cargo-cp-artifact

Release historycaution

The package has 12 releases, but none in the last 12 months; the latest release was over two years ago. This is a meaningful maintenance concern despite the earlier regular median interval of about 16 days.

Repo package mentioncaution

The linked repository name does not match the package name and its README does not mention the package, so the package-to-source relationship is not clearly established. Its presence in the repository tree is not enough to remove this transparency concern.

Workflow auditcaution

All three workflows were analyzed without high- or medium-severity findings or untrusted checkout and script-injection issues. However, all 18 action references are unpinned, leaving a reproducibility and action-substitution hygiene gap.