google-artifactregistry-auth

Build provenancecaution

No build attestation or trusted publisher identity is recorded, leaving the release origin less independently verifiable despite the organization-backed repository.

Release historycaution

The package has existed for about 6 years with 17 releases, but only one release in the last 12 months. Recent repository activity and a current release partly compensate for the slower registry cadence.

Security policycaution

The repository has no security policy file, reducing transparency about vulnerability reporting and response procedures.

Workflow auditcaution

Both workflows were analyzed successfully, use read-only permissions, and have no unpinned action references or untrusted checkout paths. The high-confidence use-trusted-publishing finding indicates long-lived registry credentials, while the cache-poisoning findings are low-confidence hygiene observations.