{"id":7746896,"name":"Traceableai/ast-action","ecosystem":"actions","description":"GitHub action for Traceable Active Security Testing","homepage":"https://www.traceable.ai/api-security-testing","licenses":"apache-2.0","normalized_licenses":["Apache-2.0"],"repository_url":"https://github.com/Traceableai/ast-action","keywords_array":["api-security","api-security-testing","security"],"namespace":"Traceableai","versions_count":8,"first_release_published_at":"2022-10-11T06:44:05.000Z","latest_release_published_at":"2026-07-31T05:26:56.000Z","latest_release_number":"v1.0.0","last_synced_at":"2026-09-25T12:22:16.898Z","created_at":"2023-05-17T11:12:50.494Z","updated_at":"2026-09-25T18:41:56.843Z","registry_url":"https://github.com/Traceableai/ast-action","install_command":null,"documentation_url":null,"metadata":{"name":"Traceable AST Action","description":"GitHub action for Traceable Active Security Testing","branding":{"icon":"activity","color":"red"},"inputs":{"step_name":{"required":true,"description":"","default":"NULL"},"scan_name":{"required":false,"description":"","default":"NULL"},"client_scan_token":{"required":true,"description":"","default":"NULL"},"traceable_cli_download_path":{"required":false,"description":"","default":"NULL"},"cli_version":{"required":false,"description":"","default":"latest"},"traffic_env":{"required":true,"description":"","default":"NULL"},"plugins":{"required":false,"description":"","default":"NULL"},"policy":{"required":false,"description":"","default":"NULL"},"include_url_regex":{"required":false,"description":"","default":".+"},"exclude_url_regex":{"required":false,"description":"","default":".*(logout|health).*"},"include_endpoint_labels":{"required":false,"description":"","default":"NULL"},"exclude_endpoint_labels":{"required":false,"description":"","default":"NULL"},"include_endpoint_with_owner_attributes":{"required":false,"description":"Comma seperted owner attributes","default":"NULL"},"include_endpoint_owners":{"required":false,"description":"Comma seperated owner values , provided only when include owner attributes are provided","default":"NULL"},"postman_collection":{"required":false,"description":"","default":"NULL"},"postman_environment":{"required":false,"description":"","default":"NULL"},"openapi_spec_ids":{"required":false,"description":"provide comma separated open api spec ids","default":"NULL"},"openapi_spec_files":{"required":false,"description":"comma separated files of open api spec documents","default":"NULL"},"target_url":{"required":false,"description":"","default":"NULL"},"traceable_server":{"required":false,"description":"","default":"NULL"},"idle_timeout":{"required":false,"description":"","default":"10"},"scan_timeout":{"required":false,"description":"","default":"NULL"},"max_retries":{"required":false,"description":"","default":"NULL"},"log_level":{"required":false,"description":"","default":"NULL"},"traceable_root_ca":{"required":false,"description":"","default":"NULL"},"traceable_cli_cert":{"required":false,"description":"","default":"NULL"},"traceable_cli_key":{"required":false,"description":"","default":"NULL"},"proxy_mode":{"required":false,"description":"Run a scan in proxy mode or not","default":"false"},"ta_service_name":{"required":false,"description":"TA service name","default":"proxy"},"tpa_endpoint":{"required":false,"description":"Traceable platform agent (TPA) reporting endpoint","default":"localhost"},"output_format":{"required":false,"description":"Out format for summary report","default":"md"},"output_file":{"required":false,"description":"Output file for summary report","default":"NULL"},"proxy_logfile":{"required":false,"description":"Output stream/file for proxy logs","default":"NULL"},"agent_logfile":{"required":false,"description":"Output stream/file for agent logs","default":"NULL"},"logfile":{"required":false,"description":"Output stream/file for traceable cli logs","default":"NULL"},"scan_suite":{"required":false,"description":"AST suite name as defined on the Traceable.ai platform","default":"NULL"},"graphql_schema_ids":{"required":false,"description":"Comma separated GraphQl schema IDs uploaded on