@orval/mock

Build provenancecaution

No build attestation or trusted-publisher identity is recorded, leaving release provenance less independently verifiable; the active repository and release workflows partly compensate.

Repo package mentioncaution

The repository name does not match @orval/mock and its README does not mention the package, creating a package-identification caution; the organization-backed monorepo context partly offsets it but does not remove the gap.

Workflow auditcaution

All seven workflows were analyzed, but all 23 action references are unpinned and four workflows grant top-level write permissions. High-confidence template-injection findings and trusted-publishing findings warrant workflow hygiene caution, while the low-confidence cache finding is not decisive.