@google-cloud/bigquery

Build provenancecaution

No build attestation or trusted-publisher provenance is reported, leaving release origin less independently verifiable; this is a transparency gap, not evidence of unsafe code.

Lifecycle scriptscaution

A prepare install-time script is present, adding a small installation-surface consideration, but the other evidence shows a mature, actively maintained package.

Workflow auditcaution

All 71 analyzed action references are pinned and 17 workflows use read-only permissions. The audit found two high-confidence low-severity adhoc package installs, and one of 19 workflows could not be analyzed, so workflow hygiene is good but not perfect.