{"id":3560476,"name":"github.com/ibuildthecloud/k3s","ecosystem":"go","description":"","homepage":"https://github.com/ibuildthecloud/k3s","licenses":"Apache-2.0","normalized_licenses":["Apache-2.0"],"repository_url":"https://github.com/ibuildthecloud/k3s","keywords_array":[],"namespace":"github.com/ibuildthecloud","versions_count":128,"first_release_published_at":"2019-01-22T21:20:29.000Z","latest_release_published_at":"2019-12-18T05:54:31.000Z","latest_release_number":"v1.0.1","last_synced_at":"2026-08-07T21:30:52.531Z","created_at":"2022-04-11T01:58:15.890Z","updated_at":"2026-08-31T23:39:03.100Z","registry_url":"https://pkg.go.dev/github.com/ibuildthecloud/k3s","install_command":"go get github.com/ibuildthecloud/k3s","documentation_url":"https://pkg.go.dev/github.com/ibuildthecloud/k3s#section-documentation","metadata":{},"repo_metadata":{"id":37029216,"uuid":"135516270","full_name":"k3s-io/k3s","owner":"k3s-io","description":"Lightweight Kubernetes","archived":false,"fork":false,"pushed_at":"2026-08-22T18:13:00.000Z","size":591270,"stargazers_count":33792,"open_issues_count":71,"forks_count":2709,"subscribers_count":289,"default_branch":"main","last_synced_at":"2026-08-23T22:30:19.815Z","etag":null,"topics":["k8s","kubernetes"],"latest_commit_sha":null,"homepage":"https://k3s.io","language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/k3s-io.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":"CONTRIBUTING.md","funding":null,"license":"LICENSE","code_of_conduct":"CODE_OF_CONDUCT.md","threat_model":null,"audit":null,"citation":null,"codeowners":"CODEOWNERS","security":".github/SECURITY.md","support":null,"governance":"GOVERNANCE.md","roadmap":"ROADMAP.md","authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":"MAINTAINERS","copyright":null,"agents":null,"claude":null,"gemini":null,"cursor":null,"copilot":null,"dco":"DCO","cla":null,"disclosure":null}},"created_at":"2018-05-31T01:37:46.000Z","updated_at":"2026-08-23T18:27:23.000Z","dependencies_parsed_at":"2026-08-23T22:31:20.551Z","dependency_job_id":"a43d24f7-2d83-4cb1-9b8d-fb9936e76be7","html_url":"https://github.com/k3s-io/k3s","commit_stats":{"total_commits":2031,"total_committers":215,"mean_commits":9.446511627906977,"dds":0.7833579517479075,"last_synced_commit":"f076080b2b5320446cb18f2ea6884be6c4f7780c"},"previous_names":["rancher/k3s","ibuildthecloud/k3s"],"tags_count":1087,"template":false,"template_full_name":null,"purl":"pkg:github/k3s-io/k3s","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/k3s-io%2Fk3s","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/k3s-io%2Fk3s/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/k3s-io%2Fk3s/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/k3s-io%2Fk3s/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/k3s-io","download_url":"https://codeload.github.com/k3s-io/k3s/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/k3s-io%2Fk3s/sbom","scorecard":{"id":546449,"data":{"date":"2025-08-15T12:38:29Z","repo":{"name":"github.com/k3s-io/k3s","commit":"e7dd3b7e7e4df0eb2da8ba31d331e95899650165"},"scorecard":{"version":"v5.2.1","commit":"ab2f6e92482462fe66246d9e32f642855a691dc1"},"score":8.2,"checks":[{"name":"Code-Review","score":10,"reason":"all changesets reviewed","details":null,"documentation":{"short":"Determines if the project requires human code review before pull requests (aka merge requests) are merged.","url":"https://github.com/ossf/scorecard/blob/ab2f6e92482462fe66246d9e32f642855a691dc1/docs/checks.md#code-review"}},{"name":"Dependency-Update-Tool","score":10,"reason":"update tool detected","details":["Info: detected update tool: Dependabot: .github/dependabot.yml:1"],"documentation":{"short":"Determines if the project uses a dependency update tool.","url":"https://github.com/ossf/scorecard/blob/ab2f6e92482462fe66246d9e32f642855a691dc1/docs/checks.md#dependency-update-tool"}},{"name":"Maintained","score":10,"reason":"30 commit(s) and 23 issue activity found in the last 90 days -- score normalized to 