getplumber/Plumber Score
Plumber detects CI/CD security issues in your GitHub workflows and gives you a score.
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Activelast commit Jul 10, 2026
- License
- MPL 2.0
Pinned Snippet
uses: getplumber/plumber@feaea981266b40eea7985b7cb880d47a3426a570 # v0.4.2tags can be moved; commit SHAs can't. why a SHA?
Inputs
| name | description | required | default |
|---|---|---|---|
| version | Plumber release tag to install (e.g. v0.4.12). Downloaded from GitHub Releases and verified against checksums.txt and SLSA attestation | — | v0.4.12 |
| verify-attestation | Verify the downloaded binary's build-provenance attestation (sigstore/SLSA) against the getplumber/plumber release workflow, using the gh CLI. This anchors the binary to a trusted build regardless of the mutable release tag. Disable for air-gapped or GHES setups without attestation access. | — | true |
| github-token | Token for the GitHub API (branch protection, advisory DB) and SARIF upload. Needs Administration:read for full branchMustBeProtected, and the job needs security-events:write to upload SARIF. | — | ${{ github.token }} |
| metadata-token | Optional token (public-repo read is enough) used only to resolve third-party action versions for the known-CVE check. Set it when an action is hosted in an org with an IP allow list that blocks the runner's GITHUB_TOKEN; it also raises the API rate limit. Default: none, Plumber falls back to an anonymous read and, if that fails too, skips the version check rather than guessing. | — | "" |
| project | owner/repo to scan remotely (upstream-fetch, no checkout needed). Default: scan the checked-out repository. | — | "" |
| github-url | GitHub Enterprise Server host, e.g. ghes.example.com. Default: github.com. | — | "" |
| min-points | Minimum Plumber Score points to pass (0-100). Default: 100 — any finding fails, same as the previous default behavior. A repo with no workflows passes when its enabled controls report no findings; the gate only force-fails when zero controls are enabled. | — | "" |
| min-score | Minimum Plumber Score letter to pass (A-E), e.g. B fails on C, D, E. When set without min-points, the letter alone gates. | — | "" |
| threshold | Deprecated: minimum percentage of passing controls (0-100). Use min-points / min-score to gate on the Plumber Score instead. The value 100 is treated as unset (same as the GitLab component): the default score gate also fails on any finding. | — | "" |
| config-file | Path to a .plumber.yaml config. Default: the repo's .plumber.yaml (required — the run fails if absent; generate one with 'plumber config generate'). | — | "" |
| controls | Run only these controls (comma-separated). Mutually exclusive with skip-controls. | — | "" |
| skip-controls | Skip these controls (comma-separated). Mutually exclusive with controls. | — | "" |
| score | Add the full Plumber points breakdown (beta) on top of the score banner. Off by default; set true to also include the per-issue-code breakdown. | — | false |
| score-push | Publish this repo's Plumber Score to the hosted badge service (score.getplumber.io) via CI-native OIDC (no secret). The calling workflow MUST grant 'permissions: id-token: write' — it cannot be set from inside a composite action. | — | false |
| score-endpoint | Score service base URL. Override only for a self-hosted score service; the minted OIDC audience follows this value so it always matches the target. | — | https://score.getplumber.io |
| fail-warnings | Fail the run on warnings: unknown configuration keys (exit 2) and 'could not verify' checks such as a skipped known-CVE lookup when an action version cannot be resolved (exit 3). soft-fail does not mask exit 3. | — | false |
| soft-fail | Do not fail the job when compliance is below the threshold. Findings are still produced and uploaded. Runtime errors still fail. | — | false |
| upload-sarif | Upload the SARIF report to GitHub Code Scanning (the job needs security-events: write). | — | true |
| upload-artifacts | Upload the JSON report, PBOM and CycloneDX SBOM as a workflow artifact. | — | true |
| artifact-name | Name of the uploaded artifact bundle. | — | plumber-report |
| output | JSON report output path. Empty to skip. | — | plumber-report.json |
| pbom | PBOM (Pipeline Bill of Materials) output path. Empty to skip. | — | plumber-pbom.json |
| pbom-cyclonedx | CycloneDX SBOM output path. Empty to skip. | — | plumber-cyclonedx-sbom.json |
| sarif | SARIF 2.1.0 output path. Empty to skip. | — | plumber.sarif |
Outputs
| name | description |
|---|---|
| passed | 'true' when the run met its gate (min-points / min-score, or the deprecated threshold). |
| report | Path to the JSON report. |
| sarif | Path to the SARIF report. |