@aws-cdk/cx-api

Build provenancecaution

No build attestation or trusted-publisher provenance is present, leaving publication origin less transparent, though the package has substantial independent maintenance evidence.

Repo package mentioncaution

The repository name does not match the package and its README does not mention the package, creating some uncertainty about package-to-repository mapping; the monorepo context partly compensates for the name mismatch.

Workflow auditcaution

The audit analyzed 30 of 48 workflows, found one untrusted checkout, and reported all 72 action references unpinned. Its four cache-poisoning findings have low confidence, so they are workflow-hygiene concerns rather than severe evidence on their own.