{"id":13597481,"url":"https://github.com/cdklabs/cdk-ecr-deployment","last_synced_at":"2026-04-08T09:01:11.517Z","repository":{"id":37037591,"uuid":"357544887","full_name":"cdklabs/cdk-ecr-deployment","owner":"cdklabs","description":"A CDK construct to deploy docker image to Amazon ECR","archived":false,"fork":false,"pushed_at":"2026-04-03T08:10:58.000Z","size":5128,"stargazers_count":186,"open_issues_count":14,"forks_count":36,"subscribers_count":15,"default_branch":"main","last_synced_at":"2026-04-03T14:43:28.684Z","etag":null,"topics":["aws","cdk","deployment","docker","ecr","transport"],"latest_commit_sha":null,"homepage":"","language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/cdklabs.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":"NOTICE","maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2021-04-13T12:28:33.000Z","updated_at":"2026-04-03T08:11:00.000Z","dependencies_parsed_at":"2024-02-18T01:25:32.084Z","dependency_job_id":"fead5d8b-b141-4266-a1d1-a2f2f570fa8f","html_url":"https://github.com/cdklabs/cdk-ecr-deployment","commit_stats":{"total_commits":843,"total_committers":29,"mean_commits":29.06896551724138,"dds":0.2752075919335706,"last_synced_commit":"59ee64b36e01a012caffa898a3952cabd81798ab"},"previous_names":[],"tags_count":344,"template":false,"template_full_name":null,"purl":"pkg:github/cdklabs/cdk-ecr-deployment","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/cdklabs%2Fcdk-ecr-deployment","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/cdklabs%2Fcdk-ecr-deployment/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/cdklabs%2Fcdk-ecr-deployment/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/cdklabs%2Fcdk-ecr-deployment/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/cdklabs","download_url":"https://codeload.github.com/cdklabs/cdk-ecr-deployment/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/cdklabs%2Fcdk-ecr-deployment/sbom","scorecard":{"id":269835,"data":{"date":"2025-08-11","repo":{"name":"github.com/cdklabs/cdk-ecr-deployment","commit":"42727e5d52f228622c1877a499ed3529e718ccbf"},"scorecard":{"version":"v5.2.1-40-gf6ed084d","commit":"f6ed084d17c9236477efd66e5b258b9d4cc7b389"},"score":6.1,"checks":[{"name":"Maintained","score":10,"reason":"27 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10","details":null,"documentation":{"short":"Determines if the project is \"actively maintained\".","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#maintained"}},{"name":"Code-Review","score":10,"reason":"all changesets reviewed","details":null,"documentation":{"short":"Determines if the project requires human code review before pull requests (aka merge requests) are merged.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#code-review"}},{"name":"Binary-Artifacts","score":10,"reason":"no binaries found in the repo","details":null,"documentation":{"short":"Determines if the project has generated executable (binary) artifacts in the source repository.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#binary-artifacts"}},{"name":"Dangerous-Workflow","score":10,"reason":"no dangerous workflow patterns detected","details":null,"documentation":{"short":"Determines if the project's GitHub Action workflows avoid dangerous patterns.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#dangerous-workflow"}},{"name":"Packaging","score":-1,"reason":"packaging workflow not detected","details":["Warn: no GitHub/GitLab publishing workflow detected."],"documentation":{"short":"Determines if the project is published as a package that others can easily download, install, easily update, and uninstall.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#packaging"}},{"name":"CII-Best-Practices","score":0,"reason":"no effort to earn an OpenSSF best practices badge detected","details":null,"documentation":{"short":"Determines if the project has an OpenSSF (formerly CII) Best Practices Badge.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#cii-best-practices"}},{"name":"License","score":10,"reason":"license file detected","details":["Info: project has a license file: LICENSE:0","Info: FSF or OSI recognized license: Apache License 2.0: LICENSE:0"],"documentation":{"short":"Determines if the project has defined a license.