@storybook/api

Build provenancecaution

No build attestation or trusted-publisher identity is present, leaving publication provenance less transparent than it could be. This is a transparency gap, not evidence that the release is unsafe.

Dangerous workflowscaution

Three workflows use pull_request_target and one uses workflow_run, which creates workflow-level review risk. However, no analyzed workflow performs an untrusted checkout or detected script injection, limiting the concern.

Package scaffoldingcaution

The package includes a README, but it explicitly directs consumers to @storybook/manager-api and says this package will no longer be released in Storybook 8. Repository tests, a changelog, and GitHub releases show the broader project is maintained, but this package's transition creates real adoption risk.

Token permissionscaution

Eleven workflows declare read-only permissions, but four omit top-level permissions and four declare top-level write access. This mixed configuration is a workflow-hardening gap despite the stronger read-only majority.