Tekton Catalog — Health Report

Baseline tektoncd/catalog@8e41018 · generated 2026-06-08 14:59 UTC · primary manifests only
158
primary manifests
123
API outdated
0
deprecated
1772
CVE critical
18437
CVE high
46
mutable images
79
$(params) in script
5
privileged
How to read this
Summary
API version outdated123
Uses PipelineResources0
Uses taskRef.bundle0
$(params) in script (review)79
Privileged securityContext (review)5
:latest / untagged images7
Mutable-tag images (not digest)46
Missing minVersion3
Missing spec.description7
Missing tests/run.yaml83
Deprecated0
API currency by kind
KindCurrent/Total%
Pipeline0 / 20%
StepAction1 / 1100%
Task34 / 15521%

Images & CVEs

Vulnerable images 1772 critical · 18437 high across 87 images
ImageSeverityUsed by
ghcr.io/tektoncd/plumbing/test-runner@sha256:44aa00796831a4ed5586152058dd96a6d14174b8a4ea9fcae663fb37f72c9454315 crit 3345 high
1 resource(s)
  • task/codecov/0.2/codecov.yaml
docker.io/python:3.11.1-bullseye237 crit 2134 high
1 resource(s)
  • task/pytest/0.2/pytest.yaml
python:3.9183 crit 879 high
1 resource(s)
  • task/upload-pypi/0.2/upload-pypi.yaml
gcr.io/google.com/cloudsdktool/cloud-sdk:slim@sha256:70d3c9ef711c704259b06485f9ab3bab6e1b5c99e4a5c1ed37f9338004664c1790 crit 801 high
1 resource(s)
  • task/gcs-generic/0.1/gcs-generic.yaml
ghcr.io/ko-build/ko:5a95f8abc540475366126d6c34baf7014794315c83 crit 1825 high
1 resource(s)
  • task/ko/0.1/ko.yaml
gcr.io/cloud-builders/gradle@sha256:96d6343589392afd9eab8c4463ec899b8b1c972e7cd70678a70a4821c16eb4c968 crit 663 high
1 resource(s)
  • task/jib-gradle/0.4/jib-gradle.yaml
docker.io/ibmcom/ibm-cloud-developer-tools-amd64:1.2.3@sha256:d755714b208f9cb6162c6d9cef09337d6de88bbde8ee534b6973721ec328410263 crit 613 high
1 resource(s)
  • task/ibmcloud/0.1/ibmcloud.yaml
gcr.io/cloud-builders/gke-deploy@sha256:6d18a1efabf8a7ea7f2169c93f3e01fc5b8247b12099618c496ab097aaae341f60 crit 655 high
1 resource(s)
  • task/gke-deploy/0.1/gke-deploy.yaml
docker.io/hugomods/hugo:0.122.0@sha256:e90f2e6786969463f3475c7d5e7f031cb5dbf75a8394687d52f99d6c9d0eda0d45 crit 376 high
1 resource(s)
  • task/hugo/0.1/hugo.yaml
docker.io/instrumenta/helm-conftest@sha256:11cb9fd6d101d80af87931db359d4b3ad9a843cf0eb1ea0ab7173424eb37994844 crit 277 high
1 resource(s)
  • task/helm-conftest/0.1/helm-conftest.yaml
docker.io/library/docker:stable@sha256:18ff92d3d31725b53fa6633d60bed323effb6d5d4588be7b547078d384e0d4bf39 crit 444 high
1 resource(s)
  • task/docker-build/0.1/docker-build.yaml
gcr.io/cloud-builders/kubectl@sha256:8ab94be8b2b4f3d117f02d868b39540fddd225447abf4014f7ba4765cb39f75336 crit 428 high
1 resource(s)
  • task/kubernetes-actions/0.2/kubernetes-actions.yaml
docker.io/library/buildpack-deps:stable-curl@sha256:3d5e59c47d5f82a769ad3f372cc9f86321e2e2905141bba974b75d3c08a53e8e36 crit 131 high
1 resource(s)
  • task/wget/0.1/wget.yaml
quay.io/openshift/origin-upi-installer:4.634 crit 412 high
2 resource(s)
  • task/openshift-install/0.1/openshift-install.yaml
  • task/openshift-uninstall/0.1/openshift-uninstall.yaml
docker.io/weaveworks/eksctl:0.35.0@sha256:48c1fa508970a01fd87a73ac7932a7160479d678cd019a3c84533d911fc5432730 crit 284 high
2 resource(s)
  • task/eks-cluster-create/0.1/eks-cluster-create.yaml
  • task/eks-cluster-teardown/0.1/eks-cluster-teardown.yaml
index.docker.io/aipipeline/kubeclient:v0.0.229 crit 373 high
1 resource(s)
  • task/kubectl-deploy-pod/0.1/kubectl-deploy-pod.yaml
docker.io/hashicorp/terraform:light25 crit 72 high
1 resource(s)
  • task/terraform-cli/0.2/terraform-cli.yaml
gcr.io/google.com/cloudsdktool/cloud-sdk22 crit 149 high
1 resource(s)
  • task/gcloud/0.3/gcloud.yaml
python@sha256:4ec7de21666118edfa1b90c79b34c282624d03e2e560fa1b542b2069a65b367f21 crit 88 high
1 resource(s)
  • task/robot-framework/0.1/robot-framework.yaml
docker.io/asciidoctor/docker-asciidoctor:1.16@sha256:36117d900e9365923dcf1d79c99eb82192c3d1b81ca1bb077e3373f722532e0517 crit 78 high
1 resource(s)
  • task/asciidoctor/0.1/asciidoctor.yaml
docker.io/aquasec/trivy@sha256:944a044451791617cc0ed2ee4d1942a4f66b790d527fcd0575a6b399ccbc05a117 crit 67 high
1 resource(s)
  • task/trivy-scanner/0.2/trivy-scanner.yaml
quay.io/openshift/origin-cli:4.913 crit 85 high
1 resource(s)
  • task/blue-green-deploy/0.2/blue-green-deploy.yaml
docker.io/stackrox/kube-linter:0.2.2-2-g7d10a69154-alpine@sha256:e520e9d8d3a2dfa611914836536545b135845e7bda9f1df34b060e116232dbf011 crit 99 high
1 resource(s)
  • task/kube-linter/0.1/kube-linter.yaml
cgr.dev/chainguard/git:2.39@sha256:fdaef225e3fd5cf190520553ff765f186a4363390af3f19912897b0b28f87aeb11 crit 69 high
1 resource(s)
  • task/git-rebase/0.1/git-rebase.yaml
cgr.dev/chainguard/git:root-2.39@sha256:7759f87050dd8bacabe61354d75ccd7f864d6b6f8ec42697db7159eccd49113911 crit 69 high
1 resource(s)
  • task/git-cli/0.4/git-cli.yaml
quay.io/chmouel/github-app-token@sha256:bc45937ae588df876555ebb56c36350ed74592c7f55f2df255cabef39c926a8811 crit 61 high
1 resource(s)
  • task/github-app-token/0.2/github-app-token.yaml
docker.io/library/python:3.9-alpine3.13@sha256:437482dd314471f5f10967f7376489d9e7f67c111850c123cc725a1741b66aac11 crit 52 high
1 resource(s)
  • task/github-request-reviewers/0.1/github-request-reviewers.yaml
docker.io/alpine/flake8@sha256:bb280bf2af4a434be912f25bbcb6c79ea4d735ed3c8e259f96c405998920871f11 crit 46 high
1 resource(s)
  • task/flake8/0.1/flake8.yaml
docker.io/cytopia/mypy:latest-0.4@sha256:0d5e1a97ce68c4aeececc818c8bf19301b396edbe36a6f83eca8248d7d84a05c11 crit 44 high
1 resource(s)
  • task/mypy-lint/0.2/mypy-lint.yaml
ghcr.io/tektoncd/github.com/tektoncd/pipeline/cmd/git-init:v0.18.110 crit 94 high
1 resource(s)
  • task/git-batch-merge/0.3/git-batch-merge.yaml
quay.io/openshift/origin-cli:4.610 crit 87 high
1 resource(s)
  • task/istio-canary-release/0.1/istio-canary-release.yaml
ghcr.io/tektoncd/plumbing/tkn@sha256:d17fec04f655551464a47dd59553c9b44cf660cc72dbcdbd52c0b8e8668c057910 crit 73 high
1 resource(s)
  • task/tkn/0.5/tkn.yaml
docker.io/lachlanevenson/k8s-kubectl@sha256:3a5e22a406a109f4f26ec06b5f1f6a66ae0cd0e185bc28499eb7b7a3bbf1fe099 crit 91 high
3 resource(s)
  • task/boskos-acquire/0.1/boskos-acquire.yaml
  • task/boskos-release/0.1/boskos-release.yaml
  • task/tekton-operator-install/0.1/tekton-operator-install.yaml
gcr.io/k8s-staging-boskos/boskosctl@sha256:a7fc984732c5dd0b4e0fe0a92e2730fa4b6bddecd0f6f6c7c6b5501abe4ab1059 crit 88 high
2 resource(s)
  • task/boskos-acquire/0.1/boskos-acquire.yaml
  • task/boskos-release/0.1/boskos-release.yaml
docker.io/elnebuloso/prettier:2.1.1@sha256:a42d03000e17d343f57ec156820d64934c76d9a0d2ce4abd602f92fd18d5e6d49 crit 68 high
1 resource(s)
  • task/prettier/0.1/prettier.yaml
quay.io/stackrox-io/roxctl:3.71.08 crit 78 high
3 resource(s)
  • task/rhacs-deployment-check/3.71/rhacs-deployment-check.yaml
  • task/rhacs-image-check/3.71/rhacs-image-check.yaml
  • task/rhacs-image-scan/3.71/rhacs-image-scan.yaml
python:3.10.1-alpine3.158 crit 36 high
1 resource(s)
  • task/github-set-status/0.4/github-set-status.yaml
python:3.10.1-alpine3.15@sha256:affe0faa14e7553fc570beec3864e74b5e36f8c19b2bb49ae8ba79c0e9e7236e8 crit 36 high
1 resource(s)
  • task/gitea-set-status/0.1/gitea-set-status.yaml
docker.io/lachlanevenson/k8s-helm@sha256:0a068ae407e21d1836c6a89a1e9e81af1e55fa56890998e33d5caabdbb51e77b7 crit 75 high
3 resource(s)
  • task/helm-render-manifests-from-repo/0.1/helm-render-manifests-from-repo.yaml
  • task/helm-upgrade-from-repo/0.3/helm-upgrade-from-repo.yaml
  • task/helm-upgrade-from-source/0.4/helm-upgrade-from-source.yaml
docker.io/apache/camel-k:2.0.07 crit 58 high
1 resource(s)
  • task/kamel-run/0.1/kamel-run.yaml
docker.io/anchore/syft@sha256:dd40bc09ff2bf3b860c399e7cf5c2db088e84c85937ac05fdeca3cd88fe2a7287 crit 33 high
1 resource(s)
  • task/syft/0.1/syft.yaml
quay.io/shipwright/cli:0.126 crit 55 high
1 resource(s)
  • task/shp/0.1/shp.yaml
quay.io/stackrox-io/roxctl:4.4.26 crit 30 high
5 resource(s)