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#license"}},{"name":"Fuzzing","score":0,"reason":"project is not fuzzed","details":["Warn: no fuzzer integrations found"],"documentation":{"short":"Determines if the project uses fuzzing.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#fuzzing"}},{"name":"Token-Permissions","score":6,"reason":"detected GitHub workflow tokens with excessive permissions","details":["Warn: jobLevel 'contents' permission set to 'write': .github/workflows/auto-queue.yml:16","Info: jobLevel 'contents' permission set to 'read': .github/workflows/build.yml:166","Info: jobLevel 'contents' permission set to 'read': .github/workflows/build.yml:203","Info: jobLevel 'contents' permission set to 'read': .github/workflows/build.yml:240","Warn: jobLevel 'contents' permission set to 'write': .github/workflows/build.yml:12","Warn: jobLevel 'contents' permission set to 'write': .github/workflows/build.yml:63","Info: jobLevel 'contents' permission set to 'read': .github/workflows/build.yml:94","Info: jobLevel 'contents' permission set to 'read': .github/workflows/build.yml:128","Warn: jobLevel 'contents' permission set to 'write': .github/workflows/release.yml:16","Warn: jobLevel 'contents' permission set to 'write': .github/workflows/release.yml:72","Info: jobLevel 'contents' permission set to 'read': .github/workflows/release.yml:96","Info: jobLevel 'contents' permission set to 'read': .github/workflows/release.yml:136","Info: jobLevel 'contents' permission set to 'read': .github/workflows/release.yml:182","Info: jobLevel 'contents' permission set to 'read': .github/workflows/release.yml:223","Info: jobLevel 'contents' permission set to 'read': .github/workflows/release.yml:263","Info: jobLevel 'contents' permission set to 'read': .github/workflows/upgrade-cdklabs-projen-project-types-main.yml:11","Info: jobLevel 'contents' permission set to 'read': .github/workflows/upgrade-cdklabs-projen-project-types-main.yml:43","Info: jobLevel 'contents' permission set to 'read': .github/workflows/upgrade-dev-deps-main.yml:13","Info: jobLevel 'contents' permission set to 'read': .github/workflows/upgrade-dev-deps-main.yml:47","Info: jobLevel 'contents' permission set to 'read': .github/workflows/upgrade-main.yml:13","Info: jobLevel 'contents' permission set to 'read': .github/workflows/upgrade-main.yml:47","Warn: no topLevel permission defined: .github/workflows/auto-approve.yml:1","Warn: no topLevel permission defined: .github/workflows/auto-queue.yml:1","Warn: no topLevel permission defined: .github/workflows/build.yml:1","Warn: no topLevel permission defined: .github/workflows/pull-request-lint.yml:1","Warn: no topLevel permission defined: .github/workflows/release.yml:1","Warn: no topLevel permission defined: .github/workflows/upgrade-cdklabs-projen-project-types-main.yml:1","Warn: no topLevel permission defined: .github/workflows/upgrade-dev-deps-main.yml:1","Warn: no topLevel permission defined: .github/workflows/upgrade-main.yml:1"],"documentation":{"short":"Determines if the project's workflows follow the principle of least privilege.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#token-permissions"}},{"name":"Branch-Protection","score":-1,"reason":"internal error: error during branchesHandler.setup: internal error: githubv4.Query: Resource not accessible by integration","details":null,"documentation":{"short":"Determines if the default and release branches are protected with GitHub's branch protection settings.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#branch-protection"}},{"name":"Signed-Releases","score":0,"reason":"Project has not signed or included provenance with any releases.","details":["Warn: release artifact v3.2.2 not signed: https://api.github.com/repos/cdklabs/cdk-ecr-deployment/releases/205581499","Warn: release artifact v3.2.2 does not have provenance: https://api.github.com/repos/cdklabs/cdk-ecr-deployment/releases/205581499"],"documentation":{"short":"Determines if the project cryptographically signs release artifacts.