@lightdash/common

Maintainerscaution

Three of four publishing accounts use the lightdash.com domain, consistent with the organization backing the repository. The owlas account uses gmail.com, creating a minor account-hygiene concern but not evidence of limited maintenance capacity.

Repo package mentioncaution

The repository name does not match the package name and its README does not mention @lightdash/common. This may be normal for a monorepo subpackage, but the absence of an explicit mention leaves a small ownership-transparency gap.

Workflow auditcaution

All 23 workflows were analyzed without failures, and most use read-only or job-level permissions. However, high-confidence findings include blanket GitHub App permissions, repeated template-injection patterns, floating container images, and an ad hoc package install; the low-confidence cache findings are hygiene concerns only.