{"id":12682352,"name":"getsentry/craft","ecosystem":"actions","description":"Prepare a new release using Craft","homepage":"https://getsentry.github.io/craft/","licenses":"mit","normalized_licenses":["MIT"],"repository_url":"https://github.com/getsentry/craft","keywords_array":["cli","craft","google-cloud-storage","npm","nuget","packaging","pypi","release-automation","rust-crate","sentry","sentry-release-registry","tag-production","typescript"],"namespace":"getsentry","versions_count":214,"first_release_published_at":"2018-06-28T15:07:00.000Z","latest_release_published_at":"2026-02-17T21:37:48.000Z","latest_release_number":"2.21.6","last_synced_at":"2026-03-23T09:49:04.274Z","created_at":"2026-01-16T13:58:29.130Z","updated_at":"2026-03-23T09:49:04.274Z","registry_url":"https://github.com/getsentry/craft","install_command":null,"documentation_url":null,"metadata":{"name":"Craft Prepare Release","description":"Prepare a new release using Craft","inputs":{"version":{"description":"Version to release. Can be a semver string (e.g., \"1.2.3\"), a bump type (\"major\", \"minor\", \"patch\"), or \"auto\" for automatic detection.\n","required":false},"merge_target":{"description":"Target branch to merge into. Uses the default branch as a fallback.","required":false},"force":{"description":"Force a release even when there are release-blockers","required":false,"default":"false"},"blocker_label":{"description":"Label that blocks releases","required":false,"default":"release-blocker"},"publish_repo":{"description":"Repository for publish issues (owner/repo format)","required":false},"git_user_name":{"description":"Git committer name","required":false},"git_user_email":{"description":"Git committer email","required":false},"path":{"description":"The path that Craft will run inside","required":false,"default":"."},"craft_config_from_merge_target":{"description":"Use the craft config from the merge target branch","required":false,"default":"false"},"craft_version":{"description":"Version of Craft to install (tag or \"latest\"). Defaults to the action ref (e.g., \"v2\") if not specified.\n","required":false,"default":""}},"outputs":{"version":{"description":"The resolved version being released","value":"${{ steps.craft.outputs.version }}"},"branch":{"description":"The release branch name","value":"${{ steps.craft.outputs.branch }}"},"sha":{"description":"The commit SHA on the release branch","value":"${{ steps.craft.outputs.sha }}"},"previous_tag":{"description":"The tag before this release (for diff links)","value":"${{ steps.craft.outputs.previous_tag }}"},"changelog":{"description":"The changelog for this release (may be truncated for large repos)","value":"${{ steps.craft.outputs.changelog }}"},"changelog_file":{"description":"Path to the full changelog file (available when running in GitHub Actions)","value":"${{ steps.craft.outputs.changelog_file }}"},"issue_url":{"description":"The URL of the created publish request issue","value":"${{ steps.request-publish.outputs.issue_url }}"}},"runs":{"using":"composite","steps":[{"id":"killswitch","name":"Check release blockers","shell":"bash","run":"if [[ '${{ inputs.force }}' != 'true' ]] \u0026\u0026 gh issue list -l '${{ inputs.blocker_label }}' -s open | grep -q '^[0-9]\\+[[:space:]]'; then\n  echo \"::error::Open release-blocking issues found (label: ${{ inputs.blocker_label }}), cancelling release...