{"id":31646098,"url":"https://github.com/codefresh-io/codefresh-pipeline-runner","last_synced_at":"2025-10-07T05:20:01.886Z","repository":{"id":37899051,"uuid":"198299342","full_name":"codefresh-io/codefresh-pipeline-runner","owner":"codefresh-io","description":"GitHub action with ability to run codefresh pipeline","archived":false,"fork":false,"pushed_at":"2023-11-17T23:11:03.000Z","size":10816,"stargazers_count":52,"open_issues_count":2,"forks_count":27,"subscribers_count":12,"default_branch":"master","last_synced_at":"2025-08-24T20:45:28.085Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":"","language":"Shell","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/codefresh-io.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":"CONTRIBUTING.md","funding":null,"license":"LICENSE.md","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2019-07-22T20:43:32.000Z","updated_at":"2024-04-30T19:17:52.000Z","dependencies_parsed_at":"2023-01-04T12:15:18.673Z","dependency_job_id":null,"html_url":"https://github.com/codefresh-io/codefresh-pipeline-runner","commit_stats":{"total_commits":161,"total_committers":10,"mean_commits":16.1,"dds":0.6273291925465838,"last_synced_commit":"c563a2bb98a7b8522192aaabf79ee9504141f8dc"},"previous_names":[],"tags_count":8,"template":false,"template_full_name":null,"purl":"pkg:github/codefresh-io/codefresh-pipeline-runner","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/codefresh-io%2Fcodefresh-pipeline-runner","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/codefresh-io%2Fcodefresh-pipeline-runner/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/codefresh-io%2Fcodefresh-pipeline-runner/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/codefresh-io%2Fcodefresh-pipeline-runner/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/codefresh-io","download_url":"https://codeload.github.com/codefresh-io/codefresh-pipeline-runner/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/codefresh-io%2Fcodefresh-pipeline-runner/sbom","scorecard":{"id":296404,"data":{"date":"2025-08-11","repo":{"name":"github.com/codefresh-io/codefresh-pipeline-runner","commit":"c2fe0b32ae880220653855bc2254271a37441fb1"},"scorecard":{"version":"v5.2.1-40-gf6ed084d","commit":"f6ed084d17c9236477efd66e5b258b9d4cc7b389"},"score":3.5,"checks":[{"name":"Dangerous-Workflow","score":10,"reason":"no dangerous workflow patterns detected","details":null,"documentation":{"short":"Determines if the project's GitHub Action workflows avoid dangerous patterns.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#dangerous-workflow"}},{"name":"Maintained","score":0,"reason":"0 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0","details":null,"documentation":{"short":"Determines if the project is \"actively maintained\".","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#maintained"}},{"name":"Code-Review","score":1,"reason":"Found 3/26 approved changesets -- score normalized to 1","details":null,"documentation":{"short":"Determines if the project requires human code review before pull requests (aka merge requests) are merged.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#code-review"}},{"name":"Binary-Artifacts","score":10,"reason":"no binaries found in the repo","details":null,"documentation":{"short":"Determines if the project has generated executable (binary) artifacts in the source repository.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#binary-artifacts"}},{"name":"Token-Permissions","score":0,"reason":"detected GitHub workflow tokens with excessive permissions","details":["Warn: no topLevel permission defined: .github/workflows/main.yml:1","Info: no jobLevel write permissions found"],"documentation":{"short":"Determines if the project's workflows follow the principle of least privilege.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#token-permissions"}},{"name":"Packaging","score":-1,"reason":"packaging workflow not detected","details":["Warn: no GitHub/GitLab publishing workflow detected."],"documentation":{"short":"Determines if the project is published as a package that others can easily download, install, easily update, and uninstall.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#packaging"}},{"name":"CII-Best-Practices","score":0,"reason":"no effort to earn an OpenSSF best practices badge detected","details":null,"documentation":{"short":"Determines if the project has an OpenSSF (formerly CII) Best Practices Badge.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#cii-best-practices"}},{"name":"Vulnerabilities","score":10,"reason":"0 existing vulnerabilities detected","details":null,"documentation":{"short":"Determines if the project has open, known unfixed vulnerabilities.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#vulnerabilities"}},{"name":"Fuzzing","score":0,"reason":"project is not fuzzed","details":["Warn: no fuzzer integrations found"],"documentation":{"short":"Determines if the project uses fuzzing.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#fuzzing"}},{"name":"Security-Policy","score":0,"reason":"security policy file not detected","details":["Warn: no security policy file detected","Warn: no security file to analyze","Warn: no security file to analyze","Warn: no security file to analyze"],"documentation":{"short":"Determines if the project has published a security policy.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#security-policy"}},{"name":"License","score":10,"reason":"license file detected","details":["Info: project has a license file: LICENSE.md:0","Info: FSF or OSI recognized license: MIT License: LICENSE.md:0"],"documentation":{"short":"Determines if the project has defined a license.