module-lookup-amd

Build provenancecaution

No build attestation or trusted-publisher provenance is available. The package remains adoptable, but its publication chain is less transparent.

Repo bus factorcaution

One contributor made all 2 commits in the last 3 months, giving the project a concentrated recent commit base. Organization ownership partly offsets handoff risk, but does not remove it.

Security policycaution

The repository has no security policy. This is a minor transparency gap for reporting vulnerabilities, not evidence that the package is unsafe.

Workflow auditcaution

All 3 workflows use read-only permissions and the audit found no dangerous sinks or findings, but all 7 action references are unpinned. That leaves avoidable workflow supply-chain drift despite otherwise restrained permissions.