Traceable.ai platform","default":"NULL"},"graphql_schema_files":{"required":false,"description":"Comma separated GraphQl SDL file paths","default":"NULL"},"graphql_introspection_enabled":{"required":false,"description":"Enables extracting the GraphQl Schema by running introspection on target-url","default":"NULL"}},"runs":{"using":"composite","steps":[{"name":"Validate required parameters","run":"[[ \"${{ inputs.step_name }}\" != \"NULL\" ]] || { echo \"step name input is empty\" ; exit 1; }\n[[ \"${{ inputs.client_scan_token }}\" != \"NULL\" ]] || { echo \"client_scan_token input is empty\" ; exit 1; }\nif [[ \"${{ inputs.graphql_introspection_enabled }}\" == \"true\" ]]; then\n          [[ \"${{ inputs.target_url }}\" != \"NULL\" ]] || { echo \"target_url is required when graphql_introspection_enabled is true\" ; exit 1; }\n        fi\n","shell":"bash"},{"name":"Download CLI","if":"${{ inputs.step_name == 'init' || inputs.step_name == 'init and run' }}","run":"if [[ \"${{ inputs.traceable_cli_download_path }}\" != \"NULL\" ]]\nthen\n  curl -Lo traceableCli.tar.gz ${{ inputs.traceable_cli_download_path }}\n  tar -xvf traceableCli.tar.gz --directory ${GITHUB_WORKSPACE}\nelse\n  if [[ \"${{ inputs.cli_version }}\"  = *\"-rc.\"* ]]\n  then\n    curl -Lo traceableCli.tar.gz https://downloads.traceable.ai/cli/rc/${{ inputs.cli_version }}/traceable-cli-${{ inputs.cli_version }}-linux-x86_64.tar.gz\n  else\n    curl -Lo traceableCli.tar.gz https://downloads.traceable.ai/cli/release/${{ inputs.cli_version }}/traceable-cli-${{ inputs.cli_version }}-linux-x86_64.tar.gz\n  fi\n  tar -xvf traceableCli.tar.gz --directory ${GITHUB_WORKSPACE}\nfi\n","shell":"bash"},{"name":"Init and run command on cli","if":"${{ inputs.step_name == 'init and run' }}","run":"export LC_ALL=en_US.utf-8\nexport LANG=en_US.utf-8\n\nif  [[ -n \"${{ inputs.traceable_root_ca }}\" ]] \u0026\u0026 [[ \"${{ inputs.traceable_root_ca }}\" != \"''\" ]] \u0026\u0026 [[ \"${{ inputs.traceable_root_ca }}\" != \"NULL\" ]]\nthen\n  echo \"${{ inputs.traceable_root_ca }}\" \u003e /tmp/ca_file.crt\n  export TRACEABLE_ROOT_CA_FILE_NAME=/tmp/ca_file.crt\nfi\nif  [[ -n \"${{ inputs.traceable_cli_cert }}\" ]] \u0026\u0026 [[ \"${{ inputs.traceable_cli_cert }}\" != \"''\" ]] \u0026\u0026 [[ \"${{ inputs.traceable_cli_cert }}\" != \"NULL\" ]]\nthen\n  echo \"${{ inputs.traceable_cli_cert }}\" \u003e /tmp/ca_cert.crt\n  export TRACEABLE_CLI_CERT_FILE_NAME=/tmp/ca_cert.crt\nfi\nif  [[ -n \"${{ inputs.traceable_cli_key }}\" ]] \u0026\u0026 [[ \"${{ inputs.traceable_cli_key }}\" != \"''\" ]] \u0026\u0026 [[ \"${{ inputs.traceable_cli_key }}\" != \"NULL\" ]]\nthen\n  echo \"${{ inputs.traceable_cli_key }}\" \u003e /tmp/ca_key.crt\n  export TRACEABLE_CLI_KEY_FILE_NAME=/tmp/ca_key.crt\nfi\n\ntraceableCliBinaryLocation=${GITHUB_WORKSPACE}/traceable\n\nscanInitCmd=$traceableCliBinaryLocation' ast scan initAndRun'\noptionsArr=('--scan-name' '--traffic-env' '--token' '--plugins' '--include-url-regex' '--exclude-url-regex' '--target-url' '--traceable-server' '--idle-timeout' '--scan-timeout' ' --reference-env' '--max-retries' '--openapi-spec-ids' '--openapi-spec-files' '--policy' '--postman-collection' '--postman-environment' '--include-endpoint-labels' '--exclude-endpoint-labels' '--include-endpoint-with-owner-attributes' '--include-endpoint-owners' '--loglevel' '--logfile' '--agent-logfile' '--proxy-logfile' '--scan-suite' '--graphql-schema-ids' '--graphql-schema-files' '--graphql-introspection-enabled')\n\n#Iterating the options available from options array and filling them with the arguments received in order\niterator=0\nfor option in '${{ inputs.scan_name }}' '${{ inputs.traffic_env }}' '${{ inputs.client_scan_token }}' '${{ inputs.plugins }}' '${{ inputs.include_url_regex }}' '${{ inputs.exclude_url_regex }}' '${{ inputs.target_url }}' '${{ inputs.traceable_server }}' '${{ inputs.idle_timeout }}' '${{ inputs.scan_timeout }}' '${{ inputs.reference_env }}' '${{ inputs.max_retries }}' '${{ inputs.openapi_spec_ids }}' '${{ inputs.openapi_spec_files }}' '${{ inputs.policy }}' '${{ inputs.postman_collection }}' '${{ inputs.postman_environment }}' '${{ inputs.include_endpoint_labels}}' '${{ inputs.exclude_endpoint_labels }}' '${{ inputs.include_endpoint_with_owner_attributes }}' '${{ inputs.include_endpoint_owners }}' '${{ inputs.log_level }}' '${{ inputs.logfile }}' '${{ inputs.agent_logfile }}' '${{ inputs.proxy_logfile }}' '${{ inputs.scan_suite }}' '${{ inputs.graphql_schema_ids }}' '${{ inputs.graphql_schema_files }}' '${{ inputs.graphql_introspection_enabled }}'\ndo\n  if [ -z \"$option\" ] || [ \"$option\" = \"''\" ] || [ \"$option\" = \"NULL\" ]\n  then\n    echo \"${optionsArr[$iterator]}\" is Null\n  else\n    scanInitCmd=$scanInitCmd\"  \"${optionsArr[$iterator]}\" \"${option}\n  fi\n  iterator=$(($iterator+1))\ndone\n\nif [[ \"${{ inputs.proxy_mode }}\" == \"true\" ]]\nthen\n  export TRACEABLE_PROXY_HOST=localhost\n  export TRACEABLE_PROXY_PORT=18080\n  export TA_SERVICE_NAME=\"${{ inputs.ta_service_name }}\"\n  unset http_proxy\n  scanInitCmd=$scanInitCmd\" -tpa \"${{ inputs.tpa_endpoint }}\" --proxy\"\nfi\necho \"Running cli command $scanInitCmd\"\n$scanInitCmd\n","shell":"bash"},{"name":"Init command on cli","if":"${{ inputs.step_name == 'init' }}","run":"export LC_ALL=en_US.utf-8\nexport LANG=en_US.utf-8\n\nif  [[ -n \"${{ inputs.traceable_root_ca }}\" ]] \u0026\u0026 [[ \"${{ inputs.traceable_root_ca }}\" != \"''\" ]] \u0026\u0026 [[ \"${{ inputs.traceable_root_ca }}\" != \"NULL\" ]]\nthen\n  echo \"${{ inputs.traceable_root_ca }}\" \u003e /tmp/ca_file.crt\n  export TRACEABLE_ROOT_CA_FILE_NAME=/tmp/ca_file.crt\nfi\nif  [[ -n \"${{ inputs.traceable_cli_cert }}\" ]] \u0026\u0026 [[ \"${{ inputs.traceable_cli_cert }}\" != \"''\" ]] \u0026\u0026 [[ \"${{ inputs.traceable_cli_cert }}\" != \"NULL\" ]]\nthen\n  echo \"${{ inputs.traceable_cli_cert }}\" \u003e /tmp/ca_cert.crt\n  export TRACEABLE_CLI_CERT_FILE_NAME=/tmp/ca_cert.crt\nfi\nif  [[ -n \"${{ inputs.traceable_cli_key }}\" ]] \u0026\u0026 [[ \"${{ inputs.traceable_cli_key }}\" != \"''\" ]] \u0026\u0026 [[ \"${{ inputs.traceable_cli_key }}\" != \"NULL\" ]]\nthen\n  echo \"${{ inputs.traceable_cli_key }}\" \u003e /tmp/ca_key.crt\n  export TRACEABLE_CLI_KEY_FILE_NAME=/tmp/ca_key.crt\nfi\n\ntraceableCliBinaryLocation=${GITHUB_WORKSPACE}/traceable\n\nscanInitCmd=$traceableCliBinaryLocation' ast scan init '\noptionsArr=('--scan-name' '--traffic-env' '--token' '--plugins' '--include-url-regex' '--exclude-url-regex' '--target-url' '--traceable-server'  '--scan-timeout' ' --reference-env' '--openapi-spec-ids' '--openapi-spec-files' '--policy' '--include-endpoint-labels' '--exclude-endpoint-labels' '--include-endpoint-with-owner-attributes' '--include-endpoint-owners' '--loglevel' '--scan-suite' '--graphql-schema-ids' '--graphql-schema-files' '--graphql-introspection-enabled')\n\n#Iterating the options available from options array and filling them with the arguments received in order\niterator=0\nfor option in '${{ inputs.scan_name }}' '${{ inputs.traffic_env }}' '${{ inputs.client_scan_token }}' '${{ inputs.plugins }}' '${{ inputs.include_url_regex }}' '${{ inputs.exclude_url_regex }}' '${{ inputs.target_url }}' '${{ inputs.traceable_server }}' '${{ inputs.scan_timeout }}' '${{ inputs.reference_env }}' '${{ inputs.openapi_spec_ids }}' '${{ inputs.openapi_spec_files }}' '${{ inputs.policy }}' '${{ inputs.include_endpoint_labels}}' '${{ inputs.exclude_endpoint_labels }}' '${{ inputs.include_endpoint_with_owner_attributes }}' '${{ inputs.include_endpoint_owners }}' '${{ inputs.log_level }}' '${{ inputs.scan_suite }}' '${{ inputs.graphql_schema_ids }}' '${{ inputs.graphql_schema_files }}' '${{ inputs.graphql_introspection_enabled }}'\ndo\n  if [ -z \"$option\" ] || [ \"$option\" = \"''\" ] || [ \"$option\" = \"NULL\" ]\n  then\n    echo \"${optionsArr[$iterator]}\" is Null\n  else\n    scanInitCmd=$scanInitCmd\"  \"${optionsArr[$iterator]}\" \"${option}\n  fi\n  iterator=$(($iterator+1))\ndone\necho \"Running cli command $scanInitCmd\"\n$scanInitCmd\n","shell":"bash"},{"name":"Run command on cli","id":"run_scan","if":"${{ inputs.step_name == 'run' }}","run":"export LC_ALL=en_US.utf-8\nexport LANG=en_US.utf-8\nif [ -f \"/tmp/ca_file.crt\" ]\nthen\n  export TRACEABLE_ROOT_CA_FILE_NAME=/tmp/ca_file.crt\nfi\nif  [ -f \"/tmp/ca_cert.crt\" ]\nthen\n  export TRACEABLE_CLI_CERT_FILE_NAME=/tmp/ca_cert.crt\nfi\nif  [ -f \"/tmp/ca_key.crt\" ]\nthen\n  export TRACEABLE_CLI_KEY_FILE_NAME=/tmp/ca_key.crt\nfi\n\ntraceableCliBinaryLocation=${GITHUB_WORKSPACE}/traceable\nscanRunCmd=$traceableCliBinaryLocation' ast scan run '\noptionsArr=('--token' '--idle-timeout' '--max-retries' '--postman-collection' '--postman-environment' '--loglevel' '--logfile' '--agent-logfile' '--proxy-logfile')\n\n#Iterating the options available from options array and filling them with the arguments received in order\niterator=0\nfor option in '${{ inputs.client_scan_token }}' '${{ inputs.idle_timeout }}' '${{ inputs.max_retries }}' '${{ inputs.postman_collection }}' '${{ inputs.postman_environment }}' '${{ inputs.log_level }}' '${{ inputs.logfile }}' '${{ inputs.agent_logfile }}' '${{ inputs.proxy_logfile }}'\ndo\n  if [ -z \"$option\" ] || [ \"$option\" = \"''\" ] || [ \"$option\" = \"NULL\" ]\n  then\n    echo \"${optionsArr[$iterator]}\" is Null\n  else\n    scanRunCmd=$scanRunCmd\" \"${optionsArr[$iterator]}\" \"${option}\n  fi\n  iterator=$(($iterator+1))\ndone\necho \"Running cli command $scanRunCmd\"\n$scanRunCmd\n","shell":"bash"},{"name":"Publish report","if":"${{ inputs.step_name == 'run' || inputs.step_name == 'init and run'}}","run":"export LC_ALL=en_US.utf-8\nexport LANG=en_US.utf-8\nif [ -f \"/tmp/ca_file.crt\" ]\nthen\n  export TRACEABLE_ROOT_CA_FILE_NAME=/tmp/ca_file.crt\nfi\nif  [ -f \"/tmp/ca_cert.crt\" ]\nthen\n  export TRACEABLE_CLI_CERT_FILE_NAME=/tmp/ca_cert.crt\nfi\nif  [ -f \"/tmp/ca_key.crt\" ]\nthen\n  export TRACEABLE_CLI_KEY_FILE_NAME=/tmp/ca_key.crt\nfi        \n${GITHUB_WORKSPACE}/traceable ast scan report --exit-code --output-format '${{ inputs.output_format }}' \u003e\u003e $GITHUB_STEP_SUMMARY\n","shell":"bash"},{"name":"Stop scan","id":"stop_scan","if":"${{ inputs.step_name == 'stop' }}","run":"export LC_ALL=en_US.utf-8\nexport LANG=en_US.utf-8\nif [ -f \"/tmp/ca_file.crt\" ]\nthen\n  export TRACEABLE_ROOT_CA_FILE_NAME=/tmp/ca_file.crt\nfi\nif  [ -f \"/tmp/ca_cert.crt\" ]\nthen\n  export TRACEABLE_CLI_CERT_FILE_NAME=/tmp/ca_cert.crt\nfi\nif  [ -f \"/tmp/ca_key.crt\" ]\nthen\n  export TRACEABLE_CLI_KEY_FILE_NAME=/tmp/ca_key.crt\nfi        \n${GITHUB_WORKSPACE}/traceable ast scan stop \u003e/dev/null || true\n","shell":"bash"}]},"default_branch":"main","path":null},"repo_metadata":{"id":65158560,"uuid":"538821791","full_name":"Traceableai/ast-action","owner":"Traceableai","description":"GitHub action to run Traceable Active Security Testing in GitHub workflows","archived":false,"fork":false,"pushed_at":"2026-09-21T04:51:06.000Z","size":29852,"stargazers_count":4,"open_issues_count":20,"forks_count":1,"subscribers_count":0,"default_branch":"main","last_synced_at":"2026-09-25T15:08:18.084Z","etag":null,"topics":["api-security","api-security-testing","security"],"latest_commit_sha":null,"homepage":"https://www.traceable.ai/api-security-testing","language":null,"has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/Traceableai.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null,"disclosure":null}},"created_at":"2022-09-20T05:20:46.000Z","updated_at":"2026-08-19T05:24:16.000Z","dependencies_parsed_at":"2024-05-31T08:25:03.224Z","dependency_job_id":"338451a2-175d-4a14-be85-09ebbc62333d","html_url":"https://github.com/Traceableai/ast-action","commit_stats":null,"previous_names":[],"tags_count":8,"template":false,"template_full_name":null,"purl":"pkg:github/Traceableai/ast-action","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Traceableai%2Fast-action","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Traceableai%2Fast-action/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Traceableai%2Fast-action/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Traceableai%2Fast-action/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/Traceableai","download_url":"https://codeload.github.com/Traceableai/ast-action/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Traceableai%2Fast-action/sbom","scorecard":{"id":143335,"data":{"date":"2025-08-11","repo":{"name":"github.com/Traceableai/ast-action","commit":"638dd92953f434bce9a06a79aeb95ffbdadf3c1e"},"scorecard":{"version":"v5.2.1-40-gf6ed084d","commit":"f6ed084d17c9236477efd66e5b258b9d4cc7b389"},"score":4.5,"checks":[{"name":"Code-Review","score":4,"reason":"Found 12/30 approved changesets -- score normalized to 4","details":null,"documentation":{"short":"Determines if the project requires human code review before pull requests (aka merge requests) are merged.