@algolia/ingestion

Dangerous workflowscaution

One of three workflows uses pull_request_target, which warrants review because that trigger can be security-sensitive; however, no untrusted checkout or script-injection patterns were detected.

Repo issue activitycaution

There are only 21 open issues and 3 open pull requests, but no issues or pull requests were opened or closed in the last month; this is a modest activity concern, partly offset by recent commits and releases.

Repo package mentioncaution

The repository name does not match the package name and its README does not mention @algolia/ingestion, creating a package-to-repository transparency concern; the mismatch may reflect a monorepo, but the missing README mention remains a caution.

Security policycaution

No SECURITY.md or equivalent security policy was found, reducing transparency for vulnerability reporting and response.

Token permissionscaution

One workflow lacks top-level permissions and the release workflow has top-level write permissions; although another workflow is read-only, the permissions posture is not maximally restrictive.