@github/copilot-sdk

Build provenancecaution

The package has no build attestation or provenance, although the trusted publisher is identified as github; consumers therefore have limited independent evidence connecting the artifact to its build.

Maintainerscaution

The package has 25 publish-access accounts, but many use consumer addresses including croffz, mackinnonbuck, devm33, gracepark, arelia, khiga8, srt32, jfuchs, and others; this is an account-hygiene caution despite the github.com accounts.

Version stabilitycaution

Version 1.0.22 is a stable major release, but 80% of recent releases are prereleases, creating meaningful churn and compatibility uncertainty.