\"\n  gh api -X POST repos/:owner/:repo/actions/runs/$GITHUB_RUN_ID/cancel\nfi\n"},{"name":"Set git user","shell":"bash","env":{"GIT_USER_NAME":"${{ inputs.git_user_name || github.actor }}","GIT_USER_EMAIL":"${{ inputs.git_user_email || format('{0}+{1}@users.noreply.github.com', github.actor_id, github.actor) }}"},"run":"echo \"GIT_COMMITTER_NAME=${GIT_USER_NAME}\" \u003e\u003e $GITHUB_ENV\necho \"GIT_AUTHOR_NAME=${GIT_USER_NAME}\" \u003e\u003e $GITHUB_ENV\necho \"EMAIL=${GIT_USER_EMAIL}\" \u003e\u003e $GITHUB_ENV\n"},{"name":"Download Craft from build artifact","id":"craft-artifact","if":"github.repository == 'getsentry/craft'","uses":"actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16","with":{"name":"craft-binary","path":"/tmp/craft-artifact"}},{"name":"Install Craft from artifact or release","shell":"bash","run":"set -euo pipefail\n\nif [[ -f /tmp/craft-artifact/dist/craft ]]; then\n  echo \"Installing Craft from build artifact...\"\n  sudo install -m 755 /tmp/craft-artifact/dist/craft /usr/local/bin/craft\nelse\n  # Download from release (for external repos or if artifact unavailable)\n  # Use explicit craft_version input if provided, otherwise fall back to github.action_ref\n  CRAFT_VERSION=\"${{ inputs.craft_version }}\"\n  if [[ -z \"$CRAFT_VERSION\" ]]; then\n    CRAFT_VERSION=\"${{ github.action_ref }}\"\n  fi\n\n  if [[ \"$CRAFT_VERSION\" == \"latest\" || -z \"$CRAFT_VERSION\" ]]; then\n    echo \"Downloading latest Craft release...\"\n    CRAFT_URL=$(curl -fsSL \"https://api.github.com/repos/getsentry/craft/releases/latest\" \\\n      | jq -r '.assets[] | select(.name == \"craft\") | .browser_download_url')\n  else\n    CRAFT_URL=\"https://github.com/getsentry/craft/releases/download/${CRAFT_VERSION}/craft\"\n    echo \"Downloading Craft ${CRAFT_VERSION} from: ${CRAFT_URL}\"\n\n    # Fallback to latest if specified version doesn't have a release\n    if ! curl -sfI \"$CRAFT_URL\" \u003e/dev/null 2\u003e\u00261; then\n      echo \"Release not found for version '${CRAFT_VERSION}', falling back to latest...\"\n      CRAFT_URL=$(curl -fsSL \"https://api.github.com/repos/getsentry/craft/releases/latest\" \\\n        | jq -r '.assets[] | select(.name == \"craft\") | .browser_download_url')\n    fi\n  fi\n\n  # Verify we have a valid URL\n  if [[ -z \"$CRAFT_URL\" ]]; then\n    echo \"::error::Failed to determine Craft download URL. The GitHub API may have failed or the release asset is missing.\"\n    exit 1\n  fi\n\n  echo \"Installing Craft from: ${CRAFT_URL}\"\n  sudo curl -fsSL -o /usr/local/bin/craft \"$CRAFT_URL\"\n  sudo chmod +x /usr/local/bin/craft\n\n  # Verify the binary was downloaded successfully\n  if [[ ! -s /usr/local/bin/craft ]]; then\n    echo \"::error::Downloaded Craft binary is empty or missing\"\n    exit 1\n  fi\nfi\n"},{"name":"Craft Prepare","id":"craft","shell":"bash","env":{"CRAFT_LOG_LEVEL":"Debug"},"working-directory":"${{ inputs.path }}","run":"# Ensure we have origin/HEAD set\ngit remote set-head origin --auto\n\n# Build command with optional flags\nCRAFT_ARGS=\"\"\nif [[ '${{ inputs.craft_config_from_merge_target }}' == 'true' \u0026\u0026 -n '${{ inputs.merge_target }}' ]]; then\n  CRAFT_ARGS=\"--config-from ${{ inputs.merge_target }}\"\nfi\n\n# Version is optional - if not provided, Craft uses versioning.policy from config\nVERSION_ARG=\"\"\nif [[ -n '${{ inputs.version }}' ]]; then\n  VERSION_ARG=\"${{ inputs.version }}\"\nfi\n\ncraft prepare $VERSION_ARG $CRAFT_ARGS\n"},{"name":"Read Craft Targets","id":"craft-targets","shell":"bash","working-directory":"${{ inputs.path }}","env":{"CRAFT_LOG_LEVEL":"Warn"},"run":"targets=$(craft targets | jq -r '.[]|\" - [ ] \\(.)