keycloak-angular

Build provenancecaution

No build attestation or trusted-publisher identity is present, leaving the release's registry publication less independently verifiable.

Maintainerscaution

Only one account has registry publish access. The linked repository is user-owned, so the small publishing base provides limited redundancy.

Project backingcaution

The source repository is owned by an individual rather than an organization, so there is no organizational backing signal to offset the thin maintainer base.

Repo commit activitycaution

The repository recorded 0 commits and 0 active maintainers in the last three months, despite a recent release and push; this is a meaningful maintenance warning.

Workflow auditcaution

Both workflows were fully analyzed with no reported findings or untrusted checkouts, but all 10 action references are unpinned, reducing build reproducibility and update integrity.