jiti

Build provenancecaution

No build attestation or trusted-publisher provenance is available, leaving the relationship between source and published artifact less transparent.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers during the last three months, indicating a meaningful recent maintenance slowdown despite the recent release and push evidence.

Repo toolingcaution

The repository uses established build and test tooling, but no security-scanning tools were detected, leaving security hygiene less evidenced.

Security policycaution

No security policy was found in the repository, reducing clarity about vulnerability reporting and response.

Workflow auditcaution

The audit completed all workflows and found no high- or medium-severity issues, but 6 of 7 action references are unpinned, both workflows install packages outside a lockfile, and one workflow has top-level write permissions.