@orval/swr

Build provenancecaution

No build attestation or trusted-publisher identity is recorded. This is a transparency gap, but the active repository and release history provide meaningful compensating evidence.

Workflow auditcaution

All seven workflows were analyzed with no untrusted checkout or script-injection findings, but all 23 action references are unpinned and four workflows have top-level write permissions. High-confidence template-injection findings are limited to a different workflow from the sole workflow_run trigger, while the low-confidence cache finding is hygiene rather than decisive evidence.