es-to-primitive

Build provenancecaution

Staged publishing is enabled, but no build attestation or trusted publisher identity is recorded. That leaves the origin of the published artifact less independently verifiable.

Repo bus factorcaution

All 17 recent commits came from one contributor, so maintenance depends heavily on a single person and has limited recent redundancy.

Workflow auditcaution

All six workflows were analyzed with no audit findings or untrusted checkouts, and three workflows use read-only permissions. However, all seven analyzed action references are unpinned, which weakens workflow supply-chain reproducibility.