{"id":13509163,"url":"https://github.com/replicatedhq/kots","last_synced_at":"2026-01-17T00:26:38.861Z","repository":{"id":37546748,"uuid":"198856247","full_name":"replicatedhq/kots","owner":"replicatedhq","description":"KOTS provides the framework, tools and integrations that enable the delivery and management of 3rd-party Kubernetes applications, a.k.a. Kubernetes Off-The-Shelf (KOTS) Software.","archived":false,"fork":false,"pushed_at":"2026-01-10T06:11:05.000Z","size":160031,"stargazers_count":935,"open_issues_count":133,"forks_count":99,"subscribers_count":23,"default_branch":"main","last_synced_at":"2026-01-11T01:47:54.767Z","etag":null,"topics":["gitops","go","golang","kubernetes","kubernetes-applications"],"latest_commit_sha":null,"homepage":"https://kots.io","language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/replicatedhq.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":"CONTRIBUTING.md","funding":null,"license":"LICENSE","code_of_conduct":"CODE_OF_CONDUCT.md","threat_model":null,"audit":null,"citation":null,"codeowners":".github/CODEOWNERS","security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2019-07-25T15:24:08.000Z","updated_at":"2026-01-10T06:11:00.000Z","dependencies_parsed_at":"2023-10-21T00:00:45.085Z","dependency_job_id":"216604bd-506c-4601-8499-72848ebc04e7","html_url":"https://github.com/replicatedhq/kots","commit_stats":{"total_commits":6242,"total_committers":88,"mean_commits":70.93181818181819,"dds":0.8340275552707466,"last_synced_commit":"c9a85e37fea9c584a1b33786892bbe912b289f06"},"previous_names":[],"tags_count":3163,"template":false,"template_full_name":null,"purl":"pkg:github/replicatedhq/kots","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/replicatedhq%2Fkots","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/replicatedhq%2Fkots/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/replicatedhq%2Fkots/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/replicatedhq%2Fkots/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/replicatedhq","download_url":"https://codeload.github.com/replicatedhq/kots/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/replicatedhq%2Fkots/sbom","scorecard":{"id":394376,"data":{"date":"2025-08-11","repo":{"name":"github.com/replicatedhq/kots","commit":"0a91812bd36e8155fba2028cdf04e6885345504c"},"scorecard":{"version":"v5.2.1-40-gf6ed084d","commit":"f6ed084d17c9236477efd66e5b258b9d4cc7b389"},"score":4.9,"checks":[{"name":"Maintained","score":10,"reason":"30 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10","details":null,"documentation":{"short":"Determines if the project is \"actively maintained\".","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#maintained"}},{"name":"Code-Review","score":10,"reason":"all changesets reviewed","details":null,"documentation":{"short":"Determines if the project requires human code review before pull requests (aka merge requests) are merged.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#code-review"}},{"name":"CII-Best-Practices","score":0,"reason":"no effort to earn an OpenSSF best practices badge detected","details":null,"documentation":{"short":"Determines if the project has an OpenSSF (formerly CII) Best Practices Badge.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#cii-best-practices"}},{"name":"Security-Policy","score":0,"reason":"security policy file not detected","details":["Warn: no security policy file detected","Warn: no security file to analyze","Warn: no security file to analyze","Warn: no security file to analyze"],"documentation":{"short":"Determines if the project has published a security policy.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#security-policy"}},{"name":"License","score":10,"reason":"license file detected","details":["Info: project has a license file: LICENSE:0","Info: FSF or OSI recognized license: Apache License 2.0: LICENSE:0"],"documentation":{"short":"Determines if the project has defined a license.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#license"}},{"name":"Branch-Protection","score":-1,"reason":"internal error: error during branchesHandler.setup: internal error: githubv4.Query: Resource not accessible by integration","details":null,"documentation":{"short":"Determines if the default and release branches are protected with GitHub's branch protection settings.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#branch-protection"}},{"name":"Dangerous-Workflow","score":10,"reason":"no dangerous workflow patterns detected","details":null,"documentation":{"short":"Determines if the project's GitHub Action workflows avoid dangerous patterns.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#dangerous-workflow"}},{"name":"Signed-Releases","score":0,"reason":"Project has not signed or included provenance with any releases.","details":["Warn: release artifact v1.126.0 not signed: https://api.github.com/repos/replicatedhq/kots/releases/240302785","Warn: release artifact v1.125.2 not signed: https://api.github.com/repos/replicatedhq/kots/releases/237730320","Warn: release artifact v1.125.1 not signed: https://api.github.com/repos/replicatedhq/kots/releases/236627308","Warn: release artifact v1.125.0 not signed: https://api.github.com/repos/replicatedhq/kots/releases/234568194","Warn: release artifact v1.124.18 not signed: https://api.github.com/repos/replicatedhq/kots/releases/224683631","Warn: release artifact v1.126.0 does not have provenance: https://api.github.com/repos/replicatedhq/kots/releases/240302785","Warn: release artifact v1.125.2 does not have provenance: https://api.github.com/repos/replicatedhq/kots/releases/237730320","Warn: release artifact v1.125.1 does not have provenance: https://api.github.com/repos/replicatedhq/kots/releases/236627308","Warn: release artifact v1.125.0 does not have provenance: https://api.github.com/repos/replicatedhq/kots/releases/234568194","Warn: release artifact v1.124.18 does not have provenance: https://api.github.com/repos/replicatedhq/kots/releases/224683631"],"documentation":{"short":"Determines if the project cryptographically signs release artifacts.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#signed-releases"}},{"name":"Token-Permissions","score":0,"reason":"detected GitHub workflow tokens with excessive permissions","details":["Info: jobLevel 'contents' permission set to 'read': .github/workflows/daily-image-scans.yml:181","Warn: jobLevel 'security-events' permission set to 'write': .github/workflows/daily-image-scans.yml:182","Info: jobLevel 'actions' permission set to 'read': .github/workflows/daily-image-scans.yml:183","Info: jobLevel 'contents' permission set to 'read': .github/workflows/daily-image-scans.yml:212","Warn: jobLevel 'security-events' permission set to 'write': .github/workflows/daily-image-scans.yml:213","Info: jobLevel 'actions' permission set to 'read': .github/workflows/daily-image-scans.yml:214","Info: jobLevel 'contents' permission set to 'read': .github/workflows/daily-image-scans.yml:19","Info: jobLevel 'contents' permission set to 'read': .github/workflows/daily-image-scans.yml:39","Warn: jobLevel 'security-events' permission set to 'write': .github/workflows/daily-image-scans.yml:40","Info: jobLevel 'actions' permission set to 'read': .github/workflows/daily-image-scans.yml:41","Info: jobLevel 'contents' permission set to 'read': .github/workflows/daily-image-scans.yml:66","Warn: jobLevel 'security-events' permission set to 'write': .github/workflows/daily-image-scans.yml:67","Info: jobLevel 'actions' permission set to 'read': .github/workflows/daily-image-scans.yml:68","Info: jobLevel 'contents' permission set to 'read': .github/workflows/daily-image-scans.yml:93","Warn: jobLevel 'security-events' permission set to 'write': .github/workflows/daily-image-scans.yml:94","Info: jobLevel 'actions' permission set to 'read': .github/workflows/daily-image-scans.yml:95","Info: jobLevel 'contents' permission set to 'read': .github/workflows/daily-image-scans.yml:119","Warn: jobLevel 'security-events' permission set to 'write': .github/workflows/daily-image-scans.yml:120","Info: jobLevel 'actions' permission set to 'read': .github/workflows/daily-image-scans.yml:121","Info: jobLevel 'contents' permission set to 'read': .github/workflows/daily-image-scans.yml:150","Warn: