@pulumi/azure

Build provenancecaution

No build attestation, trusted publisher identity, or staged publishing is reported, leaving release-origin transparency weaker than best practice.

Dangerous workflowscaution

Two workflows use pull_request_target, which warrants review because that trigger can expose elevated repository context, but no untrusted checkouts or script-injection patterns were detected across the 23 analyzed workflows.

Package scaffoldingcaution

A substantial README is present and the repository uses GitHub Releases, which compensates for the absence of a packaged changelog; however, neither the artifact nor repository reports tests, leaving a modest quality-assurance gap for a provider package.

Repo bus factorcaution

The top contributor made 89.1% of recent commits, a substantial concentration risk; organization backing and six additional active contributors partly reduce, but do not eliminate, the concern.

Repo toolingcaution

The repository uses a build tool, but no security-scanning tools were detected, leaving a security-process hygiene gap.