matcher

Build provenancecaution

No build attestation or trusted-publisher provenance was reported. This is a transparency gap, but the clear repository match, recent release, and simple dependency profile keep it from being a severe concern.

Repo bus factorcaution

All one recent commit came from a single contributor, giving the project a concentrated bus factor. The active owner and recent release partly compensate, but succession resilience remains limited.

Workflow auditcaution

The sole workflow was fully analyzed with no dangerous triggers, untrusted checkouts, script injection, or audit findings. However, both of its action references are unpinned, leaving a modest supply-chain reproducibility concern.