jobLevel 'security-events' permission set to 'write': .github/workflows/daily-image-scans.yml:151","Info: jobLevel 'actions' permission set to 'read': .github/workflows/daily-image-scans.yml:152","Warn: no topLevel permission defined: .github/workflows/actionlint.yaml:1","Warn: no topLevel permission defined: .github/workflows/alpha.yaml:1","Warn: no topLevel permission defined: .github/workflows/arm64-arc-runner-set.yaml:1","Warn: no topLevel permission defined: .github/workflows/automated-prs-manager.yaml:1","Info: topLevel 'contents' permission set to 'read': .github/workflows/build-test.yaml:11","Info: topLevel 'pull-requests' permission set to 'read': .github/workflows/build-test.yaml:12","Info: found token with 'none' permissions: .github/workflows/daily-image-scans.yml:1","Warn: no topLevel permission defined: .github/workflows/e2e-infra-cleanup.yaml:1","Warn: no topLevel permission defined: .github/workflows/e2e-workspace-cleanup.yaml:1","Warn: no topLevel permission defined: .github/workflows/image-deps-updater.yaml:1","Warn: no topLevel permission defined: .github/workflows/kurl-addon-kots-publish.yaml:1","Warn: no topLevel permission defined: .github/workflows/kurl-addon-kots-test.yaml:1","Warn: no topLevel permission defined: .github/workflows/license.yaml:1","Warn: no topLevel permission defined: .github/workflows/regression.yaml:1","Warn: topLevel 'contents' permission set to 'write': .github/workflows/release-for-ec.yaml:12","Warn: topLevel 'contents' permission set to 'write': .github/workflows/release.yaml:11","Warn: no topLevel permission defined: .github/workflows/tag-helm-chart.yaml:1","Warn: no topLevel permission defined: .github/workflows/update-kubectl.yaml:1"],"documentation":{"short":"Determines if the project's workflows follow the principle of least privilege.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#token-permissions"}},{"name":"Binary-Artifacts","score":10,"reason":"no binaries found in the repo","details":null,"documentation":{"short":"Determines if the project has generated executable (binary) artifacts in the source repository.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#binary-artifacts"}},{"name":"Fuzzing","score":0,"reason":"project is not fuzzed","details":["Warn: no fuzzer integrations found"],"documentation":{"short":"Determines if the project uses fuzzing.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#fuzzing"}},{"name":"Packaging","score":10,"reason":"packaging workflow detected","details":["Info: Project packages its releases by way of GitHub Actions.: .github/workflows/release.yaml:229"],"documentation":{"short":"Determines if the project is published as a package that others can easily download, install, easily update, and uninstall.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#packaging"}},{"name":"SAST","score":0,"reason":"SAST tool is not run on all commits -- score normalized to 0","details":["Warn: 0 commits out of 30 are checked with a SAST tool"],"documentation":{"short":"Determines if the project uses static code analysis.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#sast"}},{"name":"Pinned-Dependencies","score":0,"reason":"dependency not pinned by hash detected -- score normalized to 0","details":["Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/actionlint.yaml:13: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/actionlint.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/actionlint.yaml:15: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/actionlint.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/alpha.yaml:16: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/alpha.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/alpha.yaml:33: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/alpha.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/alpha.yaml:45: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/alpha.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/alpha.yaml:67: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/alpha.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/alpha.yaml:79: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/alpha.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/alpha.yaml:101: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/alpha.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/alpha.yaml:128: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/alpha.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/alpha.yaml:130: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/alpha.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/alpha.yaml:148: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/alpha.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/alpha.yaml:218: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/alpha.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/alpha.yaml:234: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/alpha.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/alpha.yaml:113: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/alpha.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/alpha.yaml:157: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/alpha.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/alpha.yaml:159: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/alpha.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/alpha.yaml:178: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/alpha.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/alpha.yaml:187: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/alpha.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/alpha.yaml:189: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/alpha.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/alpha.yaml:208: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/alpha.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/alpha.yaml:243: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/alpha.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/alpha.yaml:245: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/alpha.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/alpha.yaml:264: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/alpha.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/alpha.yaml:274: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/alpha.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/alpha.yaml:290: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/alpha.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/alpha.yaml:299: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/alpha.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/alpha.yaml:315: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/alpha.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/arm64-arc-runner-set.yaml:15: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/arm64-arc-runner-set.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/automated-prs-manager.yaml:56: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/automated-prs-manager.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/automated-prs-manager.yaml:17: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/automated-prs-manager.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build-test.yaml:81: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/build-test.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build-test.yaml:87: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/build-test.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build-test.yaml:94: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/build-test.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build-test.yaml:531: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/build-test.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build-test.yaml:538: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/build-test.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/build-test.yaml:567: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/build-test.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build-test.yaml:1948: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/build-test.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/build-test.yaml:1952: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/build-test.