  • task/rhacs-deployment-check/4.0/rhacs-deployment-check.yaml
  • task/rhacs-generic/0.1/rhacs-generic.yaml
  • task/rhacs-image-check/4.0/rhacs-image-check.yaml
  • task/rhacs-image-scan/4.0/rhacs-image-scan.yaml
  • task/rhacs-m2m-authenticate/0.1/rhacs-m2m-authenticate.yaml
docker.io/datree/datree:0.15.22@sha256:85cf78f16e67e08ea9df18ab6d3d823a576bfbcc5937f30629eb4859fdeb3fd15 crit 66 high
1 resource(s)
  • task/datree/0.1/datree.yaml
docker.io/iancoffey/prometheus-gate-cf7c3e662ede0a4e9bc24d37d2af86d6@sha256:c3df9d8400aef7acb76f409d1e347c5ecaa6f28a69df50981c14bfe87add85d75 crit 61 high
1 resource(s)
  • task/prometheus-gate/0.1/prometheus-gate.yaml
docker.io/iancoffey/sendevent-89c3de01c503ceb66b676a3e41c265ed@sha256:fc39998cba7ad8e54323b948b56b11b0b235996069349fb74776865fedf182a55 crit 60 high
1 resource(s)
  • task/cloudevent/0.1/cloudevent.yaml
ghcr.io/tektoncd/plumbing/tkn@sha256:328b4a98eb566ccad4aafcd7fb8307a97c5771e681d85bda669e21e37c071a815 crit 47 high
2 resource(s)
  • stepaction/tekton-catalog-publish/0.3/tekton-catalog-publish.yaml
  • task/tekton-catalog-publish/0.2/tekton-catalog-publish.yaml
docker.io/library/node:12-alpine@sha256:dfbebf17bfb014e1e7068e76325a117bccf8679c68aec6a28514184a209c8bae5 crit 38 high
1 resource(s)
  • task/npm/0.1/npm.yaml
docker.io/library/python:3.9.19-alpine3.20@sha256:45cc18540209d878c2b24080cf8f64fc37603721b67d0ecc508799e2f9a9b21d5 crit 30 high
1 resource(s)
  • task/python-boto3-aws/0.1/python-boto3-aws.yaml
mcr.microsoft.com/azure-cli:2.0.784 crit 55 high
1 resource(s)
  • task/az/0.1/az.yaml
docker.io/mikefarah/yq:4.27.5@sha256:2be3626ed633fbe1fc33ee9343a1256a6be53334412b2251b9a859f8c145bb534 crit 50 high
1 resource(s)
  • task/yq/0.4/yq.yaml
ghcr.io/linuxsuren/gogit:v0.0.1@sha256:33e06228b645dd46102c0870c11d420a213cdab84b7a0700dcb6da6ce8b530d64 crit 40 high
1 resource(s)
  • task/gogit/0.1/gogit.yaml
docker.io/library/bash:5.1.4@sha256:b208215a4655538be652b2769d82e576bc4d0a2bb132144c060efc5be8c3f5d64 crit 34 high
1 resource(s)
  • task/buildpacks/0.6/buildpacks.yaml
docker.io/curlimages/curl:7.72.0@sha256:bd5bbd35f89b867c1dccbc84b8be52f3f74dea20b46c5fe0db3780e040afcb6f4 crit 27 high
1 resource(s)
  • task/curl/0.1/curl.yaml
docker.io/library/alpine:3.12@sha256:36553b10a4947067b9fbb7d532951066293a68eae893beba1d9235f7d11a20ad4 crit 25 high
1 resource(s)
  • task/write-file/0.1/write-file.yaml
gcr.io/cloud-builders/mvn@sha256:57523fc43394d6d9d2414ee8d1c85ed7a13460cbb268c3cd16d28cfb3859e6413 crit 159 high
2 resource(s)
  • task/jib-maven/0.5/jib-maven.yaml
  • task/maven/0.4/maven.yaml
docker.io/mikefarah/yq:4.47.13 crit 30 high
1 resource(s)
  • task/yq/0.5/yq.yaml
docker.io/appleboy/drone-scp:1.6.14@sha256:0e0597678b948b0aa09888c66ac75af904cce81baf6af955208527d259c618183 crit 26 high
1 resource(s)
  • task/remote-scp/0.1/remote-scp.yaml
docker:dind3 crit 14 high
1 resource(s)
  • task/docker-build/0.1/docker-build.yaml
docker.io/42crunch/docker-api-security-audit:v4.2@sha256:350df27b2a1b1aac8e3772d8fb13b254569d49c960f31ab58aa3a1e2fbcec3fe2 crit 40 high
1 resource(s)
  • task/42crunch-api-security-audit/0.3/42crunch-api-security-audit.yaml
docker.io/cytopia/black:latest-0.2@sha256:2ec766f1c7e42e6b59c0873ce066fa0a2aa2bf8a80dbc1c40f1566bb539303e02 crit 14 high
1 resource(s)
  • task/black/0.2/black.yaml
docker.io/library/python:3.12-slim2 crit 7 high
1 resource(s)
  • task/ai-code-review/0.1/ai-code-review.yaml
docker.io/shaowenchen/rsync-sshpass:v1@sha256:934985f9a955f416c7378e22d847ac1320fcae1495ee70ad53c9f9fc08b993231 crit 43 high
1 resource(s)
  • task/rsync/0.1/rsync.yaml
docker.io/sonatype/nexus-iq-cli:1.136.0-011 crit 25 high
1 resource(s)
  • task/nexus-lifecycle-scan/0.1/nexus-lifecycle-scan.yaml
registry.access.redhat.com/ubi8/python-38:1-34.1599745032384 high
1 resource(s)
  • task/github-open-pr/0.2/github-open-pr.yaml
registry.access.redhat.com/ubi8/python-38@sha256:af6f93b81f9313de95966e8cd681edb9dbcb5fdbddc5a4cc365af8e4534096ef372 high
1 resource(s)
  • task/gitlab-set-status/0.2/gitlab-set-status.yaml
registry.access.redhat.com/ubi8/python-39@sha256:27e795fd6b1b77de70d1dc73a65e4c790650748a9cfda138fdbd194b3d6eea3d283 high
1 resource(s)
  • task/jira-get-ticket-status/0.1/jira-get-ticket-status.yaml
registry.access.redhat.com/ubi8/python-311@sha256:43605cb2491ef2297a7acf4b4bf0b7f54f0c91b96daf12ae41c49cc7f192b153185 high
1 resource(s)
  • task/buildpacks-phases/0.3/buildpacks-phases.yaml
ghcr.io/oracle/oci-cli:sha-5846bb2100 high
1 resource(s)
  • task/oci-cli/0.1/oci-cli.yaml
anchore/engine-cli:latest99 high
1 resource(s)
  • task/anchore-cli/0.1/anchore-cli.yaml
docker.io/centos@sha256:a1801b843b1bfaf77c501e7a6d3f709401a1e0c83863037fa3aab063a7fdb9dc96 high
2 resource(s)
  • task/stackrox-image-check/0.1/stackrox-image-check.yaml
  • task/stackrox-image-scan/0.1/stackrox-image-scan.yaml
registry.access.redhat.com/ubi8/ubi:8.292 high
4 resource(s)
  • task/github-add-labels/0.1/github-add-labels.yaml
  • task/github-close-issue/0.2/github-close-issue.yaml
  • task/gitlab-add-label/0.1/gitlab-add-label.yaml
  • task/trigger-jenkins-job/0.1/trigger-jenkins-job.yaml
registry.access.redhat.com/ubi8:8.292 high
1 resource(s)
  • task/jenkins/0.1/jenkins.yaml
quay.io/openshift-pipeline/s2i:nightly89 high
1 resource(s)
  • task/s2i/0.3/s2i.yaml
registry.access.redhat.com/ubi8/ubi-minimal:8.272 high
8 resource(s)
  • task/create-gitlab-release/0.1/create-gitlab-release.yaml
  • task/github-add-comment/0.7/github-add-comment.yaml
  • task/github-add-gist/0.2/github-add-gist.yaml
  • task/github-create-deployment-status/0.1/github-create-deployment-status.yaml
  • task/github-create-deployment/0.2/github-create-deployment.yaml
  • task/kube-linter/0.1/kube-linter.yaml
  • task/maven/0.4/maven.yaml
  • task/openshift-install/0.1/openshift-install.yaml
quay.io/jpmaida1/jq@sha256:f90645c017ba8b1a2fff44309231cb7f8fd3a441690e17c15a53e60997f309c051 high
1 resource(s)
  • task/jq/0.1/jq.yaml
quay.io/halkyonio/skopeo-jq:0.1.3@sha256:1b3d21ad541227dc9d3e793d18cef9eb00a969c0c01eb09cab88997bc63680c648 high
1 resource(s)
  • task/buildpacks-phases/0.3/buildpacks-phases.yaml
docker.io/library/gradle:7.6-jdk8@sha256:ebda657f66e04cfa9f152896b4fa70bea4b80561a836adddca3ed85d622f889825 high
1 resource(s)
  • task/gradle/0.4/gradle.yaml
registry.gitlab.com/pipeline-components/pylint:0.12.0@sha256:051b701936dfab6fa27bd1ebd50ef56b19577565661bc0227e50dd1cf94a3d6e22 high
1 resource(s)
  • task/pylint/0.3/pylint.yaml
registry.access.redhat.com/ubi8/ubi-minimal@sha256:b2a1bec3dfbc7a14a1d84d98934dfe8fdde6eb822a211286601cf109cbccb07514 high
1 resource(s)
  • task/buildpacks-phases/0.3/buildpacks-phases.yaml
gcr.io/knative-releases/knative.dev/client/cmd/kn:latest1 high
2 resource(s)
  • task/kn-apply/0.2/kn-apply.yaml
  • task/kn/0.2/kn.yaml
docker.io/goreleaser/goreleaser@sha256:2a949686d9886ac7c10582a6c29116fd29d3077d02755e87e111870d63607725clean
1 resource(s)
  • task/goreleaser/0.2/goreleaser.yaml
* remote error: GET https://index.docker.io/v2/goreleaser/g
quay.io/buildah/stable:v1.17.0clean
1 resource(s)
  • task/s2i/0.3/s2i.yaml
* remote error: unsupported MediaType: "application/vnd.doc
quay.io/vinamra2807/openshift-client-python@sha256:17c6b464c2fa930d09203b75b68dbcf120c46a4e8fe56b60fb4e5d0015798343clean
1 resource(s)
  • task/openshift-client-python/0.1/openshift-client-python.yaml
2026-06-08T16:54:21+02:00 FATAL Fatal error run error: image
Task 109 with concrete images
ResourceImages & CVEs
task/codecov/0.2/codecov.yaml
  • ghcr.io/tektoncd/plumbing/test-runner@sha256:44aa00796831a4ed5586152058dd96a6d14174b8a4ea9fcae663fb37f72c9454 — 315 crit 3345 high
task/pytest/0.2/pytest.yaml
  • docker.io/python:3.11.1-bullseyeunpinned — 237 crit 2134 high
task/upload-pypi/0.2/upload-pypi.yaml
  • python:3.9unpinned — 183 crit 879 high
task/gcs-generic/0.1/gcs-generic.yaml
  • gcr.io/google.com/cloudsdktool/cloud-sdk:slim@sha256:70d3c9ef711c704259b06485f9ab3bab6e1b5c99e4a5c1ed37f9338004664c17 — 90 crit 801 high
