@openapitools/openapi-generator-cli

Build provenancecaution

No build attestation or trusted-publisher provenance is reported, leaving release origin less independently verifiable than it could be.

Dependency profilecaution

Seventeen runtime dependencies create a moderate maintenance and transitive-dependency surface for a CLI, but this is proportionate to a tool that manages downloads, configuration, and command execution.

Repo toolingcaution

The project uses Nx, TypeScript, Webpack, and npm tooling, supporting a structured build. No security-scanning tooling is reported, which is a modest transparency and hygiene gap.

Security policycaution

The repository has no published security policy, leaving vulnerability-reporting expectations unclear for consumers and maintainers.

Workflow auditcaution

All eight analyzed action references are unpinned, which weakens workflow reproducibility. The cache-poisoning findings have low confidence and the high-confidence adhoc-package findings are low severity, so they add only a modest hygiene concern; no untrusted triggers or script-injection sinks were found.