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build-test.yaml:1963: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/build-test.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/build-test.yaml:2048: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/build-test.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build-test.yaml:2221: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/build-test.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build-test.yaml:2224: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/build-test.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/build-test.yaml:2253: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/build-test.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/build-test.yaml:2392: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/build-test.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build-test.yaml:2477: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/build-test.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build-test.yaml:2479: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/build-test.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build-test.yaml:2484: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/build-test.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/build-test.yaml:2510: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/build-test.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build-test.yaml:2705: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/build-test.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build-test.yaml:2707: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/build-test.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build-test.yaml:2712: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/build-test.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/build-test.yaml:2738: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/build-test.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build-test.yaml:3825: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/build-test.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/build-test.yaml:3829: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/build-test.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build-test.yaml:3840: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/build-test.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build-test.yaml:3921: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/build-test.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build-test.yaml:3998: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/build-test.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build-test.yaml:4075: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/build-test.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/build-test.yaml:4112: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/build-test.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build-test.yaml:171: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/build-test.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build-test.yaml:176: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/build-test.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build-test.yaml:920: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/build-test.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build-test.yaml:922: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/build-test.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build-test.yaml:929: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/build-test.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build-test.yaml:1149: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/build-test.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build-test.yaml:1151: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/build-test.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build-test.yaml:1158: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/build-test.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build-test.yaml:1220: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/build-test.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build-test.yaml:1222: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/build-test.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build-test.yaml:1229: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/build-test.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build-test.yaml:1585: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/build-test.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/build-test.yaml:1589: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/build-test.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build-test.yaml:1601: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/build-test.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/build-test.yaml:1673: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/build-test.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build-test.yaml:2903: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/build-test.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/build-test.yaml:2907: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/build-test.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build-test.yaml:2924: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/build-test.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/build-test.yaml:3065: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/build-test.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build-test.yaml:54: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/build-test.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build-test.yaml:60: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/build-test.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build-test.yaml:67: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/build-test.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build-test.yaml:517: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/build-test.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/build-test.yaml:518: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/build-test.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build-test.yaml:2591: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/build-test.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build-test.yaml:2593: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/build-test.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build-test.yaml:2598: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/build-test.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/build-test.yaml:2624: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/build-test.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build-test.yaml:473: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/build-test.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/build-test.yaml:479: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/build-test.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build-test.yaml:1296: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/build-test.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/build-test.yaml:1300: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/build-test.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build-test.yaml:1311: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/build-test.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/build-test.yaml:1447: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/build-test.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build-test.yaml:1467: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/build-test.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/build-test.yaml:1469: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/build-test.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/build-test.yaml:1475: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/build-test.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build-test.yaml:1487: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/build-test.