gradle-to-js

Build provenancecaution

No build attestation or trusted-publisher provenance is available. This limits publication transparency, though it is not by itself evidence of unhealthy maintenance.

Release historycaution

The latest release was over four years ago, with no releases in the last 12 months. Its 17-release history shows prior activity, but the current cadence indicates stalled maintenance.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months. This provides no evidence of current maintenance capacity.

Security policycaution

The repository has no security policy. For a small parser this is a transparency gap rather than a severe dependency risk, but it weakens vulnerability-reporting readiness.

Workflow auditcaution

The sole workflow was fully analyzed without dangerous triggers, untrusted checkouts, injection findings, or severity-bearing audit findings. Both action references are unpinned, leaving a reproducibility and action-substitution hygiene gap.