@storybook/csf-tools

Build provenancecaution

No build attestation or trusted-publisher provenance is present, leaving publication origin less independently verifiable. This is a transparency gap, though the active organization-backed repository provides compensating context.

Repo package mentioncaution

The repository name does not match the package name and its README does not mention the package, creating some uncertainty about package-to-repository linkage. The organization-backed monorepo context partially explains the mismatch but does not remove the documentation gap.

Workflow auditcaution

All 19 workflows were analyzed with no high- or medium-severity findings, no untrusted checkouts, no script injection, and all 46 action references pinned. Two high-confidence low-severity findings install packages outside a lockfile, so workflow hygiene is not perfect.