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#code-review"}},{"name":"Maintained","score":0,"reason":"0 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0","details":null,"documentation":{"short":"Determines if the project is \"actively maintained\".","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#maintained"}},{"name":"Dangerous-Workflow","score":10,"reason":"no dangerous workflow patterns detected","details":null,"documentation":{"short":"Determines if the project's GitHub Action workflows avoid dangerous patterns.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#dangerous-workflow"}},{"name":"Packaging","score":-1,"reason":"packaging workflow not detected","details":["Warn: no GitHub/GitLab publishing workflow detected."],"documentation":{"short":"Determines if the project is published as a package that others can easily download, install, easily update, and uninstall.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#packaging"}},{"name":"Binary-Artifacts","score":10,"reason":"no binaries found in the repo","details":null,"documentation":{"short":"Determines if the project has generated executable (binary) artifacts in the source repository.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#binary-artifacts"}},{"name":"Pinned-Dependencies","score":0,"reason":"dependency not pinned by hash detected -- score normalized to 0","details":["Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/test-e2e.yml:14: update your workflow using https://app.stepsecurity.io/secureworkflow/Traceableai/ast-action/test-e2e.yml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/test-e2e.yml:16: update your workflow using https://app.stepsecurity.io/secureworkflow/Traceableai/ast-action/test-e2e.yml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/test-e2e.yml:26: update your workflow using https://app.stepsecurity.io/secureworkflow/Traceableai/ast-action/test-e2e.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/test-traceable-ast-init-and-run.yml:14: update your workflow using https://app.stepsecurity.io/secureworkflow/Traceableai/ast-action/test-traceable-ast-init-and-run.yml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/test-traceable-ast-init-and-run.yml:16: update your workflow using https://app.stepsecurity.io/secureworkflow/Traceableai/ast-action/test-traceable-ast-init-and-run.yml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/test-traceable-ast-init-and-run.yml:25: update your workflow using https://app.stepsecurity.io/secureworkflow/Traceableai/ast-action/test-traceable-ast-init-and-run.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/test-traceable-ast-init-traceable-ast-run.yml:13: update your workflow using https://app.stepsecurity.io/secureworkflow/Traceableai/ast-action/test-traceable-ast-init-traceable-ast-run.yml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/test-traceable-ast-init-traceable-ast-run.yml:15: update your workflow using https://app.stepsecurity.io/secureworkflow/Traceableai/ast-action/test-traceable-ast-init-traceable-ast-run.yml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/test-traceable-ast-init-traceable-ast-run.yml:29: update your workflow using https://app.stepsecurity.io/secureworkflow/Traceableai/ast-action/test-traceable-ast-init-traceable-ast-run.yml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/test-traceable-ast-init-traceable-ast-run.yml:36: update your workflow using https://app.stepsecurity.io/secureworkflow/Traceableai/ast-action/test-traceable-ast-init-traceable-ast-run.yml/main?enable=pin","Info:   0 out of   3 GitHub-owned GitHubAction dependencies pinned","Info:   0 out of   7 third-party GitHubAction dependencies pinned"],"documentation":{"short":"Determines if the project has declared and pinned the dependencies of its build process.