@azure/core-lro

Build provenancecaution

No build provenance attestation or trusted-publisher identity is reported, leaving release-to-source/build transparency weaker than it could be.

Repo package mentioncaution

The repository name does not match the package and its README does not mention @azure/core-lro, which weakens package-to-source transparency; the organization-owned Azure monorepo context makes a name mismatch understandable but does not remove the omission.

Repo toolingcaution

TypeScript and Turbo provide an explicit build system, but no repository security-scanning tools were detected, leaving a modest tooling gap.

Token permissionscaution

Most workflows declare read-only permissions, but two lack top-level permissions and one declares top-level write access, creating a limited workflow-hardening concern.