task/ko/0.1/ko.yaml
  • ghcr.io/ko-build/ko:5a95f8abc540475366126d6c34baf7014794315cunpinned — 83 crit 1825 high
task/jib-gradle/0.4/jib-gradle.yaml
  • gcr.io/cloud-builders/gradle@sha256:96d6343589392afd9eab8c4463ec899b8b1c972e7cd70678a70a4821c16eb4c9 — 68 crit 663 high
task/ibmcloud/0.1/ibmcloud.yaml
  • docker.io/ibmcom/ibm-cloud-developer-tools-amd64:1.2.3@sha256:d755714b208f9cb6162c6d9cef09337d6de88bbde8ee534b6973721ec3284102 — 63 crit 613 high
task/gke-deploy/0.1/gke-deploy.yaml
  • gcr.io/cloud-builders/gke-deploy@sha256:6d18a1efabf8a7ea7f2169c93f3e01fc5b8247b12099618c496ab097aaae341f — 60 crit 655 high
task/hugo/0.1/hugo.yaml
  • docker.io/hugomods/hugo:0.122.0@sha256:e90f2e6786969463f3475c7d5e7f031cb5dbf75a8394687d52f99d6c9d0eda0d — 45 crit 376 high
task/helm-conftest/0.1/helm-conftest.yaml
  • docker.io/instrumenta/helm-conftest@sha256:11cb9fd6d101d80af87931db359d4b3ad9a843cf0eb1ea0ab7173424eb379948 — 44 crit 277 high
task/docker-build/0.1/docker-build.yaml
  • docker.io/library/docker:stable@sha256:18ff92d3d31725b53fa6633d60bed323effb6d5d4588be7b547078d384e0d4bf — 39 crit 444 high
  • docker:dindunpinned — 3 crit 14 high
task/kubernetes-actions/0.2/kubernetes-actions.yaml
  • gcr.io/cloud-builders/kubectl@sha256:8ab94be8b2b4f3d117f02d868b39540fddd225447abf4014f7ba4765cb39f753 — 36 crit 428 high
task/wget/0.1/wget.yaml
  • docker.io/library/buildpack-deps:stable-curl@sha256:3d5e59c47d5f82a769ad3f372cc9f86321e2e2905141bba974b75d3c08a53e8e — 36 crit 131 high
task/openshift-install/0.1/openshift-install.yaml
  • registry.access.redhat.com/ubi8/ubi-minimal:8.2unpinned — 72 high
  • quay.io/openshift/origin-upi-installer:4.6unpinned — 34 crit 412 high
task/openshift-uninstall/0.1/openshift-uninstall.yaml
  • quay.io/openshift/origin-upi-installer:4.6unpinned — 34 crit 412 high
task/eks-cluster-create/0.1/eks-cluster-create.yaml
  • docker.io/weaveworks/eksctl:0.35.0@sha256:48c1fa508970a01fd87a73ac7932a7160479d678cd019a3c84533d911fc54327 — 30 crit 284 high
task/eks-cluster-teardown/0.1/eks-cluster-teardown.yaml
  • docker.io/weaveworks/eksctl:0.35.0@sha256:48c1fa508970a01fd87a73ac7932a7160479d678cd019a3c84533d911fc54327 — 30 crit 284 high
task/kubectl-deploy-pod/0.1/kubectl-deploy-pod.yaml
  • index.docker.io/aipipeline/kubeclient:v0.0.2unpinned — 29 crit 373 high
task/boskos-acquire/0.1/boskos-acquire.yaml
  • gcr.io/k8s-staging-boskos/boskosctl@sha256:a7fc984732c5dd0b4e0fe0a92e2730fa4b6bddecd0f6f6c7c6b5501abe4ab105 — 9 crit 88 high
  • docker.io/lachlanevenson/k8s-kubectl@sha256:3a5e22a406a109f4f26ec06b5f1f6a66ae0cd0e185bc28499eb7b7a3bbf1fe09 — 9 crit 91 high
  • gcr.io/k8s-staging-boskos/boskosctl@sha256:a7fc984732c5dd0b4e0fe0a92e2730fa4b6bddecd0f6f6c7c6b5501abe4ab105 — 9 crit 88 high
task/terraform-cli/0.2/terraform-cli.yaml
  • docker.io/hashicorp/terraform:lightunpinned — 25 crit 72 high
task/gcloud/0.3/gcloud.yaml
  • gcr.io/google.com/cloudsdktool/cloud-sdkunpinned — 22 crit 149 high
task/robot-framework/0.1/robot-framework.yaml
  • python@sha256:4ec7de21666118edfa1b90c79b34c282624d03e2e560fa1b542b2069a65b367f — 21 crit 88 high
task/tekton-operator-install/0.1/tekton-operator-install.yaml
  • docker.io/lachlanevenson/k8s-kubectl@sha256:3a5e22a406a109f4f26ec06b5f1f6a66ae0cd0e185bc28499eb7b7a3bbf1fe09 — 9 crit 91 high
  • docker.io/lachlanevenson/k8s-kubectl@sha256:3a5e22a406a109f4f26ec06b5f1f6a66ae0cd0e185bc28499eb7b7a3bbf1fe09 — 9 crit 91 high
task/boskos-release/0.1/boskos-release.yaml
  • gcr.io/k8s-staging-boskos/boskosctl@sha256:a7fc984732c5dd0b4e0fe0a92e2730fa4b6bddecd0f6f6c7c6b5501abe4ab105 — 9 crit 88 high
  • docker.io/lachlanevenson/k8s-kubectl@sha256:3a5e22a406a109f4f26ec06b5f1f6a66ae0cd0e185bc28499eb7b7a3bbf1fe09 — 9 crit 91 high
task/asciidoctor/0.1/asciidoctor.yaml
  • docker.io/asciidoctor/docker-asciidoctor:1.16@sha256:36117d900e9365923dcf1d79c99eb82192c3d1b81ca1bb077e3373f722532e05 — 17 crit 78 high
task/trivy-scanner/0.2/trivy-scanner.yaml
  • docker.io/aquasec/trivy@sha256:944a044451791617cc0ed2ee4d1942a4f66b790d527fcd0575a6b399ccbc05a1 — 17 crit 67 high
task/blue-green-deploy/0.2/blue-green-deploy.yaml
  • quay.io/openshift/origin-cli:4.9unpinned — 13 crit 85 high
task/kube-linter/0.1/kube-linter.yaml
  • docker.io/stackrox/kube-linter:0.2.2-2-g7d10a69154-alpine@sha256:e520e9d8d3a2dfa611914836536545b135845e7bda9f1df34b060e116232dbf0 — 11 crit 99 high
  • registry.access.redhat.com/ubi8/ubi-minimal:8.2unpinned — 72 high
task/git-cli/0.4/git-cli.yaml
  • cgr.dev/chainguard/git:root-2.39@sha256:7759f87050dd8bacabe61354d75ccd7f864d6b6f8ec42697db7159eccd491139 — 11 crit 69 high
task/git-rebase/0.1/git-rebase.yaml
  • cgr.dev/chainguard/git:2.39@sha256:fdaef225e3fd5cf190520553ff765f186a4363390af3f19912897b0b28f87aeb — 11 crit 69 high
task/github-app-token/0.2/github-app-token.yaml
  • quay.io/chmouel/github-app-token@sha256:bc45937ae588df876555ebb56c36350ed74592c7f55f2df255cabef39c926a88 — 11 crit 61 high
task/github-request-reviewers/0.1/github-request-reviewers.yaml
  • docker.io/library/python:3.9-alpine3.13@sha256:437482dd314471f5f10967f7376489d9e7f67c111850c123cc725a1741b66aac — 11 crit 52 high
task/flake8/0.1/flake8.yaml
  • docker.io/alpine/flake8@sha256:bb280bf2af4a434be912f25bbcb6c79ea4d735ed3c8e259f96c405998920871f — 11 crit 46 high
task/mypy-lint/0.2/mypy-lint.yaml
  • docker.io/cytopia/mypy:latest-0.4@sha256:0d5e1a97ce68c4aeececc818c8bf19301b396edbe36a6f83eca8248d7d84a05c — 11 crit 44 high
task/git-batch-merge/0.3/git-batch-merge.yaml
  • ghcr.io/tektoncd/github.com/tektoncd/pipeline/cmd/git-init:v0.18.1unpinned — 10 crit 94 high
task/istio-canary-release/0.1/istio-canary-release.yaml
  • quay.io/openshift/origin-cli:4.6unpinned — 10 crit 87 high
task/tkn/0.5/tkn.yaml
  • ghcr.io/tektoncd/plumbing/tkn@sha256:d17fec04f655551464a47dd59553c9b44cf660cc72dbcdbd52c0b8e8668c0579 — 10 crit 73 high
task/prettier/0.1/prettier.yaml
  • docker.io/elnebuloso/prettier:2.1.1@sha256:a42d03000e17d343f57ec156820d64934c76d9a0d2ce4abd602f92fd18d5e6d4 — 9 crit 68 high
task/rhacs-deployment-check/3.71/rhacs-deployment-check.yaml
  • quay.io/stackrox-io/roxctl:3.71.0unpinned — 8 crit 78 high
task/rhacs-image-check/3.71/rhacs-image-check.yaml
  • quay.io/stackrox-io/roxctl:3.71.0unpinned — 8 crit 78 high
task/rhacs-image-scan/3.71/rhacs-image-scan.yaml
  • quay.io/stackrox-io/roxctl:3.71.0unpinned — 8 crit 78 high
task/buildpacks/0.6/buildpacks.yaml
  • docker.io/library/bash:5.1.4@sha256:b208215a4655538be652b2769d82e576bc4d0a2bb132144c060efc5be8c3f5d6 — 4 crit 34 high
  • docker.io/library/bash:5.1.4@sha256:b208215a4655538be652b2769d82e576bc4d0a2bb132144c060efc5be8c3f5d6 — 4 crit 34 high
task/gitea-set-status/0.1/gitea-set-status.yaml
  • python:3.10.1-alpine3.15@sha256:affe0faa14e7553fc570beec3864e74b5e36f8c19b2bb49ae8ba79c0e9e7236e — 8 crit 36 high
task/github-set-status/0.4/github-set-status.yaml
  • python:3.10.1-alpine3.15unpinned — 8 crit 36 high
task/helm-render-manifests-from-repo/0.1/helm-render-manifests-from-repo.yaml
  • docker.io/lachlanevenson/k8s-helm@sha256:0a068ae407e21d1836c6a89a1e9e81af1e55fa56890998e33d5caabdbb51e77b — 7 crit 75 high
task/helm-upgrade-from-repo/0.3/helm-upgrade-from-repo.yaml
  • docker.io/lachlanevenson/k8s-helm@sha256:0a068ae407e21d1836c6a89a1e9e81af1e55fa56890998e33d5caabdbb51e77b — 7 crit 75 high
task/helm-upgrade-from-source/0.4/helm-upgrade-from-source.yaml
  • docker.io/lachlanevenson/k8s-helm@sha256:0a068ae407e21d1836c6a89a1e9e81af1e55fa56890998e33d5caabdbb51e77b — 7 crit 75 high
task/kamel-run/0.1/kamel-run.yaml
  • docker.io/apache/camel-k:2.0.0unpinned — 7 crit 58 high
task/syft/0.1/syft.yaml
  • docker.io/anchore/syft@sha256:dd40bc09ff2bf3b860c399e7cf5c2db088e84c85937ac05fdeca3cd88fe2a728 — 7 crit 33 high
task/shp/0.1/shp.yaml
  • quay.io/shipwright/cli:0.12unpinned — 6 crit 55 high
task/rhacs-deployment-check/4.0/rhacs-deployment-check.yaml
  • quay.io/stackrox-io/roxctl:4.4.2unpinned — 6 crit 30 high