\"')\n\n# https://docs.github.com/en/actions/using-workflows/workflow-commands-for-github-actions#multiline-strings\necho \"targets\u003c\u003cEOF\" \u003e\u003e \"$GITHUB_OUTPUT\"\necho \"$targets\" \u003e\u003e \"$GITHUB_OUTPUT\"\necho \"EOF\" \u003e\u003e \"$GITHUB_OUTPUT\"\n"},{"name":"Request publish","id":"request-publish","shell":"bash","env":{"CHANGELOG_FILE":"${{ steps.craft.outputs.changelog_file }}","TARGETS":"${{ steps.craft-targets.outputs.targets }}","RESOLVED_VERSION":"${{ steps.craft.outputs.version }}","RELEASE_BRANCH":"${{ steps.craft.outputs.branch }}","RELEASE_SHA":"${{ steps.craft.outputs.sha }}","RELEASE_PREVIOUS_TAG":"${{ steps.craft.outputs.previous_tag || 'HEAD' }}","SUBDIRECTORY":"${{ inputs.path != '.' \u0026\u0026 format('/{0}', inputs.path) || '' }}","MERGE_TARGET":"${{ inputs.merge_target || '(default)' }}","PUBLISH_REPO":"${{ inputs.publish_repo || format('{0}/publish', github.repository_owner) }}"},"run":"if [[ -z \"$RESOLVED_VERSION\" ]]; then\n  echo \"::error::Craft did not output a version. This is unexpected.\"\n  exit 1\nfi\n\n# Read changelog from file to avoid E2BIG.\n# Produced by craft \u003e= 2.22.0; older versions don't produce the file\n# and the publish issue will be created without a changelog section.\nCHANGELOG=\"\"\nif [[ -n \"${CHANGELOG_FILE:-}\" \u0026\u0026 -f \"$CHANGELOG_FILE\" ]]; then\n  CHANGELOG=$(cat \"$CHANGELOG_FILE\")\nfi\n\n# GitHub issue bodies are limited to ~65 536 characters.  Truncate\n# the changelog to stay under that limit with room for the rest of\n# the body template (~2 KB of surrounding markdown).\nMAX_CHANGELOG_CHARS=60000\nif [[ ${#CHANGELOG} -gt $MAX_CHANGELOG_CHARS ]]; then\n  CHANGELOG=\"${CHANGELOG:0:$MAX_CHANGELOG_CHARS}\"$'\\n\\n---\\n*Changelog truncated for issue body.*'\nfi\n\ntitle=\"publish: ${GITHUB_REPOSITORY}${SUBDIRECTORY}@${RESOLVED_VERSION}\"\n\n# Check if issue already exists by listing all open issues and filtering by exact title match.\n# We avoid GitHub search API to bypass indexing delays and query syntax edge cases.\n# gh issue list returns issues sorted by creation date (most recent first), so we take\n# the first match to handle the theoretical case of duplicate titles.\nexisting_issue=$(gh -R \"$PUBLISH_REPO\" issue list --json title,url,number,body | jq -r --arg t \"$title\" '[.[] | select(.title == $t)] | first // empty')\nexisting_issue_url=\"\"\nexisting_issue_number=\"\"\nexisting_body=\"\"\nif [[ -n \"$existing_issue\" ]]; then\n  existing_issue_url=$(echo \"$existing_issue\" | jq -r '.url')\n  existing_issue_number=$(echo \"$existing_issue\" | jq -r '.number')\n  existing_body=$(echo \"$existing_issue\" | jq -r '.body')\nfi\n\n# Extract checked targets from the existing body.\n# Targets appear as \" - [x] targetName\" or \" - [X] targetName\" in markdown.\n# We only look within the \"### Targets\" section to avoid matching checkboxes in the changelog.\n# We store them in an associative array for O(1) lookup when rebuilding targets.\ndeclare -A checked_targets\nif [[ -n \"$existing_body\" ]]; then\n  # Extract only the Targets section (between \"### Targets\" and \"Checked targets will be skipped\")\n  targets_section=$(echo \"$existing_body\" | sed -n '/### Targets/,/Checked targets will be skipped/p')\n  while IFS= read -r target; do\n    [[ -n \"$target\" ]] \u0026\u0026 checked_targets[\"$target\"]=1\n  done \u003c \u003c(echo \"$targets_section\" | grep -oE '^\\s*-\\s*\\[[xX]\\]\\s+\\S+' | sed 's/.*\\[[xX]\\][[:space:]]*//')\nfi\n\n# Apply preserved checked states to the new targets list.\n# For each target in the new list, check if it was marked as checked in the original.\nif [[ ${#checked_targets[@]} -gt 0 ]]; then\n  new_targets=\"\"\n  while IFS= read -r line; do\n    # Extract target name from \" - [ ] targetName\" format\n    target_name=$(echo \"$line\" | sed 's/.