@storybook/core-common

Build provenancecaution

No build attestation or trusted-publisher provenance is available, leaving publication transparency weaker than it could be.

Repo package mentioncaution

The repository name does not match the package and its README does not mention @storybook/core-common, creating some uncertainty about the package-to-repository relationship; the monorepo context partly explains the name mismatch but not the missing mention.

Workflow auditcaution

All 19 workflows were analyzed, all 46 action references are pinned, and no untrusted checkout or script injection was found; two high-confidence low-severity adhoc package-install findings are a minor hygiene concern.