@temporalio/core-bridge

Build provenancecaution

No build attestation, trusted publisher, or staged publishing is reported, so release origin is less independently verifiable despite the repository's strong activity and tooling.

Security policycaution

The repository has no SECURITY policy, leaving vulnerability-reporting guidance less transparent; active scanning and development activity partly compensate for this documentation gap.

Token permissionscaution

All workflows declare permissions, but four of eight have top-level write access while the other four are read-only; explicit permissions are positive, though broad write access warrants review.