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/build-test.yaml:1564: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/build-test.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build-test.yaml:1851: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/build-test.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/build-test.yaml:1855: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/build-test.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build-test.yaml:1866: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/build-test.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/build-test.yaml:1927: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/build-test.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build-test.yaml:3336: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/build-test.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/build-test.yaml:3340: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/build-test.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build-test.yaml:3351: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/build-test.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/build-test.yaml:3411: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/build-test.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build-test.yaml:43: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/build-test.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build-test.yaml:322: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/build-test.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build-test.yaml:326: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/build-test.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build-test.yaml:332: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/build-test.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build-test.yaml:342: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/build-test.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build-test.yaml:374: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/build-test.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build-test.yaml:412: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/build-test.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build-test.yaml:703: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/build-test.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/build-test.yaml:707: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/build-test.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build-test.yaml:718: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/build-test.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/build-test.yaml:902: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/build-test.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build-test.yaml:3657: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/build-test.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/build-test.yaml:3659: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/build-test.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/build-test.yaml:3665: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/build-test.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build-test.yaml:3676: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/build-test.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/build-test.yaml:3803: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/build-test.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build-test.yaml:138: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/build-test.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build-test.yaml:144: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/build-test.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build-test.yaml:151: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/build-test.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build-test.yaml:162: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/build-test.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build-test.yaml:204: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/build-test.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build-test.yaml:209: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/build-test.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build-test.yaml:276: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/build-test.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build-test.yaml:623: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/build-test.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build-test.yaml:625: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/build-test.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build-test.yaml:632: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/build-test.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build-test.yaml:661: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/build-test.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build-test.yaml:663: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/build-test.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build-test.yaml:670: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/build-test.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build-test.yaml:4131: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/build-test.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build-test.yaml:4133: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/build-test.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build-test.yaml:4140: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/build-test.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build-test.yaml:491: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/build-test.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build-test.yaml:3121: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/build-test.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build-test.yaml:3123: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/build-test.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build-test.yaml:3130: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/build-test.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build-test.yaml:187: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/build-test.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build-test.yaml:192: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/build-test.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build-test.yaml:261: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/build-test.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build-test.yaml:397: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/build-test.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build-test.yaml:430: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/build-test.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/build-test.yaml:436: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/build-test.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build-test.yaml:958: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/build-test.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build-test.yaml:960: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/build-test.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build-test.yaml:967: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/build-test.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build-test.yaml:4168: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/build-test.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build-test.yaml:4170: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/build-test.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build-test.yaml:4177: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/build-test.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build-test.yaml:223: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/build-test.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build-test.yaml:228: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/build-test.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build-test.yaml:234: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/build-test.