@rc-component/portal

Build provenancecaution

No build attestation or trusted-publisher provenance is available, which limits publication transparency, but it is not by itself evidence of an unhealthy release.

Lifecycle scriptscaution

A prepare install-time script adds some supply-chain and installation complexity, although this signal alone does not show harmful behavior.

Security policycaution

The repository has no security policy, leaving disclosure and response expectations undocumented; this is a minor transparency gap for an otherwise maintained project.

Workflow auditcaution

All three workflows were analyzed with no audited findings or untrusted checkouts. However, two workflows grant top-level write permissions and four of six action references are unpinned, creating moderate workflow hygiene concerns without a demonstrated exploit path.