@backstage-community/plugin-github-actions
A Backstage plugin that integrates towards GitHub Actions
9
Versions
Apache-2.0
License
No
Install Scripts
Verified
Provenance
Supply chain provenance
Status for the latest visible version.
SLSA provenance attestation
npm registry signatures
gitHead linked
Maintainers
patriko
Keywords
backstagegithubgithub actions
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| publish-pattern | new-deps-added | AI (publish-pattern): zod is a mainstream, well-vetted validation library; benign addition. | ai | |
| publish-pattern | dormant-publish | AI (publish-pattern): Backstage community plugin in official monorepo; publisher has 726 approved packages and SLSA provenance confirms CI/CD publish. | ai | |
| dependencies | unvetted-dep:@material-ui/lab | AI (dependencies): MUI v4 alpha lab dep is a stable, well-known pattern across Backstage plugins; not a security risk. | ai | |
| phantom-deps | phantom-dep:@types/react | AI (phantom-deps): Type-only peer dep; framework-scoped, not directly imported by convention. | ai | |
| phantom-deps | phantom-dep:@material-ui/lab | AI (phantom-deps): Referenced in config files; stable false positive for this Backstage plugin. | ai | |
| phantom-deps | phantom-dep:react-aria-components | AI (phantom-deps): Referenced in config files; stable false positive for this Backstage plugin. | ai |
Versions (showing 9 of 9)
| Version | Deps | Published |
|---|---|---|
| 1.1.0 | 19 / 13 | |
| 1.0.0 | 19 / 13 | |
| 0.23.0 | 17 / 13 | |
| 0.22.0 | 16 / 13 | |
| 0.21.0 | 16 / 13 | |
| 0.20.0 | 16 / 13 | |
| 0.19.0 | 16 / 13 | |
| 0.18.0 | 16 / 13 | |
| 0.17.0 | 16 / 13 |
v0.23.0
1 finding
INFO
Has SLSA provenance attestation
provenance
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.