flow-parser

Build provenancecaution

No build attestation or trusted publisher identity is present, leaving publication provenance less transparent. This is a meaningful hygiene gap but is partly offset by the project's long release history and active organizational repository.

Workflow auditcaution

The single workflow was fully analyzed with no untrusted checkout or script-injection trigger. However, all 63 action references are unpinned, and the audit identifies high-confidence template-injection patterns plus traditional trusted publishing; the cache findings are low confidence and mainly hygiene.