graphql-scalars

Build provenancecaution

No build attestation or trusted-publisher provenance was detected, so consumers have less verifiable evidence connecting the published artifact to its source build.

Repo toolingcaution

The project uses TypeScript, Vitest, Babel, and npm scripts, but no security-scanning tools were detected; that is a modest transparency and maintenance gap.

Security policycaution

The repository has no SECURITY.md or other security policy, leaving vulnerability-reporting expectations unclear.

Workflow auditcaution

All 6 action references are unpinned, which weakens workflow reproducibility. However, all 5 workflows were analyzed with no dangerous triggers, untrusted checkouts, script injections, or audit findings, so this remains a hygiene concern.