@commitlint/resolve-extends

Build provenancecaution

No build attestation or trusted-publisher provenance is present, leaving the connection between source and published artifact less transparent.

Repo package mentioncaution

The repository name does not match the package and its README does not mention the package, creating some uncertainty about package-specific ownership; the organization-backed monorepo context partly offsets that concern.

Repo toolingcaution

The project uses TypeScript, Vitest, and build tooling, but no security-scanning tools were detected; this is a modest transparency and assurance gap.

Security policycaution

The repository has no security policy, so its vulnerability-reporting and response process is not documented.

Workflow auditcaution

All five workflows were analyzed with no untrusted checkouts or script injection, but 20 of 25 action references are unpinned and a high-confidence audit found an ad-hoc package install; one workflow also grants top-level write access.