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build-test.yaml:244: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/build-test.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build-test.yaml:359: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/build-test.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build-test.yaml:997: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/build-test.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/build-test.yaml:1001: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/build-test.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build-test.yaml:1012: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/build-test.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/build-test.yaml:1130: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/build-test.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build-test.yaml:2190: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/build-test.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build-test.yaml:2193: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/build-test.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build-test.yaml:2529: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/build-test.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build-test.yaml:2531: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/build-test.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build-test.yaml:2536: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/build-test.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/build-test.yaml:2572: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/build-test.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build-test.yaml:108: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/build-test.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build-test.yaml:114: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/build-test.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build-test.yaml:121: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/build-test.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build-test.yaml:293: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/build-test.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build-test.yaml:452: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/build-test.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/build-test.yaml:458: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/build-test.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build-test.yaml:1256: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/build-test.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build-test.yaml:1258: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/build-test.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build-test.yaml:1265: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/build-test.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build-test.yaml:2413: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/build-test.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build-test.yaml:2415: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/build-test.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build-test.yaml:2420: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/build-test.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/build-test.yaml:2456: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/build-test.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build-test.yaml:1186: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/build-test.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build-test.yaml:1188: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/build-test.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build-test.yaml:1195: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/build-test.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build-test.yaml:2643: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/build-test.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build-test.yaml:2645: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/build-test.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build-test.yaml:2650: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/build-test.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/build-test.yaml:2686: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/build-test.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build-test.yaml:2762: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/build-test.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/build-test.yaml:2766: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/build-test.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build-test.yaml:2784: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/build-test.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/build-test.yaml:2879: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/build-test.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build-test.yaml:3434: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/build-test.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/build-test.yaml:3436: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/build-test.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/build-test.yaml:3442: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/build-test.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build-test.yaml:3453: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/build-test.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/build-test.yaml:3636: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/build-test.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build-test.yaml:4207: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/build-test.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/build-test.yaml:4211: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/build-test.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build-test.yaml:4222: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/build-test.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/build-test.yaml:4448: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/build-test.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build-test.yaml:1696: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/build-test.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/build-test.yaml:1700: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/build-test.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build-test.yaml:1711: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/build-test.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/build-test.yaml:1830: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/build-test.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build-test.yaml:2068: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/build-test.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/build-test.yaml:2072: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/build-test.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build-test.yaml:2083: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/build-test.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/build-test.yaml:2177: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/build-test.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build-test.yaml:3084: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/build-test.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build-test.yaml:3086: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/build-test.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build-test.yaml:3093: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/build-test.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build-test.yaml:3160: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/build-test.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/build-test.yaml:3164: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/build-test.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build-test.yaml:3176: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/build-test.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/build-test.yaml:3317: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/build-test.