10","details":null,"documentation":{"short":"Determines if the project is \"actively maintained\".","url":"https://github.com/ossf/scorecard/blob/ab2f6e92482462fe66246d9e32f642855a691dc1/docs/checks.md#maintained"}},{"name":"Security-Policy","score":10,"reason":"security policy file detected","details":["Info: security policy file detected: .github/SECURITY.md:1","Info: Found linked content: .github/SECURITY.md:1","Info: Found disclosure, vulnerability, and/or timelines in security policy: .github/SECURITY.md:1","Info: Found text in security policy: .github/SECURITY.md:1"],"documentation":{"short":"Determines if the project has published a security policy.","url":"https://github.com/ossf/scorecard/blob/ab2f6e92482462fe66246d9e32f642855a691dc1/docs/checks.md#security-policy"}},{"name":"Dangerous-Workflow","score":10,"reason":"no dangerous workflow patterns detected","details":null,"documentation":{"short":"Determines if the project's GitHub Action workflows avoid dangerous patterns.","url":"https://github.com/ossf/scorecard/blob/ab2f6e92482462fe66246d9e32f642855a691dc1/docs/checks.md#dangerous-workflow"}},{"name":"Binary-Artifacts","score":10,"reason":"no binaries found in the repo","details":null,"documentation":{"short":"Determines if the project has generated executable (binary) artifacts in the source repository.","url":"https://github.com/ossf/scorecard/blob/ab2f6e92482462fe66246d9e32f642855a691dc1/docs/checks.md#binary-artifacts"}},{"name":"Token-Permissions","score":10,"reason":"GitHub workflow tokens follow principle of least privilege","details":["Info: jobLevel 'contents' permission set to 'read': .github/workflows/e2e.yaml:33","Warn: jobLevel 'packages' permission set to 'write': .github/workflows/e2e.yaml:34","Info: jobLevel 'contents' permission set to 'read': .github/workflows/e2e.yaml:41","Warn: jobLevel 'packages' permission set to 'write': .github/workflows/e2e.yaml:42","Warn: jobLevel 'contents' permission set to 'write': .github/workflows/release.yml:107","Warn: jobLevel 'contents' permission set to 'write': .github/workflows/release.yml:158","Warn: jobLevel 'contents' permission set to 'write': .github/workflows/stale.yml:13","Warn: jobLevel 'contents' permission set to 'write': .github/workflows/trivy-scan.yml:17","Warn: jobLevel 'contents' permission set to 'write': .github/workflows/updatecli.yaml:17","Info: topLevel 'contents' permission set to 'read': .github/workflows/build-k3s.yaml:24","Info: topLevel 'contents' permission set to 'read': .github/workflows/codeql.yml:9","Info: topLevel 'contents' permission set to 'read': .github/workflows/e2e.yaml:28","Info: topLevel 'contents' permission set to 'read': .github/workflows/epic.yaml:7","Info: topLevel permissions set to 'read-all': .github/workflows/govulncheck.yml:10","Info: topLevel 'contents' permission set to 'read': .github/workflows/install.yaml:20","Info: topLevel 'contents' permission set to 'read': .github/workflows/integration.yaml:26","Info: topLevel 'contents' permission set to 'read': .github/workflows/nightly-install.yaml:8","Info: topLevel 'contents' permission set to 'read': .github/workflows/release.yml:8","Info: topLevel 'packages' permission set to 'read': .github/workflows/release.yml:9","Info: topLevel permissions set to 'read-all': .github/workflows/scorecard.yml:18","Info: topLevel 'contents' permission set to 'read': .github/workflows/stale.yml:7","Info: topLevel 'contents' permission set to 'read': .github/workflows/trivy-scan.yml:10","Info: topLevel 'contents' permission set to 'read': .github/workflows/trivy-trigger.yml:14","Info: topLevel 'contents' permission set to 'read': .github/workflows/unitcoverage.yaml:26","Info: topLevel 'contents' permission set to 'read': .github/workflows/updatecli.yaml:11"],"documentation":{"short":"Determines if the project's workflows follow the principle of least privilege.","url":"https://github.com/ossf/scorecard/blob/ab2f6e92482462fe66246d9e32f642855a691dc1/docs/checks.md#token-permissions"}},{"name":"CII-Best-Practices","score":5,"reason":"badge