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#pinned-dependencies"}},{"name":"Token-Permissions","score":0,"reason":"detected GitHub workflow tokens with excessive permissions","details":["Warn: no topLevel permission defined: .github/workflows/test-e2e.yml:1","Warn: no topLevel permission defined: .github/workflows/test-traceable-ast-init-and-run.yml:1","Warn: no topLevel permission defined: .github/workflows/test-traceable-ast-init-traceable-ast-run.yml:1","Info: no jobLevel write permissions found"],"documentation":{"short":"Determines if the project's workflows follow the principle of least privilege.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#token-permissions"}},{"name":"CII-Best-Practices","score":0,"reason":"no effort to earn an OpenSSF best practices badge detected","details":null,"documentation":{"short":"Determines if the project has an OpenSSF (formerly CII) Best Practices Badge.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#cii-best-practices"}},{"name":"Vulnerabilities","score":10,"reason":"0 existing vulnerabilities detected","details":null,"documentation":{"short":"Determines if the project has open, known unfixed vulnerabilities.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#vulnerabilities"}},{"name":"Fuzzing","score":0,"reason":"project is not fuzzed","details":["Warn: no fuzzer integrations found"],"documentation":{"short":"Determines if the project uses fuzzing.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#fuzzing"}},{"name":"Security-Policy","score":0,"reason":"security policy file not detected","details":["Warn: no security policy file detected","Warn: no security file to analyze","Warn: no security file to analyze","Warn: no security file to analyze"],"documentation":{"short":"Determines if the project has published a security policy.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#security-policy"}},{"name":"License","score":10,"reason":"license file detected","details":["Info: project has a license file: LICENSE:0","Info: FSF or OSI recognized license: Apache License 2.0: LICENSE:0"],"documentation":{"short":"Determines if the project has defined a license.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#license"}},{"name":"Branch-Protection","score":-1,"reason":"internal error: error during branchesHandler.setup: internal error: githubv4.Query: Resource not accessible by integration","details":null,"documentation":{"short":"Determines if the default and release branches are protected with GitHub's branch protection settings.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#branch-protection"}},{"name":"Signed-Releases","score":-1,"reason":"no releases found","details":null,"documentation":{"short":"Determines if the project cryptographically signs release artifacts.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#signed-releases"}},{"name":"SAST","score":-1,"reason":"internal error: internal error: Client.Checks.ListCheckRunsForRef: error during graphqlHandler.setupCheckRuns: Although you appear to have the correct authorization credentials, the `bridgecrewio` organization has an IP allow list enabled, and your IP address is not permitted to access this resource.","details":null,"documentation":{"short":"Determines if the project uses static code analysis.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#sast"}}]},"last_synced_at":"2025-08-16T08:43:56.411Z","repository_id":65158560,"created_at":"2025-08-16T08:43:56.411Z","updated_at":"2025-08-16T08:43:56.411Z"},"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":341189360,"owners_count":37685510,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-08-22T15:14:58.755Z","status":"online","status_checked_at":"2026-09-25T02:00:20.896Z","response_time":55,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"},"owner_record":{"login":"Traceableai","name":"Traceableai","uuid":"44785680","kind":"organization","description":null,"email":null,"website":null,"location":null,"twitter":null,"company":null,"icon_url":"https://avatars.githubusercontent.com/u/44785