task/rhacs-generic/0.1/rhacs-generic.yaml
  • quay.io/stackrox-io/roxctl:4.4.2unpinned — 6 crit 30 high
task/rhacs-image-check/4.0/rhacs-image-check.yaml
  • quay.io/stackrox-io/roxctl:4.4.2unpinned — 6 crit 30 high
task/rhacs-image-scan/4.0/rhacs-image-scan.yaml
  • quay.io/stackrox-io/roxctl:4.4.2unpinned — 6 crit 30 high
task/rhacs-m2m-authenticate/0.1/rhacs-m2m-authenticate.yaml
  • quay.io/stackrox-io/roxctl:4.4.2unpinned — 6 crit 30 high
task/datree/0.1/datree.yaml
  • docker.io/datree/datree:0.15.22@sha256:85cf78f16e67e08ea9df18ab6d3d823a576bfbcc5937f30629eb4859fdeb3fd1 — 5 crit 66 high
task/prometheus-gate/0.1/prometheus-gate.yaml
  • docker.io/iancoffey/prometheus-gate-cf7c3e662ede0a4e9bc24d37d2af86d6@sha256:c3df9d8400aef7acb76f409d1e347c5ecaa6f28a69df50981c14bfe87add85d7 — 5 crit 61 high
task/cloudevent/0.1/cloudevent.yaml
  • docker.io/iancoffey/sendevent-89c3de01c503ceb66b676a3e41c265ed@sha256:fc39998cba7ad8e54323b948b56b11b0b235996069349fb74776865fedf182a5 — 5 crit 60 high
task/tekton-catalog-publish/0.2/tekton-catalog-publish.yaml
  • ghcr.io/tektoncd/plumbing/tkn@sha256:328b4a98eb566ccad4aafcd7fb8307a97c5771e681d85bda669e21e37c071a81 — 5 crit 47 high
task/npm/0.1/npm.yaml
  • docker.io/library/node:12-alpine@sha256:dfbebf17bfb014e1e7068e76325a117bccf8679c68aec6a28514184a209c8bae — 5 crit 38 high
task/python-boto3-aws/0.1/python-boto3-aws.yaml
  • docker.io/library/python:3.9.19-alpine3.20@sha256:45cc18540209d878c2b24080cf8f64fc37603721b67d0ecc508799e2f9a9b21d — 5 crit 30 high
task/az/0.1/az.yaml
  • mcr.microsoft.com/azure-cli:2.0.78unpinned — 4 crit 55 high
task/yq/0.4/yq.yaml
  • docker.io/mikefarah/yq:4.27.5@sha256:2be3626ed633fbe1fc33ee9343a1256a6be53334412b2251b9a859f8c145bb53 — 4 crit 50 high
task/gogit/0.1/gogit.yaml
  • ghcr.io/linuxsuren/gogit:v0.0.1@sha256:33e06228b645dd46102c0870c11d420a213cdab84b7a0700dcb6da6ce8b530d6 — 4 crit 40 high
task/curl/0.1/curl.yaml
  • docker.io/curlimages/curl:7.72.0@sha256:bd5bbd35f89b867c1dccbc84b8be52f3f74dea20b46c5fe0db3780e040afcb6f — 4 crit 27 high
task/write-file/0.1/write-file.yaml
  • docker.io/library/alpine:3.12@sha256:36553b10a4947067b9fbb7d532951066293a68eae893beba1d9235f7d11a20ad — 4 crit 25 high
task/ai-code-review/0.1/ai-code-review.yaml
  • docker.io/library/python:3.12-slimunpinned — 2 crit 7 high
  • docker.io/library/python:3.12-slimunpinned — 2 crit 7 high
task/maven/0.4/maven.yaml
  • gcr.io/cloud-builders/mvn@sha256:57523fc43394d6d9d2414ee8d1c85ed7a13460cbb268c3cd16d28cfb3859e641 — 3 crit 159 high
  • registry.access.redhat.com/ubi8/ubi-minimal:8.2unpinned — 72 high
task/jib-maven/0.5/jib-maven.yaml
  • gcr.io/cloud-builders/mvn@sha256:57523fc43394d6d9d2414ee8d1c85ed7a13460cbb268c3cd16d28cfb3859e641 — 3 crit 159 high
task/yq/0.5/yq.yaml
  • docker.io/mikefarah/yq:4.47.1unpinned — 3 crit 30 high
task/remote-scp/0.1/remote-scp.yaml
  • docker.io/appleboy/drone-scp:1.6.14@sha256:0e0597678b948b0aa09888c66ac75af904cce81baf6af955208527d259c61818 — 3 crit 26 high
task/42crunch-api-security-audit/0.3/42crunch-api-security-audit.yaml
  • docker.io/42crunch/docker-api-security-audit:v4.2@sha256:350df27b2a1b1aac8e3772d8fb13b254569d49c960f31ab58aa3a1e2fbcec3fe — 2 crit 40 high
task/black/0.2/black.yaml
  • docker.io/cytopia/black:latest-0.2@sha256:2ec766f1c7e42e6b59c0873ce066fa0a2aa2bf8a80dbc1c40f1566bb539303e0 — 2 crit 14 high
task/rsync/0.1/rsync.yaml
  • docker.io/shaowenchen/rsync-sshpass:v1@sha256:934985f9a955f416c7378e22d847ac1320fcae1495ee70ad53c9f9fc08b99323 — 1 crit 43 high
task/nexus-lifecycle-scan/0.1/nexus-lifecycle-scan.yaml
  • docker.io/sonatype/nexus-iq-cli:1.136.0-01unpinned — 1 crit 25 high
task/github-open-pr/0.2/github-open-pr.yaml
  • registry.access.redhat.com/ubi8/python-38:1-34.1599745032unpinned — 384 high
task/gitlab-set-status/0.2/gitlab-set-status.yaml
  • registry.access.redhat.com/ubi8/python-38@sha256:af6f93b81f9313de95966e8cd681edb9dbcb5fdbddc5a4cc365af8e4534096ef — 372 high
task/jira-get-ticket-status/0.1/jira-get-ticket-status.yaml
  • registry.access.redhat.com/ubi8/python-39@sha256:27e795fd6b1b77de70d1dc73a65e4c790650748a9cfda138fdbd194b3d6eea3d — 283 high
task/buildpacks-phases/0.3/buildpacks-phases.yaml
  • registry.access.redhat.com/ubi8/ubi-minimal@sha256:b2a1bec3dfbc7a14a1d84d98934dfe8fdde6eb822a211286601cf109cbccb075 — 14 high
  • registry.access.redhat.com/ubi8/python-311@sha256:43605cb2491ef2297a7acf4b4bf0b7f54f0c91b96daf12ae41c49cc7f192b153 — 185 high
  • quay.io/halkyonio/skopeo-jq:0.1.3@sha256:1b3d21ad541227dc9d3e793d18cef9eb00a969c0c01eb09cab88997bc63680c6 — 48 high
task/oci-cli/0.1/oci-cli.yaml
  • ghcr.io/oracle/oci-cli:sha-5846bb2unpinned — 100 high
task/anchore-cli/0.1/anchore-cli.yaml
  • anchore/engine-cli:latestunpinned — 99 high
task/stackrox-image-check/0.1/stackrox-image-check.yaml
  • docker.io/centos@sha256:a1801b843b1bfaf77c501e7a6d3f709401a1e0c83863037fa3aab063a7fdb9dc — 96 high
task/stackrox-image-scan/0.1/stackrox-image-scan.yaml
  • docker.io/centos@sha256:a1801b843b1bfaf77c501e7a6d3f709401a1e0c83863037fa3aab063a7fdb9dc — 96 high
task/github-add-labels/0.1/github-add-labels.yaml
  • registry.access.redhat.com/ubi8/ubi:8.2unpinned — 92 high
task/github-close-issue/0.2/github-close-issue.yaml
  • registry.access.redhat.com/ubi8/ubi:8.2unpinned — 92 high
task/gitlab-add-label/0.1/gitlab-add-label.yaml
  • registry.access.redhat.com/ubi8/ubi:8.2unpinned — 92 high
task/jenkins/0.1/jenkins.yaml
  • registry.access.redhat.com/ubi8:8.2unpinned — 92 high
task/trigger-jenkins-job/0.1/trigger-jenkins-job.yaml
  • registry.access.redhat.com/ubi8/ubi:8.2unpinned — 92 high
task/s2i/0.3/s2i.yaml
  • quay.io/openshift-pipeline/s2i:nightlyunpinned — 89 high
  • quay.io/buildah/stable:v1.17.0unpinned — not scanned
task/create-gitlab-release/0.1/create-gitlab-release.yaml
  • registry.access.redhat.com/ubi8/ubi-minimal:8.2unpinned — 72 high
task/github-add-comment/0.7/github-add-comment.yaml
  • registry.access.redhat.com/ubi8/ubi-minimal:8.2unpinned — 72 high
task/github-add-gist/0.2/github-add-gist.yaml
  • registry.access.redhat.com/ubi8/ubi-minimal:8.2unpinned — 72 high
task/github-create-deployment-status/0.1/github-create-deployment-status.yaml
  • registry.access.redhat.com/ubi8/ubi-minimal:8.2unpinned — 72 high
task/github-create-deployment/0.2/github-create-deployment.yaml
  • registry.access.redhat.com/ubi8/ubi-minimal:8.2unpinned — 72 high
task/jq/0.1/jq.yaml
  • quay.io/jpmaida1/jq@sha256:f90645c017ba8b1a2fff44309231cb7f8fd3a441690e17c15a53e60997f309c0 — 51 high
task/gradle/0.4/gradle.yaml
  • docker.io/library/gradle:7.6-jdk8@sha256:ebda657f66e04cfa9f152896b4fa70bea4b80561a836adddca3ed85d622f8898 — 25 high
task/pylint/0.3/pylint.yaml
  • registry.gitlab.com/pipeline-components/pylint:0.12.0@sha256:051b701936dfab6fa27bd1ebd50ef56b19577565661bc0227e50dd1cf94a3d6e — 22 high
task/kn-apply/0.2/kn-apply.yaml
  • gcr.io/knative-releases/knative.dev/client/cmd/kn:latestunpinned — 1 high
task/kn/0.2/kn.yaml
  • gcr.io/knative-releases/knative.dev/client/cmd/kn:latestunpinned — 1 high
task/buildah-manifest-create/0.1/buildah-manifest-create.yaml
  • quay.io/buildah/stable:v1unpinned — clean
task/buildah-manifest-push/0.1/buildah-manifest-push.yaml
  • quay.io/buildah/stable:v1unpinned — clean
task/buildah/0.9/buildah.yaml
  • quay.io/buildah/stable:v1unpinned — clean
task/goreleaser/0.2/goreleaser.yaml
  • docker.io/goreleaser/goreleaser@sha256:2a949686d9886ac7c10582a6c29116fd29d3077d02755e87e111870d63607725 — not scanned
task/jumpstarter-get-lease/0.1/jumpstarter-get-lease.yaml
  • quay.io/jumpstarter-dev/jumpstarter:latestunpinned — clean
task/jumpstarter-release-lease/0.1/jumpstarter-release-lease.yaml
  • quay.io/jumpstarter-dev/jumpstarter:latestunpinned — clean
task/jumpstarter-run-cmd/0.1/jumpstarter-run-cmd.yaml
  • quay.io/jumpstarter-dev/jumpstarter:latestunpinned — clean
task/openshift-client-python/0.1/openshift-client-python.yaml
