micromark

Build provenancecaution

No build attestation or trusted-publishing provenance is reported, leaving release origin less independently verifiable despite the otherwise established project.

Repo bus factorcaution

One contributor made all 11 recent commits, creating a real continuity risk. The organization-owned repository provides some capacity to hand maintenance off, partly compensating for the concentration.

Repo toolingcaution

The project uses established build tools, but no security-scanning tools were detected, leaving a modest repository-hygiene gap.

Workflow auditcaution

Both workflows were analyzed without audit findings or untrusted checkouts, and neither grants top-level write access. However, all 7 action references are unpinned, which weakens build reproducibility and action supply-chain hygiene.