@pulumi/pulumi

Build provenancecaution

No build attestation or trusted-publisher provenance is recorded, leaving the registry artifact's build origin less transparent despite the package's strong repository evidence.

Repo toolingcaution

The repository uses a build tool, but no security-scanning tool was detected. That is a modest process gap, partly offset by the separate workflow audit and published security policy.

Workflow auditcaution

All 30 workflows were analyzed, but 15 grant top-level write permissions, 39 of 101 action references are unpinned, and high-confidence findings include inherited secrets, overprovisioned secrets, and a broad GitHub App token. The single pull_request_target workflow has no detected untrusted checkout or script injection, so these are serious hygiene concerns rather than a standalone release-blocking finding.