  • quay.io/vinamra2807/openshift-client-python@sha256:17c6b464c2fa930d09203b75b68dbcf120c46a4e8fe56b60fb4e5d0015798343 — not scanned
task/python-coverage/0.1/python-coverage.yaml
  • docker.io/python:$(inputs.params.PYTHON)unpinned — not scanned
task/skopeo-copy/0.4/skopeo-copy.yaml
  • quay.io/skopeo/stable:v1unpinned — clean
StepAction 1 with concrete images
ResourceImages & CVEs
stepaction/tekton-catalog-publish/0.3/tekton-catalog-publish.yaml
  • ghcr.io/tektoncd/plumbing/tkn@sha256:328b4a98eb566ccad4aafcd7fb8307a97c5771e681d85bda669e21e37c071a81 — 5 crit 47 high

Findings per resource

Task 149 with findings
ResourceFindings
task/jumpstarter-get-lease/0.1/jumpstarter-get-lease.yamlscript-paramsunpinned-img
  • $(params) used inside script (injection risk): $(params.client-name), $(params.lease-duration), $(params.timeout)
  • unpinned :latest/no-tag image(s): 1
  • missing tekton.dev/pipelines.minVersion
  • missing spec.description
  • missing tekton.dev/categories
  • no tests/run.yaml
task/jumpstarter-release-lease/0.1/jumpstarter-release-lease.yamlscript-paramsunpinned-img
  • $(params) used inside script (injection risk): $(params.client-name), $(params.jmp-lease-id)
  • unpinned :latest/no-tag image(s): 1
  • missing tekton.dev/pipelines.minVersion
  • missing spec.description
  • missing tekton.dev/categories
  • no tests/run.yaml
task/jumpstarter-run-cmd/0.1/jumpstarter-run-cmd.yamlscript-paramsunpinned-img
  • $(params) used inside script (injection risk): $(params.client-name), $(params.jmp-jScript), $(params.jmp-lease-id)
  • unpinned :latest/no-tag image(s): 1
  • missing tekton.dev/pipelines.minVersion
  • missing spec.description
  • missing tekton.dev/categories
  • no tests/run.yaml
task/anchore-cli/0.1/anchore-cli.yamlapicvescript-paramsunpinned-img
  • apiVersion tekton.dev/v1beta1 -> should be tekton.dev/v1
  • $(params) used inside script (injection risk): $(params.ANCHORE_CLI_URL), $(params.IMAGE_NAME)
  • unpinned :latest/no-tag image(s): 1
  • no tests/run.yaml
task/create-gitlab-release/0.1/create-gitlab-release.yamlapicvescript-paramsunpinned-img
  • apiVersion tekton.dev/v1beta1 -> should be tekton.dev/v1
  • $(params) used inside script (injection risk): $(params.DESCRIPTION), $(params.NAME), $(params.PROJECT_ID), $(params.RELEASE_REF), $(params.TAG_NAME)
  • mutable-tag image(s) (not digest-pinned): 1
  • no tests/run.yaml
task/gcloud/0.3/gcloud.yamlapicvescript-paramsunpinned-img
  • apiVersion tekton.dev/v1beta1 -> should be tekton.dev/v1
  • $(params) used inside script (injection risk): $(params.SCRIPT)
  • unpinned :latest/no-tag image(s): 1
  • no tests/run.yaml
task/github-add-labels/0.1/github-add-labels.yamlapicvescript-paramsunpinned-img
  • apiVersion tekton.dev/v1beta1 -> should be tekton.dev/v1
  • $(params) used inside script (injection risk): $(params.API_PATH_PREFIX), $(params.GITHUB_HOST_URL), $(params.REQUEST_URL)
  • mutable-tag image(s) (not digest-pinned): 1
  • no tests/run.yaml
task/github-close-issue/0.2/github-close-issue.yamlapicvescript-paramsunpinned-img
  • apiVersion tekton.dev/v1beta1 -> should be tekton.dev/v1
  • $(params) used inside script (injection risk): $(params.API_PATH_PREFIX), $(params.GITHUB_HOST_URL), $(params.REQUEST_URL)
  • mutable-tag image(s) (not digest-pinned): 1
  • no tests/run.yaml
task/gitlab-add-label/0.1/gitlab-add-label.yamlapicvescript-paramsunpinned-img
  • apiVersion tekton.dev/v1beta1 -> should be tekton.dev/v1
  • $(params) used inside script (injection risk): $(params.API_PATH_PREFIX), $(params.GITLAB_HOST_URL), $(params.REQUEST_URL)
  • mutable-tag image(s) (not digest-pinned): 1
  • no tests/run.yaml
task/istio-canary-release/0.1/istio-canary-release.yamlapicvescript-paramsunpinned-img
  • apiVersion tekton.dev/v1beta1 -> should be tekton.dev/v1
  • $(params) used inside script (injection risk): $(params.V1_WEIGHT), $(params.V2_WEIGHT), $(params.VS_NAME)
  • mutable-tag image(s) (not digest-pinned): 1
  • no tests/run.yaml
task/openshift-install/0.1/openshift-install.yamlapicvescript-paramsunpinned-img
  • apiVersion tekton.dev/v1beta1 -> should be tekton.dev/v1
  • $(params) used inside script (injection risk): $(params.BASE_DOMAIN), $(params.CLUSTER_NAME), $(params.PLATFORM), $(params.PROJECT_ID), $(params.REGION)
  • mutable-tag image(s) (not digest-pinned): 2
  • no tests/run.yaml
task/s2i/0.3/s2i.yamlapicvescript-paramsprivilegedunpinned-img
  • apiVersion tekton.dev/v1beta1 -> should be tekton.dev/v1
  • $(params) used inside script (injection risk): $(params.IMAGE), $(params.TLSVERIFY)
  • privileged securityContext
  • mutable-tag image(s) (not digest-pinned): 2
task/ai-code-review/0.1/ai-code-review.yamlapicveunpinned-img
  • apiVersion tekton.dev/v1beta1 -> should be tekton.dev/v1
  • mutable-tag image(s) (not digest-pinned): 2
  • no tests/run.yaml
task/argocd-task-connect-repo/0.1/argocd-task-connect-repo.yamlapiscript-params
  • apiVersion tekton.dev/v1beta1 -> should be tekton.dev/v1
  • $(params) used inside script (injection risk): $(params.flags), $(params.repository-name), $(params.repository-type), $(params.repository-url)
  • no tests/run.yaml
task/argocd-task-sync-and-wait/0.2/argocd-task-sync-and-wait.yamlapiscript-params
  • apiVersion tekton.dev/v1beta1 -> should be tekton.dev/v1
  • $(params) used inside script (injection risk): $(params.application-name), $(params.flags), $(params.revision)
  • no tests/run.yaml
task/aws-cli/0.2/aws-cli.yamlapiscript-params
  • apiVersion tekton.dev/v1beta1 -> should be tekton.dev/v1
  • $(params) used inside script (injection risk): $(params.SCRIPT)
  • no tests/run.yaml
task/aws-ecr-login/0.1/aws-ecr-login.yamlapiscript-params
  • apiVersion tekton.dev/v1beta1 -> should be tekton.dev/v1
  • $(params) used inside script (injection risk): $(params.region)
  • no tests/run.yaml
task/az/0.1/az.yamlapicveunpinned-img
  • apiVersion tekton.dev/v1beta1 -> should be tekton.dev/v1
  • mutable-tag image(s) (not digest-pinned): 1
  • no tests/run.yaml
task/blue-green-deploy/0.2/blue-green-deploy.yamlapicvescript-paramsunpinned-img
  • apiVersion tekton.dev/v1beta1 -> should be tekton.dev/v1
  • $(params) used inside script (injection risk): $(params.MANIFEST), $(params.NAMESPACE), $(params.NEW_VERSION), $(params.SERVICE_NAME)
  • mutable-tag image(s) (not digest-pinned): 1
task/boskos-acquire/0.1/boskos-acquire.yamlapicvescript-params
  • apiVersion tekton.dev/v1beta1 -> should be tekton.dev/v1
  • $(params) used inside script (injection risk): $(params.owner-name), $(params.server-url), $(params.type)
  • no tests/run.yaml
task/buildah-manifest-create/0.1/buildah-manifest-create.yamlprivilegedunpinned-img
  • privileged securityContext
  • mutable-tag image(s) (not digest-pinned): 1
  • no tests/run.yaml
task/buildah-manifest-push/0.1/buildah-manifest-push.yamlprivilegedunpinned-img
  • privileged securityContext
  • mutable-tag image(s) (not digest-pinned): 1
  • no tests/run.yaml
task/create-github-release/0.1/create-github-release.yamlapiscript-params
  • apiVersion tekton.dev/v1beta1 -> should be tekton.dev/v1
  • $(params) used inside script (injection risk): $(params.RELEASE_FILE_NAME), $(params.REVISION), $(params.TAG)
  • no tests/run.yaml
task/datree/0.1/datree.yamlapicveprivileged
  • apiVersion tekton.dev/v1beta1 -> should be tekton.dev/v1
  • privileged securityContext
  • no tests/run.yaml
task/docker-build/0.1/docker-build.yamlapicvescript-paramsunpinned-img
  • apiVersion tekton.dev/v1beta1 -> should be tekton.dev/v1
  • $(params) used inside script (injection risk): $(params.build_extra_args), $(params.context), $(params.dockerfile), $(params.image), $(params.push_extra_args)
  • mutable-tag image(s) (not digest-pinned): 1
task/eks-cluster-create/0.1/eks-cluster-create.yamlapicvescript-params
  • apiVersion tekton.dev/v1beta1 -> should be tekton.dev/v1
  • $(params) used inside script (injection risk): $(params.cluster-name), $(params.desired-nodes), $(params.max-nodes), $(params.min-nodes), $(params.node-type)