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#license"}},{"name":"Pinned-Dependencies","score":0,"reason":"dependency not pinned by hash detected -- score normalized to 0","details":["Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/main.yml:8: update your workflow using https://app.stepsecurity.io/secureworkflow/codefresh-io/codefresh-pipeline-runner/main.yml/master?enable=pin","Warn: containerImage not pinned by hash: Dockerfile:1: pin your Docker image by updating codefresh/cli to codefresh/cli@sha256:dfd9accd43ba6f9e491c838e2beb519f1cf217c1e5dda4f246debe5829059a1f","Info:   0 out of   1 GitHub-owned GitHubAction dependencies pinned","Info:   0 out of   1 containerImage dependencies pinned"],"documentation":{"short":"Determines if the project has declared and pinned the dependencies of its build process.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#pinned-dependencies"}},{"name":"Branch-Protection","score":0,"reason":"branch protection not enabled on development/release branches","details":["Warn: branch protection not enabled for branch 'master'"],"documentation":{"short":"Determines if the default and release branches are protected with GitHub's branch protection settings.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#branch-protection"}},{"name":"Signed-Releases","score":-1,"reason":"no releases found","details":null,"documentation":{"short":"Determines if the project cryptographically signs release artifacts.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#signed-releases"}},{"name":"SAST","score":0,"reason":"SAST tool is not run on all commits -- score normalized to 0","details":["Warn: 0 commits out of 7 are checked with a SAST tool"],"documentation":{"short":"Determines if the project uses static code analysis.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#sast"}}]},"last_synced_at":"2025-08-17T19:36:55.880Z","repository_id":37899051,"created_at":"2025-08-17T19:36:55.881Z","updated_at":"2025-08-17T19:36:55.881Z"},"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":278722757,"owners_count":26034463,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","status":"online","status_checked_at":"2025-10-07T02:00:06.786Z","response_time":59,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2025-10-07T05:19:57.790Z","updated_at":"2025-10-07T05:20:01.872Z","avatar_url":"https://github.com/codefresh-io.png","language":"Shell","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Codefresh pipeline runner GitHub Action  \n\nCodefresh is a CI/CD platform that engineers actually love to use. The [Codefresh pipeline](https://codefresh.io/docs/docs/configure-ci-cd-pipeline/pipelines/) runner GitHub action will trigger an existing Codefresh pipeline from a GitHub action.\n\nIt is based on the [Codefresh CLI](https://codefresh-io.github.io/cli/) which can execute Codefresh pipelines remotely (using an API key for authentication). The Codefresh CLI is already available as a [public Docker image](https://hub.docker.com/r/codefresh/cli/), so creating a GitHub action with it is a trivial process.\n\n## Integrating Codefresh pipelines with GitHub actions\n\nGitHub actions are a flexible way to respond to GitHub events and perform one or more tasks\nwhen a specific GitHub event happens. GitHub actions can also use Codefresh pipelines as a back-end\nresulting in a very powerful combination where the first action starts from GitHub, but Codefresh takes care\nof the actual compilation or deployment in a pipeline.\n\n\u003cimg src=\"/art/github-action-demo.gif?raw=true\" width=\"600px\"\u003e\n\n## Prerequisites\n\nMake sure that you have\n\n* a GitHub account with Actions enabled\n* a [Codefresh account](https://codefresh.io/docs/docs/getting-started/create-a-codefresh-account/) with one or more existing pipelines ready\n* a [Codefresh API token](https://codefresh.io/docs/docs/integrations/codefresh-api/#authentication-instructions) that will be used as a secret in the GitHub action\n\n\n## How the Codefresh action works\n\nThe GitHub workflow is placed on the [push event](https://developer.github.com/v3/activity/events/types/#pushevent) and therefore starts whenever a Git commit happens. The Workflow has a single action that starts the Codefresh pipeline runner.\n\nThe pipeline runner is a Docker image with the Codefresh CLI. It uses the Codefresh API token to authenticate to Codefresh and then calls a an existing pipeline via its trigger.\n\nThe result is that all the details from the Git push (i.e. the GIT hash) are transferred to the Codefresh pipeline that gets triggered remotely\n\n## How to use the Codefresh GitHub action\n\nAn example of workflow\n\n```\nname: run codefresh pipeline\non: push\njobs:\n  build:\n    runs-on: ubuntu-18.04\n    steps:\n      - name: Checkout\n        uses: actions/checkout@master\n        \n      - name: 'run pipeline'\n        uses: codefresh-io/codefresh-pipeline-runner@v8\n        with:\n          args: '-v key1=value1 -v key2=value2'\n        env:\n          PIPELINE_NAME: 'codefresh-pipeline'\n          TRIGGER_NAME: 'codefresh-trigger'\n          CF_API_KEY: ${{ secrets.CF_API_KEY }}\n        id: run-pipeline\n```\n### Env variables\n* A secret with name `CF_API_KEY` and value your Codefresh API token ( https://codefresh.io/docs/docs/integrations/codefresh-api/#authentication-instructions )\n* An environment variable called `PIPELINE_NAME` with a value of `\u003cproject_name\u003e/\u003cpipeline_name\u003e`\n* An optional environment variable called `TRIGGER_NAME` with trigger name attached to this pipeline. See the [triggers section](https://codefresh.io/docs/docs/configure-ci-cd-pipeline/triggers/) for more information\n* An optional environment variable called `CF_BRANCH` with branch name .\n\nClick the Done button to save your changes and commit.\n\nNow next time you commit anything in your GitHub repository the Codefresh pipeline will also execute.\n\n### Outputs\nThe action will report if the pipeline execution was successful. For example, if your pipeline has unit tests that fail, by default, it will report the action failed. The logs from the pipeline will be streamed into the Github action console.\n\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fcodefresh-io%2Fcodefresh-pipeline-runner","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fcodefresh-io%2Fcodefresh-pipeline-runner","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fcodefresh-io%2Fcodefresh-pipeline-runner/lists"}