> ## Documentation Index
> Fetch the complete documentation index at: https://docs.pipefort.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Actions inventory

> Every GitHub Action your repositories use, with its risk score and how many repos depend on it.

## What it shows

**Inventory** is the org-wide answer to "which third-party actions do we
actually depend on?" — the software-composition view of your CI.

Each row is one action:

* **Action** — the marketplace action, e.g. `actions/checkout`.
* **Score** — the action's [risk score](/webapp/action-risk-scores) (A–F).
  This is the action's own hygiene, not your usage of it.
* **Repos** — how many of your repositories reference it.
* **Refs** — the refs your repos pin, e.g. `v4, v3`.

Expand a row to see exactly which repositories use the action, which ref each
one pins, and whether that ref is a **SHA**, a **tag**, or a **branch**. A
branch pin is the weakest: the code behind it can change under you at any time.

## Where the data comes from

The inventory is built from **each repository's most recent scan** — it reflects
your current state, not your history. A repo appears only once it has been
scanned, so scan a repository first if you don't see it. Rescanning a repo
updates its contribution automatically.

An action shows **Pending analysis** instead of a grade when Pipefort has seen
it but hasn't scored it yet. Scoring runs asynchronously and usually catches up
within minutes.

## Filtering and export

Search by action name, filter to a single repository, and sort by riskiest,
most-used, or alphabetically.

**CSV** and **JSON** export what's currently on screen, filters included. CSV is
one row per action with the repository list flattened into a cell — convenient
for a spreadsheet or an audit. JSON keeps the per-repository drill-in nested,
including each ref and its pin type.