  • no tests/run.yaml
task/eks-cluster-teardown/0.1/eks-cluster-teardown.yamlapicvescript-params
  • apiVersion tekton.dev/v1beta1 -> should be tekton.dev/v1
  • $(params) used inside script (injection risk): $(params.cluster-name), $(params.region)
  • no tests/run.yaml
task/gcs-create-bucket/0.1/gcs-create-bucket.yamlapiscript-params
  • apiVersion tekton.dev/v1beta1 -> should be tekton.dev/v1
  • $(params) used inside script (injection risk): $(params.bucketName), $(params.project), $(params.region), $(params.serviceAccountPath), $(params.storageClass)
  • no tests/run.yaml
task/gcs-delete-bucket/0.1/gcs-delete-bucket.yamlapiscript-params
  • apiVersion tekton.dev/v1beta1 -> should be tekton.dev/v1
  • $(params) used inside script (injection risk): $(params.bucketName), $(params.serviceAccountPath)
  • no tests/run.yaml
task/gcs-download/0.1/gcs-download.yamlapiscript-params
  • apiVersion tekton.dev/v1beta1 -> should be tekton.dev/v1
  • $(params) used inside script (injection risk): $(params.location), $(params.path), $(params.serviceAccountPath), $(params.typeDir)
  • no tests/run.yaml
task/gcs-generic/0.1/gcs-generic.yamlapicvescript-params
  • apiVersion tekton.dev/v1beta1 -> should be tekton.dev/v1
  • $(params) used inside script (injection risk): $(params.serviceAccountPath)
  • no tests/run.yaml
task/git-rebase/0.1/git-rebase.yamlapicvescript-params
  • apiVersion tekton.dev/v1beta1 -> should be tekton.dev/v1
  • $(params) used inside script (injection risk): $(params.COMMIT_MSG), $(params.GIT_USER_EMAIL), $(params.GIT_USER_NAME), $(params.PULL_BRANCH_NAME), $(params.PULL_REMOTE_NAME)
  • no tests/run.yaml
task/github-add-comment/0.7/github-add-comment.yamlapicvescript-paramsunpinned-img
  • apiVersion tekton.dev/v1beta1 -> should be tekton.dev/v1
  • $(params) used inside script (injection risk): $(params.API_PATH_PREFIX), $(params.AUTH_TYPE), $(params.COMMENT_OR_FILE), $(params.COMMENT_TAG), $(params.GITHUB_HOST_URL)
  • mutable-tag image(s) (not digest-pinned): 1
task/github-add-gist/0.2/github-add-gist.yamlapicvescript-paramsunpinned-img
  • apiVersion tekton.dev/v1beta1 -> should be tekton.dev/v1
  • $(params) used inside script (injection risk): $(params.API_PATH_PREFIX), $(params.FILE_NAME), $(params.GITHUB_HOST_URL)
  • mutable-tag image(s) (not digest-pinned): 1
task/github-create-deployment-status/0.1/github-create-deployment-status.yamlapicvescript-paramsunpinned-img
  • apiVersion tekton.dev/v1beta1 -> should be tekton.dev/v1
  • $(params) used inside script (injection risk): $(params.API_PATH_PREFIX), $(params.AUTO_INACTIVE), $(params.DEPLOYMENT_ID), $(params.DESCRIPTION), $(params.ENVIRONMENT)
  • mutable-tag image(s) (not digest-pinned): 1
task/github-create-deployment/0.2/github-create-deployment.yamlapicvescript-paramsunpinned-img
  • apiVersion tekton.dev/v1beta1 -> should be tekton.dev/v1
  • $(params) used inside script (injection risk): $(params.API_PATH_PREFIX), $(params.AUTO_MERGE), $(params.DESCRIPTION), $(params.ENVIRONMENT), $(params.GITHUB_HOST_URL)
  • mutable-tag image(s) (not digest-pinned): 1
task/github-open-pr/0.2/github-open-pr.yamlapicvescript-paramsunpinned-img
  • apiVersion tekton.dev/v1beta1 -> should be tekton.dev/v1
  • $(params) used inside script (injection risk): $(params.API_PATH_PREFIX), $(params.AUTH_TYPE), $(params.BASE), $(params.BODY), $(params.GITHUB_HOST_URL)
  • mutable-tag image(s) (not digest-pinned): 1
task/github-set-status/0.4/github-set-status.yamlapicvescript-paramsunpinned-img
  • apiVersion tekton.dev/v1beta1 -> should be tekton.dev/v1
  • $(params) used inside script (injection risk): $(params.GITHUB_HOST_URL), $(params.SHEBANG)
  • mutable-tag image(s) (not digest-pinned): 1
task/gke-cluster-create/0.1/gke-cluster-create.yamlapiscript-params
  • apiVersion tekton.dev/v1beta1 -> should be tekton.dev/v1
  • $(params) used inside script (injection risk): $(params.cluster-version), $(params.identifier), $(params.image-type), $(params.machine-type), $(params.max-nodes)
  • no tests/run.yaml
task/goreleaser/0.2/goreleaser.yamlapiscript-params
  • apiVersion tekton.dev/v1beta1 -> should be tekton.dev/v1
  • $(params) used inside script (injection risk): $(params.flags)
  • no tests/run.yaml
task/jenkins/0.1/jenkins.yamlapicvescript-paramsunpinned-img
  • apiVersion tekton.dev/v1beta1 -> should be tekton.dev/v1
  • $(params) used inside script (injection risk): $(params.JENKINS_HOST_URL)
  • mutable-tag image(s) (not digest-pinned): 1
task/kamel-run/0.1/kamel-run.yamlapicvescript-paramsunpinned-img
  • apiVersion tekton.dev/v1beta1 -> should be tekton.dev/v1
  • $(params) used inside script (injection risk): $(params.container-image), $(params.filename), $(params.namespace), $(params.wait)
  • mutable-tag image(s) (not digest-pinned): 1
task/kn-apply/0.2/kn-apply.yamlapicveunpinned-img
  • apiVersion tekton.dev/v1beta1 -> should be tekton.dev/v1
  • unpinned :latest/no-tag image(s): 1
  • no tests/run.yaml
task/kn/0.2/kn.yamlapicveunpinned-img
  • apiVersion tekton.dev/v1beta1 -> should be tekton.dev/v1
  • unpinned :latest/no-tag image(s): 1
  • no tests/run.yaml
task/kube-linter/0.1/kube-linter.yamlapicvescript-paramsunpinned-img
  • apiVersion tekton.dev/v1beta1 -> should be tekton.dev/v1
  • $(params) used inside script (injection risk): $(params.config_file_path), $(params.config_file_url), $(params.default_option), $(params.excludelist), $(params.includelist)
  • mutable-tag image(s) (not digest-pinned): 1
task/kubectl-deploy-pod/0.1/kubectl-deploy-pod.yamlapicveunpinned-img
  • apiVersion tekton.dev/v1beta1 -> should be tekton.dev/v1
  • mutable-tag image(s) (not digest-pinned): 1
  • no tests/run.yaml
task/nexus-lifecycle-scan/0.1/nexus-lifecycle-scan.yamlapicveunpinned-img
  • apiVersion tekton.dev/v1beta1 -> should be tekton.dev/v1
  • mutable-tag image(s) (not digest-pinned): 1
  • no tests/run.yaml
task/oci-cli/0.1/oci-cli.yamlcveunpinned-img
  • mutable-tag image(s) (not digest-pinned): 1
  • missing spec.description
  • no tests/run.yaml
task/openshift-client-python/0.1/openshift-client-python.yamlapiscript-params
  • apiVersion tekton.dev/v1beta1 -> should be tekton.dev/v1
  • $(params) used inside script (injection risk): $(params.SCRIPT)
  • no tests/run.yaml
task/openshift-uninstall/0.1/openshift-uninstall.yamlapicveunpinned-img
  • apiVersion tekton.dev/v1beta1 -> should be tekton.dev/v1
  • mutable-tag image(s) (not digest-pinned): 1
  • no tests/run.yaml
task/pytest/0.2/pytest.yamlapicvescript-paramsunpinned-img
  • apiVersion tekton.dev/v1beta1 -> should be tekton.dev/v1
  • $(params) used inside script (injection risk): $(params.ARGS), $(params.REQUIREMENTS_FILE), $(params.SOURCE_PATH)
  • mutable-tag image(s) (not digest-pinned): 1
task/remote-ssh-commands/0.1/remote-ssh-commands.yamlapiscript-params
  • apiVersion tekton.dev/v1beta1 -> should be tekton.dev/v1
  • $(params) used inside script (injection risk): $(params.HOST), $(params.PORT), $(params.SSH_SCRIPT), $(params.USERNAME), $(params.USE_INSECURE_CIPHER)
  • no tests/run.yaml
task/rhacs-deployment-check/3.71/rhacs-deployment-check.yamlapicveunpinned-img
  • apiVersion tekton.dev/v1beta1 -> should be tekton.dev/v1
  • mutable-tag image(s) (not digest-pinned): 1
  • no tests/run.yaml
task/rhacs-image-check/3.71/rhacs-image-check.yamlapicveunpinned-img
  • apiVersion tekton.dev/v1beta1 -> should be tekton.dev/v1
  • mutable-tag image(s) (not digest-pinned): 1
  • no tests/run.yaml
task/rhacs-image-scan/3.71/rhacs-image-scan.yamlapicveunpinned-img
  • apiVersion tekton.dev/v1beta1 -> should be tekton.dev/v1
  • mutable-tag image(s) (not digest-pinned): 1
  • no tests/run.yaml
task/rsync/0.1/rsync.yamlapicvescript-params
  • apiVersion tekton.dev/v1beta1 -> should be tekton.dev/v1
  • $(params) used inside script (injection risk): $(params.direction), $(params.local-path), $(params.remote-ip), $(params.remote-path), $(params.remote-username)
