@github/copilot-linux-x64

Build provenancecaution

No build attestation is present, although the trusted publisher identity is GitHub; this leaves publication provenance less independently verifiable.

Maintainerscaution

The package has 27 registry publishers and clear GitHub-backed ownership, but accounts using outside domains include jonrohan, smockle, simurai, and mattcosta7, creating a modest account-hygiene concern.

Repo package mentioncaution

The repository name does not match this package and its README does not mention @github/copilot-linux-x64, so the package-to-source relationship is not directly demonstrated by the collected repository metadata.

Workflow auditcaution

All 11 workflows were analyzed with no untrusted checkouts, script injection, or unpinned action uses. Seven workflows grant top-level write permissions and a high-confidence template-injection finding appears in winget.yml, so workflow hygiene is a caution despite no corroborating untrusted checkout in that path.