@sentry/nestjs

Build provenancecaution

No build attestation or trusted-publisher identity is present, leaving publication provenance less transparent than it could be; the active organization-backed repository provides some compensation.

Workflow auditcaution

The audit analyzed all 27 workflows and found no untrusted checkout or script-injection paths, but 37 high-confidence findings include broad GitHub App token permissions; 145 of 164 action uses are unpinned. Low-confidence cache findings and ordinary pull_request_target triggers do not independently outweigh the otherwise strong maintenance evidence.