680?v=4","repositories_count":8,"last_synced_at":"2023-03-10T02:47:07.042Z","metadata":{"has_sponsors_listing":false},"html_url":"https://github.com/Traceableai","funding_links":[],"total_stars":null,"followers":null,"following":null,"created_at":"2022-11-19T20:13:49.735Z","updated_at":"2023-03-10T02:47:07.045Z","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/Traceableai","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/Traceableai/repositories"},"tags":[{"name":"v1.0.0","sha":"37ba512f0addf0f66b7ef7d0e6f347559bda9172","kind":"tag","published_at":"2026-07-31T05:26:56.000Z","download_url":"https://codeload.github.com/Traceableai/ast-action/tar.gz/v1.0.0","html_url":"https://github.com/Traceableai/ast-action/releases/tag/v1.0.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/Traceableai/ast-action@v1.0.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Traceableai%2Fast-action/tags/v1.0.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Traceableai%2Fast-action/tags/v1.0.0/manifests"},{"name":"v1","sha":"37ba512f0addf0f66b7ef7d0e6f347559bda9172","kind":"tag","published_at":"2026-07-31T05:26:56.000Z","download_url":"https://codeload.github.com/Traceableai/ast-action/tar.gz/v1","html_url":"https://github.com/Traceableai/ast-action/releases/tag/v1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/Traceableai/ast-action@v1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Traceableai%2Fast-action/tags/v1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Traceableai%2Fast-action/tags/v1/manifests"},{"name":"0.0.5.1","sha":"c09d8319959c5b275466b8b2e81a1507f4261d3c","kind":"commit","published_at":"2023-04-17T20:04:51.000Z","download_url":"https://codeload.github.com/Traceableai/ast-action/tar.gz/0.0.5.1","html_url":"https://github.com/Traceableai/ast-action/releases/tag/0.0.5.1","dependencies_parsed_at":"2023-06-02T00:24:22.295Z","dependency_job_id":null,"purl":"pkg:github/Traceableai/ast-action@0.0.5.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Traceableai%2Fast-action/tags/0.0.5.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Traceableai%2Fast-action/tags/0.0.5.1/manifests"},{"name":"0.0.5","sha":"1646f97cad5fa3e297457188c67d9548d1ad1b16","kind":"commit","published_at":"2023-03-15T16:35:15.000Z","download_url":"https://codeload.github.com/Traceableai/ast-action/tar.gz/0.0.5","html_url":"https://github.com/Traceableai/ast-action/releases/tag/0.0.5","dependencies_parsed_at":"2023-06-02T00:24:21.062Z","dependency_job_id":null,"purl":"pkg:github/Traceableai/ast-action@0.0.5","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Traceableai%2Fast-action/tags/0.0.5","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Traceableai%2Fast-action/tags/0.0.5/manifests"},{"name":"0.0.4","sha":"3fa0b695efda545fbe514b5128c68151fc21b406","kind":"commit","published_at":"2022-12-02T06:07:54.000Z","download_url":"https://codeload.github.com/Traceableai/ast-action/tar.gz/0.0.4","html_url":"https://github.com/Traceableai/ast-action/releases/tag/0.0.4","dependencies_parsed_at":"2023-06-01T12:16:40.126Z","dependency_job_id":null,"purl":"pkg:github/Traceableai/ast-action@0.0.4","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Traceableai%2Fast-action/tags/0.0.4","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Traceableai%2Fast-action/tags/0.0.4/manifests"},{"name":"0.0.3","sha":"99f7b460784d12b6e0cf29aef00f7aa5290b0935","kind":"commit","published_at":"2022-10-27T07:21:01.000Z","download_url":"https://codeload.github.com/Traceableai/ast-action/tar.gz/0.0.3","html_url":"https://github.com/Traceableai/ast-action/releases/tag/0.0.3","dependencies_parsed_at":"2023-06-01T12:16:47.807Z","dependency_job_id":null,"purl":"pkg:github/Traceableai/ast-action@0.0.3","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Traceableai%2Fast-action/tags/0.0.3","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Traceableai%2Fast-action/tags/0.0.3/manifests"},{"name":"0.0.2","sha":"f933bd014143bcb04f4d613da0ee653c2bcd7671","kind":"commit","published_at":"2022-10-21T17:33:57.000Z","download_url":"https://codeload.github.com/Traceableai/ast-action/tar.gz/0.0.2","html_url":"https://github.com/Traceableai/ast-action/releases/tag/0.0.2","dependencies_parsed_at":"2023-06-01T12:16:51.216Z","dependency_job_id":null,"purl":"pkg:github/Traceableai/ast-action@0.0.2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Traceableai%2Fast-action/tags/0.0.