@sentry-internal/tracing

Package scaffoldingdanger

The package includes a README that explicitly identifies it as for internal use and says the code will be split into other packages for v8. Repository tests and changelog support project transparency, but the package's own guidance is a significant adoption warning.

Release historydanger

The package has had no release in the last 12 months, despite 130 releases overall and a historically short median interval of about 3 days. Repository activity compensates for project maintenance, but not for this package's apparent lifecycle slowdown.

Repo package mentioncaution

The repository name does not match the package and its README does not mention the package. A name mismatch can be normal for a monorepo, but the absence of either match or mention makes package ownership and support intent less transparent.

Workflow auditcaution

The audit covered all 26 workflows with no failed files, but found 145 of 164 action references unpinned and high-confidence broad GitHub App permissions in several workflows. Pull request target workflows had no reported untrusted checkout or script-injection sink, limiting the severity to workflow hygiene caution.