conventional-commits-filter

Build provenancecaution

No build attestation or trusted-publisher provenance is present, leaving the origin of the published artifact less transparent than it could be.

Repo toolingcaution

The repository uses a build toolchain, but no security-scanning tools were detected, leaving a modest security-process gap.

Security policycaution

The repository has no published security policy, making vulnerability reporting and response expectations less transparent.

Workflow auditcaution

All five workflows were analyzed without dangerous triggers, untrusted checkouts, script injection, or audit findings. However, all 37 action references are unpinned and one workflow grants top-level write access, creating workflow-reproducibility and permissions concerns without an untrusted execution path.