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build-test.yaml:4468: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/build-test.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/build-test.yaml:4472: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/build-test.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build-test.yaml:4483: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/build-test.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/build-test.yaml:4562: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/build-test.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/daily-image-scans.yml:25: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/daily-image-scans.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/daily-image-scans.yml:43: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/daily-image-scans.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/daily-image-scans.yml:70: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/daily-image-scans.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/daily-image-scans.yml:97: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/daily-image-scans.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/daily-image-scans.yml:123: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/daily-image-scans.yml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/daily-image-scans.yml:125: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/daily-image-scans.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/daily-image-scans.yml:154: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/daily-image-scans.yml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/daily-image-scans.yml:156: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/daily-image-scans.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/daily-image-scans.yml:185: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/daily-image-scans.yml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/daily-image-scans.yml:187: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/daily-image-scans.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/daily-image-scans.yml:216: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/daily-image-scans.yml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/daily-image-scans.yml:218: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/daily-image-scans.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/e2e-infra-cleanup.yaml:32: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/e2e-infra-cleanup.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/e2e-infra-cleanup.yaml:39: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/e2e-infra-cleanup.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/e2e-infra-cleanup.yaml:72: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/e2e-infra-cleanup.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/e2e-workspace-cleanup.yaml:67: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/e2e-workspace-cleanup.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/e2e-workspace-cleanup.yaml:74: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/e2e-workspace-cleanup.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/e2e-workspace-cleanup.yaml:95: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/e2e-workspace-cleanup.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/e2e-workspace-cleanup.yaml:102: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/e2e-workspace-cleanup.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/image-deps-updater.yaml:17: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/image-deps-updater.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/image-deps-updater.yaml:76: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/image-deps-updater.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/image-deps-updater.yaml:79: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/image-deps-updater.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/image-deps-updater.yaml:90: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/image-deps-updater.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/image-deps-updater.yaml:114: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/image-deps-updater.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/kurl-addon-kots-publish.yaml:17: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/kurl-addon-kots-publish.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/kurl-addon-kots-test.yaml:43: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/kurl-addon-kots-test.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/license.yaml:16: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/license.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/license.yaml:19: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/license.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/license.yaml:27: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/license.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/license.yaml:45: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/license.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/regression.yaml:106: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/regression.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/regression.yaml:114: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/regression.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/regression.yaml:120: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/regression.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/regression.yaml:147: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/regression.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/regression.yaml:262: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/regression.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/regression.yaml:341: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/regression.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/regression.yaml:409: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/regression.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/regression.yaml:431: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/regression.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release-for-ec.yaml:37: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/release-for-ec.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release-for-ec.yaml:49: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/release-for-ec.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release-for-ec.yaml:70: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/release-for-ec.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release-for-ec.yaml:82: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/release-for-ec.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release-for-ec.yaml:103: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/release-for-ec.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release-for-ec.yaml:115: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/release-for-ec.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release-for-ec.yaml:130: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/release-for-ec.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release.yaml:289: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/release.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release.yaml:290: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/release.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/release.yaml:293: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/release.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release.yaml:359: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/release.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release.yaml:382: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/release.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release.yaml:108: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/release.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release.yaml:163: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/release.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release.yaml:175: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/release.