*\\[ \\][[:space:]]*//')\n    if [[ -n \"$target_name\" \u0026\u0026 -n \"${checked_targets[$target_name]+x}\" ]]; then\n      # This target was checked in the original, preserve that state\n      line=$(echo \"$line\" | sed 's/\\[ \\]/[x]/')\n    fi\n    new_targets+=\"${line}\"$'\\n'\n  done \u003c\u003c\u003c \"$TARGETS\"\n  # Remove trailing newline\n  TARGETS=\"${new_targets%$'\\n'}\"\nfi\n\n# Build changelog section if available\nif [[ -n \"$CHANGELOG\" ]]; then\n  CHANGELOG_SECTION=\"\n---\n\n\u003cdetails open\u003e\n\u003csummary\u003e📋 Changelog\u003c/summary\u003e\n\n${CHANGELOG}\n\n\u003c/details\u003e\"\nelse\n  CHANGELOG_SECTION=\"\"\nfi\n\nbody=\"Requested by: @${GITHUB_ACTOR}\n\nMerge target: ${MERGE_TARGET}\n\nQuick links:\n- [View changes](https://github.com/${GITHUB_REPOSITORY}/compare/${RELEASE_PREVIOUS_TAG}...${RELEASE_BRANCH})\n- [View check runs](https://github.com/${GITHUB_REPOSITORY}/commit/${RELEASE_SHA}/checks/)\n\nAssign the **accepted** label to this issue to approve the release.\n\n### Targets\n\n${TARGETS}\n\nChecked targets will be skipped (either already published or user-requested skip). Uncheck to retry a target.\n${CHANGELOG_SECTION}\"\n\nif [[ -n \"$existing_issue_number\" ]]; then\n  # Try to update existing issue with fresh body (preserving checked target states)\n  # This may fail if the token doesn't have permission to update issues in the publish repo\n  if gh issue edit \"$existing_issue_number\" -R \"$PUBLISH_REPO\" --body \"$body\" 2\u003e/dev/null; then\n    echo \"::notice::Updated existing publish request: ${existing_issue_url}\"\n  else\n    echo \"::warning::Could not update existing issue (permission denied). Using existing issue as-is.\"\n  fi\n  echo \"issue_url=${existing_issue_url}\" \u003e\u003e \"$GITHUB_OUTPUT\"\nelse\n  # Create new issue\n  issue_url=$(gh issue create -R \"$PUBLISH_REPO\" --title \"$title\" --body \"$body\")\n  echo \"::notice::Created publish request: ${issue_url}\"\n  echo \"issue_url=${issue_url}\" \u003e\u003e \"$GITHUB_OUTPUT\"\nfi\n"}]},"default_branch":"master","path":null},"repo_metadata":{"id":39850948,"uuid":"137485248","full_name":"getsentry/craft","owner":"getsentry","description":"The universal Sentry release CLI  🚀","archived":false,"fork":false,"pushed_at":"2026-02-17T21:42:45.000Z","size":7978,"stargazers_count":168,"open_issues_count":28,"forks_count":18,"subscribers_count":47,"default_branch":"master","last_synced_at":"2026-02-18T03:38:46.556Z","etag":null,"topics":["cli","craft","google-cloud-storage","npm","nuget","packaging","pypi","release-automation","rust-crate","sentry","sentry-release-registry","tag-production","typescript"],"latest_commit_sha":null,"homepage":"https://getsentry.github.io/craft/","language":"TypeScript","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/getsentry.png","metadata":{"funding":{"custom":["https://sentry.io/pricing/","https://sentry.io/"]},"files":{"readme":"README.md","changelog":"CHANGELOG.md","contributing":"CONTRIBUTING.md","funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":"AGENTS.md","dco":null,"cla":null}},"created_at":"2018-06-15T12:30:25.000Z","updated_at":"2026-02-17T21:41:53.000Z","dependencies_parsed_at":"2026-02-11T21:03:12.182Z","dependency_job_id":null,"html_url":"https://github.com/getsentry/craft","commit_stats":{"total_commits":787,"total_committers":33,"mean_commits":"23.848484848484848","dds":0.6416772554002541,"last_synced_commit":"3a136a5dbd40e9b2e7fe7ae7799cfbf71784108e"},"previous_names":[],"tags_count":214,"template":false,"template_full_name":null,"purl":"pkg:github/getsentry/craft","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getsentry%2Fcraft","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getsentry%2Fcraft/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getsentry%2Fcraft/