@azure/functions

Build provenancecaution

The release has no build attestation or trusted-publisher provenance, so consumers cannot independently verify how the published artifact was produced; the mature organization-backed repository partly offsets this gap.

Token permissionscaution

One workflow lacks top-level permissions and another grants top-level write access, leaving some workflow permission hardening uncertainty despite the absence of dangerous workflow patterns.