@commitlint/execute-rule

Build provenancecaution

No build attestation or trusted-publisher provenance was reported, so consumers have limited verification of how this release was built and published.

Repo package mentioncaution

The repository name does not match this package and its README does not mention it, creating a linkage concern; the mismatch is consistent with a package within a larger monorepo, which partly compensates for the gap.

Repo toolingcaution

The project uses TypeScript, Vitest, build tooling, and npm scripts, but no security-scanning tools were detected; the missing scanning is a modest transparency gap.

Security policycaution

No repository security policy was found, leaving vulnerability-reporting expectations undocumented.

Workflow auditcaution

All five workflows were analyzed with no untrusted checkout or script-injection findings, but 20 of 25 action references are unpinned, one workflow has top-level write permissions, and a high-confidence low-severity adhoc-packages finding remains.