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getsentry%2Fcraft/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/getsentry","download_url":"https://codeload.github.com/getsentry/craft/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getsentry%2Fcraft/sbom","scorecard":{"id":424586,"data":{"date":"2025-08-11","repo":{"name":"github.com/getsentry/craft","commit":"1397609d89066eeff0a818aac448f1e0ec5a855e"},"scorecard":{"version":"v5.2.1-40-gf6ed084d","commit":"f6ed084d17c9236477efd66e5b258b9d4cc7b389"},"score":6.3,"checks":[{"name":"Code-Review","score":3,"reason":"Found 9/27 approved changesets -- score normalized to 3","details":null,"documentation":{"short":"Determines if the project requires human code review before pull requests (aka merge requests) are merged.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#code-review"}},{"name":"Token-Permissions","score":7,"reason":"detected GitHub workflow tokens with excessive permissions","details":["Info: jobLevel 'contents' permission set to 'read': .github/workflows/build.yml:13","Info: jobLevel 'contents' permission set to 'read': .github/workflows/build.yml:39","Info: jobLevel 'contents' permission set to 'read': .github/workflows/enforce-license-compliance.yml:13","Info: jobLevel 'contents' permission set to 'read': .github/workflows/image.yml:12","Info: jobLevel 'contents' permission set to 'read': .github/workflows/lint.yml:11","Warn: jobLevel 'contents' permission set to 'write': .github/workflows/release.yml:16","Warn: no topLevel permission defined: .github/workflows/build.yml:1","Warn: no topLevel permission defined: .github/workflows/enforce-license-compliance.yml:1","Warn: no topLevel permission defined: .github/workflows/image.yml:1","Warn: no topLevel permission defined: .github/workflows/lint.yml:1","Warn: no topLevel permission defined: .github/workflows/release.yml:1"],"documentation":{"short":"Determines if the project's workflows follow the principle of least privilege.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#token-permissions"}},{"name":"Dangerous-Workflow","score":10,"reason":"no dangerous workflow patterns detected","details":null,"documentation":{"short":"Determines if the project's GitHub Action workflows avoid dangerous patterns.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#dangerous-workflow"}},{"name":"Maintained","score":10,"reason":"25 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10","details":null,"documentation":{"short":"Determines if the project is \"actively maintained\".","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#maintained"}},{"name":"Binary-Artifacts","score":10,"reason":"no binaries found in the repo","details":null,"documentation":{"short":"Determines if the project has generated executable (binary) artifacts in the source repository.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#binary-artifacts"}},{"name":"CII-Best-Practices","score":0,"reason":"no effort to earn an OpenSSF best practices badge detected","details":null,"documentation":{"short":"Determines if the project has an OpenSSF (formerly CII) Best Practices Badge.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#cii-best-practices"}},{"name":"License","score":10,"reason":"license file detected","details":["Info: project has a license file: LICENSE:0","Info: FSF or OSI recognized license: MIT License: LICENSE:0"],"documentation":{"short":"Determines if the project has defined a license.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#license"}},{"name":"Fuzzing","score":0,"reason":"project is not fuzzed","details":["Warn: no fuzzer integrations found"],"documentation":{"short":"Determines if the project uses fuzzing.