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release.yaml:344: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/release.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/release.yaml:345: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/release.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release.yaml:419: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/release.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release.yaml:425: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/release.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/release.yaml:439: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/release.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/release.yaml:445: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/release.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release.yaml:461: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/release.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release.yaml:122: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/release.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release.yaml:126: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/release.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release.yaml:128: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/release.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release.yaml:137: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/release.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release.yaml:147: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/release.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release.yaml:190: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/release.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release.yaml:192: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/release.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release.yaml:218: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/release.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release.yaml:224: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/release.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release.yaml:316: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/release.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release.yaml:323: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/release.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release.yaml:401: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/release.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release.yaml:55: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/release.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release.yaml:70: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/release.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release.yaml:72: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/release.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release.yaml:80: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/release.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release.yaml:96: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/release.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release.yaml:20: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/release.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release.yaml:43: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/release.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release.yaml:234: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/release.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release.yaml:239: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/release.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release.yaml:242: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/release.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/release.yaml:259: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/release.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release.yaml:266: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/release.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/release.yaml:277: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/release.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/tag-helm-chart.yaml:13: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/tag-helm-chart.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/update-kubectl.yaml:11: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/update-kubectl.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/update-kubectl.yaml:20: update your workflow using https://app.stepsecurity.io/secureworkflow/replicatedhq/kots/update-kubectl.yaml/main?enable=pin","Warn: containerImage not pinned by hash: .github/actions/copy-assets/Dockerfile:1","Warn: containerImage not pinned by hash: .github/actions/copy-assets/Dockerfile:9: pin your Docker image by updating alpine:latest to alpine:latest@sha256:4bcff63911fcb4448bd4fdacec207030997caf25e9bea4045fa6c8c44de311d1","Warn: containerImage not pinned by hash: dev/dockerfiles/kotsadm-migrations/Dockerfile.local:1: pin your Docker image by updating schemahero/schemahero:0.17.10 to schemahero/schemahero:0.17.10@sha256:8ddb4b88def5d70c80d914e3704b2103310f4a0db0a51e010e82d7fc7d205cb4","Warn: containerImage not pinned by hash: dev/dockerfiles/kotsadm-migrations/Dockerfile.ttlsh:3","Warn: containerImage not pinned by hash: dev/dockerfiles/kotsadm-migrations/Dockerfile.ttlsh:5: pin your Docker image by updating debian:bookworm to debian:bookworm@sha256:731dd1380d6a8d170a695dbeb17fe0eade0e1c29f654cf0a3a07f372191c3f4b","Warn: containerImage not pinned by hash: dev/dockerfiles/kotsadm-web/Dockerfile.local:1: pin your Docker image by updating node:22-alpine to node:22-alpine@sha256:1b2479dd35a99687d6638f5976fd235e26c5b37e8122f786fcd5fe231d63de5b","Warn: containerImage not pinned by hash: dev/dockerfiles/kotsadm/Dockerfile.local:1","Warn: containerImage not pinned by hash: dev/dockerfiles/kotsadm/Dockerfile.local:5: pin your Docker image by updating golang:1.24.4-alpine to golang:1.24.4-alpine@sha256:68932fa6d4d4059845c8f40ad7e654e626f3ebd3706eef7846f319293ab5cb7a","Warn: containerImage not pinned by hash: dev/dockerfiles/kotsadm/Dockerfile.ttlsh:1: pin your Docker image by updating debian:bookworm-slim to debian:bookworm-slim@sha256:b1a741487078b369e78119849663d7f1a5341ef2768798f7b7406c4240f86aef","Warn: containerImage not pinned by hash: dev/dockerfiles/kurl-proxy/Dockerfile.local:1: pin your Docker image by updating golang:1.24.4-alpine to golang:1.24.4-alpine@sha256:68932fa6d4d4059845c8f40ad7e654e626f3ebd3706eef7846f319293ab5cb7a","Warn: containerImage not pinned by hash: dev/dockerfiles/kurl-proxy/Dockerfile.ttlsh:1: pin your Docker image by updating debian:bookworm-slim to debian:bookworm-slim@sha256:b1a741487078b369e78119849663d7f1a5341ef2768798f7b7406c4240f86aef","Warn: containerImage not pinned by hash: e2e/Dockerfile:1: pin your Docker image by updating ubuntu:22.04 to ubuntu:22.04@sha256:1aa979d85661c488ce030ac292876cf6ed04535d3a237e49f61542d8e5de5ae0","Warn: goCommand not pinned by hash: dev/scripts/dev-deps.sh:16","Warn: downloadThenRun not pinned by hash: e2e/scripts/deps.sh:59","Warn: downloadThenRun not pinned by hash: e2e/scripts/deps.sh:63","Info:   0 out of 232 GitHub-owned GitHubAction dependencies pinned","Info:   0 out of  77 third-party GitHubAction dependencies pinned","Info:   0 out of  12 containerImage dependencies pinned","Info:   1 out of   2 goCommand dependencies pinned","Info:   0 out of   2 downloadThenRun dependencies pinned","Info:   1 out of   1 npmCommand dependencies pinned"],"documentation":{"short":"Determines if the project has declared and pinned the dependencies of its build process.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#pinned-dependencies"}},{"name":"Vulnerabilities","score":2,"reason":"8 existing vulnerabilities detected","details":["Warn: Project is vulnerable to: GO-2022-0635","Warn: Project is vulnerable to: GO-2022-0646","Warn: Project is vulnerable to: GHSA-9h84-qmv7-982p","Warn: Project is vulnerable to: GHSA-f9f8-9pmf-xv68","Warn: Project is vulnerable to: GHSA-v6h2-p8h4-qcjw","Warn: Project is vulnerable to: GHSA-3xgq-45jj-v275","Warn: Project is vulnerable to: GHSA-76c9-3jph-rj3q","Warn: Project is vulnerable to: GHSA-c2qf-rxjj-qqgw"],"documentation":{"short":"Determines if the project has open, known unfixed vulnerabilities.