@microsoft/teams.api

Build provenancecaution

No build attestation or trusted publisher provenance is present, leaving the relationship between the published artifact and its source less independently verifiable despite the active repository.

Dangerous workflowscaution

One of four workflows uses pull_request_target, which warrants review because it can run with elevated repository context, but no untrusted checkout or script-injection pattern was detected.

Token permissionscaution

Two workflows declare read-only permissions, but one workflow has top-level write permissions and another lacks top-level permissions, creating a modest workflow-hardening gap.