detected: Passing","details":null,"documentation":{"short":"Determines if the project has an OpenSSF (formerly CII) Best Practices Badge.","url":"https://github.com/ossf/scorecard/blob/ab2f6e92482462fe66246d9e32f642855a691dc1/docs/checks.md#cii-best-practices"}},{"name":"SAST","score":7,"reason":"SAST tool detected but not run on all commits","details":["Info: SAST configuration detected: CodeQL","Warn: 0 commits out of 30 are checked with a SAST tool"],"documentation":{"short":"Determines if the project uses static code analysis.","url":"https://github.com/ossf/scorecard/blob/ab2f6e92482462fe66246d9e32f642855a691dc1/docs/checks.md#sast"}},{"name":"License","score":10,"reason":"license file detected","details":["Info: project has a license file: LICENSE:0","Info: FSF or OSI recognized license: Apache License 2.0: LICENSE:0"],"documentation":{"short":"Determines if the project has defined a license.","url":"https://github.com/ossf/scorecard/blob/ab2f6e92482462fe66246d9e32f642855a691dc1/docs/checks.md#license"}},{"name":"Signed-Releases","score":0,"reason":"Project has not signed or included provenance with any releases.","details":["Warn: release artifact v1.33.4-rc1+k3s1 not signed: https://api.github.com/repos/k3s-io/k3s/releases/240102814","Warn: release artifact v1.32.8-rc1+k3s1 not signed: https://api.github.com/repos/k3s-io/k3s/releases/240102847","Warn: release artifact v1.31.12-rc1+k3s1 not signed: https://api.github.com/repos/k3s-io/k3s/releases/240102863","Warn: release artifact v1.30.14+k3s2 not signed: https://api.github.com/repos/k3s-io/k3s/releases/235337356","Warn: release artifact v1.30.14-rc1+k3s2 not signed: https://api.github.com/repos/k3s-io/k3s/releases/234008425","Warn: release artifact v1.33.4-rc1+k3s1 does not have provenance: https://api.github.com/repos/k3s-io/k3s/releases/240102814","Warn: release artifact v1.32.8-rc1+k3s1 does not have provenance: https://api.github.com/repos/k3s-io/k3s/releases/240102847","Warn: release artifact v1.31.12-rc1+k3s1 does not have provenance: https://api.github.com/repos/k3s-io/k3s/releases/240102863","Warn: release artifact v1.30.14+k3s2 does not have provenance: https://api.github.com/repos/k3s-io/k3s/releases/235337356","Warn: release artifact v1.30.14-rc1+k3s2 does not have provenance: https://api.github.com/repos/k3s-io/k3s/releases/234008425"],"documentation":{"short":"Determines if the project cryptographically signs release artifacts.","url":"https://github.com/ossf/scorecard/blob/ab2f6e92482462fe66246d9e32f642855a691dc1/docs/checks.md#signed-releases"}},{"name":"Pinned-Dependencies","score":0,"reason":"dependency not pinned by hash detected -- score normalized to 0","details":["Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build-k3s.yaml:37: update your workflow using https://app.stepsecurity.io/secureworkflow/k3s-io/k3s/build-k3s.yaml/master?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/build-k3s.yaml:41: update your workflow using https://app.stepsecurity.io/secureworkflow/k3s-io/k3s/build-k3s.yaml/master?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/build-k3s.yaml:46: update your workflow using https://app.stepsecurity.io/secureworkflow/k3s-io/k3s/build-k3s.yaml/master?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/build-k3s.yaml:63: update your workflow using https://app.stepsecurity.io/secureworkflow/k3s-io/k3s/build-k3s.yaml/master?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/build-k3s.yaml:84: update your workflow using https://app.stepsecurity.io/secureworkflow/k3s-io/k3s/build-k3s.yaml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build-k3s.yaml:123: update your workflow using https://app.stepsecurity.io/secureworkflow/k3s-io/k3s/build-k3s.yaml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/codeql.yml:29: update your workflow using https://app.stepsecurity.io/secureworkflow/k3s-io/k3s/codeql.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/codeql.yml:33: update your workflow using https://app.stepsecurity.io/secureworkflow/k3s-io/k3s/codeql.