@temporalio/testing

Build provenancecaution

No build attestation or trusted-publisher provenance is present, which reduces publication transparency even though the package has strong independent maintenance evidence.

Security policycaution

No security policy was found in the repository, leaving vulnerability-reporting guidance less transparent; the repository's active security scanning partly compensates but does not remove this gap.

Token permissionscaution

All workflows declare permissions, but 4 of 8 have top-level write access rather than read-only permissions, increasing automation privilege despite the absence of other dangerous workflow patterns.