commander

Build provenancecaution

No build attestation or trusted-publisher provenance is available, leaving the exact registry-to-source publication path less transparent despite the otherwise strong project evidence.

Repo commit activitycaution

No commits and no active maintainers were recorded in the last three months, which is a meaningful maintenance warning. This is partly offset by the recent release, recent repository push, and active issue and pull-request handling.

Token permissionscaution

No workflow declares top-level write permissions, and one workflow explicitly uses read-only permissions. One workflow lacks a top-level permissions declaration, so its effective permissions are less transparent.