@orval/solid-start

Build provenancecaution

No build attestation or trusted-publisher identity is present, which limits publication transparency, but active releases and repository-backed release notes provide some compensating evidence.

Workflow auditcaution

All seven workflows were analyzed, but all 23 action references are unpinned and two workflows use trusted publishing with long-lived credentials; high-confidence template-injection findings and top-level write permissions add workflow hygiene concerns, while the low-confidence cache finding is not material alone.