geotiff

Build provenancecaution

No build attestation or staged publishing is present, reducing release transparency, although the active project and matching license provide some compensating evidence.

Lifecycle scriptscaution

A prepare script runs during installation or package preparation, adding some build-time behavior that consumers should account for, but this alone is not a severe health concern.

Repo toolingcaution

The project uses established build tooling, but no security scanning tools were detected, leaving a modest maintenance and assurance gap.

Security policycaution

No repository security policy was found, so users have less guidance for reporting vulnerabilities and assessing security maintenance.

Workflow auditcaution

All 15 action references are unpinned, and three workflows use archived actions; high-confidence template-injection findings also need cleanup. No untrusted checkout or script-injection path was found, so this is workflow hygiene rather than a severe dependency-health risk.