@datadog/datadog-ci-plugin-sarif

Repo package mentioncaution

The repository name does not match the package and its README does not mention it, creating some uncertainty about package-to-source mapping; the organization-backed monorepo context partly offsets this.

Security policycaution

No repository security policy was found, leaving vulnerability-reporting expectations less transparent even though other maintenance signals are strong.

Workflow auditcaution

All four workflows were analyzed, and all 109 action references are pinned, but one file failed audit; the publish workflow has high-confidence template-injection findings and top-level write permissions, while the cache findings are low confidence.