step-security/sonarqube-scan-action

step-security/sonarqube-scan-action

Secure drop-in replacement for sonarsource/sonarqube-scan-action

GitHubGitHub Repository

0 stars

Node.js

Node Action

Maintained by StepSecurity

Score updated 4 days ago

GitHub Actions security score comparison

step-security/sonarqube-scan-actionsonarsource/sonarqube-scan-action

Score

10/10

7/10

Pinnable

YesYes

License

GNU Lesser General Public License v3.0GNU Lesser General Public License v3.0

Maintained

Maintained by StepSecurity5 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 4

Vulnerabilities

0 existing vulnerabilities detected

7 existing vulnerabilities detected

Branch protection

Branch protection is maximal on development and all release branches

branch protection is not maximal on development and all release branches

AI analysis

3 Security findings

Manual code review

Upstream changes are reviewed before merging-

Secure publishing

Reproducible builds with SBOM and provenance-

Signed commits

All commits are signed-

Automated security tools

Findings from tools are triaged and fixed before each change-

Popular

Used by StepSecurity enterprise customersUsed by 17312 open-source projects

Security Policy

security policy file detectedsecurity policy file detected

Networking Behavior of step-security/sonarqube-scan-action

This GitHub Action often makes outbound network calls to these destinations, as gathered from public workflows using the Harden-Runner GitHub Action. Harden-Runner offers network egress filtering and runtime security for both GitHub-hosted and self-hosted runners.

Popular DestinationUnknown Destination
Network DestinationOwner
binaries.sonarsource.comUnknown
keyserver.ubuntu.comUbuntuUbuntu
api.sonarcloud.ioSonarSonar
scanner.sonarcloud.ioSonarSonar
sonarcloud.ioSonarSonar
_pgpkey-https._tcp.keyserver.ubuntu.comUbuntuUbuntu