> ## Documentation Index
> Fetch the complete documentation index at: https://docs.pipefort.com/llms.txt
> Use this file to discover all available pages before exploring further.

# CICD-SEC-3 — Action's upstream repository is archived

> A uses: reference points at an archived (unmaintained) repository.

| Field      | Value                                                                                                                              |
| ---------- | ---------------------------------------------------------------------------------------------------------------------------------- |
| Category   | `CICD-SEC-3`                                                                                                                       |
| Severity   | **HIGH**                                                                                                                           |
| Confidence | HIGH                                                                                                                               |
| Pass       | Online — automatic with a GitHub token, forced by [`--audit-pins`](/cli/flags), disabled by `--offline`                            |
| OWASP      | [CICD-SEC-3: Dependency Chain Abuse](https://owasp.org/www-project-top-10-ci-cd-security-risks/CICD-SEC-03-Dependency-Chain-Abuse) |
| Auto-fix   | ✗                                                                                                                                  |

## What the check does

For each third-party `uses:` reference, asks the GitHub API whether the
upstream repository is **archived** (read-only). If it is, the action is
flagged.

## Why it matters

An archived repository is frozen: no bug fixes, no security patches, no
response to a disclosed vulnerability. Any flaw in an archived action is
permanent, and archived projects are prime targets for repo-jacking if the
owner ever deletes the account. Depending on unmaintained code in your build
pipeline is a standing supply-chain risk.

## Safe alternative

Migrate to a maintained fork or an actively-supported alternative, pin it to a
commit SHA, and record the version in a trailing comment.