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#signed-releases"}},{"name":"Security-Policy","score":10,"reason":"security policy file detected","details":["Info: security policy file detected: github.com/cdklabs/.github/SECURITY.md:1","Info: Found linked content: github.com/cdklabs/.github/SECURITY.md:1","Info: Found disclosure, vulnerability, and/or timelines in security policy: github.com/cdklabs/.github/SECURITY.md:1","Info: Found text in security policy: github.com/cdklabs/.github/SECURITY.md:1"],"documentation":{"short":"Determines if the project has published a security policy.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#security-policy"}},{"name":"Pinned-Dependencies","score":0,"reason":"dependency not pinned by hash detected -- score normalized to 0","details":["Warn: third-party GitHubAction not pinned by hash: .github/workflows/auto-approve.yml:19: update your workflow using https://app.stepsecurity.io/secureworkflow/cdklabs/cdk-ecr-deployment/auto-approve.yml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/auto-queue.yml:18: update your workflow using https://app.stepsecurity.io/secureworkflow/cdklabs/cdk-ecr-deployment/auto-queue.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build.yml:131: update your workflow using https://app.stepsecurity.io/secureworkflow/cdklabs/cdk-ecr-deployment/build.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build.yml:135: update your workflow using https://app.stepsecurity.io/secureworkflow/cdklabs/cdk-ecr-deployment/build.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build.yml:139: update your workflow using https://app.stepsecurity.io/secureworkflow/cdklabs/cdk-ecr-deployment/build.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build.yml:147: update your workflow using https://app.stepsecurity.io/secureworkflow/cdklabs/cdk-ecr-deployment/build.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build.yml:169: update your workflow using https://app.stepsecurity.io/secureworkflow/cdklabs/cdk-ecr-deployment/build.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build.yml:172: update your workflow using https://app.stepsecurity.io/secureworkflow/cdklabs/cdk-ecr-deployment/build.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build.yml:176: update your workflow using https://app.stepsecurity.io/secureworkflow/cdklabs/cdk-ecr-deployment/build.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build.yml:184: update your workflow using https://app.stepsecurity.io/secureworkflow/cdklabs/cdk-ecr-deployment/build.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build.yml:206: update your workflow using https://app.stepsecurity.io/secureworkflow/cdklabs/cdk-ecr-deployment/build.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build.yml:209: update your workflow using https://app.stepsecurity.io/secureworkflow/cdklabs/cdk-ecr-deployment/build.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build.yml:213: update your workflow using https://app.stepsecurity.io/secureworkflow/cdklabs/cdk-ecr-deployment/build.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build.yml:221: update your workflow using https://app.stepsecurity.io/secureworkflow/cdklabs/cdk-ecr-deployment/build.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build.yml:243: update your workflow using https://app.stepsecurity.io/secureworkflow/cdklabs/cdk-ecr-deployment/build.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build.yml:246: update your workflow using https://app.stepsecurity.io/secureworkflow/cdklabs/cdk-ecr-deployment/build.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build.yml:250: update your workflow using https://app.stepsecurity.io/secureworkflow/cdklabs/cdk-ecr-deployment/build.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build.yml:258: update your workflow using https://app.stepsecurity.io/secureworkflow/cdklabs/cdk-ecr-deployment/build.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build.yml:19: update your workflow using https://app.stepsecurity.io/secureworkflow/cdklabs/cdk-ecr-deployment/build.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build.yml:24: update your workflow using https://app.stepsecurity.io/secureworkflow/cdklabs/cdk-ecr-deployment/build.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build.yml:39: update your workflow using https://app.stepsecurity.io/secureworkflow/cdklabs/cdk-ecr-deployment/build.