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#fuzzing"}},{"name":"Pinned-Dependencies","score":5,"reason":"dependency not pinned by hash detected -- score normalized to 5","details":["Warn: containerImage not pinned by hash: Dockerfile:1","Warn: containerImage not pinned by hash: Dockerfile:18: pin your Docker image by updating node:22-bookworm to node:22-bookworm@sha256:3266bc9e8bee1acc8a77386eefaf574987d2729b8c5ec35b0dbd6ddbc40b0ce2","Warn: pipCommand not pinned by hash: Dockerfile:49","Warn: downloadThenRun not pinned by hash: Dockerfile:51-88","Info:  13 out of  13 GitHub-owned GitHubAction dependencies pinned","Info:   2 out of   2 third-party GitHubAction dependencies pinned","Info:   0 out of   1 pipCommand dependencies pinned","Info:   0 out of   1 downloadThenRun dependencies pinned","Info:   0 out of   2 containerImage dependencies pinned"],"documentation":{"short":"Determines if the project has declared and pinned the dependencies of its build process.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#pinned-dependencies"}},{"name":"Signed-Releases","score":0,"reason":"Project has not signed or included provenance with any releases.","details":["Warn: release artifact 2.9.1 not signed: https://api.github.com/repos/getsentry/craft/releases/235767617","Warn: release artifact 2.9.0 not signed: https://api.github.com/repos/getsentry/craft/releases/234174029","Warn: release artifact 2.8.0 not signed: https://api.github.com/repos/getsentry/craft/releases/229773583","Warn: release artifact 2.7.2 not signed: https://api.github.com/repos/getsentry/craft/releases/228763580","Warn: release artifact 2.7.1 not signed: https://api.github.com/repos/getsentry/craft/releases/224849748","Warn: release artifact 2.9.1 does not have provenance: https://api.github.com/repos/getsentry/craft/releases/235767617","Warn: release artifact 2.9.0 does not have provenance: https://api.github.com/repos/getsentry/craft/releases/234174029","Warn: release artifact 2.8.0 does not have provenance: https://api.github.com/repos/getsentry/craft/releases/229773583","Warn: release artifact 2.7.2 does not have provenance: https://api.github.com/repos/getsentry/craft/releases/228763580","Warn: release artifact 2.7.1 does not have provenance: https://api.github.com/repos/getsentry/craft/releases/224849748"],"documentation":{"short":"Determines if the project cryptographically signs release artifacts.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#signed-releases"}},{"name":"Security-Policy","score":10,"reason":"security policy file detected","details":["Info: security policy file detected: github.com/getsentry/.github/SECURITY.md:1","Info: Found linked content: github.com/getsentry/.github/SECURITY.md:1","Info: Found disclosure, vulnerability, and/or timelines in security policy: github.com/getsentry/.github/SECURITY.md:1","Info: Found text in security policy: github.com/getsentry/.github/SECURITY.md:1"],"documentation":{"short":"Determines if the project has published a security policy.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#security-policy"}},{"name":"Branch-Protection","score":4,"reason":"branch protection is not maximal on development and all release branches","details":["Info: 'allow deletion' disabled on branch 'master'","Info: 'force pushes' disabled on branch 'master'","Warn: 'branch protection settings apply to administrators' is disabled on branch 'master'","Warn: 'stale review dismissal' is disabled on branch 'master'","Warn: required approving review count is 1 on branch 'master'","Warn: codeowners review is not required on branch 'master'","Warn: 'last push approval' is disabled on branch 'master'","Warn: 'up-to-date branches' is disabled on branch 'master'","Info: status check found to merge onto on branch 'master'","Info: PRs are required in order to make changes on branch 'master'"],"documentation":{"short":"Determines if the default and release branches are protected with GitHub's branch protection settings.