git-raw-commits

Registry deprecationdanger

The registry marks the entire package as deprecated and says it is no longer maintained, recommending @conventional-changelog/git-client instead. This outweighs the otherwise active source repository.

Build provenancecaution

No build provenance attestation or trusted-publisher evidence was found, reducing release transparency. This is a supporting supply-chain concern, not the primary health verdict.

Repo package mentioncaution

The linked repository name does not match the package and its README does not mention the package, so the package-to-repository relationship is not clearly established.

Security policycaution

The linked repository has no security policy, leaving vulnerability reporting and handling expectations undocumented.

Workflow auditcaution

All 37 analyzed action references are unpinned, and one workflow grants top-level write permissions. The audit found no untrusted checkout or script-injection path, so these remain hygiene concerns rather than severe workflow risk.