Skip to main content

​
What it shows

Inventory is the org-wide answer to “which third-party actions do we actually depend on?” — the software-composition view of your CI. Each row is one action:
  • Action — the marketplace action, e.g. actions/checkout.
  • Score — the action’s risk score (A–F). This is the action’s own hygiene, not your usage of it.
  • Repos — how many of your repositories reference it.
  • Refs — the refs your repos pin, e.g. v4, v3.
Expand a row to see exactly which repositories use the action, which ref each one pins, and whether that ref is a SHA, a tag, or a branch. A branch pin is the weakest: the code behind it can change under you at any time.

​
Where the data comes from

The inventory is built from each repository’s most recent scan — it reflects your current state, not your history. A repo appears only once it has been scanned, so scan a repository first if you don’t see it. Rescanning a repo updates its contribution automatically. An action shows Pending analysis instead of a grade when Pipefort has seen it but hasn’t scored it yet. Scoring runs asynchronously and usually catches up within minutes.

​
Filtering and export

Search by action name, filter to a single repository, and sort by riskiest, most-used, or alphabetically. CSV and JSON export what’s currently on screen, filters included. CSV is one row per action with the repository list flattened into a cell — convenient for a spreadsheet or an audit. JSON keeps the per-repository drill-in nested, including each ref and its pin type.