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#branch-protection"}},{"name":"Packaging","score":10,"reason":"packaging workflow detected","details":["Info: Project packages its releases by way of GitHub Actions.: .github/workflows/image.yml:9"],"documentation":{"short":"Determines if the project is published as a package that others can easily download, install, easily update, and uninstall.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#packaging"}},{"name":"Vulnerabilities","score":4,"reason":"6 existing vulnerabilities detected","details":["Warn: Project is vulnerable to: GHSA-968p-4wvh-cqc8","Warn: Project is vulnerable to: GHSA-h5c3-5r3r-rr8q","Warn: Project is vulnerable to: GHSA-rmvr-2pp2-xj38","Warn: Project is vulnerable to: GHSA-xx4v-prfh-6cgc","Warn: Project is vulnerable to: GHSA-v6h2-p8h4-qcjw","Warn: Project is vulnerable to: GHSA-pxg6-pf52-xh8x"],"documentation":{"short":"Determines if the project has open, known unfixed vulnerabilities.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#vulnerabilities"}},{"name":"SAST","score":9,"reason":"SAST tool is not run on all commits -- score normalized to 9","details":["Warn: 11 commits out of 12 are checked with a SAST tool"],"documentation":{"short":"Determines if the project uses static code analysis.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#sast"}}]},"last_synced_at":"2025-08-19T01:58:13.257Z","repository_id":39850948,"created_at":"2025-08-19T01:58:13.258Z","updated_at":"2025-08-19T01:58:13.258Z"},"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":29669956,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-02-21T00:11:43.526Z","status":"ssl_error","status_checked_at":"2026-02-20T23:52:33.807Z","response_time":59,"last_error":"SSL_connect returned=1 errno=0 peeraddr=140.82.121.5:443 state=error: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"repo_metadata_updated_at":"2026-02-21T01:17:21.155Z","dependent_packages_count":0,"downloads":null,"downloads_period":null,"dependent_repos_count":0,"rankings":{"downloads":null,"dependent_repos_count":43.38183053779384,"dependent_packages_count":0.0,"stargazers_count":1.8869672637430512,"forks_count":4.64484249536751,"docker_downloads_count":null,"average":12.4784100742261},"purl":"pkg:githubactions/getsentry/craft","advisories":[],"docker_usage_url":"https://docker.ecosyste.ms/usage/actions/getsentry/craft","docker_dependents_count":null,"docker_downloads_count":null,"usage_url":"https://repos.ecosyste.ms/usage/actions/getsentry/craft","dependent_repositories_url":"https://repos.ecosyste.ms/api/v1/usage/actions/getsentry/craft/dependencies","status":null,"funding_links":["https://sentry.io/pricing/","https://sentry.io/"],"critical":null,"issue_metadata":null,"versions_url":"https://packages.ecosyste.ms/api/v1/registries/github%20actions/packages/getsentry%2Fcraft/versions","version_numbers_url":"https://packages.ecosyste.ms/api/v1/registries/github%20actions/packages/getsentry%2Fcraft/version_numbers","dependent_packages_url":"https://packages.ecosyste.ms/api/v1/registries/github%20actions/packages/getsentry%2Fcraft/dependent_packages","related_packages_url":"https://packages.ecosyste.ms/api/v1/registries/github%20actions/packages/getsentry%2Fcraft/related_packages","codemeta_url":"https://packages.ecosyste.ms/api/v1/registries/github%20actions/packages/getsentry%2Fcraft/codemeta","maintainers":[]}