step-security/docker-build-push-action

step-security/docker-build-push-action

Secure drop-in replacement for docker/build-push-action

GitHub Action to build and push Docker images with Buildx.

GitHubGitHub Repository

0 star

Node.js

Node Action

Maintained by StepSecurity

Score updated 1 hour ago

GitHub Actions security score comparison

step-security/docker-build-push-actiondocker/build-push-action

Score

10/10

8/10

License

Apache License 2.0Apache License 2.0

Maintained

Maintained by StepSecurity10 commit(s) and 7 issue activity found in the last 90 days -- score normalized to 10

Vulnerabilities

3 existing vulnerabilities detected

16 existing vulnerabilities detected

Branch protection

Branch protection is maximal on development and all release branches

branch protection is not maximal on development and all release branches

Manual code review

Upstream changes are reviewed before merging-

Secure publishing

Reproducible builds with SBOM and provenance-

Signed commits

All commits are signed-

Automated security tools

Findings from tools are triaged and fixed before each change-

Popular

Used by StepSecurity enterprise customersUsed by 40496 open-source projects

Security Policy

security policy file detectedsecurity policy file detected

Networking Behavior of step-security/docker-build-push-action

This GitHub Action often makes outbound network calls to these destinations, as gathered from public workflows using the Harden-Runner GitHub Action. Harden-Runner offers network egress filtering and runtime security for both GitHub-hosted and self-hosted runners.

Popular DestinationUnknown Destination
Network DestinationOwner
registry-1.docker.ioDockerHubDockerHub
auth.docker.ioDockerHubDockerHub
production.cloudflare.docker.comDockerHubDockerHub
ghcr.ioGitHubGitHub
gcr.ioUnknown
static.rust-lang.orgUnknown
index.crates.ioUnknown
static.crates.ioUnknown
debian.map.fastlydns.netUnknown
_http._tcp.deb.debian.orgUnknown
registry.npmjs.orgnpm Registrynpm Registry
pkg-containers.githubusercontent.comGitHubGitHub
security.ubuntu.comUbuntuUbuntu
archive.ubuntu.comUbuntuUbuntu
ports.ubuntu.comUbuntuUbuntu
_http._tcp.archive.ubuntu.comUbuntuUbuntu
_http._tcp.security.ubuntu.comUbuntuUbuntu
_http._tcp.ports.ubuntu.comUbuntuUbuntu
github.comGitHubGitHub
release-assets.githubusercontent.comGitHubGitHub
files.pythonhosted.orgPython RegistryPython Registry