  • no tests/run.yaml
task/send-to-channel-slack/0.1/send-to-channel-slack.yamlapiscript-params
  • apiVersion tekton.dev/v1beta1 -> should be tekton.dev/v1
  • $(params) used inside script (injection risk): $(params.channel), $(params.message)
  • no tests/run.yaml
task/send-to-webex-room/0.1/send-to-webex-room.yamlapiscript-params
  • apiVersion tekton.dev/v1beta1 -> should be tekton.dev/v1
  • $(params) used inside script (injection risk): $(params.message), $(params.room-id)
  • no tests/run.yaml
task/skopeo-copy/0.4/skopeo-copy.yamlapiscript-paramsunpinned-img
  • apiVersion tekton.dev/v1beta1 -> should be tekton.dev/v1
  • $(params) used inside script (injection risk): $(params.destImageURL), $(params.destTLSverify), $(params.multiArch), $(params.srcImageURL), $(params.srcTLSverify)
  • mutable-tag image(s) (not digest-pinned): 1
task/stackrox-image-check/0.1/stackrox-image-check.yamlapicvescript-params
  • apiVersion tekton.dev/v1beta1 -> should be tekton.dev/v1
  • $(params) used inside script (injection risk): $(params.image), $(params.insecure-skip-tls-verify)
  • no tests/run.yaml
task/stackrox-image-scan/0.1/stackrox-image-scan.yamlapicvescript-params
  • apiVersion tekton.dev/v1beta1 -> should be tekton.dev/v1
  • $(params) used inside script (injection risk): $(params.image), $(params.insecure-skip-tls-verify), $(params.output_format)
  • no tests/run.yaml
task/tekton-operator-install/0.1/tekton-operator-install.yamlapicvescript-params
  • apiVersion tekton.dev/v1beta1 -> should be tekton.dev/v1
  • $(params) used inside script (injection risk): $(params.INSTALL_DASHBOARD), $(params.INSTALL_EXTENSION_WEBHOOKS), $(params.INSTALL_TRIGGERS), $(params.OPERATOR_VERSION)
  • no tests/run.yaml
task/terraform-cli/0.2/terraform-cli.yamlapicveunpinned-img
  • apiVersion tekton.dev/v1beta1 -> should be tekton.dev/v1
  • mutable-tag image(s) (not digest-pinned): 1
  • no tests/run.yaml
task/trigger-jenkins-job/0.1/trigger-jenkins-job.yamlapicvescript-paramsunpinned-img
  • apiVersion tekton.dev/v1beta1 -> should be tekton.dev/v1
  • $(params) used inside script (injection risk): $(params.JENKINS_HOST_URL), $(params.JOB_NAME)
  • mutable-tag image(s) (not digest-pinned): 1
task/upload-pypi/0.2/upload-pypi.yamlapicvescript-paramsunpinned-img
  • apiVersion tekton.dev/v1beta1 -> should be tekton.dev/v1
  • $(params) used inside script (injection risk): $(params.PREBUILD_SCRIPT)
  • mutable-tag image(s) (not digest-pinned): 1
task/yq/0.5/yq.yamlapicvescript-paramsunpinned-img
  • apiVersion tekton.dev/v1beta1 -> should be tekton.dev/v1
  • $(params) used inside script (injection risk): $(params.SCRIPT), $(params.expression)
  • mutable-tag image(s) (not digest-pinned): 1
task/42crunch-api-security-audit/0.3/42crunch-api-security-audit.yamlapicve
  • apiVersion tekton.dev/v1beta1 -> should be tekton.dev/v1
  • no tests/run.yaml
task/ansible-tower-cli/0.1/ansible-tower-cli.yamlapi
  • apiVersion tekton.dev/v1beta1 -> should be tekton.dev/v1
  • no tests/run.yaml
task/black/0.2/black.yamlapicvescript-params
  • apiVersion tekton.dev/v1beta1 -> should be tekton.dev/v1
  • $(params) used inside script (injection risk): $(params.requirements_file)
task/boskos-release/0.1/boskos-release.yamlapicve
  • apiVersion tekton.dev/v1beta1 -> should be tekton.dev/v1
  • no tests/run.yaml
task/buildah/0.9/buildah.yamlprivilegedunpinned-img
  • privileged securityContext
  • mutable-tag image(s) (not digest-pinned): 1
task/buildpacks/0.6/buildpacks.yamlapicvescript-params
  • apiVersion tekton.dev/v1beta1 -> should be tekton.dev/v1
  • $(params) used inside script (injection risk): $(params.APP_IMAGE), $(params.GROUP_ID), $(params.USER_ID)
task/cloudevent/0.1/cloudevent.yamlapicve
  • apiVersion tekton.dev/v1beta1 -> should be tekton.dev/v1
  • no tests/run.yaml
task/flake8/0.1/flake8.yamlapicvescript-params
  • apiVersion tekton.dev/v1beta1 -> should be tekton.dev/v1
  • $(params) used inside script (injection risk): $(params.path), $(params.requirements_file)
task/gcs-upload/0.3/gcs-upload.yamlapi
  • apiVersion tekton.dev/v1beta1 -> should be tekton.dev/v1
  • no tests/run.yaml
task/git-batch-merge/0.3/git-batch-merge.yamlcvescript-paramsunpinned-img
  • $(params) used inside script (injection risk): $(params.batchedRefs), $(params.deleteExisting), $(params.depth), $(params.gitUserEmail), $(params.gitUserName)
  • mutable-tag image(s) (not digest-pinned): 1
task/git-cli/0.4/git-cli.yamlapicvescript-params
  • apiVersion tekton.dev/v1beta1 -> should be tekton.dev/v1
  • $(params) used inside script (injection risk): $(params.GIT_SCRIPT), $(params.GIT_USER_EMAIL), $(params.GIT_USER_NAME)
task/gitea-set-status/0.1/gitea-set-status.yamlapicvescript-params
  • apiVersion tekton.dev/v1beta1 -> should be tekton.dev/v1
  • $(params) used inside script (injection risk): $(params.API_PATH_PREFIX), $(params.CONTEXT), $(params.DESCRIPTION), $(params.GITEA_HOST_URL), $(params.GITEA_HTTPS_OR_HTTP)
task/github-app-token/0.2/github-app-token.yamlapicve
  • apiVersion tekton.dev/v1beta1 -> should be tekton.dev/v1
  • no tests/run.yaml
task/github-request-reviewers/0.1/github-request-reviewers.yamlapicvescript-params
  • apiVersion tekton.dev/v1beta1 -> should be tekton.dev/v1
  • $(params) used inside script (injection risk): $(params.API_PATH_PREFIX), $(params.GITHUB_HOST_URL), $(params.GITHUB_TOKEN_FILE), $(params.PACKAGE), $(params.PULL_REQUEST_NUMBER)
task/gitlab-set-status/0.2/gitlab-set-status.yamlapicvescript-params
  • apiVersion tekton.dev/v1beta1 -> should be tekton.dev/v1
  • $(params) used inside script (injection risk): $(params.API_PATH_PREFIX), $(params.CONTEXT), $(params.COVERAGE), $(params.DESCRIPTION), $(params.GITLAB_HOST_URL)
task/gke-deploy/0.1/gke-deploy.yamlapicve
  • apiVersion tekton.dev/v1beta1 -> should be tekton.dev/v1
  • no tests/run.yaml
task/gogit/0.1/gogit.yamlapicve
  • apiVersion tekton.dev/v1beta1 -> should be tekton.dev/v1
  • no tests/run.yaml
task/golangci-lint/0.2/golangci-lint.yamlapiscript-params
  • apiVersion tekton.dev/v1beta1 -> should be tekton.dev/v1
  • $(params) used inside script (injection risk): $(params.flags)
task/helm-conftest/0.1/helm-conftest.yamlapicve
  • apiVersion tekton.dev/v1beta1 -> should be tekton.dev/v1
  • no tests/run.yaml
task/helm-upgrade-from-repo/0.3/helm-upgrade-from-repo.yamlapicvescript-params
  • apiVersion tekton.dev/v1beta1 -> should be tekton.dev/v1
  • $(params) used inside script (injection risk): $(params.chart_name), $(params.helm_repo), $(params.overwrite_values), $(params.release_name), $(params.release_namespace)
task/helm-upgrade-from-source/0.4/helm-upgrade-from-source.yamlapicvescript-params
  • apiVersion tekton.dev/v1beta1 -> should be tekton.dev/v1
  • $(params) used inside script (injection risk): $(params.charts_dir), $(params.overwrite_values), $(params.release_name), $(params.release_namespace), $(params.release_version)
task/ibmcloud/0.1/ibmcloud.yamlapicve
  • apiVersion tekton.dev/v1beta1 -> should be tekton.dev/v1
  • no tests/run.yaml
task/jib-gradle/0.4/jib-gradle.yamlapicvescript-params
  • apiVersion tekton.dev/v1beta1 -> should be tekton.dev/v1
  • $(params) used inside script (injection risk): $(params.EXTRA_ARGS), $(params.IMAGE), $(params.INSECUREREGISTRY)
task/jib-maven/0.5/jib-maven.yamlapicvescript-params
  • apiVersion tekton.dev/v1beta1 -> should be tekton.dev/v1
  • $(params) used inside script (injection risk): $(params.CACERTFILE), $(params.DIRECTORY), $(params.IMAGE), $(params.INSECUREREGISTRY)
task/jq/0.1/jq.yamlcvescript-params
  • $(params) used inside script (injection risk): $(params.filter), $(params.input), $(params.options), $(params.stringOrFile)
  • no tests/run.yaml
task/ko/0.1/ko.yamlapicveunpinned-img
  • apiVersion tekton.dev/v1beta1 -> should be tekton.dev/v1
  • mutable-tag image(s) (not digest-pinned): 1