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Traceableai%2Fast-action/tags/0.0.2/manifests"},{"name":"0.0.1","sha":"a5569bf6e03a910a058d6c02b870a6eecb9df51d","kind":"commit","published_at":"2022-10-11T06:44:05.000Z","download_url":"https://codeload.github.com/Traceableai/ast-action/tar.gz/0.0.1","html_url":"https://github.com/Traceableai/ast-action/releases/tag/0.0.1","dependencies_parsed_at":"2023-06-01T12:16:55.142Z","dependency_job_id":null,"purl":"pkg:github/Traceableai/ast-action@0.0.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Traceableai%2Fast-action/tags/0.0.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Traceableai%2Fast-action/tags/0.0.1/manifests"}]},"repo_metadata_updated_at":"2026-09-25T18:41:56.843Z","dependent_packages_count":0,"downloads":null,"downloads_period":null,"dependent_repos_count":1,"rankings":{"downloads":null,"dependent_repos_count":24.753604816986215,"dependent_packages_count":0.0,"stargazers_count":17.528125495167167,"forks_count":35.11012517826018,"docker_downloads_count":null,"average":19.34796387260339},"purl":"pkg:githubactions/Traceableai/ast-action","advisories":[],"docker_usage_url":"https://docker.ecosyste.ms/usage/actions/Traceableai/ast-action","docker_dependents_count":null,"docker_downloads_count":null,"usage_url":"https://repos.ecosyste.ms/usage/actions/Traceableai/ast-action","dependent_repositories_url":"https://repos.ecosyste.ms/api/v1/usage/actions/Traceableai/ast-action/dependencies","status":null,"funding_links":[],"critical":null,"issue_metadata":{"last_synced_at":"2026-09-25T12:22:22.532Z","issues_count":0,"pull_requests_count":56,"avg_time_to_close_issue":null,"avg_time_to_close_pull_request":318739.59375,"issues_closed_count":0,"pull_requests_closed_count":32,"pull_request_authors_count":11,"issue_authors_count":0,"avg_comments_per_issue":null,"avg_comments_per_pull_request":0.05357142857142857,"merged_pull_requests_count":31,"bot_issues_count":0,"bot_pull_requests_count":0,"past_year_issues_count":0,"past_year_pull_requests_count":5,"past_year_avg_time_to_close_issue":null,"past_year_avg_time_to_close_pull_request":852793.5,"past_year_issues_closed_count":0,"past_year_pull_requests_closed_count":2,"past_year_pull_request_authors_count":3,"past_year_issue_authors_count":0,"past_year_avg_comments_per_issue":null,"past_year_avg_comments_per_pull_request":0.2,"past_year_bot_issues_count":0,"past_year_bot_pull_requests_count":0,"past_year_merged_pull_requests_count":2,"issues_url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/repositories/Traceableai%2Fast-action/issues","maintainers":[{"login":"dhruv-singhal-github","count":23,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/dhruv-singhal-github"},{"login":"samarth-gupta-traceable","count":4,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/samarth-gupta-traceable"},{"login":"yogesh-gogia1","count":2,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/yogesh-gogia1"},{"login":"sarthak77","count":2,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/sarthak77"}],"active_maintainers":[]},"versions_url":"https://packages.ecosyste.ms/api/v1/registries/github%20actions/packages/Traceableai%2Fast-action/versions","version_numbers_url":"https://packages.ecosyste.ms/api/v1/registries/github%20actions/packages/Traceableai%2Fast-action/version_numbers","latest_version_url":"https://packages.ecosyste.ms/api/v1/registries/github%20actions/packages/Traceableai%2Fast-action/latest_version","dependent_packages_url":"https://packages.ecosyste.ms/api/v1/registries/github%20actions/packages/Traceableai%2Fast-action/dependent_packages","related_packages_url":"https://packages.ecosyste.ms/api/v1/registries/github%20actions/packages/Traceableai%2Fast-action/related_packages","codemeta_url":"https://packages.ecosyste.ms/api/v1/registries/github%20actions/packages/Traceableai%2Fast-action/codemeta","maintainers":[]}