@rc-component/util

Build provenancecaution

The release has no build attestation or trusted-publisher provenance, so consumers have less independent evidence connecting the published artifact to its source build.

Security policycaution

No repository security policy was found, leaving vulnerability-reporting expectations less transparent despite the presence of automated security scanning.

Workflow auditcaution

All five workflows were analyzed with no audit findings or untrusted checkout and script-injection paths. However, 5 of 10 action references are unpinned and three workflows grant top-level write permissions, creating modest workflow hygiene concerns.