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/codeql.yml:47: update your workflow using https://app.stepsecurity.io/secureworkflow/k3s-io/k3s/codeql.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/e2e.yaml:58: update your workflow using https://app.stepsecurity.io/secureworkflow/k3s-io/k3s/e2e.yaml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/e2e.yaml:65: update your workflow using https://app.stepsecurity.io/secureworkflow/k3s-io/k3s/e2e.yaml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/e2e.yaml:72: update your workflow using https://app.stepsecurity.io/secureworkflow/k3s-io/k3s/e2e.yaml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/e2e.yaml:86: update your workflow using https://app.stepsecurity.io/secureworkflow/k3s-io/k3s/e2e.yaml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/e2e.yaml:99: update your workflow using https://app.stepsecurity.io/secureworkflow/k3s-io/k3s/e2e.yaml/master?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/e2e.yaml:106: update your workflow using https://app.stepsecurity.io/secureworkflow/k3s-io/k3s/e2e.yaml/master?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/e2e.yaml:112: update your workflow using https://app.stepsecurity.io/secureworkflow/k3s-io/k3s/e2e.yaml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/e2e.yaml:129: update your workflow using https://app.stepsecurity.io/secureworkflow/k3s-io/k3s/e2e.yaml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/e2e.yaml:137: update your workflow using https://app.stepsecurity.io/secureworkflow/k3s-io/k3s/e2e.yaml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/e2e.yaml:182: update your workflow using https://app.stepsecurity.io/secureworkflow/k3s-io/k3s/e2e.yaml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/e2e.yaml:184: update your workflow using https://app.stepsecurity.io/secureworkflow/k3s-io/k3s/e2e.yaml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/e2e.yaml:198: update your workflow using https://app.stepsecurity.io/secureworkflow/k3s-io/k3s/e2e.yaml/master?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/epic.yaml:17: update your workflow using https://app.stepsecurity.io/secureworkflow/k3s-io/k3s/epic.yaml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/govulncheck.yml:18: update your workflow using https://app.stepsecurity.io/secureworkflow/k3s-io/k3s/govulncheck.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/install.yaml:42: update your workflow using https://app.stepsecurity.io/secureworkflow/k3s-io/k3s/install.yaml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/install.yaml:47: update your workflow using https://app.stepsecurity.io/secureworkflow/k3s-io/k3s/install.yaml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/install.yaml:55: update your workflow using https://app.stepsecurity.io/secureworkflow/k3s-io/k3s/install.yaml/master?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/install.yaml:103: update your workflow using https://app.stepsecurity.io/secureworkflow/k3s-io/k3s/install.yaml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/integration.yaml:52: update your workflow using https://app.stepsecurity.io/secureworkflow/k3s-io/k3s/integration.yaml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/integration.yaml:58: update your workflow using https://app.stepsecurity.io/secureworkflow/k3s-io/k3s/integration.yaml/master?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/integration.yaml:68: update your workflow using https://app.stepsecurity.io/secureworkflow/k3s-io/k3s/integration.yaml/master?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/integration.yaml:76: update your workflow using https://app.stepsecurity.io/secureworkflow/k3s-io/k3s/integration.yaml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/integration.yaml:91: update your workflow using https://app.stepsecurity.io/secureworkflow/k3s-io/k3s/integration.yaml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/integration.yaml:96: update your workflow using https://app.stepsecurity.io/secureworkflow/k3s-io/k3s/integration.yaml/master?