Package Health/@stoplight/spectral-ruleset-migrator

@stoplight/spectral-ruleset-migrator

This project serves as a converter between the legacy ruleset format and a new one. It's used internally, albeit it can be used externally too, also in browsers.

Latest 1.13.0

NPM

82%

Total Score

healthy

Healthy release with active maintenance; workflow credential sharing and weak package-to-repository identification are the main caveats.

Health Score Breakdown

Build provenance

No build attestation or trusted-publisher identity is present, which reduces publication transparency, although the active repository and release history provide compensating maintenance evidence.

Repo package mention

The repository name differs from the package name, which is ordinary for a monorepo, but its README does not mention this package; that weakens confidence that the linked repository specifically documents and owns this package.

Repo tooling

The repository uses TypeScript, npm scripts, and SWC for builds, but no security-scanning tools were detected, leaving a modest security-process gap.

Security policy

The repository has no security policy, reducing transparency for reporting and handling vulnerabilities despite the otherwise active project.

Workflow audit

All six workflows were analyzed, with no untrusted checkouts or script injection. However, 18 of 20 action references are unpinned, one reusable workflow inherits secrets with medium high-confidence severity, and one workflow installs a package outside a lockfile.