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#vulnerabilities"}}]},"last_synced_at":"2025-08-18T18:36:58.906Z","repository_id":37546748,"created_at":"2025-08-18T18:36:58.907Z","updated_at":"2025-08-18T18:36:58.907Z"},"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":28490057,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-01-16T23:55:29.509Z","status":"ssl_error","status_checked_at":"2026-01-16T23:55:29.108Z","response_time":107,"last_error":"SSL_connect returned=1 errno=0 peeraddr=140.82.121.5:443 state=error: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["gitops","go","golang","kubernetes","kubernetes-applications"],"created_at":"2024-08-01T02:01:03.859Z","updated_at":"2026-01-17T00:26:38.819Z","avatar_url":"https://github.com/replicatedhq.png","language":"Go","funding_links":[],"categories":["Go","kubernetes","Configuration Management","Repositories","Cluster"],"sub_categories":[],"readme":"[![go.dev reference](https://img.shields.io/badge/go.dev-reference-007d9c?logo=go\u0026logoColor=white\u0026style=flat-square)](https://pkg.go.dev/github.com/replicatedhq/kots)\n\n# Kubernetes Off-The-Shelf (KOTS) Software\nReplicated KOTS is the collective set of tools that enable the distribution and management of Kubernetes Off-The-Shelf (KOTS) software. The Kots CLI (a Kubectl plugin) is a general purpose, client-side binary for configuring and building dynamic Kubernetes manifests. The Kots CLI also serves as the bootstrapper for the in-cluster Kubernetes application Admin Console [kotsadm](https://github.com/replicatedhq/kots/tree/main/web) which can be used to automate the core Kots CLI tasks for managing applications (license verification, configuration, updates, image renaming, version controlling changes, and deployment) as well as additional KOTS tasks (running preflight checks and performing support bundle analysis).\n\n## Distributing a KOTS application\nSoftware vendors can [package their Kubernetes applications](https://docs.replicated.com/vendor/distributing-workflow) or [Helm charts](https://docs.replicated.com/vendor/helm-overview) or [Operators](https://docs.replicated.com/vendor/operator-packaging-about) as a KOTS application in order to distribute the application to cluster operators.\n\n## Kots CLI Documentation\nCheck out the [full docs on the cluster operator experience](https://docs.replicated.com/reference/kots-cli-getting-started) for using the Kots CLI as a Kubectl plugin.\n\n## Try Kots\nTry Kots as a cluster operator by installing the Replicated sample app ([Sentry Pro Example](https://github.com/replicatedhq/kots-sentry/)) into an existing Kubernetes cluster. First, install the Kots CLI (a Kubectl plugin) on your workstation:\n```\ncurl https://kots.io/install | bash\n```\n\n### Run `kots install`\n\nThe `install` command is the recommended way to learn KOTS. Executing the `install` command will install an application and the [kotsadm](https://github.com/replicatedhq/kotsadm) Admin Console to an existing Kubernetes cluster. This command supports installing Helm charts (without Tiller), standard Kubernetes applications and also Replicated KOTS apps.\n\nContinue with the demo by running the following command:\n```\nkubectl kots install sentry-pro\n```\n\nSet a namespace for the admin console and the application components to be installed, and provide a password for the admin console. After this command completes, the kotsadm Admin Console will be running in your cluster, listening on port :8800 on a ClusterIP service in the namespace you deployed the application to. By default this is exposed to your workstation using kubectl port-forward, but you could set up an ingress/load balancer of your own.\n\n### Access the Admin Console\nVisit http://localhost:8800 to access the Admin Console, enter the password.\n\nDownload the [sample license](https://kots.io/sample-license) for Sentry Pro \u0026 upload it to the console. You'll then be presented with configuration settings, preflight checks and other application options.\n\nIf you terminate your terminal session, the port-forward will also terminate. To access the admin console again, just run:\n```\nkubectl kots admin-console --namespace sentry-pro\n```\n\n## Supportability\n\nSupports OSX (including Apple Silicon arm64) and Linux platforms.\n\n# Community\n\nFor questions about using KOTS, there's a [Replicated Community](https://help.replicated.com/community) forum, and a [#kots channel in Kubernetes Slack](https://kubernetes.slack.com/channels/kots).\n\n# Notifications\n\nBy default, KOTS will leverage [MinIO](https://github.com/minio/minio) as a standalone object store instance to store application archives and support bundles. All communication between KOTS and the MinIO object store is limited to a REST API released under the Apache 2.0 license. KOTS has not modified the MinIO source code. Use of [MinIO](https://github.com/minio/minio) is currently governed by the GNU AGPLv3 license that can be found in their [LICENSE](https://github.com/minio/minio/blob/main/LICENSE) file. To remove MinIO usage for this use case in an existing cluster, an optional install flag `--with-minio=false` is available for new [KOTS installs](https://docs.replicated.com/reference/kots-cli-install) or [upgrades from existing versions](https://docs.replicated.com/reference/kots-cli-admin-console-upgrade). To remove MinIO usage for this use case in an embedded cluster, the [`disableS3`](https://kurl.sh/docs/add-ons/kotsadm#advanced-install-options) option is available in the KOTS add-on and can be used for new installs or upgrades.\n\n# Software Bill of Materials\nSigned SBOMs for KOTS Go dependencies and are included in each release.\nUse [Cosign](https://github.com/sigstore/cosign) to validate the signature by running the following\ncommand.\n```shell\ncosign verify-blob --key sbom/key.pub --signature sbom/kots-sbom.tgz.sig sbom/kots-sbom.tgz\n```\n\n# Development\n\n### Requirements\n\n- MacOS\n- Docker Desktop with Kubernetes enabled\n- Homebrew\n\n### Running the Development Environment\n\n1. Clone the KOTS repo:\n    ```bash\n    git clone https://github.com/replicatedhq/kots.git\n    cd kots\n    ```\n\n1. From the root directory, run:\n    ```bash\n    make dev\n    ```\n\n1. Once the development environment is running, you can access the admin console:\n   - Directly at http://localhost:30808\n   - Via kURL proxy at http://localhost:30880\n\n### Developing kotsadm web\n\nChanges to the kotsadm web component are reflected in real-time; no manual steps are required.\n\nHowever, to add, remove, or upgrade a dependency / package:\n\n1. Exec into the kotsadm-web container:\n    ```bash\n    make kotsadm-web-up\n    ```\n\n1. Run the desired `yarn` commands. For example:\n    ```bash\n    yarn add \u003cpackage\u003e\n    ```\n\n1. When finished, exit the container:\n    ```bash\n    exit\n    ```\n\n### Developing kotsadm API\n\n1. To apply your current changes, run the following commands:\n    ```bash\n    make kotsadm-up\n    ```\n    ```bash\n    make build run\n    ```\n\n1. To apply additional changes, stop the current process with Ctrl+C, then run the following command:\n    ```bash\n    make build run\n    ```\n\n1. When finished developing, run the following command to revert back to the original state:\n    ```bash\n    exit\n    ```\n    ```bash\n    make kotsadm-down\n    ```\n\n### Developing kurl-proxy web / API\n\n1. To apply your current changes, run the following commands:\n    ```bash\n    make kurl-proxy-up\n    ```\n    ```bash\n    make build run\n    ```\n\n1. To apply additional changes, stop the current process with Ctrl+C, then run the following command:\n    ```bash\n    make build run\n    ```\n\n1. When finished developing, run the following command to revert back to the original state:\n    ```bash\n    exit\n    ```\n    ```bash\n    make kurl-proxy-down\n    ```\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Freplicatedhq%2Fkots","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Freplicatedhq%2Fkots","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Freplicatedhq%2Fkots/lists"}