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build.yml:54: update your workflow using https://app.stepsecurity.io/secureworkflow/cdklabs/cdk-ecr-deployment/build.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build.yml:67: update your workflow using https://app.stepsecurity.io/secureworkflow/cdklabs/cdk-ecr-deployment/build.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build.yml:73: update your workflow using https://app.stepsecurity.io/secureworkflow/cdklabs/cdk-ecr-deployment/build.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build.yml:97: update your workflow using https://app.stepsecurity.io/secureworkflow/cdklabs/cdk-ecr-deployment/build.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build.yml:101: update your workflow using https://app.stepsecurity.io/secureworkflow/cdklabs/cdk-ecr-deployment/build.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build.yml:109: update your workflow using https://app.stepsecurity.io/secureworkflow/cdklabs/cdk-ecr-deployment/build.yml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/pull-request-lint.yml:22: update your workflow using https://app.stepsecurity.io/secureworkflow/cdklabs/cdk-ecr-deployment/pull-request-lint.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release.yml:226: update your workflow using https://app.stepsecurity.io/secureworkflow/cdklabs/cdk-ecr-deployment/release.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release.yml:229: update your workflow using https://app.stepsecurity.io/secureworkflow/cdklabs/cdk-ecr-deployment/release.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release.yml:233: update your workflow using https://app.stepsecurity.io/secureworkflow/cdklabs/cdk-ecr-deployment/release.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release.yml:241: update your workflow using https://app.stepsecurity.io/secureworkflow/cdklabs/cdk-ecr-deployment/release.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release.yml:266: update your workflow using https://app.stepsecurity.io/secureworkflow/cdklabs/cdk-ecr-deployment/release.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release.yml:269: update your workflow using https://app.stepsecurity.io/secureworkflow/cdklabs/cdk-ecr-deployment/release.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release.yml:273: update your workflow using https://app.stepsecurity.io/secureworkflow/cdklabs/cdk-ecr-deployment/release.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release.yml:281: update your workflow using https://app.stepsecurity.io/secureworkflow/cdklabs/cdk-ecr-deployment/release.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release.yml:24: update your workflow using https://app.stepsecurity.io/secureworkflow/cdklabs/cdk-ecr-deployment/release.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release.yml:32: update your workflow using https://app.stepsecurity.io/secureworkflow/cdklabs/cdk-ecr-deployment/release.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release.yml:56: update your workflow using https://app.stepsecurity.io/secureworkflow/cdklabs/cdk-ecr-deployment/release.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release.yml:75: update your workflow using https://app.stepsecurity.io/secureworkflow/cdklabs/cdk-ecr-deployment/release.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release.yml:79: update your workflow using https://app.stepsecurity.io/secureworkflow/cdklabs/cdk-ecr-deployment/release.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release.yml:99: update your workflow using https://app.stepsecurity.io/secureworkflow/cdklabs/cdk-ecr-deployment/release.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release.yml:103: update your workflow using https://app.stepsecurity.io/secureworkflow/cdklabs/cdk-ecr-deployment/release.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release.yml:111: update your workflow using https://app.stepsecurity.io/secureworkflow/cdklabs/cdk-ecr-deployment/release.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release.yml:139: update your workflow using https://app.stepsecurity.io/secureworkflow/cdklabs/cdk-ecr-deployment/release.