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/integration.yaml:123: update your workflow using https://app.stepsecurity.io/secureworkflow/k3s-io/k3s/integration.yaml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/nightly-install.yaml:28: update your workflow using https://app.stepsecurity.io/secureworkflow/k3s-io/k3s/nightly-install.yaml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/nightly-install.yaml:33: update your workflow using https://app.stepsecurity.io/secureworkflow/k3s-io/k3s/nightly-install.yaml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release.yml:163: update your workflow using https://app.stepsecurity.io/secureworkflow/k3s-io/k3s/release.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release.yml:166: update your workflow using https://app.stepsecurity.io/secureworkflow/k3s-io/k3s/release.yml/master?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/release.yml:188: update your workflow using https://app.stepsecurity.io/secureworkflow/k3s-io/k3s/release.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release.yml:40: update your workflow using https://app.stepsecurity.io/secureworkflow/k3s-io/k3s/release.yml/master?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/release.yml:43: update your workflow using https://app.stepsecurity.io/secureworkflow/k3s-io/k3s/release.yml/master?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/release.yml:46: update your workflow using https://app.stepsecurity.io/secureworkflow/k3s-io/k3s/release.yml/master?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/release.yml:72: update your workflow using https://app.stepsecurity.io/secureworkflow/k3s-io/k3s/release.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release.yml:80: update your workflow using https://app.stepsecurity.io/secureworkflow/k3s-io/k3s/release.yml/master?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/release.yml:92: update your workflow using https://app.stepsecurity.io/secureworkflow/k3s-io/k3s/release.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release.yml:114: update your workflow using https://app.stepsecurity.io/secureworkflow/k3s-io/k3s/release.yml/master?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/release.yml:117: update your workflow using https://app.stepsecurity.io/secureworkflow/k3s-io/k3s/release.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release.yml:131: update your workflow using https://app.stepsecurity.io/secureworkflow/k3s-io/k3s/release.yml/master?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/release.yml:137: update your workflow using https://app.stepsecurity.io/secureworkflow/k3s-io/k3s/release.yml/master?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/release.yml:148: update your workflow using https://app.stepsecurity.io/secureworkflow/k3s-io/k3s/release.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/scorecard.yml:77: update your workflow using https://app.stepsecurity.io/secureworkflow/k3s-io/k3s/scorecard.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/stale.yml:16: update your workflow using https://app.stepsecurity.io/secureworkflow/k3s-io/k3s/stale.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/trivy-scan.yml:25: update your workflow using https://app.stepsecurity.io/secureworkflow/k3s-io/k3s/trivy-scan.yml/master?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/trivy-scan.yml:61: update your workflow using https://app.stepsecurity.io/secureworkflow/k3s-io/k3s/trivy-scan.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/trivy-scan.yml:72: update your workflow using https://app.stepsecurity.io/secureworkflow/k3s-io/k3s/trivy-scan.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/trivy-scan.yml:88: update your workflow using https://app.stepsecurity.io/secureworkflow/k3s-io/k3s/trivy-scan.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/trivy-trigger.yml:22: update your workflow using https://app.stepsecurity.io/secureworkflow/k3s-io/k3s/trivy-trigger.