@pulumi/docker-build

Build provenancecaution

No registry build attestation, trusted publisher identity, or staged publishing is present, leaving release origin less independently verifiable despite the otherwise strong maintenance evidence.

Dangerous workflowscaution

Two workflows use pull_request_target, which requires careful review because it can run with elevated repository context, but no untrusted checkouts or script-injection patterns were detected.

Repo toolingcaution

The project uses a build tool, but no security scanning tools were detected, leaving a modest process gap in repository security hygiene.

Token permissionscaution

Eleven of 12 workflows lack top-level permissions, seven rely on job-level permissions, and one workflow has top-level write access; the absence of read-only declarations is a workflow-hardening gap.

Version stabilitycaution

Version 0.0.22 is not marked prerelease, but the package remains below 1.0 and all recent releases are in the prerelease-style version range, so API stability is not yet mature.