main_3

Repo package mentioncaution

The repository name does not match this artifact and its README does not mention the package, which is a caution under the package-ownership check; the sbt organization and repository context partly reduce the concern because this appears consistent with a monorepo component.

Security policycaution

The repository has no published security policy, which is a transparency gap for a widely used build tool, though active maintenance and dependency scanning partly compensate.

Version stabilitycaution

This release is a prerelease RC, so compatibility may still change, although the package is on a stable major line and prereleases are a regular part of recent development.

Workflow auditcaution

All 8 workflows were analyzed without audit findings or untrusted checkout/script-injection issues, and 5 use read-only permissions. However, 25 of 26 action references are unpinned, and 2 workflows grant top-level write access, creating workflow supply-chain and permission-hygiene concerns.