task/kubernetes-actions/0.2/kubernetes-actions.yamlapicvescript-params
  • apiVersion tekton.dev/v1beta1 -> should be tekton.dev/v1
  • $(params) used inside script (injection risk): $(params.script)
task/kubeval/0.1/kubeval.yamlapi
  • apiVersion tekton.dev/v1beta1 -> should be tekton.dev/v1
  • no tests/run.yaml
task/maven/0.4/maven.yamlcvescript-paramsunpinned-img
  • $(params) used inside script (injection risk): $(params.MAVEN_MIRROR_URL), $(params.PROXY_HOST), $(params.PROXY_NON_PROXY_HOSTS), $(params.PROXY_PASSWORD), $(params.PROXY_PORT)
  • mutable-tag image(s) (not digest-pinned): 1
task/mypy-lint/0.2/mypy-lint.yamlapicvescript-params
  • apiVersion tekton.dev/v1beta1 -> should be tekton.dev/v1
  • $(params) used inside script (injection risk): $(params.requirements_file)
task/openshift-client/0.2/openshift-client.yamlapiscript-params
  • apiVersion tekton.dev/v1beta1 -> should be tekton.dev/v1
  • $(params) used inside script (injection risk): $(params.SCRIPT)
task/powershell/0.1/powershell.yamlapiscript-params
  • apiVersion tekton.dev/v1beta1 -> should be tekton.dev/v1
  • $(params) used inside script (injection risk): $(params.command), $(params.verbose)
task/prometheus-gate/0.1/prometheus-gate.yamlapicve
  • apiVersion tekton.dev/v1beta1 -> should be tekton.dev/v1
  • no tests/run.yaml
task/pylint/0.3/pylint.yamlapicvescript-params
  • apiVersion tekton.dev/v1beta1 -> should be tekton.dev/v1
  • $(params) used inside script (injection risk): $(params.path), $(params.requirements_file)
task/python-boto3-aws/0.1/python-boto3-aws.yamlcve
  • missing spec.description
  • no tests/run.yaml
task/python-coverage/0.1/python-coverage.yamlapiunpinned-img
  • apiVersion tekton.dev/v1beta1 -> should be tekton.dev/v1
  • mutable-tag image(s) (not digest-pinned): 1
task/python-sdk-azure/0.1/python-sdk-azure.yaml
  • missing spec.description
  • no tests/run.yaml
task/remote-scp/0.1/remote-scp.yamlcvescript-params
  • $(params) used inside script (injection risk): $(params.HOST), $(params.LOCAL_PATH), $(params.PORT), $(params.TO_PATH), $(params.USERNAME)
  • no tests/run.yaml
task/rhacs-deployment-check/4.0/rhacs-deployment-check.yamlcveunpinned-img
  • mutable-tag image(s) (not digest-pinned): 1
  • no tests/run.yaml
task/rhacs-generic/0.1/rhacs-generic.yamlcveunpinned-img
  • mutable-tag image(s) (not digest-pinned): 1
  • no tests/run.yaml
task/rhacs-image-check/4.0/rhacs-image-check.yamlcveunpinned-img
  • mutable-tag image(s) (not digest-pinned): 1
  • no tests/run.yaml
task/rhacs-image-scan/4.0/rhacs-image-scan.yamlcveunpinned-img
  • mutable-tag image(s) (not digest-pinned): 1
  • no tests/run.yaml
task/rhacs-m2m-authenticate/0.1/rhacs-m2m-authenticate.yamlcveunpinned-img
  • mutable-tag image(s) (not digest-pinned): 1
  • no tests/run.yaml
task/robot-framework/0.1/robot-framework.yamlapicvescript-params
  • apiVersion tekton.dev/v1beta1 -> should be tekton.dev/v1
  • $(params) used inside script (injection risk): $(params.ROBOT_OPTIONS), $(params.TEST_DIR), $(params.VARIABLES_FILE)
task/scorecard/0.1/scorecard.yamlapi
  • apiVersion tekton.dev/v1beta1 -> should be tekton.dev/v1
  • no tests/run.yaml
task/send-to-microsoft-teams/0.1/send-to-microsoft-teams.yamlapi
  • apiVersion tekton.dev/v1beta1 -> should be tekton.dev/v1
  • no tests/run.yaml
task/send-to-telegram/0.1/send-to-telegram.yamlapi
  • apiVersion tekton.dev/v1beta1 -> should be tekton.dev/v1
  • no tests/run.yaml
task/send-to-webhook-discord/0.1/send-to-webhook-discord.yamlapi
  • apiVersion tekton.dev/v1beta1 -> should be tekton.dev/v1
  • no tests/run.yaml
task/send-to-webhook-slack/0.1/send-to-webhook-slack.yamlapi
  • apiVersion tekton.dev/v1beta1 -> should be tekton.dev/v1
  • no tests/run.yaml
task/sendmail/0.2/sendmail.yamlscript-params
  • $(params) used inside script (injection risk): $(params.body), $(params.recipients), $(params.sender), $(params.subject)
  • no tests/run.yaml
task/shp/0.1/shp.yamlcvescript-paramsunpinned-img
  • $(params) used inside script (injection risk): $(params.SCRIPT)
  • mutable-tag image(s) (not digest-pinned): 1
task/syft/0.1/syft.yamlapicve
  • apiVersion tekton.dev/v1beta1 -> should be tekton.dev/v1
  • no tests/run.yaml
task/trivy-scanner/0.2/trivy-scanner.yamlapicvescript-params
  • apiVersion tekton.dev/v1beta1 -> should be tekton.dev/v1
  • $(params) used inside script (injection risk): $(params.AIR_GAPPED_ENABLED), $(params.IMAGE_PATH)
task/yq/0.4/yq.yamlapicvescript-params
  • apiVersion tekton.dev/v1beta1 -> should be tekton.dev/v1
  • $(params) used inside script (injection risk): $(params.SCRIPT), $(params.expression)
task/asciidoctor/0.1/asciidoctor.yamlapicve
  • apiVersion tekton.dev/v1beta1 -> should be tekton.dev/v1
task/bentoml/0.1/bentoml.yamlapi
  • apiVersion tekton.dev/v1beta1 -> should be tekton.dev/v1
task/buildpacks-phases/0.3/buildpacks-phases.yamlcvescript-params
  • $(params) used inside script (injection risk): $(params.CNB_PLATFORM_DIR), $(params.SOURCE_SUBPATH)
task/check-make/0.1/check-make.yamlapi
  • apiVersion tekton.dev/v1beta1 -> should be tekton.dev/v1
task/conftest/0.2/conftest.yaml
  • no tests/run.yaml
task/curl/0.1/curl.yamlapicve
  • apiVersion tekton.dev/v1beta1 -> should be tekton.dev/v1
task/generate-build-id/0.1/generate-build-id.yamlapi
  • apiVersion tekton.dev/v1beta1 -> should be tekton.dev/v1
task/git-version/0.1/git-version.yamlapi
  • apiVersion tekton.dev/v1beta1 -> should be tekton.dev/v1
task/gradle/0.4/gradle.yamlapicve
  • apiVersion tekton.dev/v1beta1 -> should be tekton.dev/v1
task/hadolint/0.1/hadolint.yamlapi
  • apiVersion tekton.dev/v1beta1 -> should be tekton.dev/v1
task/jira-get-ticket-status/0.1/jira-get-ticket-status.yamlcve
  • no tests/run.yaml
task/kind/0.1/kind.yamlapi
  • apiVersion tekton.dev/v1beta1 -> should be tekton.dev/v1
task/markdown-lint/0.1/markdown-lint.yamlapi
  • apiVersion tekton.dev/v1beta1 -> should be tekton.dev/v1
task/npm/0.1/npm.yamlapicve
  • apiVersion tekton.dev/v1beta1 -> should be tekton.dev/v1
task/oracle-cloud-storage-download/0.1/oracle-cloud-storage-download.yaml
  • no tests/run.yaml
task/oracle-cloud-storage-download/0.2/oracle-cloud-storage-download.yaml
  • no tests/run.yaml
task/oracle-cloud-storage-upload/0.1/oracle-cloud-storage-upload.yaml
  • no tests/run.yaml
task/oracle-cloud-storage-upload/0.2/oracle-cloud-storage-upload.yaml
  • no tests/run.yaml
task/pluto/0.1/pluto.yamlapi
  • apiVersion tekton.dev/v1beta1 -> should be tekton.dev/v1
task/prettier/0.1/prettier.yamlapicve
  • apiVersion tekton.dev/v1beta1 -> should be tekton.dev/v1
task/replace-tokens/0.1/replace-tokens.yamlapi
  • apiVersion tekton.dev/v1beta1 -> should be tekton.dev/v1
task/ruby-lint/0.1/ruby-lint.yamlapi
  • apiVersion tekton.dev/v1beta1 -> should be tekton.dev/v1
task/shellcheck/0.1/shellcheck.yamlapi
  • apiVersion tekton.dev/v1beta1 -> should be tekton.dev/v1
task/tkn/0.5/tkn.yamlcvescript-params
  • $(params) used inside script (injection risk): $(params.SCRIPT)
task/ts-lint/0.1/ts-lint.yamlapi
  • apiVersion tekton.dev/v1beta1 -> should be tekton.dev/v1
task/valint/0.1/valint.yamlapi
  • apiVersion tekton.dev/v1beta1 -> should be tekton.dev/v1
task/wget/0.1/wget.yamlapicve
  • apiVersion tekton.dev/v1beta1 -> should be tekton.dev/v1
task/write-file/0.1/write-file.yamlapicve
  • apiVersion tekton.dev/v1beta1 -> should be tekton.dev/v1
task/yaml-lint/0.1/yaml-lint.yamlapi
  • apiVersion tekton.dev/v1beta1 -> should be tekton.dev/v1
Pipeline 2 with findings
ResourceFindings
pipeline/build-push-gke-deploy/0.1/build-push-gke-deploy.yamlapi
  • apiVersion tekton.dev/v1beta1 -> should be tekton.dev/v1
  • missing tekton.dev/categories
pipeline/buildpacks/0.2/buildpacks.yamlapi
  • apiVersion tekton.dev/v1beta1 -> should be tekton.dev/v1
  • missing tekton.dev/categories
StepAction 1 with findings
ResourceFindings
stepaction/tekton-catalog-publish/0.3/tekton-catalog-publish.yamlcve
  • missing spec.description