@azure/opentelemetry-instrumentation-azure-sdk

Build provenancecaution

No build attestation or trusted-publisher identity is present, so release origin is less independently verifiable; this is a transparency caveat rather than evidence of unsafe behavior.

Repo package mentioncaution

The repository name does not match the package and its README does not mention it, creating uncertainty about package ownership despite the normal monorepo explanation for name mismatches.

Workflow auditcaution

All 21 workflows were analyzed, with no untrusted checkouts or script-injection findings and read-only permissions in 18 workflows. High-confidence template-injection findings and two high-confidence adhoc package installations remain workflow hygiene concerns, while the low-confidence GITHUB_ENV findings are weaker evidence.