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/trivy-trigger.yml:49: update your workflow using https://app.stepsecurity.io/secureworkflow/k3s-io/k3s/trivy-trigger.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/trivy-trigger.yml:64: update your workflow using https://app.stepsecurity.io/secureworkflow/k3s-io/k3s/trivy-trigger.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/unitcoverage.yaml:85: update your workflow using https://app.stepsecurity.io/secureworkflow/k3s-io/k3s/unitcoverage.yaml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/unitcoverage.yaml:35: update your workflow using https://app.stepsecurity.io/secureworkflow/k3s-io/k3s/unitcoverage.yaml/master?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/unitcoverage.yaml:46: update your workflow using https://app.stepsecurity.io/secureworkflow/k3s-io/k3s/unitcoverage.yaml/master?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/unitcoverage.yaml:50: update your workflow using https://app.stepsecurity.io/secureworkflow/k3s-io/k3s/unitcoverage.yaml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/unitcoverage.yaml:62: update your workflow using https://app.stepsecurity.io/secureworkflow/k3s-io/k3s/unitcoverage.yaml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/unitcoverage.yaml:66: update your workflow using https://app.stepsecurity.io/secureworkflow/k3s-io/k3s/unitcoverage.yaml/master?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/unitcoverage.yaml:74: update your workflow using https://app.stepsecurity.io/secureworkflow/k3s-io/k3s/unitcoverage.yaml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/updatecli.yaml:23: update your workflow using https://app.stepsecurity.io/secureworkflow/k3s-io/k3s/updatecli.yaml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/updatecli.yaml:26: update your workflow using https://app.stepsecurity.io/secureworkflow/k3s-io/k3s/updatecli.yaml/master?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/updatecli.yaml:39: update your workflow using https://app.stepsecurity.io/secureworkflow/k3s-io/k3s/updatecli.yaml/master?enable=pin","Warn: containerImage not pinned by hash: Dockerfile.dapper:2","Warn: containerImage not pinned by hash: Dockerfile.local:2","Warn: containerImage not pinned by hash: Dockerfile.local:28","Warn: containerImage not pinned by hash: Dockerfile.local:44","Warn: containerImage not pinned by hash: Dockerfile.local:53","Warn: containerImage not pinned by hash: Dockerfile.manifest:2","Warn: containerImage not pinned by hash: Dockerfile.test:2","Warn: containerImage not pinned by hash: Dockerfile.test:10","Warn: containerImage not pinned by hash: Dockerfile.test:15","Warn: containerImage not pinned by hash: Dockerfile.test:37","Warn: containerImage not pinned by hash: package/Dockerfile:1","Warn: containerImage not pinned by hash: tests/e2e/scripts/Dockerfile:1: pin your Docker image by updating ubuntu:24.04 to ubuntu:24.04@sha256:7c06e91f61fa88c08cc74f7e1b7c69ae24910d745357e0dfe1d2c0322aaf20f9","Warn: containerImage not pinned by hash: tests/integration/Dockerfile.test:1: pin your Docker image by updating golang:buster to golang:buster@sha256:eb3f9ac805435c1b2c965d63ce460988e1000058e1f67881324746362baf9572","Warn: goCommand not pinned by hash: Dockerfile.dapper:31","Warn: downloadThenRun not pinned by hash: Dockerfile.dapper:37-39","Warn: goCommand not pinned by hash: Dockerfile.local:14","Warn: downloadThenRun not pinned by hash: Dockerfile.local:17-19","Warn: downloadThenRun not pinned by hash: tests/integration/Dockerfile.test:5-7","Warn: goCommand not pinned by hash: tests/integration/Dockerfile.test:16","Warn: goCommand not pinned by hash: tests/integration/Dockerfile.test:17","Warn: goCommand not pinned by hash: .github/workflows/govulncheck.yml:27","Info:   2 out of  47 GitHub-owned GitHubAction dependencies pinned","Info:   1 out of  25 third-party GitHubAction dependencies pinned","Info:   0 out of  13 containerImage dependencies