@chevrotain/gast

Repo bus factorcaution

One contributor made all 14 commits in the last 3 months, creating a meaningful continuity risk despite organization backing.

Repo package mentioncaution

The repository name does not match the package and its README does not mention @chevrotain/gast, which leaves package ownership less explicit; the organization-backed monorepo context partly compensates.

Repo toolingcaution

The project uses TypeScript, Turbo, and npm scripts, but no security scanning tools were detected; this is a modest repository-hygiene gap.

Security policycaution

No repository security policy was found, reducing transparency about vulnerability reporting and response.

Workflow auditcaution

All two workflows were analyzed with no untrusted checkout or script-injection findings, but all 7 action references are unpinned and one workflow has top-level write permissions. The two cache-poisoning findings are low-confidence hygiene warnings, so this is caution rather than a severe risk.