@microsoft/teams.cards

Build provenancecaution

The release has no build attestation or trusted-publisher provenance, so consumers cannot independently verify how the artifact was produced; active Microsoft ownership and repository tooling provide partial context but do not replace provenance.

Dangerous workflowscaution

One of four workflows uses pull_request_target, which warrants review because that trigger can run with elevated repository context; however, no untrusted checkout or script injection was detected.

Token permissionscaution

One workflow has top-level write permissions and another lacks a top-level permissions declaration, creating a modest workflow-hardening gap despite two workflows declaring read-only permissions.