@commitlint/ensure

Build provenancecaution

This release has no attestation or trusted-publisher provenance, leaving publication origin less independently verifiable despite the package's otherwise strong project evidence.

Package scaffoldingcaution

Tests and a changelog are absent from the compiled package, which is normal packaging practice; the repository has both, plus GitHub Releases support. The missing package README is a minor documentation gap for a library.

Repo package mentioncaution

The repository name does not match this package and its README does not mention it. The mismatch is consistent with a monorepo subpackage, but the absent README mention leaves package ownership slightly less explicit.

Repo toolingcaution

The project uses TypeScript, Vitest, npm scripts, Vite, and SWC for its build and tests. No security-scanning tools were detected, leaving a modest security-process gap.

Security policycaution

The linked repository has no security policy, making vulnerability reporting and disclosure expectations less transparent.