jsii-diff

Build provenancecaution

No build attestation or trusted-publisher provenance is present, leaving publication origin less transparent, but this is a transparency gap rather than evidence of abandonment.

Repo package mentioncaution

The repository name does not match the package name and its README does not mention jsii-diff, so the link may be indirect or the package may be a subproject; this deserves verification.

Workflow auditcaution

All workflows were analyzed and scope permissions at job level, with no untrusted checkout or script-injection findings. However, all 46 action references are unpinned and high-confidence adhoc package installs occur, creating a workflow hygiene caution; the low-confidence cache findings do not materially change the assessment.