@octokit/core

Repo bus factorcaution

All recent commits came from one contributor. Organization ownership provides some handoff capacity, but no second recently active contributor is shown, leaving maintenance concentrated.

Repo commit activitycaution

Only two commits were recorded in three months, indicating a slow recent development pace. Recent releases and pull-request activity partly compensate, but the maintenance signal remains weak.

Workflow auditcaution

All 17 action references are unpinned, and high-confidence findings show blanket app-token permissions in three workflows; top-level write permissions also appear in two workflows. The workflows were fully analyzed and have no untrusted checkout or script-injection findings, but credential breadth and pinning remain meaningful hygiene risks.