pinned","Info:   0 out of   5 goCommand dependencies pinned","Info:   0 out of   3 downloadThenRun dependencies pinned"],"documentation":{"short":"Determines if the project has declared and pinned the dependencies of its build process.","url":"https://github.com/ossf/scorecard/blob/ab2f6e92482462fe66246d9e32f642855a691dc1/docs/checks.md#pinned-dependencies"}},{"name":"Branch-Protection","score":-1,"reason":"internal error: error during branchesHandler.setup: internal error: githubv4.Query: Resource not accessible by personal access token","details":null,"documentation":{"short":"Determines if the default and release branches are protected with GitHub's branch protection settings.","url":"https://github.com/ossf/scorecard/blob/ab2f6e92482462fe66246d9e32f642855a691dc1/docs/checks.md#branch-protection"}},{"name":"Packaging","score":10,"reason":"packaging workflow detected","details":["Info: Project packages its releases by way of GitHub Actions.: .github/workflows/release.yml:32"],"documentation":{"short":"Determines if the project is published as a package that others can easily download, install, easily update, and uninstall.","url":"https://github.com/ossf/scorecard/blob/ab2f6e92482462fe66246d9e32f642855a691dc1/docs/checks.md#packaging"}},{"name":"Vulnerabilities","score":7,"reason":"3 existing vulnerabilities detected","details":["Warn: Project is vulnerable to: GO-2025-3829 / GHSA-4vq8-7jfc-9cvp","Warn: Project is vulnerable to: GO-2024-3218","Warn: Project is vulnerable to: GO-2025-3748 / GHSA-f26w-gh5m-qq77"],"documentation":{"short":"Determines if the project has open, known unfixed vulnerabilities.","url":"https://github.com/ossf/scorecard/blob/ab2f6e92482462fe66246d9e32f642855a691dc1/docs/checks.md#vulnerabilities"}},{"name":"Fuzzing","score":10,"reason":"project is fuzzed","details":["Info: GoBuiltInFuzzer integration found: pkg/authenticator/hash/scrypt_test.go:41"],"documentation":{"short":"Determines if the project uses fuzzing.","url":"https://github.com/ossf/scorecard/blob/ab2f6e92482462fe66246d9e32f642855a691dc1/docs/checks.md#fuzzing"}},{"name":"CI-Tests","score":8,"reason":"22 out of 27 merged PRs checked by a CI test -- score normalized to 8","details":null,"documentation":{"short":"Determines if the project runs tests before pull requests are merged.","url":"https://github.com/ossf/scorecard/blob/ab2f6e92482462fe66246d9e32f642855a691dc1/docs/checks.md#ci-tests"}},{"name":"Contributors","score":10,"reason":"project has 42 contributing companies or organizations","details":["Info: found contributions from: ClangBuiltLinux, NIV-DEVELOPER, SUSE, acorn labs, acorn-io, aind-containers, anza-xyz, axiscommunications, aya-rs, cilium, containerbuilding, containerd, dwavesystems, exein-io, fiuskylab, flannel-io, go-phoenix-chandler, hobbyfarm, k3s-io, k3s-io | @rancher | suse, kubernetes, kubernetes-sigs, lima-vm, lockc-project, moby, netgroup-polito, ntt, ntt-developers, opencontainers, osrg, principal engineer at akamai, rancher, rancher @suse @k3s-io, rancherfederal, rancherlabs, reproducible-containers, rootless-containers, submariner-io, suse, suse @rancher, suse rancher labs, wordfence"],"documentation":{"short":"Determines if the project has a set of contributors from multiple organizations (e.g., companies).","url":"https://github.com/ossf/scorecard/blob/ab2f6e92482462fe66246d9e32f642855a691dc1/docs/checks.md#contributors"}}]},"last_synced_at":"2025-08-20T09:39:33.280Z","repository_id":37029216,"created_at":"2025-08-20T09:39:33.280Z","updated_at":"2025-08-20T09:39:33.280Z"},"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":37008963,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-08-22T15:14:58.755Z","status":"online","status_checked_at":"2026-08-31T02:00:07.497Z","response_time":119,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"repo_metadata_updated_at":"2026-08-31T23:39:03.099Z","dependent_packages_count":0,"downloads":null,"downloads_period":null,"dependent_repos_count":0,"rankings":{"downloads":null,"dependent_repos_count":