@sentry/cli-linux-arm64

Build provenancecaution

No build attestation or trusted-publisher metadata is present, which leaves publication provenance less transparent even though the repository shows an established release process.

Repo package mentioncaution

The repository name differs from the platform-specific package name and its README does not mention this exact package, creating a small linkage-transparency concern; the package README does explicitly link to this repository, which partly compensates.

Token permissionscaution

Ten workflows lack top-level permissions and three declare write access, while none declare read-only permissions; this is a workflow-hardening gap, although no dangerous workflow pattern was detected.