840013286

Warn: containerImage not pinned by hash: ruby25/Dockerfile:1

Warn: containerImage not pinned by hash: ruby25/Dockerfile:2

Warn: containerImage not pinned by hash: ruby25/Dockerfile:9: pin your Docker image by updating ruby:2.5-alpine to ruby:2.5-alpine@sha256:1aa1dbab746b3dc5d102567a3f91b04023bc61da29bbb36efe1280e9d90074f7

Warn: containerImage not pinned by hash: ruby32/Dockerfile:1

Warn: containerImage not pinned by hash: ruby32/Dockerfile:8: pin your Docker image by updating amazon/aws-lambda-ruby:3.2 to amazon/aws-lambda-ruby:3.2@sha256:a61bfca06e0f39a46571e70d7fe150ea223ad68867dbb5d5537d427621b14d7d

Warn: pipCommand not pinned by hash: python310/Dockerfile:13-14

Warn: pipCommand not pinned by hash: python310/Dockerfile:13-14

Warn: pipCommand not pinned by hash: python37/Dockerfile:13-14

Warn: pipCommand not pinned by hash: python37/Dockerfile:13-14

Info: 0 out of 4 GitHub-owned GitHubAction dependencies pinned

Info: 0 out of 5 third-party GitHubAction dependencies pinned

Info: 0 out of 19 containerImage dependencies pinned

Info: 0 out of 4 pipCommand dependencies pinned