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release.yml:143: update your workflow using https://app.stepsecurity.io/secureworkflow/cdklabs/cdk-ecr-deployment/release.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release.yml:147: update your workflow using https://app.stepsecurity.io/secureworkflow/cdklabs/cdk-ecr-deployment/release.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release.yml:155: update your workflow using https://app.stepsecurity.io/secureworkflow/cdklabs/cdk-ecr-deployment/release.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release.yml:185: update your workflow using https://app.stepsecurity.io/secureworkflow/cdklabs/cdk-ecr-deployment/release.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release.yml:188: update your workflow using https://app.stepsecurity.io/secureworkflow/cdklabs/cdk-ecr-deployment/release.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release.yml:192: update your workflow using https://app.stepsecurity.io/secureworkflow/cdklabs/cdk-ecr-deployment/release.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release.yml:200: update your workflow using https://app.stepsecurity.io/secureworkflow/cdklabs/cdk-ecr-deployment/release.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/upgrade-cdklabs-projen-project-types-main.yml:16: update your workflow using https://app.stepsecurity.io/secureworkflow/cdklabs/cdk-ecr-deployment/upgrade-cdklabs-projen-project-types-main.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/upgrade-cdklabs-projen-project-types-main.yml:20: update your workflow using https://app.stepsecurity.io/secureworkflow/cdklabs/cdk-ecr-deployment/upgrade-cdklabs-projen-project-types-main.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/upgrade-cdklabs-projen-project-types-main.yml:33: update your workflow using https://app.stepsecurity.io/secureworkflow/cdklabs/cdk-ecr-deployment/upgrade-cdklabs-projen-project-types-main.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/upgrade-cdklabs-projen-project-types-main.yml:47: update your workflow using https://app.stepsecurity.io/secureworkflow/cdklabs/cdk-ecr-deployment/upgrade-cdklabs-projen-project-types-main.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/upgrade-cdklabs-projen-project-types-main.yml:51: update your workflow using https://app.stepsecurity.io/secureworkflow/cdklabs/cdk-ecr-deployment/upgrade-cdklabs-projen-project-types-main.yml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/upgrade-cdklabs-projen-project-types-main.yml:63: update your workflow using https://app.stepsecurity.io/secureworkflow/cdklabs/cdk-ecr-deployment/upgrade-cdklabs-projen-project-types-main.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/upgrade-dev-deps-main.yml:18: update your workflow using https://app.stepsecurity.io/secureworkflow/cdklabs/cdk-ecr-deployment/upgrade-dev-deps-main.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/upgrade-dev-deps-main.yml:22: update your workflow using https://app.stepsecurity.io/secureworkflow/cdklabs/cdk-ecr-deployment/upgrade-dev-deps-main.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/upgrade-dev-deps-main.yml:37: update your workflow using https://app.stepsecurity.io/secureworkflow/cdklabs/cdk-ecr-deployment/upgrade-dev-deps-main.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/upgrade-dev-deps-main.yml:51: update your workflow using https://app.stepsecurity.io/secureworkflow/cdklabs/cdk-ecr-deployment/upgrade-dev-deps-main.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/upgrade-dev-deps-main.yml:55: update your workflow using https://app.stepsecurity.io/secureworkflow/cdklabs/cdk-ecr-deployment/upgrade-dev-deps-main.yml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/upgrade-dev-deps-main.yml:67: update your workflow using https://app.stepsecurity.io/secureworkflow/cdklabs/cdk-ecr-deployment/upgrade-dev-deps-main.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/upgrade-main.yml:18: update your workflow using https://app.stepsecurity.io/secureworkflow/cdklabs/cdk-ecr-deployment/upgrade-main.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/upgrade-main.yml:22: update your workflow using https://app.stepsecurity.io/secureworkflow/cdklabs/cdk-ecr-deployment/upgrade-main.