@backstage/catalog-model

Build provenancecaution

No build attestation or trusted-publisher identity is present. The mature repository and active release history provide maintenance evidence, but do not replace verifiable artifact provenance.

Dangerous workflowscaution

The repository contains eight pull_request_target workflows and two workflows that check out untrusted content. Although no script-injection workflows were detected, these patterns deserve review because they can increase CI exposure.

Repo package mentioncaution

The repository name does not match the package name and its README does not mention the package, which creates some uncertainty about package-to-source mapping. The @backstage organization and large repository tree make a monorepo sub-package explanation plausible, so this is a limited concern.

Token permissionscaution

Eleven analyzed workflows lack top-level permission declarations and six request top-level write access. Read-only permissions are present in 13 workflows, but the inconsistent permission model remains a CI governance gap.