filenamify

Build provenancecaution

No build attestation or trusted-publisher provenance is available, which limits publication transparency, although the release has matching source and artifact context.

Repo bus factorcaution

One contributor made 80% of recent commits, but a second contributor remains active; the concentration is a modest resilience concern rather than a severe risk.

Workflow auditcaution

The sole workflow was fully analyzed with no dangerous sinks or audit findings, but both action references are unpinned, leaving avoidable maintenance and supply-chain hygiene risk.