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/upgrade-main.yml:37: update your workflow using https://app.stepsecurity.io/secureworkflow/cdklabs/cdk-ecr-deployment/upgrade-main.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/upgrade-main.yml:51: update your workflow using https://app.stepsecurity.io/secureworkflow/cdklabs/cdk-ecr-deployment/upgrade-main.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/upgrade-main.yml:55: update your workflow using https://app.stepsecurity.io/secureworkflow/cdklabs/cdk-ecr-deployment/upgrade-main.yml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/upgrade-main.yml:67: update your workflow using https://app.stepsecurity.io/secureworkflow/cdklabs/cdk-ecr-deployment/upgrade-main.yml/main?enable=pin","Warn: containerImage not pinned by hash: lambda-src/Dockerfile:4","Warn: containerImage not pinned by hash: test/docker/Dockerfile:5: pin your Docker image by updating nginx to nginx@sha256:3ab4ed065a1437cbbd45e65617b1285bdf6523c6bf56a121e00df41720e09a89","Info:   0 out of  64 GitHub-owned GitHubAction dependencies pinned","Info:   0 out of   6 third-party GitHubAction dependencies pinned","Info:   0 out of   2 containerImage dependencies pinned"],"documentation":{"short":"Determines if the project has declared and pinned the dependencies of its build process.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#pinned-dependencies"}},{"name":"SAST","score":0,"reason":"SAST tool is not run on all commits -- score normalized to 0","details":["Warn: 0 commits out of 30 are checked with a SAST tool"],"documentation":{"short":"Determines if the project uses static code analysis.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#sast"}},{"name":"Vulnerabilities","score":6,"reason":"4 existing vulnerabilities detected","details":["Warn: Project is vulnerable to: GO-2025-3829","Warn: Project is vulnerable to: GHSA-v4mq-x674-ff73","Warn: Project is vulnerable to: GHSA-qq4x-c6h6-rfxh","Warn: Project is vulnerable to: GHSA-5pq3-h73f-66hr"],"documentation":{"short":"Determines if the project has open, known unfixed vulnerabilities.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#vulnerabilities"}}]},"last_synced_at":"2025-08-17T13:04:33.860Z","repository_id":37037591,"created_at":"2025-08-17T13:04:33.860Z","updated_at":"2025-08-17T13:04:33.860Z"},"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":31547845,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-04-07T16:28:08.000Z","status":"online","status_checked_at":"2026-04-08T02:00:06.127Z","response_time":54,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["aws","cdk","deployment","docker","ecr","transport"],"created_at":"2024-08-01T17:00:34.213Z","updated_at":"2026-04-08T09:01:11.490Z","avatar_url":"https://github.com/cdklabs.png","language":"Go","funding_links":[],"categories":["docker"],"sub_categories":[],"readme":"# cdk-ecr-deployment\n\n[![Release](https://github.com/cdklabs/cdk-ecr-deployment/actions/workflows/release.yml/badge.svg)](https://github.com/cdklabs/cdk-ecr-deployment/actions/workflows/release.yml)\n[![npm version](https://img.shields.io/npm/v/cdk-ecr-deployment)](https://www.npmjs.com/package/cdk-ecr-deployment)\n[![PyPI](https://img.shields.io/pypi/v/cdk-ecr-deployment)](https://pypi.org/project/cdk-ecr-deployment)\n[![npm](https://img.shields.io/npm/dw/cdk-ecr-deployment?label=npm%20downloads)](https://www.npmjs.com/package/cdk-ecr-deployment)\n[![PyPI - Downloads](https://img.shields.io/pypi/dw/cdk-ecr-deployment?label=pypi%20downloads)](https://pypi.org/project/cdk-ecr-deployment)\n\nCDK construct to synchronize single docker image between docker registries.\n\n\u003e [!IMPORTANT]\n\u003e\n\u003e Please use the latest version of this package, which is `v4`.\n\u003e\n\u003e (Older versions are no longer supported).\n\n## Features\n\n- Copy image or multi-architecture image index from ECR/external registry to (another) ECR/external registry\n- Copy an archive tarball image from s3 to ECR/external registry\n\n## Examples\n\n```ts\nimport { DockerImageAsset } from 'aws-cdk-lib/aws-ecr-assets';\n\nconst image = new DockerImageAsset(this, 'CDKDockerImage', {\n  directory: path.join(__dirname, 'docker'),\n});\n\n// Copy from cdk docker image asset to another ECR.