expo-manifests

Build provenancecaution

No build attestation or trusted publisher identity is available, leaving the connection between source and published artifact less transparent than it could be.

Repo package mentioncaution

The repository name does not match expo-manifests and its README does not mention the package, so the package-to-repository relationship is less explicit; the mismatch may reflect a monorepo, but it still reduces transparency.

Token permissionscaution

Twenty-four analyzed workflows lack top-level permissions declarations and six grant top-level write access, which is weaker workflow least-privilege hygiene despite the absence of detected script injection.