9.345852080216646,"dependent_packages_count":6.999148183520997,"stargazers_count":null,"forks_count":null,"average":8.172500131868823},"purl":"pkg:golang/github.com/ibuildthecloud/k3s","advisories":[],"docker_usage_url":"https://docker.ecosyste.ms/usage/go/github.com/ibuildthecloud/k3s","docker_dependents_count":null,"docker_downloads_count":null,"usage_url":"https://repos.ecosyste.ms/usage/go/github.com/ibuildthecloud/k3s","dependent_repositories_url":"https://repos.ecosyste.ms/api/v1/usage/go/github.com/ibuildthecloud/k3s/dependencies","status":null,"funding_links":[],"critical":null,"issue_metadata":{"last_synced_at":"2026-08-31T14:00:18.489Z","issues_count":2127,"pull_requests_count":1992,"avg_time_to_close_issue":2867579.0736119775,"avg_time_to_close_pull_request":1009043.5474794842,"issues_closed_count":1603,"pull_requests_closed_count":1706,"pull_request_authors_count":149,"issue_authors_count":687,"avg_comments_per_issue":1.8175834508697697,"avg_comments_per_pull_request":1.2354417670682731,"merged_pull_requests_count":1470,"bot_issues_count":1,"bot_pull_requests_count":168,"past_year_issues_count":115,"past_year_pull_requests_count":103,"past_year_avg_time_to_close_issue":958037.5762711865,"past_year_avg_time_to_close_pull_request":244274.23188405798,"past_year_issues_closed_count":59,"past_year_pull_requests_closed_count":69,"past_year_pull_request_authors_count":25,"past_year_issue_authors_count":45,"past_year_avg_comments_per_issue":1.4782608695652173,"past_year_avg_comments_per_pull_request":0.9223300970873787,"past_year_bot_issues_count":0,"past_year_bot_pull_requests_count":32,"past_year_merged_pull_requests_count":54,"issues_url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/repositories/k3s-io%2Fk3s/issues","maintainers":[{"login":"brandond","count":920,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/brandond"},{"login":"dereknola","count":353,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/dereknola"},{"login":"vitorsavian","count":85,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/vitorsavian"},{"login":"brooksn","count":54,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/brooksn"},{"login":"cwayne18","count":9,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/cwayne18"},{"login":"OrlinVasilev","count":6,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/OrlinVasilev"},{"login":"Oats87","count":1,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/Oats87"},{"login":"luishidalgoa","count":1,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/luishidalgoa"},{"login":"jelipo","count":1,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/jelipo"},{"login":"macedogm","count":1,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/macedogm"}],"active_maintainers":[{"login":"brandond","count":83,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/brandond"},{"login":"dereknola","count":15,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/dereknola"},{"login":"vitorsavian","count":5,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/vitorsavian"},{"login":"brooksn","count":1,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/brooksn"}]},"versions_url":"https://packages.ecosyste.ms/api/v1/registries/proxy.golang.org/packages/github.com%2Fibuildthecloud%2Fk3s/versions","version_numbers_url":"https://packages.ecosyste.ms/api/v1/registries/proxy.golang.org/packages/github.com%2Fibuildthecloud%2Fk3s/version_numbers","latest_version_url":"https://packages.ecosyste.ms/api/v1/registries/proxy.golang.org/packages/github.com%2Fibuildthecloud%2Fk3s/latest_version","dependent_packages_url":"https://packages.ecosyste.ms/api/v1/registries/proxy.golang.org/packages/github.com%2Fibuildthecloud%2Fk3s/dependent_packages","related_packages_url":"https://packages.ecosyste.ms/api/v1/registries/proxy.golang.org/packages/github.com%2Fibuildthecloud%2Fk3s/related_packages","codemeta_url":"https://packages.ecosyste.ms/api/v1/registries/proxy.golang.org/packages/github.com%2Fibuildthecloud%2Fk3s/codemeta","maintainers":[]}