\nnew ecrdeploy.ECRDeployment(this, 'DeployDockerImage1', {\n  src: new ecrdeploy.DockerImageName(image.imageUri),\n  dest: new ecrdeploy.DockerImageName(`${cdk.Aws.ACCOUNT_ID}.dkr.ecr.us-west-2.amazonaws.com/my-nginx:latest`),\n});\n\n// Copy from docker registry to ECR.\nnew ecrdeploy.ECRDeployment(this, 'DeployDockerImage2', {\n  src: new ecrdeploy.DockerImageName('nginx:latest'),\n  dest: new ecrdeploy.DockerImageName(`${cdk.Aws.ACCOUNT_ID}.dkr.ecr.us-west-2.amazonaws.com/my-nginx2:latest`),\n});\n\n// Copy from private docker registry to ECR.\n// The format of secret in aws secrets manager must be either:\n// - plain text in format \u003cusername\u003e:\u003cpassword\u003e\n// - json in format {\"username\":\"\u003cusername\u003e\",\"password\":\"\u003cpassword\u003e\"}\nnew ecrdeploy.ECRDeployment(this, 'DeployDockerImage3', {\n  src: new ecrdeploy.DockerImageName('javacs3/nginx:latest', 'username:password'),\n  // src: new ecrdeploy.DockerImageName('javacs3/nginx:latest', 'aws-secrets-manager-secret-name'),\n  // src: new ecrdeploy.DockerImageName('javacs3/nginx:latest', 'arn:aws:secretsmanager:us-west-2:000000000000:secret:id'),\n  dest: new ecrdeploy.DockerImageName(`${cdk.Aws.ACCOUNT_ID}.dkr.ecr.us-west-2.amazonaws.com/my-nginx3:latest`),\n}).addToPrincipalPolicy(new iam.PolicyStatement({\n  effect: iam.Effect.ALLOW,\n  actions: [\n    'secretsmanager:GetSecretValue',\n  ],\n  resources: ['*'],\n}));\n\n// Copy multi-architecture image index (manifest) with all architectures.\nnew ecrdeploy.ECRDeployment(this, 'DeployDockerImage4', {\n  src: new ecrdeploy.DockerImageName('public.ecr.aws/nginx/nginx:latest'),\n  dest: new ecrdeploy.DockerImageName(`${cdk.Aws.ACCOUNT_ID}.dkr.ecr.us-west-2.amazonaws.com/my-nginx4:manifest`),\n  copyImageIndex: true,\n  archImageTags: {\n    amd64: 'my-nginx-amd64',\n    arm64: 'my-nginx-arm64',\n  },\n});\n```\n\n## Sample: [test/example.ecr-deployment.ts](./test/example.ecr-deployment.ts)\n\nAfter cloning the repository, install dependencies and run a full build:\n\n```console\nyarn --frozen-lockfile --check-files\nyarn build\n```\n\nThen run the example like this:\n\n```shell\n# Run the following command to try the sample.\nnpx cdk deploy -a \"npx ts-node -P tsconfig.dev.json --prefer-ts-exts test/example.ecr-deployment.ts\"\n```\n\nTo run the DockerHub example you will first need to setup a Secret in AWS Secrets Manager to provide DockerHub credentials.\nReplace `username:access-token` with your credentials.\n**Please note that Secrets will occur a cost.**\n\n```console\naws secretsmanager create-secret --name DockerHubCredentials --secret-string \"username:access-token\"\n```\n\nFrom the output, copy the ARN of your new secret and export it as env variable\n\n```console\nexport DOCKERHUB_SECRET_ARN=\"\u003cARN\u003e\"\n```\n\nFinally run:\n\n```shell\n# Run the following command to try the sample.\nnpx cdk deploy -a \"npx ts-node -P tsconfig.dev.json --prefer-ts-exts test/dockerhub-example.ecr-deployment.ts\"\n```\n\nIf your Secret is encrypted, you might have to adjust the example to also grant decrypt permissions.\n\n## [API](./API.md)\n\n## Tech Details \u0026 Contribution\n\nThe core of this project relies on [containers/image](https://github.com/containers/image) which is used by [Skopeo](https://github.com/containers/skopeo).\nPlease take a look at those projects before contribution.\n\nTo support a new docker image source(like docker tarball in s3), you need to implement [image transport interface](https://github.com/containers/image/blob/master/types/types.go). You could take a look at [docker-archive](https://github.com/containers/image/blob/ccb87a8d0f45cf28846e307eb0ec2b9d38a458c2/docker/archive/transport.go) transport for a good start.\n\nAny error in the custom resource provider will show up in the CloudFormation error log as `Invalid PhysicalResourceId`, because of this: \u003chttps://github.com/aws/aws-lambda-go/issues/107\u003e. You need to go into the CloudWatch Log Group to find the real error.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fcdklabs%2Fcdk-ecr-deployment","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fcdklabs%2Fcdk-ecr-deployment","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fcdklabs%2Fcdk-ecr-deployment/lists"}