conventional-changelog-conventionalcommits

Repo toolingcaution

The project uses build tooling and npm scripts, but no security scanning tools were detected; this is a modest transparency gap rather than a dependency-blocking concern.

Security policycaution

No repository security policy was detected, leaving vulnerability-reporting expectations undocumented; this is a minor transparency gap.

Workflow auditcaution

All five workflows were analyzed with no audit findings, untrusted checkouts, or injection paths. However, all 37 action references are unpinned and one workflow grants top-level write permissions, so workflow supply-chain hygiene is weaker even without an observed dangerous path.