@nestjs/testing

Build provenancecaution

No build attestation or trusted-publisher identity is reported. This reduces publication transparency, but the active repository and release history provide compensating project evidence.

Repo package mentioncaution

The repository name does not match @nestjs/testing and its README does not mention the package. This is compatible with a monorepo subpackage, but the missing explicit mention leaves package-to-repository identity less transparent.

Workflow auditcaution

Both workflows were analyzed successfully, use read-only permissions, and have no detected sinks or audit findings. However, all 4 action references are unpinned, which weakens build reproducibility.