@temporalio/activity

Build provenancecaution

No build attestation, trusted publisher identity, or staged publishing evidence is available, leaving release-origin transparency weaker than ideal.

Security policycaution

The repository has no published security policy, leaving vulnerability-reporting guidance and disclosure expectations unclear.

Token permissionscaution

All workflows declare permissions, though four have top-level write access; explicit permissions reduce ambiguity, but write capability remains a modest workflow-surface concern.