install-artifact-from-github

Build provenancecaution

No build attestation, trusted publisher, or staged publishing is present, which limits publication transparency. This is a provenance gap rather than evidence of unhealthy maintenance.

Maintainerscaution

Only one registry account has publish access. This is a modest publishing continuity concern, although it is partly offset by the repository's demonstrated recent activity.

Project backingcaution

The repository is owned by an individual user rather than an organization, so there is no organizational maintenance redundancy to offset the concentrated contributor base.

Repo bus factorcaution

All 17 recent commits came from a single contributor with a 100% share, creating a genuine continuity and bus-factor risk for an individually owned project.

Token permissionscaution

Both workflows declare top-level permissions, but one workflow grants top-level write permissions. This increases CI credential exposure compared with read-only or narrowly scoped permissions.